Seems stupid to me; why are they wasting PCBs - can you recover any data from anywhere other than the platters?
Surely one very powerful magnet would render it useless anyway?
Surely one very powerful magnet would render it useless anyway?
Guidelines for media destruction vary based on sensitivity of the information and the risks associated with its disclosure. There are two basic categories of information, private interest and national interest, and various levels within the categories.
Private interest refers to individuals, businesses, etc., that is, anything that isn't "in the national interest". National interest refers to anything that could seriously impact the country and its interests, its overall security, etc. The classic examples are intelligence and military operations. Others include government plans that have yet to be made public, e.g., cabinet confidences in the UK and Canada, etc. There is a debate as to whether certain types of economic information, even if private, should be considered national interest, because the impact of disclosure could be recession, depression, or complete collapse, which would seriously impact national interest.
Many jurisdictions use the term "Classified" to refer to information related to the national interest; Confidential, Secret, Top Secret, and Cosmic are some common western/NATO terms for various levels of classified information.
Labels for private interests vary; for example, Canada uses "Protected A" for information about an individual that could lead to minor, recoverable harm (think a slap upside the head - it hurts, you might need ice, but it doesn't really impact you), "Protected B" for moderate harm that is difficult to recover from (think a broken arm - you will need medical attention, your life is impacted, possibly seriously, but you will recover), and "Protected C" for serious or grave harm (think being shot - you're done).
Degaussing is often considered sufficient for "Protected A" and "Protected B" type information - but there are debates as to quantity: While aggregating doesn't change the label (10,000 Protected B records are still Protected B), it can increase the harm (compromise of 100,000,000 Protected B records might seriously harm the nation, e.g.).
Degaussing is not considered enough for "Protected C" information and for Classified information: The degaussing may be imperfect, there may "edge effects", etc. We just don't know - and we assume our adversary isn't as ignorant as we.
So we destroy the media, utterly, so that it cannot be recovered.
That's what was happening here. Use of grinders is pretty standard practice.
Yes, this information had all been revealed. As far as we know. Seems pretty pointless, doesn't it?
It is? I thought everyone used giant shredders.
The UK government publishes the tables that it uses to assess business impact over at http://www.cesg.gov.uk/publications/Documents/business_impac... and you can read more about the wider information security concepts at https://www.gov.uk/service-manual/making-software/informatio...
Unfortunately, IS5, the document that describes secure sanitisation of sensitive materials is not available to the public, so we don't know what guidelines the officials were working to here.
You can assume that the least risky process for all parties is to be witness to the destruction of the physical media, giving both sides confidence that the materials were actually destroyed.
They ended up destroying every single part of the computer -- perhaps they spared the keyboard or the display, but that's not likely since they could argue that a storage device could be hidden in there.
Looking just at spining platter drives:
We know that there are no software tos that claim to recover data that has been over written just once.
We know that no companies exist that claim To be able to recover data that has been over written just once.
There are no University projects claiming that either. (There are some obscure projects using onsolete technology that had very low sucess rate for bits).
We don't think any well funded forensic units have had sucess recovering such data.
So, for most people doing a single overwrite of random data is fine.
But some other people need peace of mind, and for those people grinding the drives is easy.
Edit: A high-frequency AC magnetic field (degausser) would have a better chance. https://en.wikipedia.org/wiki/Degaussing
UK Ministry of Defence as well as the Security Services have a policy of drilling hard drives if a machine is leaving their control.
I heard a story, which I think came from Dell, who had a machine sent to them from the MOD because it had intermittent trouble booting. Standard practice was that the drives were drilled before the server was sent to Dell in Ireland. When the engineers tried to boot the server it of course wouldn't boot. When they pulled out the drives they were drilled. Report was inconclusive.
Thus the Guardian's were quasi-mimicking the MOD. I.e. taking the piss.