“Interested in selling tape? We buy used tape and offer top cash for all types of tapes, cartridges, reel tape or whatever type of magnetic media you use.”
Such pitches are everywhere on the Internet and ever so tempting. You’re looking to upgrade to new storage tapes or disks and figure you might try to defray costs by getting a few bucks back for your old tapes. But those who have bought or sold used tapes warn that doing so can put your confidential data at risk.
Dan Nutter, vice president of distributed storage at KeyBank in Cleveland, found this out firsthand.
Nutter says KeyBank was left with 8,500 old tapes containing customer financial information following a $500,000 media upgrade. The organization considered rewriting over the tapes, but Nutter says that would have taken as long as an hour per tape. So he turned to a reseller to take the tapes off his hands.
The reseller brought in a bulky gadget called a degausser – essentially a super-sized, super-charged magnet in a stainless steel box, to de-magnify the tapes and then resell them.
“We plugged the degaussed tapes back into our library and were still able to read the label on the cartridge, so we degaussed them again and put them back in the library and we were still able to read them,” Nutter says.
The reseller returned with a more powerful degausser, which also failed to erase the tapes.
“We told them to have a nice day and we would find a way to get them burned,” Nutter says.
Imation, as a maker of tapes, isn’t shy spreading the word about what it sees as a sketchy resale market. The company says it bought linear-tape-open tapes from a reseller to find out if stories it had heard about shady tape resellers were true: that these companies were reselling tapes that hadn’t been scrubbed clean, even though they were certified to be so.
“When we put them in a tape drive, we found customer data on three of four cartridges,” says Tim Bjork, marketing manager for enterprise tape at Imation. “We took some of the data, found readable words, plugged them into a Google search and were able to link back to the company that sold the tapes in the first place.
“Organizations need to understand that if they sell their tapes they are putting their corporate assets at risk,” he says.
Jeff Brown is sales manager for We Buy Used Tape, which buys and resells tapes. He says it is unfair to characterize all tape resellers as corner cutters, though agrees that customers need to be careful.
“It’s a market where people try to buy tape and get it erased in the cheapest manner,” he says.
One reason why some resellers don’t erase the tapes or do so only partially is that degaussers can leave some tapes unusable, Imation’s Bjork says. Certain tapes feature servo patterns – bytes of data written to the tape by manufacturers to align the tape to the tape drive – that degaussers can’t erase without ruining the tapes, he says.
Dave Federspiel, sales manager for degausser firm Data Security, says some companies buy degaussers designed to erase video tapes, not computer tapes.
“They tell everyone that they can use these same degaussers for erasing computer tapes,” he says. “[But] they just don’t erase tapes completely.”
The issue of unsafe tape handling has grabbed plenty of headlines this year, mainly because of incidents in which companies lost or improperly disposed of tapes that contained sensitive customer data. In May, for example, Time Warner said its offsite storage partner, Iron Mountain, lost 40 back-up tapes containing the names and Social Security numbers of 600,000 former and current employees.
“After seeing all the ways data can get loose when you dispose of tape, I only shred tape and get a certificate of destruction,” says Hal Weiss, IS systems engineer for Baptist Memorial Healthcare in Memphis, Tenn. “That’s the only way to guarantee your customer data doesn’t get out and compromise your business.”
When it comes to scrubbing tapes, many companies have adopted Department of Defense regulations. Regulation 5220.22-M stipulates that tape should be sanitized using a degausser or destroyed by incineration.
Data Security’s Federspiel says customers need to pay attention to their media’s coercivity factor, which measures how tightly the bits of data are bound to the magnetic media. He suggests following National Security Agency guidelines for media destruction, which include recommendations for which level of degausser to use for certain media.
He warns that incineration is more involved. “The challenge of incineration is that the byproduct of burning a tape is the thick black smoke and the release of a cyanide gas,” he says. “The Environmental Protection Agency frowns on that.”
All of which has encouraged some to consider extreme methods. Take, for example, this suggestion from the book Unix & Internet Security by Gene Spafford and Simson Garfinkel: Run your tape “through a band saw several times to reduce it to thousands of tiny pieces of plastic.”
