TRENTON – Senator Bob Smith and Assemblywoman Linda Greenstein today unveiled legislation to combat identity theft by requiring the hard drives of all digital copy machines to be wiped clean in order to protect sensitive, personal information, which is stored on each machine, in some cases in perpetuity, unbeknownst to millions of consumers.
“I’ll be the first to admit that until recently, I was among the majority of Americans that had no idea that digital copiers store all of this information on their hard drive,” said Senator Smith (D-Middlesex). “As is the case with so many businesses, copiers are leased and returned at the end of a lease agreement and then sold or re-leased to a new buyer. It’s frightening to think about all the information that is potentially at risk unless we require hard drives to be erased before an owner relinquishes it.”
“Consider all of the highly sensitive information stored on copiers used by both the public and private sector – medical records from a doctor’s office, tax information and social security numbers from an accountant’s office, sensitive police records, you name it,” said Assemblywoman Greenstein (D-Mercer/Middlesex). “In today’s global economy, a copier used in a doctor’s office in Trenton could be re-sold to someone in South America, sending thousands of sensitive documents into the realm of the unknown and opening up a Pandora’s box of potential fraud cases. We need this legislation and we need it now.”
Most digital copy machines use internal hard drives, which store every document that has been scanned, printed, faxed or emailed by the machines, many times numbering in the tens of thousands by the time a copier is resold or returned at the end of a lease agreement. According to a recent CBS news report, most businesses do not erase the hard drive on a copier before getting rid of it, putting the highly sensitive information of millions of consumers at serious risk of theft.
Nearly every digital copier built since 2002 contains a hard drive where up to as many as 20,000 records may be stored. CBS’ report, alone, uncovered a New Jersey warehouse filled with 6,000 used copy machines. Many of these hard drives can contain sensitive information that includes social security numbers, bank records, tax forms, birth certificates and medical records.
CBS purchased four random copy machines and, using forensic software available free on the Internet, ran a scan and downloaded tens of thousands documents that included reports from the Buffalo, NY Police Department’s Sex Crimes Division; detailed domestic violence complaints; design plans for a building near Ground Zero; paystubs with names, addresses, and social security numbers; and 300 pages of individual medical records which included prescriptions, blood results, and even a cancer diagnosis.
According to a 2008 survey commissioned by electronics manufacturer Sharp, sixty percent of consumers are not even aware that copiers store images on a hard drive. Although all major manufacturers offer security or encryption packages on copying products, many businesses are either unwilling to pay for these protections or unaware that they exist. One option available automatically erases a hard drive at a cost of roughly $500.
The bill introduced today would require that all records stored on a digital copy machine be destroyed when a machine is no longer going to be used by an individual or business, for example when a machine is being resold, returned at the end of a lease agreement, decommissioned or discarded. The bill requires that the records be erased or modified so that the information stored is unreadable, undecipherable or non-reconstructable through generally available means.
Anyone who knowingly violates the provisions of the bill, which will be enforced by the state Attorney General, is liable to a penalty of up to $10,000 for the first offense and up to $20,000 for the second and each subsequent offense. An individual who incurs damages in business or property as a result of a violation of this bill may sue the responsible party in the Superior Court and may recover compensatory and punitive damages and the cost of the suit, including a reasonable attorney’s fee, costs of investigation and litigation.
“In addition to the serious threat of identity theft, consumers are also vulnerable to serious social repercussions posed by sensitive medical records or police documents,” added Assemblywoman Greenstein. “There’s a simple way to eliminate these risks and we need to make sure it’s instituted.”
“The cost for the software needed to erase these hard drives is relatively minor considering the peace of mind and financial security that it provides,” added Senator Smith. “I hope we can get this bill passed swiftly for the benefit of all consumers.”
Because the legislature can only regulate copiers used in New Jersey, Senator Smith and Assemblywoman Greenstein are also introducing a resolution urging Congress to enact similar legislation at the federal level that would require the hard drives of all digital copy machines sold or leased in the United States to be wiped clean.
The legislation is expected to be introduced in the Assembly on Thursday and in the Senate next Monday, the next time both houses are respectively scheduled to meet.
For an in-depth look at the scope of the problem, please check out this CBS News report: http://www.cbsnews.com/video/watch/?id=6412572n
# # #