Number 298 - March 2008

Data destruction--it's harder than you think
by Robert Vamosi Senior editor, CNET Reviews, June 10, 2005
On June 1, 2005, the Federal Trade Commission enacted www.ftc.gov/bcp/conline/pubs/alerts/ disposalrt.htm new rules regarding proper data destruction relating to personal information such as names, addresses, and social security numbers. It's yet another provision of the www.ftc.gov/opa/2004/06/factaidt.htm Fair and Accurate Credit Transactions Act of 2003 (FACTA), an act which among other things allows everyone in the United States and its territories to request a free credit report once a year from each of the major credit bureaus. But many of the FACTA provisions, though well intentioned, remain obscure. As the old saying goes, if a tree falls in the forest and no one's around to hear it, does it still make a sound? In other words, do you know whether this rule applies to you (chances are it does), and do you know how to purge data (chances are you don't)? The fine print    The new FTC rules apply to just about anyone doing business these days, perhaps even you. Beyond the obvious candidates, credit bureaus and financial institutions, the new FTC requirements, or the FACTA Disposal rule, extends to employers, landlords, automobile dealers, private investigators, debt collectors, and any individual who obtains credit reports on prospective contractors, such as nannies. According to the new FACTA rules, if you possess personal data within your workplace, you must make every effort to:    - Burn, pulverize, or shred papers containing credit report information so that the information cannot be read or reconstructed.    - Destroy or erase electronic files or media containing credit report information so that the information cannot be read or reconstructed.    - Conduct due diligence and hire a document destruction contractor to dispose of material specifically identified as credit report information consistent with the rule.    That means you can no longer toss credit report printouts in the trash; you must burn, pulverize, or shred them instead. Failure to comply with the new regulations can result in civil and state penalties up to $1,000 per violation. Federal penalties can be as high as $2,500 for each incident. Violators also may open themselves up to class-action suits.    So what about digital versions of credit information? Destroying or erasing data covers a lot of territory.	Digital deletion is much harder than it seems    Destroying a hard drive includes smashing it to pieces or drilling holes into the case so that the magnetic disk inside is destroyed. But erasing digital data "so that the information cannot be read or reconstructed" is ill-defined within the new FTC rule.    What if I told you that I could read all the deleted Windows OS files on any intact Windows OS hard drive? Or that law enforcement officers could reconstruct files you thought were long gone? Or that the hard drive you just bought on eBay might contain a gold mine in account information and passwords belonging to its previous owners? Back in 2001, I wrote about this in greater detail in a ZDNet AnchorDesk column on Windows data destruction and how hard it is to get rid of a single file http://reviews-zdnet.com.com/4520-6033_16-4206517.html?tag=txt.    In short, just because you delete a file within Windows doesn't mean that it's gone. On the contrary, within Windows there's plenty of evidence the file existed (temporary backups, earlier saved drafts), often stored in spaces where there appears to be no data (this is called slack space). The solution is to overwrite the data with new data (usually ones and zeros) and to do that several times--the more the better. Out, out, damn file    There are several free and downloadable products that work. One, www.download.com/Eraser/3000-2092_4-10231813.html?tag=txt Eraser, is notable because it will overwrite your data up to 35 times. By comparison, the government's own standard is 7 passes. I personally use the data shredder included within the google3-cnet.com.com/.../Steganos_Security_Suite_70/4505-3667_7-31200445.html?tag=txt Steganos Security Suite, which can overwrite data up to 100 times, more than enough to purge any data.    Even if you don't run a business, I recommend getting into the habit of shredding your electronic data. You never know when you might want to donate your old computer to a local school or charity or sell it on eBay. For more on FTC safeguards regarding consumer information see the PDF file at www.ftc.gov/os/2002/05/67fr36585.pdf target="_new>.    Do you destroy electronic files? If not, why not? Talk back to me. TOGGLE Editor's Note    Don't forget the old standby BCWIPE which the DOD used to use and will overwrite the files you wish to delete, with 1's and 0's, as many times as you like. It used to be in our club library and we use it often.
Number 298 - March 2008