Policy on Disposal/Recycling of Computers

Policy on Disposal and Recycling of Old Computers

CONTENTS

1. University Policy for Computer Disposal
2. Importance of Data Removal
3. Means of Disposal
4. Deleting Data - Technical Aspects

1. University Policy for Computer Disposal

The University policy for disposal of equipment that is surplus to the requirements of the unit that originally purchased it is as follows:

a. Reasonable efforts should be made to see if any other unit within the University is able to make use of the equipment.

b. Equipment that has residual value may be sold, either to University members or to outside bodies, subject to the University's financial guidelines (see http://www.finserv.uwa.edu.au/page/19487).

c. Attention should be given to what to do about indelible asset labelling which may have been applied to the computer.

d. Where equipment has limited resale value, consideration should be given to whether it can be donated to any charitable or community project .

e. If the equipment cannot be reused, then it should be recycled or disposed of in an environmentally-friendly manner.

f. All sensitive data held on such computers must be irrevocably erased (see below) before disposal; consideration should be given to doing this even if disposal is within the University.

g. These requirements apply to all computers (PCs, Macintoshes, Unix computers, etc), as well as to other items of computer equipment (eg printers, scanners).

h. Note that all computer media (disks, tapes, CD-ROMs, etc) should also be disposed of properly, in accordance with the strictures on data contained within this Policy.

2. Importance of Data Removal

An overriding consideration in any move of equipment must be to ensure that any sensitive or confidential University data on the machine, and any software licensed to the University, is removed. It is, of course, vital to satisfy the requirements of the Privacy Act, but it must also be understood that any University data that is discovered by a later owner may cause controversy, adverse publicity, etc.

Ensuring adequate destruction of data is the responsibility of the unit that owns the equipment, and must not be delegated to any person outside the University without adequate contractual obligations being imposed.

Where a disk drive or similar device which is not in working order is to be disposed of, whether incorporated within a computer or not, then data on it must still be erased (eg by adequately exposing it to a powerful magnetic field – ITS will give consideration to the acquisition of a suitable
device should the level of demand warrant it).

3. Means of Disposal

The following mechanisms are required:

• Where machines are to be given to charities, schools, etc, then it is necessary that someone within the University who is interested in the particular good cause should volunteer to take charge of the process, and act as the University’s agent in ensuring that the proper steps are taken.
• If a unit is handling this privately, eg giving a few machines to a school or selling one to a member of staff, then basically the same procedures should be followed.
• Where equipment is to be scrapped, units should make suitable arrangements with outside contractors, and must ensure that the destruction of data is contractually ensured, and that disposal takes place in an environmentally-friendly fashion (eg proper attention is given to dangerous components, etc).
• In all respects, observe the University’s policies and guidelines for waste management and recycling (see http://www.ofm.uwa.edu.au/ops/enviro/contents.htm).

4. Deleting Data: Technical Aspects

Before disposing of any computer system, it is vital to remove all traces of sensitive data files (since identification may be difficult, it is normally far better to remove all data).

Merely deleting the visible files is not sufficient to achieve this, since data recovery software could be used by a new owner to “undelete” such files. The disk-space previously used by deleted files needs to be overwritten with new, meaningless data – either some fixed pattern (eg binary zeroes) or random data. Similarly, even reformatting the whole hard disk may not in itself prevent the recovery of old data as it is sometimes possible for disks to be “unformatted”.

The most well-known tool for fully wiping old data files is the “Wipe Info” module of the Norton Utilities suite for PC and Macintosh systems (available from Winthrop Australia http://www.winaust.com.au/). This will completely wipe the contents of any specified files, or the whole of the free space on the disk. However, this approach still assumes that you have located every file that needs to be taken care of, which may not always be easy.

A better approach is to reformat the hard disk, installing a clean copy of the original operating system, and then run Wipe Info on the free space. This should leave a machine in a suitable state for disposal. Older versions of Norton Utilities included a utility called “WipeDisk” which could fully wipe the entire hard disk on a PC booted-up from a floppy disk. Other utilities of this type are available such as Sanitizer (http://www.pinionsoftware.com/Products/Sanitizer.php ).

Virtually every PC is bought with a licence for the operating system supplied with it. A machine can therefore normally be legitimately disposed of with a freshly installed copy of the same system. However, you should not install a later copy of the system software.

[This policy is based on that adopted by Oxford University on 27-Nov-00, and prepared by Alan Gay (Deputy Director, OUCS), to whom grateful acknowledgement is given; it is used with permission]