NYS Division of Housing and Community Renewal not always wiping data before selling devices as surplus

NYS Division of Housing and Community Renewal not always wiping data before selling devices as surplus: While the NYS Department of State got a clean bill of health on their disposal of devices, the NYS Division of Housing and Community Renewal did not fare as well in an audit of its inventory and disposal procedures.

Key Findings:

• We tested a total of 752 electronic devices at both the Albany and the New York City offices. In Albany, two devices still contained general agency information and personal pictures, but none contained PPSI. In New York City, 13 hard drives showed indications that they still contained data. We did not forensically examine their content due to technical issues that made it impractical to apply modern forensic software tools against their older technology. Instead, we returned these drives to Division staff so they could be properly wiped of data.
• We were unable to locate 17 computer hard drives that had already been removed from computers and were scheduled for shredding. The Division has no record of what information may have been on these missing drives and it is unclear whether they have been stolen, reused or simply misplaced.
• We also could not locate 18 servers listed on the inventory records. Subsequently, the Division provided documentation showing it had sold 24 servers about 18 months earlier. However, the documentation did not include asset numbers and, therefore, provided only limited assurance that these were the same devices still listed on the inventory records.
• We also could not locate eight other devices listed on inventory records and found one device recorded as surplus that was actually still in use.