Dumpster Disasters: Toss That Old PC Ethically
by Ross L. Kodner
In a regular and predictable ritual, you need to replace your PCs,
laptops, and network fileservers. Not that they necessarily wear out,
but they may no longer be up to the task of running contemporary
software. Using a five-year-old PC is like driving a car with 800,000
miles – it can die in a flash, crippling your practice.
What happens to elderly PC systems relegated to the dustbin of
techno-history? Toss them in the Dumpster®? There are
many avenues instead for recycling old computers to ensure they
don’t harm our environment. There also are philanthropic entities
you can use to donate old computer equipment to worthy organizations.
But be careful when disposing of, recycling, or donating your old PC
– your ecological or kind gesture could cost you your law
license.
Why? Because old computers are packed with confidential client
information and sensitive firm information. Further, the computers
undoubtedly have software licensed to your firm for which you have
specific obligations under end-user license agreements. Giving away
control of and access to these computers can lead to malpractice claims
and ethical violations at worst and serious embarrassment at best. You
could even face potential HIPAA violation claims (for disclosing
employee or client healthcare information). So what should you do?
Ross Kodner is founder of MicroLaw Inc.,
Milwaukee, a national legal technology and law practice management
consultancy, helping lawyers to best integrate technology into the
workflow of their practices. Reach him at rkodner@microlaw.com, www.microlaw.com, and (414) 540-9433.
Courtney G. Kennaday, practice management
advisor for the South Carolina Bar Association, coauthored an in-depth
version of this article that appeared in the March
2005 Wisconsin Lawyer.
You need a D.U.M.P. – a Disposal unMalpractice Plan!
The key to a D.U.M.P. is developing a process to ensure, to the
greatest extent reasonably practicable, that you remove confidential
client information and all licensed software. This means using a process
to effectively remove information, rendering the information as
unrecoverable as possible. It may not be possible to delete information
so that no one could ever recover it (except perhaps by vaporizing the
computer in a cataclysmic Star-Trekkian matter/anti-matter implosion).
If someone wants to spend enough money and time, he or she could
probably find a way to recover at least some of your data. The standard
to meet is one of reasonableness, not perfection. What steps must a
lawyer take to ensure the reasonably effective removal of this
information?
What doesn’t work.
- Deleting files using Windows Explorer or the Windows My Computer
functions doesn’t remove the files. It merely removes the
“directory listing,” thus making it impossible for Windows
or the Mac OS to “see” the file. Think of it as removing the
address numbers from your house. The house is still there, but it may be
tougher to find.
- Deleting files and emptying the Windows or Mac Recycle Bin or
Trash. The files are still recoverable.
- Incinerating the hard drive. The data recovery experts at companies
such as Kroll Ontrack (www.kroll-ontrack.com) or
Drivesavers (www.drivesavers.com) still can
recover most, if not all, of the information from utterly scorched hard
drives.
- Throwing your computers off a 40-story building.
Entertaining, but ineffective.
What does work.
Using electronic file-shredding software. These systems
delete files in ways that you cannot accomplish using Windows alone.
They typically will run a routine that deletes the files, but then
overwrites the areas of the hard drive with repeated patterns of random
characters. The current favorite product in this category is called
Darik’s Boot & Nuke, also known as DBAN. It’s free from
www.dban.org.
Be sure also to understand all the places where data may be
located. These include, but may not be limited to:
- hard drives in PCs;
- old hard drives sitting on your shelves that may have failed and
were removed but still have recoverable information;
- ancient floppy disks of all sizes (don’t forget those in
storage);
- ZIP disks and other removable data cartridges;
- backup tapes;
- flash drives; and
- iPods and other personal music players.
The bottom line is simple. PC in the Dumpster® =
potential malpractice claims, ethical violations, embarrassment. Develop
a D.U.M.P. for your firm or law department, then make it official policy
and use it!
Wisconsin Lawyer
