Purpose

To determine if those electronic devices approved for sale as surplus equipment by the Department of Agriculture and Markets (Department) through the Office of General Services (OGS) are permanently cleaned of all data, including personal, private and sensitive information. The audit covers the period of June 1, 2012 through November 9, 2012.

Background

Office of Cyber Security Policy requires all State entities to establish formal procedures to address the risk that personal, private or sensitive information may be improperly disclosed. This policy also requires that all laptops containing, or with access to, State information must be encrypted. One way information can be compromised is through careless disposal of electronic devices. Agencies may dispose of electronic devices on their own; however, OGS' Surplus Unit provides this service for many State agencies. At the time of our audit, the Department had 132 electronic devices (laptops, desktop computers, tablets, cameras, cell phones, and a printer) ready for disposal through OGS' Surplus Unit. Agencies are required to remove all information prior to disposal and, if sending them to OGS, to certify in writing that the devices no longer contain any retrievable information. OGS' Surplus Unit does not accept any responsibility for clearing the data from these devices.

Key Findings

• Fifteen of the 132 electronic devices readied for surplus still contained data, even though the Department had certified that all memory devices had been removed.
• One of the hard drives contained personal, private and sensitive information related to an employee who had previously been assigned the computer, including the person's name, social security number, date of birth and certain health-related data.
• The printer hard drive and cameras also contained retrievable data, and the cell phones had not been programmed back to their original manufacturer settings.

Key Recommendation

• Reinforce policies and procedures to ensure that all hard drives are removed from electronic devices and properly disposed of prior to authorizing the equipment for surplus.

Other Related Audits/Reports of Interest

Office of General Services: Disposal of Electronic Devices (2012-S-4)
Office for the Aging: Disposal of Electronic Devices (2012-S-39)