ITAD Evidence Failure After Office Closure
Arclight Legal LLP is decommissioning 640 end-user devices and 46 servers from a closed office. A regional IT asset disposal vendor collected them under a master services agreement that references "certified data destruction" but names no standard, no certificate format, no notification obligation and no audit right. Three weeks later the vendor emails a spreadsheet of serial numbers with a column marked "wiped - OK". Fifty-eight rows have blank serial fields and 14 serials do not match the asset register. Client contracts require "industry-standard sanitisation", and one client's outside counsel has asked for evidence that a specific matter's data was destroyed. The devices used BitLocker full-disk encryption with recovery keys escrowed in Active Directory, and 12 of the servers held a database whose backups were never catalogued. The IT manager proposes accepting the spreadsheet and closing the project, arguing the vendor is reputable and "the disks were encrypted anyway".
1. Evaluate the "the disks were encrypted anyway" argument. What evidence is actually defensible?
Read the worked answer
Encryption helps but does not close the question, for three reasons.
Keys existed outside the device. BitLocker recovery keys escrowed in Active Directory mean the ciphertext is decryptable by anyone with domain access and the right tooling. Cryptographic erase is only a valid sanitisation route when keys are destroyed and that destruction is evidenced - which is not what happened here.
The media is out of your control. Once the devices left the site, the firm lost custody. The correct question is not "was it encrypted" but "can we prove the data is unrecoverable by anyone who now holds the drive".
The contract standard is undefined. "Certified data destruction" without a named standard is unenforceable, and "industry-standard sanitisation" in the client contract needs a defensible referent: NIST SP 800-88 Rev.1 (clear/purge per media type and classification), IEEE 2883, or an equivalent accredited process with per-media method selection.
A defensible evidence set is: a per-asset certificate stating serial number, media type, sanitisation method, tool and version, date, operator, and a legal attestation; chain-of-custody records; and, for encrypted drives, documented key destruction. A spreadsheet with a "wiped - OK" column is not a destruction certificate - it is an assertion by the party with an interest in the assertion.
2. What should be done about the 58 blank serials, the 14 mismatches, and the 12 servers with uncatalogued backups?
Read the worked answer
Treat all three as destruction not evidenced and open a formal incident, escalating to the data protection lead.
58 blank serials. Blank means unidentified. Without a serial you cannot prove which device was destroyed, so those 58 are unaccounted for. Reconcile against the asset register, the vendor's own collection manifest and weight/count records, then require the vendor to physically locate the units or re-attest by serial.
14 mismatched serials. Check first for transcription errors - transposed digits are common. If a serial does not exist in the register or the purchase history, you may have collected a device that was not yours, implying one of yours is missing. That is a potential loss of custody with personal data on it; treat it as such until disproven.
The 12 servers. Destroying the servers does not destroy the data, because uncatalogued backups exist elsewhere - tape, snapshot, or a repository nobody inventoried. Sanitise those media too and record them. This is the most serious item: the firm could issue a destruction certificate while copies of the matter data remain readable.
For the outside counsel request, provide a per-serial certificate plus a written statement of method for the specific devices tied to that matter. If the vendor cannot supply it, the honest answer is "we cannot yet evidence this", with a remediation plan - not a spreadsheet.
3. What contractual and internal controls would prevent a repeat?
Read the worked answer
The MSA is the root cause: it bought an outcome nobody defined.
Contract terms to add:
- Named sanitisation standard and per-media-type method, with verification sampling requirements.
- Per-asset certificate with serial, method, tool version, date, operator and legal attestation.
- Tamper-evident chain of custody from collection to destruction, including transport and facility.
- Right to audit, including unannounced visits to the destruction facility.
- Notification obligation within 24 hours of any discrepancy, serial mismatch or custody break, with defined remedies.
- Sub-processor restrictions, data processing terms, and a stated insurance position.
Internal controls:
- No device leaves site before reconciliation. Export the register, physically scan serials at collection, reconcile, and have the asset manager sign a sealed manifest.
- Onsite destruction or witnessed destruction for high-sensitivity matters and for any media covered by client obligations.
- Backup inventory is part of decommissioning. A server cannot be retired until its data holdings - including snapshots and backups - are identified and dispositioned.
- Closure gate. The project closes at 100% serial reconciliation, not on receipt of a file.
- Metric: certificates received versus devices collected, reported monthly, with an ageing view of unmatched serials.
Six months of that discipline would have caught all three failures in this project.