this came across my alerts today!!
« How Computer Forensics Firms Market Themselves | Main
April 21, 2010
Going to Ditch a Copier? Think Twice. It May Carry Your Data.
We had an e-mail from the Virginia State Bar's ethics guru, Jim McCauley, asking about an article he had read about how copiers can be gold mines for identity thieves. Indeed they can.
Jim asked John to comment on the issue for a piece Jim is writing. As always, John's information is valuable and generally unknown to many lawyers, so I am including it as today's post. I hope it proves illuminating to readers who may not be aware of this problem. Here's what John had to say:
As with any electronically stored device, data can be retrieved if it is not properly overwritten (wiped) and/or the device does not store data in an encrypted form. I know that many of the Konica Minolta Bizhub copiers store the data in an encrypted form and also wipe the drive area following a print, scan or fax operation. I know that several of the other copier manufacturers have this ability, but it may be an add-on option and not part of the default offering.
I think the best way to maintain confidentiality is to remove the hard disk from the copier and wipe it prior to return or disposal. There may be some problems with this approach, especially if you lease the equipment. Wiping the drive would render the copier useless since you would also remove any operating system that resides on the disk. I would check with the lessor prior to starting any manual wipe effort. Obviously, it’s a real problem if you are leasing a copier that doesn’t automatically wipe the data like the Konica Minolta AND the lessor wants a functioning machine upon return. Perhaps the only choice in that case is to purchase the machine and then wipe the disk.
I’m thinking that it is a best practice to wipe the drive prior to disposal if you own the machine or make sure that you have a model that wipes the data after each job.
John's advice is sound and many lawyers, unaware of this security concern, simply buy or lease copiers without ever considering the issue. Ditto when they go to dispose of the copiers. Yet another way for data to leak out of a law firm . . . .