Why Big Tech shreds millions of storage devices it could reuse

There are better options than destroying used hard drives in the name of data security.

Mick Payne remembers the moment the madness of the way we dispose of our data was brought home to him.

The chief operating officer of Techbuyer, an IT asset disposal company in Harrogate, was standing in a large windowless room of a data center in London surrounded by thousands of used hard drives owned by a credit card company. Knowing he could wipe the drives and sell them on, he offered a six-figure sum for all the devices.

The answer was no. Instead, a lorry would be driven up to the site, and the data-storing devices would be dropped inside by authorized security personnel. Then industrial machines would shred them into tiny fragments.

“I walked out and thought, ‘This is absolutely crazy’,” says Payne. “They couldn’t allow the disks to leave the building—despite the fact we could wipe them on-site then sell to a new customer who could make use of them for years to come... It was a complete waste.”

Payne had experienced first-hand the ubiquitous industry practice of shredding data-storing devices.

Every day when you fire off emails, update a Google document, or take a photo, the data generated is not stored in a “cloud” as the metaphor suggests. Instead it is stowed across several of the world’s estimated 70 million servers, each one a steel box about the size of a kitchen sink, made up of all sorts of precious metals, critical minerals, and plastics.

The servers contain several data-storing devices, each roughly the size of a VCR tape. They sit inside the world’s 23,000 data centers, some of which span floorspace equivalent to dozens of Olympic-sized swimming pools. When companies decide they want to upgrade their equipment, which usually happens every three to five years, data storing devices are routinely destroyed in a process like the one Payne described.

Companies such as Amazon and Microsoft, as well as banks, police services, and government departments, shred millions of data-storing devices each year, the Financial Times has learnt through interviews with more than 30 people who work in and around the decommissioning industry and via dozens of freedom of information requests.

This is despite a growing chorus of industry insiders who say there is another, better option to safely dispose of data: using computer software to securely wipe the devices before selling them on the secondary market.

“From a data security perspective, you do not need to shred,” says Felice Alfieri, a European Commission official who co-authored a report about how to make data centers more sustainable and is promoting “data deletion” over device destruction.

A hard drive shredder made by Untha.

Lorne Campbell, Guzelian, and SWEEEP Kuusakoski

The trust problem

Underpinning the reluctance to move away from shredding is the fear that data could leak, triggering fury from customers and huge fines from regulators.

Last month, the US Securities and Exchange Commission fined Morgan Stanley $35 million for an “astonishing” failure to protect customer data, after the bank’s decommissioned servers and hard drives were sold on without being properly wiped by an inexperienced company it had contracted. This was on top of a $60 million fine in 2020 and a $60 million class action settlement reached earlier this year. Some of the hardware containing bank data ended up being auctioned online.

While the incident stemmed from a failure to wipe the devices before selling them on, the bank now mandates that every one of its data-storing devices is destroyed—the vast majority on site. This approach is widespread.

One employee at Amazon Web Services, who spoke on condition of anonymity, explained that the company shreds every single data-storing device once it is deemed obsolete, usually after three to five years of use: “If we let one [piece of data] slip through, we lose the trust of our customers.” Amazon declined to comment.

A person with knowledge of Microsoft’s data disposal operations says the company shreds everything at its 200-plus Azure data centers. Microsoft says “we currently shred all [data-bearing devices] to ensure customer data privacy is maintained fully.”

The UK’s Department for Education, Department for Work and Pensions, Police Scotland, and Police Service Northern Ireland told the FT that they shred all decommissioned data-storing devices. Northern Ireland’s force says it has shredded 30,000 pieces of equipment including servers and hard drives over the past two years.

Some government departments say they follow National Cyber Security Centre guidelines, which recommend hard drives should be physically destroyed. However, HM Revenue & Customs and the Department for Business, Energy, and Industrial Strategy say they do not mandate shredding, and London’s Metropolitan Police says it wipes where possible.

Data center operators have faced scrutiny in recent years for their huge energy use. In July, they were partially blamed when it was found that the west London electricity grid had run out of capacity to support new homes, threatening housebuilding targets in the capital. The focus on their energy guzzling puts pressure on companies to replace their systems whenever more power-efficient equipment comes to market, creating a trade-off between energy efficiency and environmental waste.

Energy use is “being reduced by just throwing more material at the problem,” says Johann Boedecker, founder of the circular economy consultancy Pentatonic. “The open question is: how much energy reduction is worth how much waste?”

But with another 700 data centers set to be built around the world over the next three years, according to the tech consultancy Gartner, the question of what companies do with millions of tonnes of electrical equipment has become more important than ever.

*The gaping maw of an HDD shredder.*

*Lorne Campbell, Guzelian, and SWEEEP Kuusakoski*

“We shred everything”

It is difficult to say exactly how many hard drives are decommissioned globally each year, but one study by the US National Renewable Energy Laboratory estimates it is at least 20 million in America alone. Although most data center companies discard their storage devices after a few years, they could last for years—or even decades—longer, according to several industry experts.

The research suggests more than 90 percent are destroyed when equipment is routinely decommissioned, even though most are still functioning. The European Commission estimates that about half face the same fate in the EU.

“Clients are so worried about disposal of data that they’re insisting on the hard drives being destroyed,” says Michael Winterson of global data center provider Equinix. “It’s a big issue that as an industry we need to figure out.”

