Study reveals security risks of careless hard drive disposal

Many organisations are failing to erase confidential information from their computer hard drives before disposing of them, causing serious security risks, a university study has warned.

Ninety-two hard drives purchased from internet auction website eBay and computer fares were analysed by researchers from the University of Glamorgan who had no prior knowledge of where they had been purchased from or what they contained.

The research team, from the university's School of Computing, found that over half the disks contained information which identified the organisations (57%), identifiable usernames (53%) and personal information (51%), including employee contact details and national insurance numbers, VAT numbers and family information.

A fifth of the disks also contained important financial information, such as sales receipts and profit and loss reports.

There also appeared to have been unsuccessful attempts made to remove data from almost half (48%) of the disks.

A control group of drives, which were sourced from a company specialising in data destruction, were also used in the research – all had been wiped and were found to be clean.

Dr Andy Blyth, Principal and Head of the Information Security Research Group at the university, who headed the research team, described the results as "surprising". He said: "Companies have an obligation to dispose of data when it is no longer required and many of the organisations involved are now launching investigations in to how this information has ended up in the public domain. Such research can help improve security measures and stop this kind of infringement happening."

Dr Blyth warned that information left on hard drives could be used by criminals to commit crimes such as identity theft, extortion and blackmail. The best way to destroy information stored on the hard drive, he said, was to stick a large nail through the drive and physically destroy it.

The School of Computing regularly undertakes research on behalf of the police and high-tech crime units. The researchers have an established record in network security and data crime analysis.

(KmcA)