Old-fashioned data theft is still a serious threat

Going green is good. But it can leave your business exposed to data theft if it isn't done right.

A lot of companies want to boost their office recycling because it cuts costs and helps sustainability and the environment, according to Les Etscheidt of Cedar Rapids-based Document Destruction and Recycling Services. But what happens when a paper record that's required to be confidential goes into the recycling bin when it should go in the shredding bin?

It can be more difficult than it seems, according to Etscheidt, operations manager for the company.

“You have to tell them that documents A, B and C go in the green bin and documents D, E and F go into the blue bin, and are they going to do that?” he asked.

A data privacy policy and a document destruction plan with a shredding vendor can help. Etscheidt says all the documents his company collects for destruction are recycled after being shredded. Document Destruction employees place discarded documents in locked bins, and the documents remain in a secure environment until they are shredded and recycled.

“You're recycling, but you don't use the blue bin anymore,” Etscheidt said. “You are doing a green thing, and also protecting the company.”

Etscheidt added interest in protecting paper records remains particularly high in industries such as health care and finance, in which records privacy is demanded by federal law.

Etscheidt recommends businesses set a policy on how long they should keep records by applicable laws or for business purposes. Keeping them any longer than required creates unnecessary security risks - and more.

“A lot of businesses will call us and they'll have 20 or 30 years of boxed records,” Etscheidt said. “If you get audited and you have 20 years of boxed records, they will be audited.”

The document shredding business has gotten more competitive since Document Destruction started in 1996, Etscheidt said. Companies can contract for data destruction by the pound, by the container or, even at one local company, by the minute.

Prices vary with such factors as the frequency of collection, tonnage and number of containers.

“Let them come in, do an audit and make some recommendations,” said Etscheidt, a board member of the National Association of Information Destruction. “You want to have frequency. You don't want to have stuff sitting around.”

But concerns over paper records were almost eclipsed last year by news reports over the ease of data theft from hard drives taken from photocopiers that were sold or discarded by companies.

Data theft from the hard drives of stolen laptop computers also has attracted attention.

To this, Midwest Electronic Recovery owner Dave Long in Walford added the possibility of data theft from laptops or personal computers donated to charities.

Long offers one simple solution: Remove the hard drive from the computer or photocopier before donating it or giving it away.

“I always tell customers that if you don't trust me or anybody, pull your own hard drive,” he said. “Keep it or smash it with a hammer. Make them buy a replacement.”

Long said replacing the hard drive is not too expensive for the recipient of the computer. Midwest Electronic Recovery sells used hard drives that have been “wiped” for around $15.

Many companies with a large number of computers have their own degaussing machines, Long noted. The machines use a powerful electromagnetic field to decrease or scramble data stored magnetically on the hard drives.

Midwest Electronic Recovery wipes the data from the hard drives of every machine it receives, and provides companies with a certificate of data destruction.

Some companies with high-data security requirements pay Midwest Electronic Recovery extra to have the data overwritten to a seven-pass Department of Defense specification instead of the three-pass DOD specification the company usually performs. The cost usually runs from a few dollars per machine to $15 depending on the size of the hard drive, Long said.

The service includes scanning and recording the serial numbers of the hard drives.

Midwest Electronic Recovery reinstalls wiped hard drives on recycled computers that are still powerful enough to be in demand, but shreds the others.