“We shred everything with data on it, there are no exceptions,” says Greg Rabinowitz, president of Urban E Recycling, an electronics disposal company in Florida. Decommissioning professionals like Rabinowitz mince the drives at their clients’ behest—two others say they have even had requests to incinerate the remains.

While the shreds are widely sent for recycling, today’s processes only recover about 70 percent of the materials, according to Julien Walzberg, a researcher at the National Renewable Energy Laboratory.

Recycling plants usually separate the 6 mm-wide morsels into aluminum, steel, and circuit board for onward sale. But the hard drives contain important materials, such as neodymium and dysprosium in the magnets and nickel and palladium in the circuit boards, which are often not recovered. Several of these are on US or EU lists of “critical” materials—so designated because of natural constraints on their supply or for geopolitical reasons. China, for example, produces 60 percent of all mined rare earths.

The small amounts of critical raw material lost in shredding add up, contributing to the 54 million tonnes of electronic waste produced globally every year. Every speck lost requires more to be mined, often from areas of the world embroiled in conflict. Demand for such materials is projected to grow as the world electrifies itself away from fossil fuels.

“Shredding causes a massive problem for sustainability,” says Deborah Andrews, professor of design for sustainability and circularity at London South Bank University.

While various projects are being piloted to try to recover some of the materials lost in shredding, tearing up a drive after a few years of use still violates the first rule of sustainable consumption: reuse is always better than recycling.

*The end result.*

*Lorne Campbell, Guzelian, and SWEEEP Kuusakoski*

“Even if you recover all the materials when you recycle a product, all the energy and money you have put into using those materials to manufacture the product’s components... is lost,” says Walzberg. In a study this year, he found that reusing a hard drive avoids four times as many carbon dioxide emissions as slicing it up and feeding the pieces through even the best imaginable recycling processes, when both scenarios are compared with current recycling.

The same problem applies to entire servers that, when deemed no longer useful, are often sent for recycling rather than reused. IT company Dell found that manufacturing accounts for half of the carbon footprint of one of its servers, accounting for energy-related emissions from four years of use.

Steve Mellings, who founded and runs the UK decommissioning industry certification program Adisa, says energy savings from new technology are not as significant as they used to be. “If they’re using a 15-year-old antique server, it’s going to be heavy on consumption, but most servers [developed] over the past decade are pretty good,” he says. And even if advances do warrant a replacement, “that doesn’t mean you need to destroy the old.”

The case for refurbishing and reuse is not just a financial one. There is plenty of evidence to show that the performance gap between newer and older servers is narrowing, with the newer examples “not maintaining the same efficiency improvements” that were seen in the past, according to a recent paper led by academics at the University of East London.

Some of the major cloud computing providers have been taking steps toward reuse. Google says 27 percent of the components it used in server upgrades in 2021 were refurbished inventory and that it overwrites data on its hard drives for reuse where possible. Microsoft now operates several “circular centers” for refurbishing old servers and says more than 80 percent of its decommissioned assets will be repurposed by 2024. But for hard drives, specifically, shredding is still the norm.

Several decommissioning experts say that, while some customers have already converted to erasing and reselling their data storing devices, others simply need to be educated about the efficacy and reliability of wiping software to help them move past the ingrained belief that physical destruction is necessary.

Gartner’s Simon Mingay says many data center operators would love to increase the quantity of goods that are awarded a second life but “they’re hobbled by the requirements being placed on them by their customers.”

For now, most customers still see the risk as outweighing the potential benefits. Rabinowitz, one of the few voices in the decommissioning industry still in favor of shredding, puts the problem simply: “Why risk it if there was any chance something was going to get left on it?”

If the big tech data storers, known in the industry as “hyperscalers,” were to change their practices on drive reuse, others would follow—or so many decommissioning experts believe. But, as things stand, they are opting to prolong the life of the equipment the first time around. Last year Google said it would extend the life of its cloud servers from three to four years, and Amazon Web Services prolonged its own from four to five years in February. Last month, Microsoft announced it would extend the life of its server and network equipment from four to six years.

Nonetheless, many experts are adamant that conventional drives can be securely wiped and reused, a practice that first emerged in the early 1990s but that has only gained significant traction over the past decade. “Saying we have to shred because it’s the only thing that’s secure is a miscalculation,” says Fredrik Forslund, vice-president of Blancco, a company that makes wiping software. Forslund describes shredding as “an absolute disaster.”

The FT asked several industry insiders and experts if they were aware of any case where data had leaked after verified wiping software, such as Blancco’s, had been used, and none were. “We’ve verified that sanitization works and still they shred,” says Adisa’s Mellings. “The level of fear is palpable.”

Why Big Tech shreds millions of storage devices it could reuse

aum and Mutton
1
1

Recommended Comments

There are no comments to display.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Add a comment...

× Pasted as rich text. Paste as plain text instead

Only 75 emoji are allowed.

× Your link has been automatically embedded. Display as a link instead

× Your previous content has been restored. Clear editor

× You cannot paste images directly. Upload or insert images from URL.

Insert image from URL

Sign In

Why Big Tech shreds millions of storage devices it could reuse

There are better options than destroying used hard drives in the name of data security.

The trust problem

User Feedback

Recommended Comments

Join the conversation

Recently Browsing 0 members

nsane.down

News

Browse

Activity