Casey Mathson at Dynamic Lifecycle Innovations dreads this scenario: An individual buys a refurbished computer online, only to have previously undetected firmware brick the device and claim it was stolen from “XYZ” company. That angry consumer calls XYZ, which contracts with Dynamic for ITAD services.
“We don’t want the customer to think that we’re stealing laptops and selling them on e-commerce,” said Mathson, quality and inventory specialist at the Onalaska, Wis.-based ITAD company.
This reputational damage situation, while not yet common, could play out more often in future years as more companies and public agencies subscribe to remote management software services.
An effective tool to prevent theft and loss of sensitive data, software locks can also gum up ITAD firms’ refurbishment processes. Processors must quarantine the locked computers and contact their upstream customers or the software provider to request a lock deactivation.
“Now, not all companies have these installed in their devices. But all it takes is a relatively big client to raise the cost of labor significantly within the ITAD provider,” said David Daoud, principal analyst at ITAD industry research and consulting firm Compliance Standards.
E-Scrap News recently talked with a few processors and a major software provider about the issue and ways ITAD companies can unlock devices. Companies said the locks can sometimes lead them to simply scrapping otherwise-sellable computers.
‘It’s just become more and more common’
A number of companies have long provided different types of remote management software, including OEMs such as Apple and Microsoft, so the technology certainly isn’t new.
Casey Dingfelder, vice president of ITAD at Dynamic, said his company has been aware of remote locks for many years, but that “it’s just become more and more common.”
Noah La Liberte, director of outbound sales for the company, estimated that 1 in 5 computers recently received from upstream customers have some kind of software lock. They’re heavily used by banking and healthcare organizations, he said.
“Now, not all companies have these installed in their devices. But all it takes is a relatively big client to raise the cost of labor significantly within the ITAD provider.” – David Daoud, Compliance Standards
Lately, Dynamic has frequently encountered “Computrace,” a technology from Absolute Software, which has worked with major OEMs to embed locks into the firmware of roughly 600 million new devices. When an enterprise signs up with Absolute, the otherwise-dormant code is activated and the subscriber can remotely install or remove software, wipe data or lock the computer and track its location. Re-installing the operating system or reformatting the drive will not remove the “Persistence” software, which is embedded in the BIOS firmware.
As data security concerns grow for corporate America – and as more organizations rely on employees working from home – use of the technology is growing. According to Absolute’s latest annual report, the publicly traded company’s 2021 fiscal year revenues were up 15% from the prior year. As of June 30, 2021, the company had about 13,000 customers with 12 million activated software licenses.
In an interview with E-Scrap News, Nicko van Someren, chief technology officer for Absolute Software, said he’s not surprised some ITAD companies are seeing more of Absolute’s software, because “we’ve been growing at a healthy rate.”
He acknowledged the locks can cause problems if not properly deactivated, but he emphasized the technology also allows customers to remotely wipe data, reinstall the operating system, and remove Absolute’s agent, preparing the computers for resale or donation.
‘It does de-value the product’
ITAD companies contacted by E-Scrap News said the unlocking process isn’t always fast or simple.
La Liberte said Dynamic now has customers that expect Dynamic to manage the software lock deactivation process, as opposed to Dynamic handling it only when they forget to do it themselves.
Customers’ attempts to unlock a computer aren’t always successful, La Liberte said. Meanwhile, they rarely authorize Dynamic to contact Absolute Software directly to seek help.
Veterans Alliance Resourcing (VAR), an electronics remarketing company located in the Austin, Texas area, pointed out that staffing turnover can inhibit unlocking. Russell Joly, chief operating officer and co-founder of VAR, said school districts, which are heavy users of the technology, can find themselves unable to locate relevant files and passwords that were managed by former employees.
Michael Schuler, VAR’s CEO and co-founder, added that remote management service contracts can also be forgotten in cases where organizations rely on managed service providers to oversee their technology maintenance and replacement programs.
“A lot of that stuff seems to get lost in the mix, and it is a problem because it does de-value the product,” Schuler said.
Schuler said he includes a “bricked computer” fee in contracts, incentivising the customer to unlock computers and allowing VAR to bring in some revenue from bricked devices.
“We’ve had customers say, ‘That’s not really a big deal to us. Just scrap them.'” – Noah La Liberte, Dynamic Lifecycle Innovations
In the Pacific Northwest, 3R Technology finds that most of its upstream customers are diligent about unlocking units themselves, said Aaron Mills, refurbishment manager at the Kent, Wash.-based ITAD company. He has one customer that will physically take back BIOS-locked computers and unlock them so 3R can sell them.
