ITAD in 15 - The Hidden Risks of Non-Compliant Disposal

Hi everyone and welcome to ITAD in 15. After a short hiatus, we're back with new panel discussions covering all things ITAD, from processes and sustainability to sanitization and security, to give you the viewer some practical news, guidance, education, everything in the world of ITAD. So today I'm joined by Frank Miller, who is from IT Asset Management Group in the US, an ITAD based in the US, but Frank is known for transparency in ITAD operations and shares his facility online to educate customers and the sector on what a compliant and secure ITAD looks like. And then we've got Kyle Marks, who is the CEO of RetireIT, which is a value-added reseller of ITAD services. Kyle has also been leading efforts to challenge the ITAD certification industry, highlighting failures in enforcement that put the credibility of certifications and the industry at risk. And lastly, And lastly, we've got Amanda Harris, who is the Director of Support Operations at Centerprise, which is a UK-based company specializing in IT solutions and managed services, ITAD. With 25 years of experience in ITAD, Amanda brings deep expertise in standards compliance and operational best practices. So welcome everyone. Thank you for joining.

Thanks for having us.

Thanks for having us.

And so the aim of today is to discuss the hidden risks of non-compliant disposal. And ITAD vendors are meant to reassure clients that their data-bearing assets are handled securely and responsibly, and yet even in certified environments, we can see that failures do still occur. So assets get lost or stolen or mishandled, and it leaves the client exposed. So let's discuss why non-compliance persists and the consequences it creates within the industry, and potentially how we can all take more ownership of it. So I'll start with Amanda. From your experience, what is the biggest hidden risk that organizations overlook when choosing an ITAP partner?

Thanks, Zoe. So from my experience, the two biggest tends to be around the logistics and also ensuring chain of custody. So whilst companies will ask what our process is initially regarding data destruction, and around 20% of companies that we deal with will take us up on doing a site visit to our processing facility. They rarely ask regarding the logistics, how the equipment will be collected, how we ensure chain of custody. So they've got to be the two main areas. We've never been asked to provide details of what our policies are in the event of a breakdown, vehicle accident, as long as they get the equipment, you know, as long as they get a signed collection note, whether that is box count or scanned count, that's not— that's something we do as standard. It's not something that they tend to ask us for, and they rarely ask us for evidence such as GPS tracking or the chain of custody paperwork, which we obviously supply anyway. But, um, yeah, that's got to be the two main risk that we see.

That's really incredible that it's as low as 20%. And, um, Frank, you're probably good to comment on this as well because you do quite a lot of work trying to further the sort of education of the customer and showing them how a facility works. Would you, would you agree with that? Is it sort of a lack of questioning from the customer as well?

Uh, yeah, I, I can confirm what Amanda is saying, that very few, uh, questions are being asked about those types of policies. Breakdown is a really good one. I also think it's probably 1 out of every 100 contracts, you know, there'll be 5 phone calls about negotiating prices and no phone call about visiting our facility or seeing us in action that we can do what we're saying we're doing, you know, on paper. So I think there's a lot of risks that can be uncovered by physically going out to a vendor and seeing what they're about and what they can accomplish. Publish. Yeah, so I concur for sure.

It's really interesting, isn't it, when it's, it's people's data, that's the, the thing that they should feel, you know, so onerous of, and then actually it's in a lot of cases it still seems to be there as soon as it's out the door. As long as I've got my bit of paper to evidence, and that's sort of where my due diligence ends with that. But Kyle, you're obviously, you've been You wrote an open letter to certification bodies. I think the customer often sees a badge or knows somewhat about certifications within the sector. Do you think that the responsibility should, should lie with the customer and the education on the certification body on, you know, making sure that the audits are rigorous and like data secure and all of that? Or do you think it lies with the ITAD? What are your thoughts on this?

