IG: DoD fails to scrub discarded IT hardware

The Pentagon's inspector general has discovered that some Defense Department units have not removed data from information technology equipment before disposing of the hardware. The result, said the inspector general, is the possible release of information that had not been properly sanitized, increasing the possibility of identity theft and the unauthorized disclosure of sensitive data.

The IG said that internal controls have not been adequate, finding that Pentagon units "did not properly sanitize, document, or fully account for excess unclassified IT equipment before releasing the equipment to other organizations." The audit said some DoD organizations did not properly train personnel or develop and implement on-site procedures for the authorized release of IT equipment. Unaccounted-for equipment and hard drives with leftover readable information--including data such as Social Security numbers and email folders--comprised most of the instances of noncompliance.

The IG said the Defense Reutilization and Marketing Service, the destination for much of the excess IT equipment, also did not follow the proper guidelines.

The components cited included the Army Corps of Engineers; Naval Air Warfare Center Aircraft Division at Patuxent River, Md.; the 436th Medical Group at Dover Air Force Base in Delaware; the 50th Space Communications Squadron at Schriever Air Force Base in Colorado; and the Army Garrison at West Point in New York.

For more on the IG report:
- see this Federal Computer Week article

Related Articles:
Pentagon facing data overload
Pentagon removes SSNs from military ID cards
Should the Pentagon keep the troops from blogging?