“He scratched his ear, the infallible resource to which embarrassed people have recourse.” – Lord Byron

Take a Look Inside the Modern Photocopier.

Behind a mass of cables, circuit boards and protective panels, you will see a core technology first commercially introduced by the innovative minds at Xerox over 50 years ago in their Xerox 914: the first plain-paper copier to bring fast and economical photocopying to the masses.

Dreams of a paperless office aside, the photocopier (or “multi-function copier”) remains among the most-used machines of the modern workspace.  Whether its familiar whirring is overheard in research and development, human resources, or on the “corporate floor,” the modern photocopier’s sophistication is oft overlooked.  The result?  A surprisingly high number of businesses are literally handing over a library of proprietary information to potential competitors when the machine is retired: nearly every modern copier contains a hard drive.

Question: What might be stored on that hard drive?

Short Answer #1: Corporate strategy, latest R&D efforts, internal financials, product ideas and more.

“At a warehouse in New Jersey, 6,000 used copy machines sit ready to be sold. CBS News chief investigative correspondent Armen Keteyian reports almost every one of them holds a secret.”

“If you're in the identity theft business it seems this would be a pot of gold.” - From CBS News’ Initial Report | 4/15/2010  

Short Answer #2: A potential nightmare featuring lawsuits, public embarrassment and lost profit, oh my.

“Two of the four copiers - randomly purchased by CBS News from [the] warehouse in New Jersey - happened to be from the Buffalo Police Department.

The copiers were loaded with confidential documents, from police reports to lists of wanted sex offenders.”

“In addition to the two Buffalo copiers, we bought two others: one from a Bronx construction company, which still had a list of employees names and social security numbers on its hard drive, and the other used by a New York-based Insurance company, Affinity Health Plan, which had patients' medical records and prescription information on the hard drive.” - From CBS News’ Follow-on Piece | 4/20/2010

Avoid Embarrassment and Protect Proprietary Information

No business seeks the kind of national advertising given to Buffalo PD or Affinity Health Plan.

Assess the Risk

 ·         Audit the capabilities of your office equipment as soon as possible.  Use IT and your dealer, or seek out a firm that consults in this area.

·         Be sure to audit your maintenance agreements as well.  Confidentiality and non-disclosure agreements only go as far as one is willing to pursue them legally.

·         What about equipment recently retired?  Act fast to safeguard your proprietary information—time is no longer on your side. 

Address the Risk

·         Engage in lease agreements that explicitly provide for destruction of your proprietary data upon termination.  Consider physical destruction of the hard drive for extra security.

·         Limit the amount of proprietary information that is stored, or eliminate the storage all together if unnecessary.

·         Put a stop to vendors taking proprietary data off-site where you lose control, and public disclosure is out of your hands.  Find out what data leaves with your repairman.  It is usually impossible to put the cat back into the bag.

The Broader Picture: Regularly Review Procedures for Handling Proprietary Information.

Proprietary information assets are important in today’s service economy.  Proprietary information can include research data, unique processes, unreleased products specifications, supply chain information, customer data, corporate strategy, marketing plans, source code, and more.  According to a 2007 study conducted by the American Society for Industrial Security (ASIS), intellectual property (including proprietary information) accounts for nearly three-quarts of the market value of a typical United States company.  The ASIS study reported that the financial impact of loss of proprietary information ranged from $10,000 to more than $5 million.

Source: Trends in Proprietary Information Loss Survey Report, August 2007, p.36, available at: www.asisonline.org/newsroom/surveys/spi2.pdf

Don’t let your business become a statistic. 

Developing and implementing a program to protect proprietary information that includes:

1.       Determination of proprietary information;

2.       Clear identification of the information;

3.       Procedures to handle the information (e.g., secure storage of documents, policies prohibiting vendors from bringing camera-phones into company facilities);

4.       Ongoing employee education regarding the procedures; and

5.       Regular audits to ensure internal compliance and evaluate potential information.