May/June 2013
For electronics processors, the devices they handle, the assurances they provide, and their processing goal—reuse or recycling—all can factor into the selection of data destruction tools.
By Diana Mota
Keeping up with technology is like keeping up with the Joneses. It’s challenging, more so for electronics recyclers who handle data storage devices, from computer hard disks to portable flash drives and everything in between. They need to understand how to process the devices to maximize their reuse or commodity value, but they also must comply with the data destruction assurances they give their clients. And as data storage media evolve, so too must the equipment and methods for destroying or erasing them. Simply following a manufacturer’s reset directions might work for some newer devices. But such measures on other digital devices do little to remove sensitive data, says Craig Boswell, president of Hobi International (Batavia, Ill.), an information technology and mobile asset disposition company.
The lack of a single, industrywide standard further complicates matters, several data destruction equipment manufacturers say. Some processors select their equipment based on the requirements of certification programs such as R2/RIOS or the AAA program of the National Association for Information Destruction (Phoenix). Others use guidelines from the U.S. Department of Defense (Arlington, Va.) and National Institute of Standards and Technology (Gaithersburg, Md.), says the vice president of technology and sales for a data sanitization solutions firm in New England. Often, deciding which process or tool to use is “more of a business question than a security question,” he says. Some clients are conservative and request destruction of everything, even requiring data destruction before the device leaves their facility, says Scott Venhaus of Arrow Electronics (Englewood, Colo.). The recycler’s business plan plays a role as well: Does the company plan to refurbish and sell the product or its parts or process it for its scrap commodity value? Either way, not keeping up with changes to data storage designs and destruction needs could have serious repercussions for recyclers and their customers. When choosing a data destruction solution, recyclers need to consider the types of devices they’re handling, the data location and storage media, the cost of destruction compared with the product’s value (whether resale or scrap), and—most important—the repercussions of an unintended release of data, says the vice president of marketing and strategic accounts with another New England data destruction equipment company.
Most data destruction tools take one of three approaches: They destroy the data-storage medium by shredding, crushing, punching, or bending it; they subject magnetic media such as hard drives or data tapes to a high-strength magnetic field designed to eradicate the data and destroy the device, a process called degaussing; or they overwrite or erase the data in a process called data sanitization. Recyclers can choose one method or a combination, the technology vice president says. “Any one of these methods is perfectly viable as a standalone measure for protecting data, but they all have their own meaningful business applications.”
Going to Pieces
Physical destruction techniques render the electronic device unusable or reduce the storage media to a particle size that makes it impossible to retrieve information. To destroy unclassified data on hard drives, “all you have to do to be compliant” with NAID recommendations “is disfigure the storage media, which really means the platters on which the data is stored,” the technology vice president says. “If you bend it, put a hole in it, warp it, or fold it, you’ve physically destroyed the media and rendered data inaccessible to an adequate degree.”
Hard drive manufacturers recommend shredding their products to pieces about 1.5 inches wide, he says. Though that particle size suits most applications, some shredders produce 3/4-inch or even 3/8-inch pieces, he says. But the particle size doesn’t really matter, says a sales and marketing representative of a data destruction equipment maker in the Midwest. For standard hard drives, “1.5-inch shred width isn’t any less secure than 3/4-inch shred width,” he explains, because “the technology to retrieve data off of fragmented pieces of hard drive is costly, and the process is time consuming.” Instead, he says, “It’s about perception. You’re appealing to the customer. If they think a smaller shred size is more secure, and they demand it, then we have it for them.” Destruction of U.S. Department of Defense (Washington, D.C.) data classified as secret or top secret must meet stricter requirements, which often require degaussing followed by physical destruction, this sales rep says. Using multiple techniques “basically eliminates any singular point of failure,” the technology vice president explains. The federal government doesn’t define what it considers physical destruction, the vice president of marketing points out. “In theory, if I degaussed a hard drive using an NSA-approved degausser, I could then throw it against the wall” and meet the physical destruction requirements. “However, most people look for a piece of equipment to actively destroy it.” Equipment for physical destruction tends to fall into the following categories:
Shredders. Manufacturers offer a wide range of small, mobile shredders designed for hard drives and other media, such as portable flash drives, reel-to-reel or back-up tapes, and mobile phones, the sales rep says. These machines cut input material—including metal hard disk drives—into narrow strips that range from 0.75 inch to 1.5 inches wide and lengths that vary at random. Their mobility gives recyclers the flexibility to shred at a customer’s site for greater security, but the technology vice president cautions that mobile doesn’t mean light: The smallest shredders available commercially weigh about 1,300 pounds and move on heavy-duty casters. “You’re not going to throw it in the back of a Volkswagen, but you don’t need a full 58-foot truck,” he says. More robust, but still mobile, machines weigh up to 7,500 pounds. These larger shredders can be installed in trucks. “One company paid for all of its equipment with one stop” with such a shredding truck, the sales rep recalls.
