Guide for Disposing of Failed Devices/Media Containing Data

If a device or media which potentially contains University data cannot be wiped, the only appropriate recourse is to destroy the media before disposal. (Note: Devices which have been appropriately verified as wiped do not need to be destroyed). No single solution will be without some risk or cost. Situations and opportunities will vary for each campus/department.

The intent of this document is to outline potential solutions and risks when contemplating the best procedure(s) for destroying devices/media. The overall objective is to minimize the risk of personal injury and data exposure. 

Guidelines

CDROM/DVD: The most effective method for destroying CDROM/DVD media is to use a paper shredder rated tool. Large batches of CD’s which do not contain Critical data can be destroyed using CD“dimpler”.
Risk: Breaking CD media by bending it or striking it with force can result in bodily injury from flying debris.

Magnetic Tape: A degausser, appropriately rated for the tape media type to be erased, is the best way to remove data from a backup tape.
Merely breaking the case of a tape cartridge does not remove the data on the tape media, and doing so can result in bodily injury from flying debris.

Hard Drives/Mobile Devices: For devices and media such as hard drives, mobile devices and flash media, the most effective method of destruction is the use of a shredder or drive crusher.
Risk: Destruction of devices using a drill can result in bodily injury from flying debris.

The following are options for disposing of failed devices:

1. If on the Bloomington campus, make use of the Surplus Store’s drive shredding service.
   
   
2. If on the Indianapolis campus, use the IU Indianapolis Surplus Store pickup service or deliver the drive to the store for secure storage pending transportation to IU Bloomington Surplus for shredding.
   
   
3. If on a regional campus, departments may transport drives/devices to IUB to be shredded. Considerations include:
   1. Risk to an individual while traveling.
   2. Risk to IU should devices be lost/stolen while being transported, resulting in a data exposure.
   3. Frequency of travel (unwiped nonfunctional devices should not sit longer than 90 days).
   4. Selection of an appropriate person to transport the devices:
      1. IU full-time, non-student employees may transport failed devices for disposal.
      2. The employee who will transport the devices should understand the potential sensitivity of the data which may reside on the devices and the risk to IU in the event of a data exposure.
      3. The employee should take appropriate precautions to protect the devices, such as keeping the vehicle locked when unattended and stowing the devices out of sight.
      4. The employee should take as direct of a route as possible to the location of the drive shredder while avoiding unnecessary stops, overnight stays or side trips.
   5. Include a printed list of devices and their serial numbers with the shipment and keep a copy for your reference. Request acknowledgement of receipt and destruction of the devices from the Surplus Store.
   6. Consider using an approved courier: 1) FedEx Custom Critical (preferred), 2) USPS (critical data must be specified), or 3) World Courier.
      
      
4. Alternatively, a campus/department may choose to purchase their own drive shredders. Shredders run approximately $10,000 or more. Campuses/departments could use a crusher instead, but should select a model that crushes a significant portion of the surface area of a device to assure that no drive platens are missed, and, should it be used for mobile devices, to assure destruction of memory chips. One such hard drive crusher is the Phiston MediaVise Drive Crusher from phiston.com. Once shredded or crushed, the drive may be recycled through the university’s approved e-waste vendor.

 Note: Most drive shredders/crushers will not accept larger sized mobile devices.

Additional Considerations

As always, incidents involving potential data exposure/breach, should be communicated to it-incident@iu.edu.

The Surplus Store will accept and process larger mobile devices which do not typically fit in a drive shredder/crusher as a whole unit.

The UISO is available for consultation.