Waste Management

Issues related to the disposal of old IT equipment and of properly destroying the information it contains are starting to come to the forefront, said Jim Stover, partner at ClearNorth Technologies, an Eden Prairie, Minn.-based solution provider. "Customers know they just can't throw old equipment away," he said. "And many have extra equipment they want to get rid of. When upgrading servers, for instance, some can be reallocated. But not everything."

These kinds of concerns spell margin and service opportunities for solution providers that can help customers find environmentally safe ways to dispose of servers, desktop or laptop PCs, or storage devices, along with the data they contain.

Government regulations addressing IT asset disposal will continue to drive this trend. The U.S. Environmental Protection Agency has updated its guidelines regarding the disposal of computer monitors and requires that businesses use due diligence to ensure their IT equipment is disposed of properly.

In recent years, dozens of states have begun legislation to address computer waste. Currently, there are more than 60 pieces of legislation before 40 states dealing with electronic waste, including bills to keep CRTs out of landfills and others to collect money from sales of new equipment to help fund the disposal of old products, said Stampp Corbin, CEO and founder of RetroBox, a Columbus, Ohio-based company that helps solution providers and their customers dispose of IT assets.

In King County, Washington, for instance, local landfills will no longer take circuit boards for disposal starting late this year, said RE-PC's Dabek. In California, meanwhile, the state's Electronic Waste Recycling Act, which went into effect on Jan. 1, forces consumers there to pay a surcharge of up to $10 for every new computer monitor or television to fund a state program to recycle old CRTs.

Also, regulations such as Sarbanes-Oxley and HIPAA are driving a growing interest in how data is destroyed when IT equipment is resold, redeployed or donated. The IT manager of a Midwestern hospital, who preferred not to use his or his company's name, said that until HIPAA came along, what happened to his company's data was never much of a concern. Now, he knows differently. "It's something we'll have to do," he said. "We have to address these issues."

To meet these growing requirements, vendors such as EMC, Hewlett-Packard and IBM already have programs in place to safely dispose of obsolete IT equipment. Last month, distributors Ingram Micro and Tech Data both launched programs to help solution providers in such endeavors.

Unfortunately, solution providers say many businesses are only slowly becoming aware of the importance of destroying company and customer information when equipment becomes obsolete, and of the proper recycling of such equipment. Innovative Systems and Solutions, a Little Falls, N.J.-based solution provider, recently asked a client if it needed help disposing of some old servers. Harlan Blatman, solution specialist, said the customer answered, " 'No thanks.' They said they'll just put it on the street and let anyone take it home," he said. "They said there's no business-sensitive data, but everything business-sensitive is stored on the server. You never know. There could also be personal data in there."

Solution providers looking to tackle such issues are finding help, much of which can add to their margins or give them new customer-service tools.

For instance, when EMC takes back old EMC-branded storage devices for credit on new equipment, it does a one-pass overwrite of data on each hard drive it takes back, said Cynthia Curtis, senior director of services marketing at the Hopkinton, Mass.-based company. "Unless there's criminal intent, that's sufficient for most customers," she said.

For customers with regulatory and compliance concerns, Curtis said EMC also offers customized three-pass, five-pass and seven-pass overwrites at the customer site, and provides a certificate that the data is unreadable. However, the company does not provide indemnification against someone someday being able to read the data. "From a legal standpoint, that's outside our purview," she said.

For non-EMC equipment, EMC passes used IT equipment to third-party companies such as Salem, N.H.-based Mosaic Technology for disposal.

HP works with Duluth, Ga.-based Market Velocity to dispose of old IT equipment for customers and solution providers, said Jackie Anderson, manager of renew and trade-in at Palo Alto, Calif.-based HP.

When HP customers trade in old working equipment as part of a new purchase, Market Velocity will clean up that equipment for resale, giving the customer a credit toward its purchase or for donating to the National Cristina Foundation, which matches donors and charities, said Anderson. Unusable equipment can be recycled for a fee, she said.

For smaller customers, HP offers software tools that compare the various options related to trade-in, donations or recycling fees. Enterprise customers, on the other hand, can get customized trade-in programs.

In such cases, customers are responsible for removing their data, but Market Velocity will double-check whether the data was deleted and whether all of a company's identifying labels were removed. Market Velocity handles indemnification related to ensuring data was properly deleted, she said.

HP encourages solution providers to work with customers on handling old equipment trade-ins, said Anderson. In such a case, the vendor sends a check for the value of the products once the customer is satisfied with audits on how the data was destroyed.

IBM, Armonk, N.Y., also offers a program under which its global financing arm will pay cash for old equipment, or will provide free pickup and disposition of 25 or more working units as part of a trade-in. Customers can also pay for IBM to provide a Department of Defense-compliant three-pass wipe of data, or a customized wipe, depending on data value, according to company executives.

