Imation:” Don’t Buy Used Tapes”

Patient health records, social security numbers, bank account numbers and internal auditing procedures are examples of the kinds of information that is unknowingly ‘leaking’ out of data centers. This disturbing trend is the result of companies improperly disposing of used data storage products at end-of-life, including a growing practice of selling used computer tape cartridges to so-called ‘recertifiers.’ Imation Corp. has uncovered these and other serious data security and financial risks facing Corporate America due to improper destruction of used data storage products.

"All used data storage products, whether optical discs, flash, hard drives, or tape media, must be properly retired and disposed of in order to protect against possible data leaks. Despite the data storage industry’s warnings, companies continue to put themselves at risk. Imation wants to remind data centers that the only way to securely dispose of used tape media is through a reputable tape destruction service that provides a ‘certificate of destruction.’" said Dr. Subodh Kulkarni, vice president, Global Commercial Business, R&D and Manufacturing, Imation. "Tests in our lab of more than 100 commercially obtained tape cartridges confirmed that significant data ‘leakage’ is occurring as a result of the practice of ‘recertifying’ instead of properly destroying used tape. We take this issue seriously, because Imation’s business is centered on security in data storage and our products are being resold and reused in ways that can compromise a company’s information."

Data leaks occur when data storage managers, who increasingly face budget constraints, sell or give tape cartridges containing company data to a reseller who claims to erase or destroy the data. The reseller often ‘recertifies’ the cartridges without fully erasing the data then sells them back into the market. In many cases, the data storage manager is unaware of this practice as it is these cartridges that often contain confidential company and customer data. Imation, the world’s largest supplier of magnetic data storage tape, has determined through its testing that many tape cartridges, especially those with magnetic servo tracks, cannot in fact be completely wiped clean. With today’s high-capacity cartridges, significant amounts of data may be left intact and exposed to unwanted breaches. A typical tape cartridge can store hundreds of gigabytes of data, with the most current high-end cartridges holding up to a terabyte of data. An estimated one million cartridges are ‘recertified’ each year.

While the practice of reselling used tape was established to mitigate budget constraints, the costs associated with data breaches can far outweigh any savings. According to industry analysts and others who study the financial, security and reputation risks of data breaches, the cost to companies resulting from the failure to protect data is growing each year. In a 2006 report from the Ponemon Institute (2006 Annual Study: Cost of a Data Breach) the average cost to companies per lost customer record as a result of a data breach is $182. Multiply this by the thousands of individual records that may remain on improperly retired used data storage products, and the financial risk to these companies becomes apparent.

"Today’s tape cartridges have storage capacities of 500 gigabytes or more. Even if 99.9 percent of data is erased from a tape, hundreds of megabytes of potentially sensitive data could remain on the tape. This could include thousands of customer names and social security numbers which in turn expose a company to millions of dollars in legal fees, credit monitoring costs and customer communications. It could also ruin a company’s reputation, result in significant customer desertions and potentially expose it to regulatory penalties and costly lawsuits," Dr. Kulkarni added. "Companies that sell used tape aren’t selling back just one tape cartridge; they’re selling hundreds at a time and, as a result, are unknowingly gambling with their customers’ security and their entire businesses. The modest financial benefits from selling used tape are not being weighed against this potentially catastrophic consequence."

According to the Privacy Rights Clearinghouse, as of early October 2008, more than 245 million personal records have been exposed as the result of data breaches in the last three years alone, and that number is on the rise. In addition, the Ponemon Institute study found that more than 90 percent of data breaches occur in digital form and the costs associated with data loss are rising into the billions of dollars each year.

Uncovering Data Leaks
In lab tests run on the 100 ‘recertified’ used tape cartridges that Imation acquired through standard commercial channels, the company used off- the-shelf techniques, and randomly obtained recoverable, intelligible information from one-third of the cartridges tested. Some of the data discovered on used tapes during testing includes:

• A global banking institution: Internal bank auditing procedures, account numbers, employee credit card records, computer user names and computer server inventories
• A major U.S. hospital: Patient names, addresses, phone and Social Security numbers; clinical records including doctor diagnoses and prognoses
• A scientific research center: Field research data including geographic coordinates and conditions, names and email addresses of researchers
• A large U.S. university: Links pointing to the human genome project

"In our lengthy testing and analysis, which has spanned many months, we have confirmed industry guidance that the only way to properly dispose of data is to destroy the media itself," said Dr. Kulkarni. "The technical truth is there is no practical and secure way to completely erase and ‘recertify’ most used tape products. We want to get the word out to both the data center managers and senior executives who may not realize the risks they are exposing their companies to with this practice."

Keeping a Lock on Corporate America’s Data
Imation, with its long history and commitment to protecting customer data, offers a variety of solutions for storing and protecting user data and assisting companies in transitioning or migrating between tape formats, while also offering cost effective solutions.

Imation’s program begins with secure destruction, which ensures that used tape is securely destroyed in compliance with industry best practices, often free of charge. Imation also offers repurchase credits for securely destroying used media which provides discounts for the purchase of new media as users migrate from older to newer tape technologies.

In addition, to address the need in the market for safe and cost-effective disposal of used tape products and to promote a positive impact on the environment, Imation will launch Earthwise media in November. Earthwise media contains new media, shells made from pre-consumer recycled material and where available recycled cartridge components captured during the secure destruction process to create an environmentally friendly alternative to current recertified media.

Finally, Imation offers the DataGuard rf Tape Tracking System which uses RFID (radio frequency identification) to assist users with inventory management of their tape library.