Every organisation whether public or private sector has responsibilities to the Data Protection Act. All organisations must ensure that data does not fall into the wrong hands. One of the essential components of the Data Eliminate service for recycling WEEE, is the destruction of sensitive information held on data-storage devices. laptops, personal computers and server hard disks in addition to media such as CD’s, DVDs, floppy discs, data tapes and video tapes which accumulate over time. Destruction can either be carried out at the customer premises or back at Data Eliminate’s secure destruction facility.
Data Eliminate deploys several different methods for erasing sensitive and confidential material on devices used for data storage. The chosen technique depends on the type of technology used to store the data and the sensitivity of the information concerned.
Data Eliminate has a number of shredders especially designed for data destruction purposes. The shredders and disintegrators are mounted on vehicles to suit a number of purposes. The shredders are able to reduce all types of computer media including data tapes, computer hard disk drives DVDs, mobile phones and thumb drives into very small particles. Depending on the media concerned and the sensitivity of information, particle sizes may range from 20 mm² down to 2 mm².
It takes much longer to shred a hard drive down to 6 mm sized particles than it does to reduce down to 6 mm. The cost of doing the latter is therefore greater. In most cases, there is a standard of commercial best practice which is widely used by public sector and private industry. This standard is either known as BS 8470 or EN 15713 and governs the secure disposal of sensitive information. Data Eliminate’s on-site shredding capability has British government approval in the form of a CESG claims tested Mark.
CSG are the information assurance arm of the government Communications headquarters (GCHQ) based in Cheltenham. CESG manages approval schemes for various products and services which are used by central government in information assurance. This extends to data destruction.
Hard drives, backup tapes and floppy discs are examples of magnetic media. This type of media can be destroyed by a process called degaussing. Degaussing permanently removes confidential data on magnetic devices by destroying the magnetic field thereon. Degaussers cannot be used to destroy other forms of computer media such as CDs, DVDs or USB sticks. It is also the case that data from mobile phones and the very latest hard drives which use Flash technology cannot be destroyed by degaussing. These are also known as solid state devices (SSD). Optical and flash media devices must be crushed or shredded to ensure proper destruction of data.
There are other aspects of degaussing about which one should be aware. A degaussed hard drive does not look physically different after the degaussing process. If the procedure is therefore not properly managed, it is possible to get hard drives which have been degaussed confused with those which have not. The advantages of degaussing are that it can be a clean, quiet and quick process which can be completed within a normal office environment. For more sensitive government information a two-stage destruction process is required incorporating both degaussing and physical destruction via shredding or disintegration.
Storage devices which are physically destroyed using either shredding or degaussing may not be used again. If a customer wishes to reuse media items, particularly hard disk drives, sensitive data on the drive needs to be overwritten using specialist software. The length of time required to use the software to overwrite the hard drive is proportionate to the size of the hard drive itself. A large hard drive of say 500 MB or 1 TB may take a number of hours. Disk drives are getting bigger all the time so this is a growing problem although advances in overwriting technology are improving the overwrite speed. Overwriting has some problems as many of the disks are at least partially faulty or have bad sectors. This means that overwriting can sometimes fail, leaving no option but to physically destroy the drive concerned. Given the time taken to overwrite drives and the software licences needed, it can be more cost-effective to simply destroy the incumbent drive and replace it with another one within the computer or server concerned.
Data Eliminate uses three types of overwriting software: Blancco, Kroll on Track and Tabernus. The solutions are approved by CSG to destroy government data up to and including impact level 6 (IL6).
It is true to say that most customers who are concerned about the sensitivity of their confidential information choose shredding or disintegration as a means of destruction. Data eliminate enables customers to witness this process either at their own premises or at Data Eliminate’s central London destruction facility. Seeing your hard drive turned to cornflake sized particles is the most reassuring solution.