Sale of Magnetic Data Tapes Previously Used by the Government Presents a Low Security Risk

To read this letter, dated September 21, 2007, click on:

Sale of Magnetic Data Tapes Previously Used by 

the Government Presents a Low Security Risk

Furthermore, congresswoman Betty McCollum calls for 
renewed investigation of data tape privacy risks, citing Imation.

Imation recovers bank account numbers from used data devices that GAO deemed “a low security risk”

Washington, D.C. 
–  (Tuesday, January 22, 2008) Congresswoman Betty McCollum (MN-04), has sent a letter to the
Government Accountability Office asking that it reopen its
investigation of the privacy and national security risks posed by
government agencies reselling used magnetic data tapes that may once
have contained large amounts of sensitive personal and government
information.

Researchers
working for Imation, an Oakdale, MN-based corporation that produces
magnetic data tapes, were able to recover a wide range of sensitive
information from used data tapes that were supposedly wiped clean
before being re-sold.

Using
readily available equipment and information, Imation investigators
found out where the tapes originated and recovered bank account
numbers, expense reports, employee tax and benefit information, and
other sensitive data.

“If
federal agencies are selling used magnetic storage tapes on the open
market with this level of recoverable sensitive data available to
anyone with minimum technical skills or equipment,” McCollum wrote to
the GAO, “we should all be alarmed and demanding greater accountability
from federal agencies engaged in such sales.”

An
initial GAO investigation – less thorough than the one conducted by
Imation – failed to recover any sensitive data from used tapes. In
light of Imation’s findings, however, Rep. McCollum is strongly urging
the GAO to initiate a broader investigation to ensure that government
agencies including the Federal Reserve and U.S. Air Force are not
reselling used data tapes from which personal or national
security-related information could be recovered.