Section 7.11 Disposal Policy

---

7.11 Disposal Policy

Eventually, a computer is taken out of service and sent to computer heaven. Sometimes this means giving it to a loyal employee for home use or to a charity to enjoy a tax write-off. Sometimes it is sold to a salvage company or recycler. Frequently, an old computer is tossed in the dumpster. But what about the data? In the chain of people involved in handling equipment at large organizations, often there is no one person whose job it is to worry about confidential data that might remain on a disk. In smaller organizations, the problem sometimes is forgotten less formally.

After a computer used in the U.S. Attorney's office was sold at a public government auction, it was discovered that someone forgot to erase the data on it. It contained the names and details of undercover agents, informants, and federally protected witnesses. The disk never was located. If it had fallen into the wrong hands, innocent people could have been murdered.

Sometimes you no longer remember the password needed to log in to a system. Sometimes the system will not boot up so it is considered "safe" for disposal, but the boot problem might not be due to a defective disk. In this case a "bad guy" or even a "gray hat" could remove the disk, connect it to another system, and possibly read the data.

All disks should be erased or destroyed prior to disposal. The new owner of the system can install Linux herself if she desires. Most competing closed source software is sold via a nontransferable license, so one cannot legally leave it on the disk anyway. This means that you are obligated legally to erase the closed source from the disk. See "Erasing an Entire Disk" on page 169 for techniques for accomplishing this.

---

Top