Recyclers that handle low volumes of material for destruction can start with a single-phase, 1-hp system, which can shred about 180 hard drives an hour using 220-volt electric power. At the other end of the spectrum are high-volume shredders that offer 20-hp, three-phase power (208, 230, or 460 volt) that can shred up to 3,500 hard drives an hour, the sales rep says. For example, his company manufactures three different series of hard-drive shredders for a total of six models, he says. Machines in a single series have the same footprint but vary in horsepower and shred width.
A low-volume model might suit someone starting out in the business or offering data destruction as a new service at an existing scrap processing operation, the sales rep says. “On the back end, they can take the shredded product and recycle it further.” But such equipment has certain limitations, says the technology vice president: They’re good for hard drives and magnetic tape, but not much else. “If you’re going to do any real volume—such as a few hundred hard drives an hour—you’re going to need three-phase power, which will require a generator for mobile operations.”
Shears. Hydraulic shears are another option for destroying low volumes of data-storage devices, the sales rep says. “They offer flexibility and are a good option for someone who might already offer on-site document shredding.” A shear can process up to 24 hard drives at a time and cut them into pieces ranging from a half-inch to 2.5 inches wide, he says. “Those with a lot more volume … would probably want a shredder.”
Crushers/Benders/Destroyers. Various pieces of equipment twist, break, or otherwise mangle desktop, laptop, and server hard disks. One firm’s machine can destroy drives up to 2 inches high in a 10-second crush cycle. An automatic crusher delivers 12,000 pounds of force using a conical, hardened steel punch to render drives up to 1.85 inches high and 9 inches deep inoperable in 8 seconds. A similar manual crusher delivers 6,000 pounds of force in 5 seconds. Many of these tools are mobile for on-site data destruction. They’re not as popular as shredders, says the technology vice president. “Crushers are compliant with NAID standards, but a lot of folks just don’t see them as adequate in their own mind. For that reason, we end up selling more hard drive shredders.” They are a great solution for clients that require degaussing and physical destruction, however, one sales rep says.
Disintegrators. A disintegrator is a mill with both stationary and rotary knives that cut material continuously until it’s small enough to pass through a screen. An air evacuation system typically moves the sized material to a downstream system for sorting or disposal. Manufacturers have designed various disintegrator models specifically for light-volume mixed media such as solid-state drives (those in mobile phones, tablets, and certain laptops), optical media such as DVDs and CDs, portable flash drives, memory chips, and mobile phones. Particle size can range from several centimeters to just a few millimeters. The National Security Agency (Fort Meade, Md.) recommends taking optical disks such as CDs and DVDs down to particle sizes of 2.2 by 4 mm, “just a little bit larger than a grain of sand,” says the vice president of marketing. “At 6 mm, not even the world’s most capable IT professionals could piece data back together,” says the technology vice president.
The systems come as standalone units for tabletop mounting, cabinet-mounted units, or field kits. One company’s five-blade models, which range from 10 to 25 hp, have throughputs ranging from 250 to 1,300 pounds an hour when processing material to a 3/32-inch particle size. With larger particle sizes, throughputs would even be higher, the sales rep says. Seven-blade, 15- to 30-hp models can process between 500 and 1,800 pounds an hour. The company’s 1- to 3-hp, light-volume, mixed-media “office” disintegrators can process 100 to 150 pounds an hour.
Hammermills. Hammermills for data destruction are smaller versions of what the scrap industry would use to process an automobile. Hammers attached to a high-speed rotating shaft repeatedly strike material dropped inside the unit. That impact, as well as collisions with the walls of the unit, beat up the material until it breaks into pieces small enough to pass through a screen. Heavy materials exit the mill by their own force while lighter materials require pneumatic suction. A low-volume hammermill can process a few hundred solid-state drives an hour, but the sales rep doesn’t recommend it for hard drives because of the amount of force needed to break them. “You would need a medium-volume or above machine.” A 30- to 40-hp mill weighing more than 2,600 pounds can reduce the average hard drive to pieces smaller than 3/4 inch, for example. As with automobile shredders, downstream separation equipment can sort the processed material using a variety of technologies. Machines range from 2 to 100 hp and throughputs of 50 to 3,000 pounds an hour.
Magnetic Wipeout
Degaussers use permanent fixed magnets or electromagnetic technology to render data unrecoverable on magnetic storage media such as hard disks, magnetic tape, or floppy disks. The technology vice president warns that degaussing is “not a solution for most data storage media” used today because it’s only designed for data that are magnetically recorded. Degaussing is more effective than shredding for tape media, he explains, and the process still exists because it’s included in U.S. government guidelines for destruction of classified data. To qualify to handle such data, however, the NSA must evaluate the degausser and add it to its Evaluated Products List. It’s a costly and time consuming certification process, one sales rep says.
