Dump old gear without leaking company secrets

Getting rid of obsolete IT gear isn’t as simple as it used to be. The threat of data loss, coupled with increasingly stringent environmental regulations, has IT pros rethinking their disposal methods.

“In the past, electronic equipment disposal was more of an asset-accounting issue, handled by the financial group. Now we track computing equipment from cradle to grave, recording the final disposition and using checklists to assure that data was appropriately removed," says James Kritcher, vice president of IT at White Electronic Designs in Phoenix.

It’s about time, analysts say. According to research from IDC, Gartner and the National Safety Council, about 1 billion computers will become potential scrap between now and 2010, and 150 million obsolete PCs are currently sitting in warehouses, storerooms and closets.

“I have yet to visit an end-user IT organization without the infamous IT closet full of aging equipment that probably holds critical data. But removing that data is still not seen as a pressing business issue," says Joe Pucciarelli, a research director at IDC. “Anyone relying on ignorance of the threat as a business strategy will be unpleasantly surprised."

It’s entirely possible that someone could salvage and steal data from computing equipment that is improperly disposed, Pucciarelli says. “Five or 10 years ago the risk might not have been as high, and network executives certainly weren’t aware of it," he says. “Today a company could be considered negligent if it isn’t aware of the risk of old equipment becoming compromised. The bad guys will figure out how to get through the holes and compromise corporate data."

If that happens, companies stand to lose millions. A 2006 study by the Ponemon Institute found data breaches cost companies an average of $182 per compromised record, a 31% increase over 2005. According to the Privacy Rights Clearinghouse, more than 330 data loss incidents involving more than 93 million individual records have occurred since February 2005.