Anybody with a little money and some patience may be able to buy sensitive corporate data on eBay.
Organizations who engage in disk drive recycling - selling unneeded disk drives directly or through a service - may find that company data winds up for sale on eBay's auction site, even if the drives have been wiped first.
Idaho Power found itself in that situation last week as it attempted to track down unscrubbed company disk drives that had been sold on eBay.
The drives contained confidential employee information, correspondence with customers and memos that discussed proprietary company information, the company said.
The company supplies electricity to approximately 460,000 customers in southern Idaho and eastern Oregon.
Idaho Power said it hired Grant Korth of Nampa, Idaho, to recycle about 230 SCSI drives. Korth sold 84 of those drives to 12 parties through eBay. The remaining 146 drives were returned to Idaho Power, the company said.
Korth declined to comment on the situation.
Search and Retrieval
Idaho Power has received assurance from 10 of the 12 parties that bought drives over eBay that the hardware would be returned or the data on them would not be saved or distributed. The other two parties are still being tracked down, the company said.
An Idaho Power spokesman said the company has hired a Seattle law firm, Blank Law & Technology, to launch an investigation to determine what information was on the affected drives and why they weren't scrubbed as required.
Typically, Idaho Power either destroys drives or scrubs them to US Department of Defense standards, the spokesman said. In this case, the salvage vendor was to have scrubbed the drives to DoD standards, he said.
The company said it will not know what regulatory penalties it may face until the investigation is completed.
In the meantime, Idaho Power has implemented a new policy that calls for drives to be destroyed rather than sold for salvage. That's the type of policy advocated by Simson Garfinkel, a postdoctorate fellow at Harvard University's Center for Research on Computation and Society who has researched the issue.
"The resale value of a hard drive is really minuscule," he said. "These things are worth $5 to $20 each. I don't think anyone's buying them on the secondary market for extortion, but you never know."
Frances O'Brien, an analyst at Gartner, said the distribution of drives carrying unscrubbed data is commonplace. "It happens all the time," she said. Typically, a user either doesn't know to clean the drives or doesn't do it correctly, she said.
Aside from the financial concerns related to losing data, organizations that improperly recycle disk drives can run afoul of a number of federal regulations. They can also face data protection penalties in some US states.