Digital copiers pose security threat

Copier hard drives should be erased to minimize security risks.
Copier hard drives should be erased to minimize security risks.

Although stolen laptops and computer-savvy hackers are frequently the focus of school security discussions, information retained when sensitive documents are photocopied poses another very real, although often overlooked, security threat for schools and colleges—and for the employees and students whose personal information could be at risk.

The hard drives in digital copiers record all images that are copied using the machine. While copier security risks have been known for a number of years, CBS News shined its spotlight on the danger with an April 19 news report. eSchool News first reported on the issue in 2007 (see “Latest data security risk for schools: Copiers“).

The CBS investigative team purchased three previously-owned copiers and accessed sensitive information on all three hard drives, including one that contained scanned records from a public high school.

The St. Petersburg Times reported that Florida’s Pinellas County libraries are set to review all library copy machines and hard drives in light of the CBS report.

John Juntunen told CBS News that the industry has been slow to react and identify a solution to the security risk. Juntunen’s company, Digital Copier Security, developed INFOSweep, software that erases hard drive data on digital copiers.

The majority of copier manufacturers offer a data security kit to accompany their machines, but the kit is not a standard part of the equipment—and many schools opt not to purchase it.

“Sharp has been offering [a data security kit] for 10 years, and in those 10 years, we still don’t have more than 15 percent of machines leave here with a data security kit,” said Mike Marusic, vice president of marketing and services for the Sharp Imaging and Information Company of America.

“At the end of the day, many people choose to save the money. If it’s included standard, the [copier] prices go too high,” he said.

Awareness is critical to prevention, especially in schools—where students’ Social Security numbers, sensitive financial information, and personal histories are printed on documents that are likely to be photocopied.

A recent survey hosted by Sharp revealed that of 817 business owners and corporate executives, nearly 65 percent said they were not aware or sure that their copiers contained hard drives with sensitive information.

“My advice to all schools would be to invest in a data security kit, because it is valuable,” Marusic said.

Schools whose slashed budgets might not permit an upgrade to a new copier with a data security kit, or even the purchase of a data security kit alone, do have a few other options to tighten security when it comes to vulnerable photocopy machines.

When schools end a copier lease, administrators should request the hard drives from the machines, or ask their school’s copier dealer to provide verification that the hard drives were cleared before leaving the building.

Laura Ascione