Well, it lies with both. The WyseTech Iron Mountain breach has taught us a lot. It reveals about everything wrong in this industry. Just to kind of recap shortly, a driver working for a vendor that had multiple certifications was sentenced for stealing thousands of laptops and computers for more than a year. The owner of the ITAD has kept the clients in the dark. The certifying bodies have refused to take any action, conduct impartial investigations, or enforce the penalties. It reveals also that the end users, the clients, learned nothing from the Morgan Stanley breach. And just to refresh everyone's memory, there in the breach with Arrow Electronics, Morgan Stanley discovered it when they undertook what they called a cross-check reconciliation of assets that it believed Arrow had in its possession. You know, so what we've learned is that certifications, you know, are acting as more of a badge, a marketing badge. They can't be trusted to prevent breaches, to enforce compliance of their own published standards, or to protect the constituents who rely on them. And, you know, my company is one of them. We contract with ITAD vendors to perform work on behalf of our clients. And we've always worked on the biggest proponent of certifications because it separates the, you know, the good from the bad. But we rely on them for other things, like NADAAA is all about attesting to the vendor being compliant with the law. And nobody will deny that the WyseTech Iron Mountain breach was a breach, you know, thousands of assets unaccounted for. But yet no end users have been notified. And so it also tells us that, you know, the certifying bodies are, you know, I've learned, you know, they've been very selective and subjective in enforcing their compliance. So there's been a large number of, you know, vendors who have reached out and told me that they feel it's like a two-tier system of justice, you know, where certain vendors would be picked on and be penalized and others won't. So, you know, there is a silver lining in that. I think we've— we're recognizing that there's a huge difference between certification and verification. And unfortunately, you know, bragging about certification is sort of like bragging you have a driver's license. I mean, it just proves you can do something. And we can look at, for instance, you know, DISA is very big into certifying the the effectiveness, you know, the efficacy of erasure software. You know, erasure software verifies every sector is wiped. You know, we need that same thinking when it comes to chain of custody verification. We need to prove that every asset has been accounted for. And you started by asking a question, you know, of Frank and Amanda about, you know, what was the biggest shortcoming. I actually believe it's that we think it's choosing the vendor is the most important part, whereas managing the process is actually the biggest vulnerability because picking a qualified vendor like IT Asset Management Group is relatively easy, especially if you go visit the facility and you read about and understand. So it really has taught us that trust is for friendship, verification is for compliance. We need to take a page from cybersecurity. And unfortunately, at this moment, unless the certifications come forward, it's proving us, you know, to us that, you know, certifications protect the vendor and they don't protect the enterprises that rely on them.

Yeah. One of the things that sprung to mind as you were talking was that it really is the end user at the end of the day that, that it's their data that's breached. And over here in the UK, the Information Commissioner's Office did a really cool campaign about the effects that has when your data is leaked. And it was just putting the consequence onto one individual of how detrimental that can be. And I think the education piece is there across the sector. What more can every individual stage be doing? So Frank, I've got a question for you as well. From an operational perspective, where do breakdowns most often occur? Do you think it's logistics, chain of custody? Is it data wiping? What are your thoughts on that?

Well, I'd say all of those things have one thing in common, and it requires people and processes to go well. And like Kyle was mentioning, if an end user has no asset management practice and has no good data protection policies and processes in place and accountability, ability for it, choosing a vendor is not going to mean much because then you're just trusting whatever that vendor is saying they're doing, they're actually doing, and then that's when, you know, disasters can really occur because no one's checking what's happening. So in reality, you— there are organizations that don't need sophisticated ITAD providers because they can do all of their data destruction in-house, do very good asset management, package those assets, clean, wiped, verified. You can even bring in third parties to do it from site, and then you can dispose of it with more of an environmental compliance than a data security aspect. You know, there you can do on-site hard drive destruction with a vendor. But, but, but this is one of those things that our industry has created this problem because we've told customers this myth of indemnification that we can solve all your problems. It's easy, we're certified, just hand us the kit and we will clean it up for you and everything's okay and wrap it up in a nice package. And not to blame the customers again, but their attention span for this is also low. So, you know, you can't fix asset management at disposition, right? And that's what a lot of customers are trying to do. And that's as an industry what we're trying to do. So it's difficult because we have to meet the customer where they are and bring them where we want them to be. Yeah, I'll end on that little phrase, I guess, that I just made up.

