About disposing of failed devices and media containing data

On this page:


Overview

See below for UISO guidance about the best procedures for destroying devices or media containing data, including potential solutions and possible risks. The overall objective is to minimize the risk of personal injury and data exposure.

Guidelines

CD-ROM/DVD media

The most effective method for destroying CD-ROM/DVD media is to use a paper shredder-rated tool. Large batches of CDs that do not contain critical data can be destroyed using a CD "dimpler". (Degaussing is ineffective with optical media such as DVDs and CDs.)

Risk: Breaking CD media by bending it or striking it with force can result in bodily injury from flying debris.

Magnetic tape

A degausser, appropriately rated for the type of tape media you need to erase, is the best way to remove data from a backup tape.

Risk: Merely breaking the case of a tape cartridge does not remove the data on the tape media, and doing so can result in bodily injury from flying debris.

Note:
Since a degausser that meets the performance requirements set forth by the National Security Agency/Central Security Service (NSA/CSS) can be cost-prohibitive, departments may wish to take advantage of campuswide disposal options instead.

Hard drives and mobile devices

For devices and media such as hard drives, mobile devices, and flash media, the most effective method of destruction is the use of a shredder or drive crusher.

Risk: Destruction of devices using a drill can result in bodily injury from flying debris.

Disposal options

All campuses

For a list of contracted service providers for document destruction services, including destruction of paper and all types of media, see Document Storage and Destruction (requires IU Login).

IU Bloomington

IU Surplus on the Bloomington campus accepts many types of electronic media (including hard drives, floppy disks, and tapes) for destruction. IU departments pay a discounted rate compared to the general public. For details, contact IU Surplus.

Note:
IU Surplus does not accept paper for shredding.

IUPUI

IUPUI Surplus offers shredding services; see Surplus Hard Drive/Data Shredding Program.

Regional campuses

Departments on regional campuses may transport drives or devices to IUB or IUPUI to be shredded. Considerations include:

  • Risk to an individual while traveling.
  • Risk to IU should devices be lost or stolen while being transported, resulting in a data exposure.
  • Frequency of travel: Unwiped nonfunctional devices should not sit for longer than 90 days.
  • Selection of an appropriate person to transport the devices: IU full-time, non-student employees may transport failed devices for disposal.
    • The employee who will transport the devices should understand the potential sensitivity of the data that may reside on the devices and the risk to IU in the event of a data exposure.
    • The employee should take appropriate precautions to protect the devices, such as keeping the vehicle locked when unattended and stowing the devices out of sight.
    • The employee should take as direct a route as possible to the location of the drive shredder while avoiding unnecessary stops, overnight stays, or side trips.
  • Include a printed list of devices and their serial numbers with the shipment and keep a copy for your reference. Request acknowledgment of receipt and destruction of the devices from Surplus.
  • Consider using an approved courier:
    • FedEx Custom Critical (preferred)
    • USPS (critical data must be specified)
    • World Courier

Alternatives

Campuses and departments may choose to purchase their own drive shredder. Shredders cost approximately $10,000 or more.

Campuses and departments could use a crusher instead, but should select a model that crushes a significant portion of the surface area of a device to assure that no drive platens are missed, and, should it be used for mobile devices, to assure destruction of memory chips. One such hard drive crusher is the Phiston MediaVise Compact Hard Disk Drive Destroyer from Phiston Technologies. Once shredded or crushed, the drive may be recycled through the university’s approved e-waste vendor.

Note:
Most drive shredders/crushers will not accept larger-sized mobile devices.

Additional considerations

As always, communicate any incident involving potential data exposure or breach to it-incident@iu.edu.

Get help

Contact the UISO for a consultation if you have questions about properly disposing of devices and media containing data.

This is document bgsa in the Knowledge Base.
Last modified on 2023-08-25 16:00:19.