Ed Felten points to an op ed piece in CSO magazine by Simson Garfinkel that demonstrates, yet again, how careless we are in our use of computers.

"A FEW YEARS AGO, when
I was in Silicon Valley with
nothing to do, I stopped by
one of the valley's famed
stores that sell used and
"recycled" computers...

...But the real treasure trove that day wasn't on the store's display shelves; it was in the
warehouse. The cavernous space out back had several shelves stacked high with old hard
drives, each $5, "as is and untested," according to the sign...

...I bought 20 of them.

I took the drives home and started my own forensic analysis. Several of the drives had
source code from high-tech companies. One drive had a confidential memorandum
describing a biotech project; another had internal spreadsheets belonging to an
international shipping company.

Since then, I have repeatedly indulged my habit for procuring and then analyzing
secondhand hard drives. I bought recycled drives in Bellevue, Wash., that had internal
Microsoft e-mail (somebody who was working from home, apparently). Drives that I
found at an MIT swap meet had financial information on them from a Boston-area
investment firm. Last summer, I started buying drives en masse on eBay.

In all, I bought and analyzed the content of more than 150 drives with the help of Abhi
Shelat, another graduate student at MIT's Laboratory for Computer Science. We found
that between one-third and one-half of the drives still had significant amounts of
confidential data, even though many had been through a Format or FDisk operation. On
another third, someone had deleted the document files but left the applications behind. It
was a simple matter to undelete the data files and retrieve their secrets as well.

In fact, only 10 percent of the drives I purchased had been properly sanitized.

Much of the data we found was truly shocking. One of the drives once lived in an ATM. It
contained a year's worth of financial transactions—including account numbers and
withdrawal amounts—from a organization that had a legal requirement to not divulge such
information. Two other drives contained more than 5,000 credit card numbers—it looked
as if one had been inside a cash register. Another had e-mail and personal financial
records of a 45-year-old fellow in Georgia. The man is divorced, paying child support and
dating a woman he met in Savannah. And, oh yeah, he's really into pornography...

...Perhaps the saddest observation in our story is that erasing information from hard drives is
not difficult—with a little bit of Web searching, we found more than 50 programs that
purport to clean your hard drive so that the information on it cannot be recovered using
even the most advanced technical means...

...One key reason for today's poor disk sanitization practices is that it's very difficult to tell
the difference between a disk that has been properly sanitized and one that's simply been
reformatted...

...Another reason, we suspect, is that most people don't appreciate
the risk—the used-computer market is literally awash with
personal information from businesses and individuals, yet there
are relatively few cases of that information being used for
nefarious purposes."

ON the latter, it's only a matter of time. Garfinkel concludes:

"In the end, preventive technology is a better solution to the sanitization problem. If you use an encrypted file system, you can sanitize a disk simply by erasing the key. I'd like to see that sort of technology built in to hard drives. Or better, perhaps someday soon, all disk drives will come with a self-destruct feature—just like Star Trek's Enterprise did!"