How to Comply with the Law

Hardware Disposal

In 2003 the State passed a regulation that required all magnetic media to be overwritten or 'scrubbed' ten times before being sent to surplus. The goal of this regulation was to ensure that sensitive or personal information stored on magnetic media was unrecoverably erased before entering the State surplus stream. In response to a general lack of compliance with the 2003 regulation, Executive Order 2006-12 was issued earlier this year. EO 2006-12 empowered CMS to implement policies to assure compliance. As a result, CMS stated that it will not accept electronic items at its surplus warehouse unless they are certified by the contracted vendor, which gives the University no option but to use the vendor. The policy to address this regulation has been placed online while awaiting publishing in the Campus Administrative Manual; the standard for implementing this policy can be found at Standard for the Disposal of Digital Media.

Of particular concern is the disposal of obsolete or broken hard drives. University Property Accounting and Reporting has agreed to arrange for the secure disposal of these drives. Drives approved as scrap by University Property Accounting and Reporting should be delivered to their redistribution facility for disposal. Drives to be scrapped do not need to be scrubbed, but they must be removed from the computers that house them prior to delivery.

The practical consequence of the state act and revised policy is that all hard drives sent to surplus or transferred within the University of Illinois must be overwritten a minimum of one time. Further drive scrubbing will then be performed by a state-approved vendor if the drive is sent to surplus. In order to assist network administrators with the task of bringing hard drives into compliance with the state act on Digital Media, CITES, in conjunction with ACCC on the Chicago campus, is making available the following software packages/recommendations:

• Windows: Active Eraser (available from the IT Professionals that support your unit)
• Windows and Linux on Intel: DBAN 1.0.7
• Mac: Apple Disk Utility Secure Erase

These products are provided as-is and without support. Active Eraser has a support section on their web site. In general we recommend using informal channels for product discussion, such as the CCSP mailing list. Questions pertaining to the general issue of disk scrubbing should be directed to securitysupport@uiuc.edu.

Once a drive has been scrubbed, a sticker must be affixed to the computer it is installed in specifying the disposition of the drive in question.

Labels

You can make your own labels to place on the surplus/scrapped machine by downloading the following file and printing it onto Avery label paper.

Avery 5160 (30 labels/sheet, 1" x 2 5/8")

Downloading the Software (restricted to technical staff)

IT Professional staff can access tools for overwriting drives here. Other staff should contact their local IT Professional support staff for assistance with disposal of digital media.

A short FAQ has been created that tries to anticipate some of the basic questions pertaining to disk scrubbing. Please feel free to contact us at securitysupport@uiuc.edu with additional questions or suggestions. We recognize that in an environment as diverse as the UIUC campus there will be issues that were overlooked or inadequately addressed while developing disk scrubbing guidelines. We welcome your bringing these to our attention.