Investigators uncover dismal data disposal
By Lucy Sherriff
Published Thursday 17th February 2005 10:35 GMT
An investigation into the disposal of computer equipment has
uncovered psychological reports on school-children, confidential
company data and even details of an illicit affair on hard drives
that should have been wiped clean. Universities, schools and global
businesses are routinely breaking the Data Protection Act by
disposing of computers without removing personal data, researchers
found.
The Computer Forensics team at the University of Glamorgan examined
over 100 hard drives at the behest of investigative journalist, Peter
Warren. Some of the drives were bought from eBay, others from
computer fairs and traders. Only two contained no recoverable data at
all, and one of those was brand new. The previous owners of half the
remaining drives had made no attempt to remove the data, and the rest
had failed to remove it properly, according to Jon Godfrey, at Life
Cycle Services, which contributed ten professionally cleansed drives
as a blind control.
"What the university found was frightening," he told us. "Half of the
owners didn't seem to care, and half didn't know how to erase their
data. Over half breached the DPA because they held personal data."
The Data Protection Act requires that organisations storing personal
data do so securely, and that the data is deleted when it isn't
needed any more. As well as breaching the DPA, the lax disposal of
hard drives could mean sensitive information falling into the hands
of organised technology crime gangs in Nigeria and Russia. Godfrey
also warned that much of the information on the drives could be used
for identity theft.
Data recovered from a Yorkshire primary school included names of
pupils and details of their school reports. Other information
recovered includes: financial details that could leave the companies
concerned open to fraud or blackmail; passwords of senior company
executives; details that would allow hackers access to central
systems of universities including Southampton and Hull.
Between two and three million personal computers are disposed of
every year in the UK, according to Godfrey. "If you extrapolate from
these results, that is a huge amount of information leaching out," he
said.
Godfrey noted that although the research was conducted by a computer
forensics team, that should not imply that the data is difficult to
recover. Any computer literate individual could download a data
reconstruction tool and learn how to recover the data within half an
hour, he said, adding that it would be a totally trivial exercise for
anyone familiar with Unix.
Individuals as well as companies need to take care when disposing of
hard drives. There is readily available software, such as Blancco,
which will get rid of everything on your hard drive to the highest
standards approved by the government. If you don't want to do that,
Godfrey says, take a hammer to the hard drive before you chuck out
your old PC.
"The shelf life of the data is longer than that of the PC. We saw
that with the case of Paul McCartney's old hard drive showing up. If
it can happen to him, it can happen to anyone," Godfrey concludes. ®
---
* Origin: [adminz] tech, security, support (192:168/0.2)
generated by msg2page 0.06 on Jul 21, 2006 at 19:03:54
search: