Electronics Recycling Conference & Trade Show: Privacy Matters

Protecting confidential information is just one of many issues that electronics recyclers must concern themselves with, as a single information breach can bring not only financial hardship in the form of legal proceedings, but also damage a company’s reputation, making it virtually impossible to recover from such a slip-up.

A variety of methods from overwriting to shredding exist for destroying the information contained on hard drives and other magnetic media, though some argue that overwriting leaves too much room for human error. It is also one of the more labor intensive and time consuming options, though data sanitation allows the hard drive to be reused, which results in environmental as well as bottom-line benefits for recyclers.

Speakers at a session titled “Keep It Confidential” during the Recycling Today Media Group’s inaugural Electronics Recycling Conference & Trade Show discussed the various data protection laws as well as information destruction methods. The conference program was developed by WR3A (World Reuse, Repair and Recycling Association), Middlebury, Vt.

Bob Johnson, executive director of the National Association for Information Destruction (NAID), described the electronics recycling industry as “the Wild West,” saying that “opportunists” can capitalize on the confusion that exists in the marketplace.

He began the session by discussing the legislation governing data protection, including Health Insurance Portability and Accountability Act (HIPAA), the Financial Services Modernization Act (also known as Graham-Leach-Bliley) and the Economic Espionage Act. Such legislation calls for entities to take reasonable measures to prevent unauthorized access to data.

Media coverage of identity theft as well as the Enron-Arthur Anderson scandal helped to raise the profile of data security, Johnson said, with the Enron case leading many companies to outsource their document shredding and gaining the attention of top managers. This led to FACTA, laws specifying breach notification and state information destruction laws.

According to Johnson, 13 states currently have laws with information destruction requirements, with only one differentiating between electronic and paper documents. These laws, which he described as “very strong,” have also led to prosecutions, including six in Texas and 10 in Georgia.

Johnson said that as the industry matures and legislation is enacted, it’s harder and harder for such “cowboys” to be taken seriously.

Peter Prinz of American Electronics Recycling (AER), Sarasota, Fla., said his used to spend time and labor wiping all hard drives according to Department of Defense specifications (DoD5220.22-M), but that now, the company only wipes drives that come from sources that are not worried about confidential information. AER’s preferred method for data protection is hard drive destruction, he said.

AER puts sensitive or classified hard drives into a box either at its customer’s location or at its facility upon receipt of CPU. The box is then sealed and marked. The hard drives are then shredded without being removed from these sealed containers. Prinz says the company used to spend 30 minutes per drive to wipe the information, but now can shred 200 drives per minute, eliminating and human error that can occur during the data overwrite process.

Mick Schum, president of WeRecycle!, based in Wallingford, Conn., provided information on the various methods of information destruction, from the virtual to the physical.

           
In addition to software overwriting and shredding, electronics recyclers can also employ deformation, pulverizing and degaussing to destroy information saved to a hard drive. However, Schum warned that data can be obtained from large sections of the platter of a deformed hard drive. He also added that screens are particularly important when shredding hard drives, as they help to ensure that all drives have been destroyed down to an acceptable particle size.

While degaussing is a physical form of destruction using a strong magnetic field that works for all digital media and renders hard drives unusable, it is not a visual form of destruction and can leave room for human error, Schum cautioned.

Data overwriting, on the other hand, enables the hard drive to be reused. Using overwriting software, every track and sector of the hard drive is overwritten with a predefined pattern of random data, Schum said. DOD Directive 5220.22-M is the industry recognized standard, he added, and it is satisfactory up to “secret” level clearance. Such software requires three overwrite passes of each sector and a successful verification of the operation.

The Electronics Recycling Conference & Trade Show was held in Orlando at the Peabody Hotel from June 10 to June 12.