So, no, that's good.

You should write it down and use it. That was really good. Amanda, do you see that? Talking about the customers, or, you know, when a tender comes in, do you think that there is an element where the competitive bidding pushes vendors to take shortcuts and increase that risk? I ask because obviously Centerprise is a Standard 8 certified company, so you're a part of a standard that's officially approved and aligned to law. So you must come across that quite a lot when you're looking at tenders.

Yeah, public sector tenders are interesting. So they vary so much. We've got— they have progressed quite a bit over the last few years. They're darn sight better than they used to be, but there's still shortcomings. We're still seeing tenders coming out where the most important thing to them is that the service is cost neutral, no charge to them. Some of the tenders come out, don't even ask simple questions around certifications, chain of custody. They just— it's literally one or two questions asking for our process around data destruction and how we're going to return money to them and make it cost neutral. The newer ones that we've seen in the last few months, we are starting to see ADISA mentioned more, which is good, and we are starting to see some public sector tenders come out where they have done their homework. They've obviously taken wording from the standard and put it in the tenders, which is a, you know, a great improvement on what we've seen sort of 5, 3, 5 years ago. But there's still quite a lot of shortcomings within definitely public sector in the UK.

Yeah, I, uh, I, even in the time that, that I've worked in the sector, you can you can see how things are starting to improve. It takes a long time. I mean, I took a call from someone the other day that said, well, we're a charity, why would I have to pay for that service? You have to explain that if you want security, if you want that higher level of service, it ultimately is going to come at a cost to someone. It's that educational piece with the customer, I think, across the board, and of course with with the ITAD in making sure that compliance isn't a badge, it's a process, it's a way of thinking, it starts from the ground up, it's in every part of the process that you're making sure that you're doing things the right way. So I just wanted to close off with a question to you all, and I'll start with Kyle. What can the industry collectively do or what's one piece of advice for ITAD providers to differentiate themselves on compliance?

I think a client should, or a vendor should ask the client after they've made their pitch and they've reviewed the program, ask, do you want this to be verified? And that simple question will will invariably cause a discussion about what do you mean? What do you mean by verification? And it'll uncover any misconceptions, any false beliefs, or anything that— it also brings into the conversation people outside of procurement. It brings in people from governance, risk and compliance. And that ultimately will change the trajectory of our industry when people start thinking about this more as cybersecurity and, and less as, you know, moving boxes and one step above taking out the trash. So asking a client how they want this verified, if they want this verified, they, they'll reveal if they think it's already assumed to be done. And, and it'll have a great conversation around it.

Yeah, absolutely. And Frank, what do you reckon? What's one, one piece of advice that you could, I don't know, I suppose relay on to any ITAD?

So I, as an ITAD, would focus on turning your customer-facing employees into consultants. And I think we're going to see more and more, there's going to be salespeople that are selling best practices and real answers as opposed to easy answers. And Conversations like this are furthering that information out, and customers are going to see these types of conversations and see these types of answers. And if your salespeople are giving easy and false answers to compliance and security measures, you're going to get left behind in the sales cycle by people who can give the real facts of what, you know, security and asset management good practices look like.

Absolutely. Knowledge is power, and being able to relay that onto the customer, that's— it's the long game everyone struggles with. With motivating them to pick the right vendor. But I think, I think that's a really, really good one. Amanda, what do you reckon?

That's a good question. So, differentiating themselves on compliance and a bit of advice for eye tag providers. So I would say always be completely open, transparent with your customers. Always invite them to come and see your facility, the processes. I mean, personally, we've obviously got ADISA and like 12 ISO standards, so that differentiates ourselves against our competitors, as the majority of our competitors don't have that same level of certification. But I think at the end of the day, yeah, make sure your salespeople are saying the right things, make sure you're completely open, transparent, honest with your customers, tell them what the risks are and the best thing to do moving forward.

Yeah, brilliant. Thank you so much, um, all three of you for, for taking the time today. And, um, yeah, that, that concludes this, this ITAD in 15. So many thanks and have a good weekend.

Thank you. Cheers, guys.

Cheers.

Yeah, thank you so much