Waste Management

One day a couple of years ago, the IT manager of a Seattle company brought a couple of obsolete PCs to locally based RE-PC for recycling. That same day, RE-PC, which buys and resells used IT equipment, took along one of those PCs to show a TV news crew how personal data can be found on used PCs. They unearthed the usual Social Security numbers and other private and business data, said Mark Dabek, RE-PC co-owner. And one other thing: a love letter from the owner of the local company to his mistress. That owner's carelessness was embarrassing, but not necessarily fatal to his company's operations. But for companies that store and access financial, medical and other sensitive information, the careless disposal of data could lead to government scrutiny, heavy fines, even insolvency.

Issues related to the disposal of old IT equipment and of properly destroying the information it contains are starting to come to the forefront, said Jim Stover, partner at ClearNorth Technologies, an Eden Prairie, Minn.-based solution provider. "Customers know they just can't throw old equipment away," he said. "And many have extra equipment they want to get rid of. When upgrading servers, for instance, some can be reallocated. But not everything."

These kinds of concerns spell margin and service opportunities for solution providers that can help customers find environmentally safe ways to dispose of servers, desktop or laptop PCs, or storage devices, along with the data they contain.

Government regulations addressing IT asset disposal will continue to drive this trend. The U.S. Environmental Protection Agency has updated its guidelines regarding the disposal of computer monitors and requires that businesses use due diligence to ensure their IT equipment is disposed of properly.

In recent years, dozens of states have begun legislation to address computer waste. Currently, there are more than 60 pieces of legislation before 40 states dealing with electronic waste, including bills to keep CRTs out of landfills and others to collect money from sales of new equipment to help fund the disposal of old products, said Stampp Corbin, CEO and founder of RetroBox, a Columbus, Ohio-based company that helps solution providers and their customers dispose of IT assets.

In King County, Washington, for instance, local landfills will no longer take circuit boards for disposal starting late this year, said RE-PC's Dabek. In California, meanwhile, the state's Electronic Waste Recycling Act, which went into effect on Jan. 1, forces consumers there to pay a surcharge of up to $10 for every new computer monitor or television to fund a state program to recycle old CRTs.

Also, regulations such as Sarbanes-Oxley and HIPAA are driving a growing interest in how data is destroyed when IT equipment is resold, redeployed or donated. The IT manager of a Midwestern hospital, who preferred not to use his or his company's name, said that until HIPAA came along, what happened to his company's data was never much of a concern. Now, he knows differently. "It's something we'll have to do," he said. "We have to address these issues."

To meet these growing requirements, vendors such as EMC, Hewlett-Packard and IBM already have programs in place to safely dispose of obsolete IT equipment. Last month, distributors Ingram Micro and Tech Data both launched programs to help solution providers in such endeavors.

Unfortunately, solution providers say many businesses are only slowly becoming aware of the importance of destroying company and customer information when equipment becomes obsolete, and of the proper recycling of such equipment. Innovative Systems and Solutions, a Little Falls, N.J.-based solution provider, recently asked a client if it needed help disposing of some old servers. Harlan Blatman, solution specialist, said the customer answered, " 'No thanks.' They said they'll just put it on the street and let anyone take it home," he said. "They said there's no business-sensitive data, but everything business-sensitive is stored on the server. You never know. There could also be personal data in there."

Solution providers looking to tackle such issues are finding help, much of which can add to their margins or give them new customer-service tools.

For instance, when EMC takes back old EMC-branded storage devices for credit on new equipment, it does a one-pass overwrite of data on each hard drive it takes back, said Cynthia Curtis, senior director of services marketing at the Hopkinton, Mass.-based company. "Unless there's criminal intent, that's sufficient for most customers," she said.

For customers with regulatory and compliance concerns, Curtis said EMC also offers customized three-pass, five-pass and seven-pass overwrites at the customer site, and provides a certificate that the data is unreadable. However, the company does not provide indemnification against someone someday being able to read the data. "From a legal standpoint, that's outside our purview," she said.

For non-EMC equipment, EMC passes used IT equipment to third-party companies such as Salem, N.H.-based Mosaic Technology for disposal.

HP works with Duluth, Ga.-based Market Velocity to dispose of old IT equipment for customers and solution providers, said Jackie Anderson, manager of renew and trade-in at Palo Alto, Calif.-based HP.

When HP customers trade in old working equipment as part of a new purchase, Market Velocity will clean up that equipment for resale, giving the customer a credit toward its purchase or for donating to the National Cristina Foundation, which matches donors and charities, said Anderson. Unusable equipment can be recycled for a fee, she said.

For smaller customers, HP offers software tools that compare the various options related to trade-in, donations or recycling fees. Enterprise customers, on the other hand, can get customized trade-in programs.

In such cases, customers are responsible for removing their data, but Market Velocity will double-check whether the data was deleted and whether all of a company's identifying labels were removed. Market Velocity handles indemnification related to ensuring data was properly deleted, she said.