GovernmentExecutive.com

Return to Article: 'Erased' personal data on agency tapes can be retrieved, company says

• 42351
  

  Ensuring that information is erased from magnetic tapes is well understood in the industry. It's referred to a bulk degaussing and it's a basic subject when discussing tape storage. Anyone who works with tapes in these agencies should know that and practice it. And if they don't they should consult with other agencies who have expertise. Why anyone would want a used tape except for the scrap value is beyond me - unless you're an identity thief. Tapes have a limited number of use cycles after which they become unreliable; which one would think is bad for accurate record keeping. I agree with Jim the scrap value to the government hardly holds a candle to the security risk. Agencies responsible should be held accountable to tighten up their practices and degauss or destroy the tapes like they'd shread anything else. But that's not all that needs to be done. It's hard to understand how the GAO could miss information so basic. This isn't a "limited scope"; it's simply an example of sloppy work and the GAO should answer for it for a change. Who audits them?

  Bill Posted January 28, 2008 7:34 AM
• 42251
  

  The "limited scope of work" performed by the GAO needs to be investigated. If they had simply gone to the experts before tapes were ever sold in the first place, obtained a thorough analysis, and implemented a verifiable process for erasing, this would never have become an issue. This is just another example of taxpayers' dollars down the drain.

  Russ Posted January 25, 2008 11:37 AM
• 42175
  

  I will be sorely upset when I find out that my financial information on a backup tape at the NFC was "wiped" and resold to a third party wholesaler for $5 a case. I mean, how much can be made from a used tape anyway? And it's probably more cost effective to destroy it rather than rehabilitate it and resell it, don't you think? A block of personal data from any federal agency could conceivably cripple or at the very least tremendously hinder an organization. And for what? How frugal is that? How about we post the financial records of each Congressional member on the internet and see how long contemplation takes to resolve that issue. This issue is no different than reselling hard drives. No one does that as far as I know.

  Rod Posted January 24, 2008 3:10 PM
• 42142
  

  The disconcerting part of this story is the difficulty in knowing who to trust. There are, presumably, many experts in government service who have the expertise to attempt recovery of data from magnetic tapes. Is there a motivation for a private company to report that the data is recoverable? Possibly, if they hope for a contract to make the data unrecoverable. Is there motivation for GAO to be untruthful? In most everything we do there is risk involved that we try to mitigate as much as possible but cannot eliminate totally. A complete report by GAO should reveal if the decision to sell the tapes is poor judgement (or lack of due diligence) or if the risk was considered acceptable.

  Dennis Posted January 24, 2008 10:26 AM
• 42130
  

  I agree. First of all, a list of the Federal agencies (probably all) should be compiled and made available, especially to Federal employees. Second, the Federal agencies should be made to stop selling tapes to commercial companies, especially with all the Identity Thefts in vogue, immediately--not three years after a Congressional inquiry. Thirdly, other methods of backups, etc. should be determined and used to prevent the further invasion of private information. All institutions demand information from "clients" but, we, as "clients" get no assurances from ANY institutions. These institutions should have to have their information available to those who decide to do business with them before we make any decisions to do or continue to do any business with them.

  Grace Posted January 24, 2008 9:33 AM
• 42116
  

  The only responsible thing for the Federal government to do given the uncertainty over what is retrievable and what isn't, is to immediately stop the sale of such used tapes. No other step will suffice.

  Also, since this Minnesota company appears to be highly skilled in data retrieval, this company should be allowed(under contract) to process the tapes that the Executive Office of the President reported last week as having "missing" sections, so that they can retrieve all the data for the historical record as required by law.

  M. Rao Posted January 24, 2008 8:42 AM
• 42090
  

  Perhaps GAO should have considered asking the very competent ICE or Secret Service computer forensic personnel to test the tapes to see if data was retrievable. Certainly in some criminal cases "erased" data is recovered. That is a regular occurrence.

  Obviously, asking tape manufacturers would also have been helpful.

  The risk of sensitive government information going sideways certainly outweighs small recoveries from selling tape.

  Jim Kaley Posted January 23, 2008 6:48 PM