“Lucky for us, the customers we deal with are very conscious of the fact that we’re trying to keep things out of the garbage,” he said.
Mills estimated he’s unable to unlock only 5% to 10% of locked units. That being said, the unlocking process can still take significant time and effort. 3R sometimes needs to set aside a unit for a couple of days, restarting it multiple times and re-checking until the BIOS lock is gone.
‘We’ve had customers say … just scrap them’
The hassle of unlocking devices can consign computers to parts harvesting and commodities recovery.
La Liberte pointed out that if a customer isn’t too concerned about the revenue from the sale of the used computers, their IT staff may have little incentive to expedite unlocking.
“We’ve had customers say, ‘That’s not really a big deal to us. Just scrap them,'” La Liberte said.
Joly of VAR said the same attitude can be found at school districts, particularly if the revenue generated is a tiny fraction of a large district’s budgets.
“After the devices leave their facility, they’re no longer incented to recoup the most value,” he said. “It’s really, ‘I have all this stuff and it’s sitting in our classroom. I just want it gone.'”
Even earnest efforts to solve the problem don’t guarantee success. Joly said VAR went through several back-and-forths with a school district to unlock 1,000 remote-managed computers. Without success, VAR eventually shipped them to a scrap dealer.
Dingfelder of Dynamic pointed out that if only one or two computers in a batch from a particular customer are locked, it’s not always worth Dynamic’s time to quarantine and attempt to get them unlocked. In those cases, the company will harvest parts from them to try to recover value. Dynamic does the same when it can’t identify the original owner because it received the computers from a recycler who got them from another recycler.
3R echoed that point: “At that point I’m just going to part that out,” Mills said.
VAR can sidestep locks by swapping out components, if doing so makes financial sense based on the high resale value of the particular device. In general, COVID-19 has driven used equipment prices higher, but that doesn’t necessarily justify VAR spending more time on bricked devices. Joly explained it this way: If prices for fresh apples are high, you try to get as many fresh apple sales through as you can, rather than spending time on the 3-5% that are rotten.
‘Require the ITAD industry to come up with a smart solution’
Daoud of Compliance Standards said the practice of adding tracking software tools is expected to “increase significantly as cost falls and as staff work remotely.” He sees that as a necessary step, not a bad one.
“However, it will require the ITAD industry to come up with a smart solution,” Daoud added.
3R has one unlocking solution, but it demands some time and labor: Staff de-solder the BIOS chip from the motherboard and plug it into a special caddy that reflashes the chip, which staff then re-solder it onto the motherboard, Mills said.
“It’s a really good tool and most of the time it’s pretty successful,” he said.
“We provide tools to all major PC OEMs, and their licensed refurbishment centers, to make it easy for them to deactivate our Persistence technology on legitimately refurbished devices.” – Nicko van Someren, Absolute Software
Daoud suggested ITAD companies “could involve the major OEMs and convince them it is to their advantage to propose a simple and cost-effective solution.” To some degree, that’s already happening, at least for OEM-licensed refurbishment centers.
“We provide tools to all major PC OEMs, and their licensed refurbishment centers, to make it easy for them to deactivate our Persistence technology on legitimately refurbished devices,” said van Someren of Absolute Software.
For other ITAD companies, van Someren suggested first calling their upstream customers to have them unlocked; they can also call or email Absolute Software and provide the serial numbers of locked devices. Absolute will then reach out to its subscribers to verify the computers weren’t stolen before unlocking them.
Absolute’s customers are keen to deactivate locked computers they no longer have, because they’re still paying subscription fees, he noted.
Absolute is making it easier to integrate its lock decommissioning process into customers’ business workflow software. Those customers are realizing that automating the wiping and OS reinstallation process improves resale value, van Someren said.
“A lot of our customers are getting a bit more diligent about the automation of that recycle process,” he said.
Yet he pointed out that with millions of remotely managed devices out there, some will slip through without proper decommissioning, and an ITAD firm may not detect the remote-managed state of a computer before selling it online.
If an individual consumer who bought a locked computer calls Absolute to have it unlocked, Absolute will first wipe all data on that device. That protects the company’s data, although it’s a pain for that consumer, who deserves an apology from the enterprise that let it out the door without proper decommissioning, van Someren said.
