This story appeared on Network World at

http://www.networkworld.com/columnists/2005/103105bradner.html

'Net Insider

Family jewels to go

By Scott Bradner, Network World, 10/31/05

The other day I went to a talk by Simson Garfinkel, a Harvard postdoctorate research fellow and an instructor at the Harvard Extension School. He talked about using "patterns" to understand complex problems and ensuring that the solutions to the problems actually matched the problems. The talk used the real-world problem of residual data left on recycled disks to show how the concept of patterns could be used. Garfinkel's presentation was quite scary for a security geek like me. I had been generally aware that far too many disks that government agencies, enterprises and individuals sell or trade in when upgrading their systems still contain valuable information, but I did not know the extent of the problem.

For one part of his Ph.D. thesis, Garfinkel bought more than 230 used disk drives from eBay and other sellers of recycled disk drives. He then ran disk analysis tools that he had developed on these drives to see if he could find anything useful. He did. In Chapter 3 of his thesis, he details what he found, and it included thousands of credit card numbers, detailed financial and medical records, corporate trade secrets and other highly personal information. He found residual information on a majority of the used drives.

Garfinkel also referred to news accounts of others finding data such as ex-Beatle Paul McCartney's banking details and pharmacy records for thousands of patients who filled their prescriptions at an Arizona supermarket. Yup, the problem is real.

Now the question is: Have you or your company contributed to this problem?

It would seem to be a no-brainer to at least erase disks that might contain confidential information. So why is the problem so widespread?

Garfinkel contacted as many of the drive owners as he could and discovered two reasons why so many drives still contained data. First, some people did not think of the issue when they disposed of the drives (what Garfinkel calls the "education problem"). Second, many applications lie when they tell the user that their data is being removed (Garfinkel calls this the "usability problem").

The education problem can be addressed by teaching users that residual data can be a big problem or by developing and mandating computer-system decommissioning organizations or processes that take the guesswork out of disk recycling.

The usability problem is harder. That's because it is generally not possible to be sure that an application is actually removing data from a disk when you delete a file or reformat the disk, without knowing more about the application than most users can find out. For example, the common Microsoft utilities for both of these functions actually just free up disk space without overwriting the unused disk space to ensure the data is erased. There are devices and software tools that do the right thing and should be used. Note that U.S. law requires actual data erasure when credit report data is involved.

Don't be a data spreader. Erase data before you sell that drive or take out the frustrations of the job with a hammer.

Disclaimer: Job frustrations? At Harvard? Say it's not so. Anyway, the above seminar report is my own.