When you make photocopies of documents, don’t you feel safe doing so? After all, it’s just a copy machine, right? When the job is finished and the documents removed, that’s the end of it, right?
Wrong! Any modern photocopy machine (also called a “multi-function device” or MFD), even the small one on your desk, is really a copier attached to a computer. The reason you can get copies so quickly or make dual-sided copies is that the documents are digitally scanned and stored on a hard drive inside the copier. That stored image is then used to make the copies you actually receive.
So, what’s the big deal? Simply put, the document image remains on the copier’s hard drive after the job is finished. Although the internal computer may erase the file, the digital image remains on the drive. All erasing does is mark the file’s space on the drive as “reusable” so that another file could be recorded in the same space later. The actual digital information remains in place on the hard drive.
The reselling of used photocopiers is a robust market with many units being bought from and shipped overseas. As an April 19, 2010 report on CBS Evening News
demonstrated, when the photocopier is exchanged, the vendor seldom reformats (or “wipes”) the hard drive. The copiers go out with the copied images still on the hard drives. CBS producers bought three used copiers and extracted the hard drive data using digital forensic software freely available on the Internet. Sensitive data from a police department about suspected drug dealers and from a company with detailed personal information was found on these copiers.
The bottom line is that the industry is lagging behind on this issue and that we who use these machines are blissfully unaware of the threat. Your copies of your income tax return will probably still be on the hard drive when the photocopier is replaced. You have reason to be concerned.
Warnings about the potential for data theft were made a long time ago. Software has been available to “wipe” these hard drives, too, but given the price per unit, most companies do not install it. It is more cost efficient for a vendor to just re-package, sell, and ship a used copier than to take the time to wipe each unit’s drive. The security of our documents comes down, sadly, to money.
Response to the CBS report was staggering – over 2,000,000 responses. Since then, Xerox, the number 2 copier manufacturer behind Canon, has markedly stepped up its attention to the problem. Senator Ed Markey (D-MA) has formally requested that the Federal Trade Commission investigate “the retention of documents on the hard drives of digital copy machines…” There are significant potential legal issues for companies, too – violations of HIPAA regulations in health centers, for example. The steps being taken are in the right direction but provide no immediate protection. Unfortunately, we need to make copies. Just be aware that the “document” may not disappear. All any of us can really do is hope for the best.
Jim Aman is a summer resident
on Clearwater Lake and Associate
Professor of Computer Science at
Saint Xavier University in Chicago,
where he focuses on computer
security and digital forensics.
Leave a Reply