German Ministry of Education Throws Away PCs For 190,000 € Due To Infection
it.slashdot.org
it.slashdot.org
The only good thing about this that federal auditing by the Landesrechnungshof seems to work, since they complained about it in their yearly report in the first place and it got only picked up by the press after that.
http://www.lrh-mv.de/land-mv/LRH_prod/LRH/Veroeffentlichunge... (german pdf, page 152)
Still wish they would've donated the PCs instead of throwing them away.
(On the other hand, if you're in IT there - very cheap computers! They usually trust their own personnel to be responsible and wipe everything properly/not look for anything before use. )
While it's sad I can understand where they're coming from.
I oversaw the hard drive removal, if you can't be trusted to be sure that you have removed the drives from those pc's before sending them to the recycler how can you be sure that you've done a proper job before sending them in to be scrapped? It's the exact same problem after all.
Its just weird for me because if you pay someone to recycle computers they do exactly that which means they get money from you and the scrap people for essentially just taking things apart (which is kinda fun right?).
Regardless of whether it's possible to get some pocket change for old pc's, the point is: it's not cost effective, when you count the hourly salary of a professional, to do anything more than the absolute minimum to dispose of old computers. Especially for a government organization - bureaucracies are not designed for cost-effectiveness, but for predictability and accountability. That is not a value judgement, just an observation, but one that immediately dispels of 50% of whining about 'governments wasting money'.
But with modern drives you are not getting at the physical layout. The drive may detect an error and remap surrounding data for you. Consequently, some data surrounding some badblock(s) in the past will potentially never be overwritten by your process. Someone with separate hardware or an alternate firmware could always retrieve it.
I guess the right solution would be to store your data only in encrypted form on your drive. Then you will only have to worry about safely deleting the key.
The only way to tell the drive to erase everything is to send the ATA Secure Erase command. This tells the controller to wipe the drive in a secure way. It is the only NIST-approved way to securely erase a drive. Lots of info from this discussion http://security.stackexchange.com/questions/5749/how-can-i-r...
Sometimes the best thing to do is just give them to IT staff for training, if you can afford to pay someone to do it, put them on ebay or failing that throw them out.
german source: http://www.heise.de/newsticker/meldung/Schwerin-Virus-verseu...