The effectiveness of degaussing depends on exposure time to the magnet and the thickness of the disk, says the marketing vice president. Some degaussers are only strong enough for tape. A low-end hard drive degausser can process one drive at a time in about 60 seconds; a high-speed degausser processes about six drives in 10 seconds. Though the process renders it unusable, a hard drive appears unchanged after it’s degaussed. “You can’t tell by looking at it. It just doesn’t work anymore, and there’s no data on the drive,” the technology vice president says.
With the move toward solid-state drives, or SSDs, he believes degaussers are on their way out. “We’re doing a lot less degausser sale business because it doesn’t offer a complete solution for the media that are out there. It does nothing to [erase or sanitize] data on solid state drives,” the technology vice president points out. (For more on the challenges posed by solid-state storage media, read “Solving the Solid-State Storage Puzzle” on page 120.) But if that’s not a concern, a degausser could appeal to facilities that want to offer a basic level of electronics collection and data destruction. “It’s about half as much to buy a similar quality degausser as a shredder,” he points out.
Software Solutions
Data sanitization software can destroy data at a much lower cost than physical destruction or degaussing, and, in contrast to those techniques, it does not destroy the equipment, making resale an option. Sanitization software also can be used before physical destruction, says the vice president of business development for a Texas-based data erasure equipment and service provider. “It’s cheaper to employ some type of erasure than to bring a shredder on site” for clients who want data destruction while the equipment is on their property, he explains. It takes longer to wipe data from a device than to degauss or shred it, but it can be cost-effective to erase devices with high resale value, he says. There’s no practical limit to how many times you can rewrite over a device, says a solutions and support specialist for a data erasure company based in Finland. The device “will likely wear out before that happens.”
Several companies have developed software packages to erase data on rewriteable devices such as hard drives, mobile phones, portable flash drives, secure digital memory cards, and virtual machines. Each device requires different software, the support specialist says. For a hard disk, for example, the software must overwrite every sector of the drive, says Corey Dehmey, assistant to the executive director of R2 Solutions (Boulder, Colo.). That certification body recommends writing over the device three times: with a series of ones, then zeros, and finally randomly generated ones and zeros. The business development vice president questions the need for writing over a hard disk more than once, however. The precision and accuracy of modern drives allow for complete data erasure in one pass, he asserts. That said, DOD and NIST specifications require multiple passes, says Jade Lee, president and CEO of electronics recycler Supply-Chain Services, or SSI (Lombard, Ill.). SSI sets 3-wipe passes as its default, she says.
The time it takes to sanitize storage media varies. The more capacity in a drive, the longer it takes to overwrite the data, Lee says. Sanitization time also depends on the number of overwrite passes and the condition of the host system, says the business development vice president. Each pass extends the length of time for sanitizing, but a general rule of thumb is one hour per pass for every 200 gigabytes, says the technology vice president. Depending on the product, users might be able to install the software on a standard personal computer, a dedicated host system, or a networked device. Software firms even sell appliances or hubs designed to hold multiple loose hard drives, mobile phones, flash drives, or SD memory cards. One company, for example, offers data erasure tool kits that perform up to 160 erasures at the same time at the customer’s site or at the recycling facility.
On mobile devices, often the goal of data sanitization is to erase only personal data, not the operating system, to produce a functional device for resale, Boswell says. Off-the-shelf software solutions based on the device’s operating system—iOS, Android, or Windows Mobile, for example—are available for the more popular phones and can probably remove personal data from 95 percent of the phones a recycler is likely to encounter, Boswell says. One firm says its Windows-based software supports all major mobile device platforms and can erase up to 20 phones simultaneously, for example. Boswell notes that some software solutions don’t address purchased games, however. “Those we delete manually.” Hobi uses manual data sanitization solutions for less popular phones with less value; for some higher value devices, such as iPhones, the manufacturers have effective reset procedures, he says. “Typically, you can tell by how long it takes. If it takes three seconds, there’s no way it erased 20 gigabytes. But if it takes 15 minutes, then maybe it did.”
Software programs should provide reports that verify erasure and note errors, manufacturers say. Electronics recyclers also should have a verification sampling method and should not use the same software or person who wiped the data to verify it’s erased, Dehmey says. “It’s a two-person job. To verify, you match up serial numbers with the log and then take data recovery software and scan the media to see if you can recover anything.” The Device Renewal Forum (Costa Mesa, Calif.) recently developed data wipe certification standards for wireless phones, though it is making the standard available only to its members.
Before investing in data destruction equipment or processes, the technology vice president suggests talking with those who produce and sell such products. “There are so many different nuances to data destruction; it really depends on what business model the recyclers want to get into.”
Diana Mota is associate editor of Scrap.
For electronics processors, the devices they handle, the assurances they provide, and their processing goal—reuse or recycling—all can factor into the selection of data destruction tools.