Most digital copy machines use internal hard drives, which store every document that has been scanned, printed, faxed or emailed by the machines, many times numbering in the tens of thousands by the time a copier is resold or returned at the end of a lease agreement. According to a recent CBS news report, most businesses do not erase the hard drive on a copier before getting rid of it, putting the highly sensitive information of millions of consumers at serious risk of theft.
Nearly every digital copier built since 2002 contains a hard drive where up to as many as 20,000 records may be stored. CBS' report, alone, uncovered a New Jersey warehouse filled with 6,000 used copy machines. Many of these hard drives can contain sensitive information that includes social security numbers, bank records, tax forms, birth certificates and medical records.CBS purchased four random copy machines and, using forensic software available free on the Internet, ran a scan and downloaded tens of thousands documents that included reports from the Buffalo police's Sex Crimes Division; detailed domestic violence complaints; design plans for a building near Ground Zero; pay stubs with names, addresses, and social security numbers, and 300 pages of individual medical records which included prescriptions, blood results, and even a cancer diagnosis.
According to a 2008 survey commissioned by electronics manufacturer Sharp, 60 percent of consumers are not even aware that copiers store images on a hard drive. Although all major manufacturers offer security or encryption packages on copying products, many businesses are either unwilling to pay for these protections or unaware that they exist. One option available automatically erases a hard drive at a cost of roughly $500.
The Smith-Greenstein bill would require that all records stored on a digital copy machine be destroyed when a machine is no longer going to be used by an individual or business, for example when a machine is being resold, returned at the end of a lease agreement, decommissioned or discarded.
The bill also requires that the records be erased or modified so that the information stored is unreadable, undecipherable or non-reconstructable through generally available means.
Anyone who knowingly violates the provisions of the bill, which will be enforced by the state Attorney General, is liable to a penalty of up to $10,000 for the first offense and up to $20,000 for the second and each subsequent offense. An individual who incurs damages in business or property as a result of a violation of this bill may sue the responsible party in state Superior Court and may recover compensatory and punitive damages and the cost of the suit, including a reasonable attorney's fee, costs of investigation and litigation.
"I'll be the first to admit that until recently, I was among the majority of Americans that had no idea that digital copiers store all of this information on their hard drive," Smith said. "As is the case with so many businesses, copiers are leased and returned at the end of a lease agreement and then sold or re-leased to a new buyer. It's frightening to think about all the information that is potentially at risk unless we require hard drives to be erased before an owner relinquishes it."
"Consider all of the highly sensitive information stored on copiers used by both the public and private sector - medical records from a doctor's office, tax information and social security numbers from an accountant's office, sensitive police records, you name it," Greenstein said. "In today's global economy, a copier used in a doctor's office in Trenton could be re-sold to someone in South America, sending thousands of sensitive documents into the realm of the unknown and opening up a Pandora's box of potential fraud cases. We need this legislation and we need it now."
Because the Legislature can only regulate copiers used in New Jersey, Smith and Greenstein are also introducing a resolution urging Congress to enact similar legislation at the federal level.
The state legislation is expected to be introduced in the Assembly on Thursday and in the Senate on Monday.
– TOM HESTER SR., NEWJERSEYNEWSROOM.COM