This article originally appeared in the Summer 2018 issue of E-Scrap News. Subscribe today for access to all print content.
As the electronics recovery industry has evolved, processors have realized the opportunities that arise if they can do more than just take in material for recycling or reuse. With so many skilled companies now in the sector, savvy players are staying ahead of the competition by offering tailored services to generators of end-of-life electronics.
In short, growth in e-scrap today is being fueled by custom solutions as much as it is by commodity sales.
For a telling example of what is demanded to keep pace in the client-service space, we can look to a project recently undertaken by Advanced Technology Recycling (ATR), which operates multiple U.S. facilities and specializes in providing sales and services in the realm of IT asset disposition (ITAD). [Editor’s note: the authors of this article work for ATR.]
A financial institution approached ATR with a significant operational challenge: destroy thousands of hard drives containing sensitive information at multiple client locations, all in a very tight time frame. Accomplishing this task took logistics expertise, proven systems for remote data management, strong communication with the client, and, of course, talented personnel across the board.
This is the story of how the project played out.
HDD vestiges of the financial crisis
The large financial institution that was the client in this case had a lot of data-bearing hard disk drives (HDDs) on hand, but moving them into the recycling/reuse stream was not as simple as calling on a vendor to come provide collection.
Back in 2007, as banks were failing all across the country, solvent financial firms were asked by the Federal Deposit Insurance Corp. (FDIC) to step in and assume the responsibilities of the institutions on their way out. ATR’s client was able to assume the load of some failing organizations, and as part of that process, the client needed to preserve information from the out-of-business banks in order to remain compliant with all FDIC regulations and guidelines. The electronics taken on in the process were added to the institution’s already-growing number of devices being managed.
To conserve precious vault space and recover value on the newer equipment, HDDs were removed from remarket equipment and stored. This allowed the institution to keep information secure while still realizing recovery revenue from the laptops, desktops, servers and other data-bearing devices the institution had on hand.
Over time, drives began piling up in the client’s secure storage areas across the country, and the need for destruction became paramount. Liability was a primary concern, but there were also a number of other critical considerations, including overall project cost, reconciliation of existing inventories, and visual verification and documentation of each device being destroyed (such documentation also needed to be able to be easily retrieved for up to 10 years).
After considerable deliberations, the client determined the data-bearing devices would need to be destroyed at their facilities to minimize risk, despite the fact that doing so would come at a higher cost than utilizing secure shredding facilities run by an e-scrap processor.
Leveraging investment in remote shredding
By the time ATR was brought on to help coordinate the effort, the institution had over 6,000 drives needing attention. Our company first helped define a “statement of work” and outline a methodology the customer could use to manage secure destruction of sensitive assets going forward.
It was decided the hard drives would be consolidated from 25 sites down to 10 different client locations across the country. Major determining factors in selecting consolidation sites included geographic location, space and ability to work without impacting the client’s normal business activity. Other important considerations were the number of drives already located in a particular facility and the hours of operations at each proposed site.
The ATR logistics team soon went to work moving personnel and remote-shredding machines into place. This step was made easier by the fact that our company had long since moved to more effectively handle data and device destruction at client-operated sites.
Approximately five years ago, ATR invested in a mobile fleet of smaller shredders capable of being run on 110-volt outlets, specifically so that we could handle this type of opportunity. In most cases, ATR delivers and loans shredders to clients for smaller destruction jobs. The equipment is usually provided free of charge, with just a small per-drive fee to cover wear and tear on the shredder. This flexibility allows the client to control 100 percent of the activity and security of the devices being managed.
But in this case study, the sheer number of drives was too high to make a self-destruction strategy viable. That meant ATR and the client would need to work together to verify drive serial numbers and make sure it was clear to all parties involved what data was destroyed when. This was far from a straightforward task.
The complexity of keeping track of assets
As is common in many IT departments, record-keeping on the part of this client was not perfect.
The institution handed ATR a list of all the serial numbers of drives that were thought to be in storage, but it was common for discrepancies to exist between what was on the list and what was actually in storage. Some drives had been removed (without formal notation) for data retrieval or to be reused internally to restore another machine. This reality meant it was extremely important for ATR to accurately account for every drive it handled and to be transparent in all data-collection activities so the client would feel confident in the process.
Each HDD asset was checked in by serial number using portable bar code scanning technology, and each drive number was also checked against an extensive device list that had been manually prepared by the client. The use of hand-held computers with built-in scanners helped eliminate any potential for user errors on data entry (such typographical miscues are what cause a large portion of data accuracy issues that occur in these types of projects).
The information was stored on the hand-held device and transmitted to the ATR database upon the completion of the work at each location each day. ATR does have the capability to upload such data in real-time, using either the client’s internet or cellular technology, but more often than not, gaining access to the client’s network or a usable cellular signal can be challenging.
The process of scanning each device allowed ATR to provide the client a spreadsheet list of each hard drive at any point during the processes, allowing an additional level of scrutiny when it came to the data and accountability. The customer was able to monitor the entire project using ATR’s web portal, which is compliant to Federal Information Processing Standard (FIPS) 140-2.
Once all the serial numbers at a given site were recorded and verified, the physical destruction portion of the project got underway. All shredded material was responsibly handled, with precious metals from circuit boards and ferrous and non-ferrous metals from casings destined for commodity recovery. The rare earth magnet material, meanwhile, was sent to the reuse stream.
The entire process was captured on the client’s video surveillance systems for added security.
Providing 100 percent accuracy
Ultimately, the strategy paid off for both ATR and the client.
The ATR team cataloged, tested and repurposed the equipment that had value and destroyed the remaining assets in an environmentally safe and sustainable process on-site, all while being witnessed by client representatives. And detailed reports were provided to the client’s auditing team and senior management for an after-action audit of the project. The reporting included supporting documentation on some duplicate serial entries, some serial numbers most likely entered incorrectly by manual input, and the additional drives destroyed that were not on the original list.
Any concerns from the financial institution about data discrepancies were quickly explained site-by-site with all supporting documents, thus answering any questions from client management personnel who may not have been directly involved in the project. In the end, both sides were in agreement that the project information was 100 percent accurate.
In fact, the after-action meeting on accountability and reconciliation between client and vendor took only a couple of hours, not days or weeks or months as is all too often the case.
This project arose from the client’s need for implementation of a unique job at a reasonable cost. It was also important to minimize impact to the client’s operations. Meeting these client demands required creative solutions.
Meeting complication with customization
More and more, institutions are looking for end-of-life management and data-destruction vendors who can handle evolving challenges like the ones laid out in this case study. The demand today is for companies that can work jointly with clients to develop and execute strategies that are customized to the often complicated scenarios facing institutions of all sizes.
Those vendors that can offer these clients streamlined solutions will be the ones that thrive.
Brodie Ehresman is national business development manager at Advanced Technology recycling (ATR) and can be contacted at [email protected]. Ken Ehresman is chief operating officer of ATR and can be contacted at [email protected]. David Gray is ATR’s southeast sales manager and can be contacted at [email protected].
ATR was founded in 2002 and specializes in customized solutions and programs that enable clients to realize higher investment recovery, lower overall cost, and risk mitigation throughout. Find the company online at ATReCycle.com and facebook.com/ATReCycle.