Used Hard Drives Retain Data in eBay Sale

Anybody with five bucks and a little patience may be able to score sensitive corporate data on eBay.

Organizations engaging in the common practice of disk drive recycling--selling unneeded disk drives directly or through a service--may find that company data winds up for sale on eBay's auction site, even if the drives have been wiped first.

Idaho Power found itself in that situation last week as it attempted to track down unscrubbed company disk drives that had been sold on eBay.

The drives contained confidential employee information, correspondence with customers, and memos that discussed proprietary company information, the company said.

The Boise, Idaho-based utility supplies electricity to approximately 460,000 customers in southern Idaho and eastern Oregon.

Idaho Power said it hired Grant Korth of Nampa, Idaho, to recycle about 230 SCSI drives. Korth sold 84 of those drives to 12 parties, which have not been disclosed by the company, using the eBay Web site. The remaining 146 drives were returned to Idaho Power, the company said.

Korth declined to comment on the situation.

Search and Retrieval

Idaho Power has received assurance from ten of the 12 parties that bought drives over eBay that the hardware would be returned or the data on them would not be saved or distributed. The other two parties are still being tracked down, the company said.

An Idaho Power spokesperson said the company has hired a Seattle law firm, Blank Law & Technology, to launch an investigation to determine what information was on the affected drives and why they weren't scrubbed as required.

Typically, Idaho Power either destroys drives or scrubs them to Department of Defense standards, the spokesperson said. In this case, the salvage vendor was to have scrubbed the drives to DOD standards, he said.

The company said it will not know what regulatory penalties it may face until the investigation is completed.

In the meantime, Idaho Power has implemented a new policy that calls for drives to be destroyed rather than sold for salvage. That's the type of policy advocated by Simson Garfinkel, a postdoctorate fellow at Harvard University's Center for Research on Computation and Society who has researched the issue.

"The resale value of a hard drive is really minuscule," he said. "These things are worth $5 to $20 each. I don't think anyone's buying them on the secondary market for extortion, but you never know."

Frances O'Brien, an analyst at Gartner, said the distribution of drives carrying unscrubbed data is commonplace. "It happens all the time," she said. Typically, a user either doesn't know to clean the drives or doesn't do it correctly, she said.

Aside from the financial concerns related to losing data, organizations that improperly recycle disk drives can run afoul of a number of federal regulations, such as the Sarbanes-Oxley Act and the Health Insurance Portability and Accountability Act, O'Brien said.

In addition, such incidents could lead to significant penalties in states like California and New York that have broad privacy regulations, said Robert Houghton, president of Redemtech, a Columbus, Ohio-based outsourcer.

When a company hires an outsourcer--which is a practice Gartner recommends--it needs to be aware of the outsourcer's methods for cleansing data, O'Brien said. "If everyone else is charging $20 and someone says they'll do it for $2," he said, "you've got to wonder why."