Skip Navigation

Unveiling Soon: The Largest Second Hand Electronic Device Study

Bookmark and Share

January 25, 2017 

NAID has long included research among the tools it uses to educate consumer and policy makers. In fact, over the years, research has contributed to the association’s regulatory advocacy and standards development, and added significantly to the association’s credibility. In continuation of that tradition, NAID is currently conducting the largest known forensic examination of second hand memory devices, the results of which to be unveiled at the upcoming annual conference.
According to NAID CEO Bob Johnson, this is the type of research that sets NAID apart. “There’s no shortage of conferences, magazines, and certifications looking for support,” says Johnson. “To my knowledge, however, NAID is the only one with a rich history of reinvesting that economic support back into research to advance and promote secure data destruction.”
This study is commissioned by NAID but being conducted by a third party to ensure the reliability and integrity of the results. While there will be no public shaming of organizations (the results will be aggregated), the specific findings will be offered to regulators should they wish to investigate further.
Over the past 20 years there have been periodic studies of used hard drives purchased on the secondhand market. The first known study was conducted between 2000 and 2003, when a team lead by Dr. Simson Garfinkel purchased 158 used hard drives from a number of random sources, which were then subjected to forensic analysis. The results of the study, published in the IEEE Security & Privacy that same year under the title Remembrance of Data Passed, demonstrated that a significant percent of these randomly selected secondhand hard drives contained personal information. As startling as that result was, so was the discovery that the some of the hard drives on which personal information was found had previously been deployed in government, banking, and healthcare, all of which have regulations protecting their associated data. Furthermore, and similarly problematic, many of the hard drives containing personal information showed evidence that someone had attempted to overwrite them. This suggested that the previous owner believed they wiped the drives but had not in actuality. 
Canadian‐based CHEO Research Institute conducted a similar study in 2007, NAID replicated the study in Australia in 2013, and Blancco Technology Group released a similar study in 2016, all with similar results. In each, regulated or competitive information was discovered on a significant percentage of the hard drives. 
The current 2017 NAID second hand device study examines 250 units, including conventional hard drives as well as solid state drives. Among other past NAID research are disposal practice studies conducted in Canada, Spain and the UK, as well as consumer attitudes research in the US and Europe.
We feel it is important for NAID members to know the types of initiatives the association dedicates its focus toward. The full results of the current study will be released during the conference at NAID 2017, along with a number of other unveilings, including the first edition of the Information Disposition textbook. 
All information destruction professionals are encouraged to attend and be a part of this ground breaking event.