Advanced Systems Group, an Irvine, Calif.-based IBM solution provider, either uses IBM to handle obsolete equipment or works with local brokers, said Kari Simmerman, contract manager at the company.

Brokers have been the traditional route Advanced Systems Group has offered its customers, said Simmerman. "But now I'm leaning to get us to work more with IBM, which guarantees that data was stripped," she said. "But brokers offer better margins. They do their best to dispose of old data, but there are stories of problems with some brokers."

For Advanced Systems Group, handling old equipment is a customer service and not an income generator. Simmerman said the company either applies what brokers pay for the old products to the customer's deals, or it may keep a little in-house to cover administration costs. "But our focus is really on selling new equipment," she said.

A couple of top distributors have recently started bringing in third-party IT asset disposal companies to work with their solution providers.

Ingram Micro in early April started Ingram Micro Outlet, an IT refurbishment and disposition offering for solution providers looking to help customers handle unwanted IT equipment, said Justin Crotty, the Santa Ana, Calif.-based distributor's vice president of channel marketing for North America.

If old IT equipment has resale value, disposal firms DealTree or Intechra will purchase the items for refurbishment and will pay the solution provider for the market value of the products via a credit against future purchases from Ingram Micro, said Crotty. The distributor also has other partners that accept products with no resale value and dispose of them in an environmentally friendly fashion, he said.

Solution providers whose customers are looking to dispose of fewer than 50 items under the Ingram Micro Outlet program are sent to Intechra, where they will find online tools that automatically determine the value of most used equipment, said Kevin Dooley, senior vice president of business development at the Carrollton, Texas-based disposal firm. Some items may require manual quotes, he said.

Once the products, which could include monitors, desktops, laptops, communications, IP equipment and storage, are received by Intechra and their condition confirmed, Intechra arranges for a credit for the value to be sent to the solution provider, which can keep it or apply it to a customer's order, Dooley said.

Intechra then wipes the data using Department of Defense-standard wiping routines. Some products are then resold through Ingram Micro Outlet, some go to Intechra's other channels, and the rest are destroyed with an eye toward environmental concerns, he said.

Solution providers whose customers have more than 50 items to sell are sent to DealTree, which operates in a similar fashion. DealTree, Lake Forest, Calif., handles a wider variety of equipment, including gaming systems, cell phones, audio equipment, LCD monitors and MP3 players, said Paul Fletcher, president and co-founder.

Once DealTree acquires the products, it uses third-party, Department of Defense-compliant software to clean the data, and then resells the products in outlets such as Ebay. "One person's junk is another person's gold," Fletcher said.

For products with no resale value, including all CRT monitors, DealTree will accept them from customers who pay the pass-through costs of sending them to Irvine-based eWaste for recycling, said Fletcher.

DealTree also offers a similar program via distributor Synnex, Fremont, Calif.

In April, Clearwater, Fla.-based Tech Data began offering an IT asset disposal program to its TechSelect solution providers using RetroBox, said Annette Taber, sales director for TechSelect. The RetroBox program is offered to TechSelect members at a 15 percent discount and may eventually be opened to non-TechSelect members, she said.

RetroBox's Corbin said his company's business has on the average doubled annually for the past eight years and is on track to do so again this year. For solution providers that require IT asset disposal, RetroBox offers Department of Defense-certified information wiping services. The company also helps solution providers and their customers by providing outlets for their old equipment, such as internal redeploys, discounted sales to employees, and external sales through the RetroBox Web site, said Corbin. Products that have no resale value are recycled.

In addition to working with TechSelect members, RetroBox just launched a partner program to offer solution providers a turnkey solution to IT asset disposal, Corbin said. "We manage the whole program, and give the resellers a check—real money they can decide what to do with. Resellers can also mark up the service," he said.

RetroBox indemnifies customers against the risk of data not being completely wiped out. "We have an environmental compliance manager whose whole role is to understand the entire downstream process," said Corbin. "That manager can indemnify our clients from disposal risks. We've never had a problem so far. But I'm going to knock on wood."

While most IT asset disposal programs use three-swipe Department of Defense-certified methods or even programs with up to 10 swipes to ensure no data escapes on used hard drives, not everyone thinks that is enough. The National Association of Information Destruction (NAID) is not convinced that any data wiping software can truly guarantee data destruction. "A computer with a wiped hard drive looks the same as a computer with an unwiped drive," said Bob Johnson, NAID executive director.

As far as the Department of Defense-certified wiping process, Johnson said that the department uses it for unclassified information, but for classified data the only solution is to physically destroy the hard drive in such a way that the maximum particle size is only five-eighths of an inch.

"We know that banks, hospitals and so on will resell computers," Johnson said. "But we feel they need to know who is wiping their data, how they are doing it. We come down on the side of caution and say that physical destruction is best."