Computer recycling: Dangers for even the well intentioned

James M. Connolly

Now, what's going to be generated by that 3-year-old PC your administrator just pulled from an employee's desk? Data theft? Lawsuit? Poison? Finally, consider research firm IDC's estimate that 269 million PCs were sold worldwide last year, along with 8 million servers. The bulk of them likely were replacements for systems moved into recycling or reuse. You start to get a sense of the dangers associated with disposing of outdated computer equipment.

Concerns about computer disposal fall into three main categories: Eradicating data, finding a market for outdated but usable equipment and recycling or disposing of materials in an environmentally safe manner.

"Data eradication is probably the most important concern that corporations of any size should have on their blotter. Ask yourself, 'What's going on with our proprietary information? What's going on with our client information?"' says Kenn Ritchey, vice president of asset recovery solutions at EPC Inc., a St. Charles, Mo.-based subsidiary of CSI Leasing Inc. EPC, while primarily a used computer dealer, started offering computer disposal and recycling services three years ago after discovering that its own outdated equipment -- picked up by another service company -- may have been destined for overseas disposal.

Ritchey encourages IT managers and information security officers to establish clear plans for scrubbing data off hard drives, not just reformatting drives. Scrubbing typically calls for using the U.S. Department of Defense standard of overwriting the disk at least three times and removing the disk from the computer, although some organizations may overwrite disks seven times or more. Then, either you or your service company must carefully track and secure computers as they are moved from remote locations to a central processing facility. He notes that a palette or skid of computers may cross several loading docks at independent shipping centers. "If even one or two of those skids, even just a single system were to go missing, that could be a calamity. You can't have renegade machines out there."

Chain of custody

Mark Weatherford, chief information security officer for the state of Colorado, says knowing where computers and hard drives have gone and how the data was removed is crucial. That requires careful documentation by the IT team and the service providers of each step in the process for each piece of equipment.

"The chain of custody is the most important thing. Legitimate disposal companies have a regimented chain of custody process." He cites one of the state's service providers, which drops off a locked metal bin with a slot to drop hard drives for later pickup. "As they destroy the hard drive they videotape the process, and they give you a copy of the video on DVD, and they actually show the serial number of the drive as it's put into the shredder," he says.

Weatherford advises managers not to forget about cell phones and smartphones that have data on them. For example, some organizations want to donate used phones to troops overseas. The data first has to be removed, which can be done only by re-installing the operating system.

More green IT resources Managing the Energy Crisis: A Special Report for CIOs Green IT payback a must for midmarket CIOs Green IT strategies for the midmarket

So, if you want to ensure that you are dealing with legitimate companies -- not only the company that removes used equipment, but also its downstream partners -- what's the first step? Get out of the office, and visit these companies in person so you can see how they work, Weatherford says.

Ritchey says there should be no reason that a service provider wouldn't let you visit its facilities. That can be time consuming, but it can also help protect your company from liability. "Don't think that just because you get a piece of paper from someone saying they are going to take care of the equipment in the right way that that's the end of your responsibility. If that person doesn't do it the right way, and they get caught they are going to roll over in a New York minute, and it's going to come back to you, not Joe's Hauling Service, because your company has the deep pockets," he says.

Extend that due diligence not only to service providers, but also to charitable organizations if you choose to donate used equipment, because when that equipment reaches end of life the serial numbers will still be associated with your company.

Managers also have to understand that equipment follows a variety of paths when it leaves a company's dock. Some disposal companies, such as EPC, cherry pick the equipment that has resale value, refurbish it and share the sale proceeds with the original owner. In the extreme case, a company that disposes of relatively young equipment may recover one dollar in resale value for every 50 cents it spends in up-front costs, such as shipping and data eradication.

However, a lot of equipment is at end of life, and heads into the recycling process, which starts with dismantling. Typically, plastics go to one recycler, glass to another and metals to others. For the environmentally conscious organization, that requires visits to multiple recycling companies, and background checks. Several experts recommend that managers in the market for a disposal firm check out the Basel Action Network. The group is dedicated to encouraging compliance with the e-waste guidelines defined by the Basel Convention beginning in 1992, including elimination of e-waste in landfills and overseas dumping of hazardous materials. The Basel Action Network maintains a list of voluntary "stewards," recyclers that promise to act in a socially responsible manner.

Safe recycling

IT departments can do their own part in safe recycling, starting long before it's time to dispose of old PCs, according to Steve Brasen, an analyst at Enterprise Management Associates in Boulder, Colo. "The process actually starts with the purchase of the equipment. By buying green PCs or PCs that are more eco-friendly, it makes it easier on the back end. Fortunately, there have been some technical advances in PC design with PCs that have reduced amounts of toxins," he says.

One such move has been the development of improved plastics. While the plastics in household trash may be well-suited for recycling, the flame retardants added to most plastics used in computers make them too complex to recycle. "Ironically, the most toxic materials in a computer are also the most recyclable. Mercury, cadmium, lead and other materials are valuable, which is why it's worthwhile to recycle them," Brasen says.

For companies that don't carefully monitor electronics recycling at least two or three levels downstream in the process, the picture can get ugly.

Don't think that just because you get a piece of paper from someone saying they are going to take care of the equipment in the right way that that's the end of your responsibility. Kenn Ritchey vice president of asset recovery solutions, EPC Inc.

Ritchey notes that while it can be legal to export from the U.S., it may not be legal for that container to enter another country. "If somebody tells you, 'We'll take all your junk, don't worry about it. We'll handle it correctly and you won't have to pay any fees,' then they are doing something untoward, not necessarily illegal, but they are doing something like overseas dumping," he says. A recycler can pack a 40-foot shipping container with lead-filled CRT monitors and other equipment and get paid $1,200 by exporters.

Barbara Kyle, national coordinator at the San Francisco-based Electronics TakeBack Coalition, says that type of container may be heading for Nigeria or China, simply delaying or transferring the environmental and health hazards. Kyle, whose group is encouraging disposal firms and recyclers to become certified and is working to get electronics manufacturers to reclaim used equipment, says some used computers may be reconditioned and resold through operations in Nigeria. But, she notes, "sometimes half the container is dead stuff that can't be fixed. It just gets burned up because that's how they get rid of trash there. It was all just a ruse to export that equipment."

She also tells of villages in China where laborers are paid 10 cents per hour to smash CRTs and other equipment with hammers, extract the valuable and dangerous metals, and then burn the remaining parts.

"Companies should be prepared to do some pretty heavy due diligence, and go into the recyclers' shops, and look at their paperwork so they can trace where all their waste is going," she advises. "Many recyclers say they have a no-export, no-landfill policy, but they sell to someone else, and they don't know what that other company is doing with it. You have to do downstream due diligence, and see, waste stream by waste stream, where things are going."

James M. Connolly is a contributing writer based in Norwood, Mass. Write to him at editor@searchcio-midmarket.com.