Discarded Office Machines Could Put Trade Secrets at Risk

By Heide B. Malhotra
Heide B. Malhotra
Heide B. Malhotra
August 10, 2010 Updated: October 1, 2015

Trade secrets, personal data, and industry customer data are at risk the minute a firm sells or disposes of its digital printers and copiers. (photos.com)
Trade secrets, personal data, and industry customer data are at risk the minute a firm sells or disposes of its digital printers and copiers. (photos.com)
WASHINGTON—When discussing the theft of business trade secrets, we conjure up images of agents rummaging through corporate dumpsters, phishing and malware attacks, and treacherous corporate spies.

But few could guess that discarded photocopiers and printers from companies are a source for a wealth of business trade secrets found within their hardened plastic shells. And even machines taken for repair outside the office building could create a windfall for swindlers.

Trade secrets, personal data, and industry customer data are at risk the minute a firm sells or disposes of its digital printers and copiers with onboard memory.

“Thousands of these machines leave businesses every month with the internal data intact,” according to Digital CopierSecurity Inc. (DCSI). “Some are resold domestically and many are placed into cargo containers and shipped overseas. There is no control over the resale of these machines. They are sold on the open market to anyone with the cash to buy them.”

Not just copiers, but modern fax machines can also store digital images of a scanned document, given that they also have a built-in hard drive, and could reveal a treasure trove of information to malicious individuals.

Much of this technology, such as onboard memory, is a necessity given the demand for ever-increasing speed of printing.

“The machines store this information to improve performance. If you want ten carbon copies, the machine would scan the document only once, store the scan in the memory and then print copies from the memory directly,” according to the Digital Inspiration website.

Any information stored on the hard drive of a printer/copier or fax machine can be retrieved even by a layperson and even if the hard drive has been removed, unless the machine has been encrypted or wiped clean by a software program.

“If a fraudster manages to pull out the disk from the photocopier, it can be [a] real ‘goldmine’ as he’ll probably find everything there from employee credit card numbers to resumes to faxes and much more,” according to Digital Inspiration.

DCSI claims that the majority of printer/copier manufacturers do not put the encryption function on the machine nor install software that wipes the memory clean. Therefore, all companies are at risk of losing company secrets unless they manually wipe such data.

According to a CBS report, a warehouse in New Jersey—one of 25 such warehouses nationwide—gives the buyer a choice of 6,000 machines that were previously owned by companies from many industrial sectors, as well as the federal and state governments.

Problem Identified

“The risk to Corporate Intelligence and sensitive information is understated in the CBS report,” according to an article on the OnlineConnect.co.uk website.

Online Connect claims that the digital photocopier industry either neglected to state or kept secret the fact that information would be stored in the form of images on the machine and could be retrieved without any problem.

The Xerox Corporation responded immediately to a CBS Evening News report on the subject. It emphasized on its Real Business at Xerox website that it was one of the first companies to recognize the problem of possible data theft from its digital printing machines when discarded, sent out for repair, or sold.

“In the mid-90s, we were one of the first to introduce the secure print feature, an option that safely stores jobs in the machine until the owner enters a PIN to release them,” said Rick Dastin of Xerox in a statement.

He stressed, “Security remains an industry-wide and longstanding challenge that has received the best of Xerox’s research and innovation.”

One response on the Xerox website claimed that used Xerox machines are popular in India and many were found to have quite a bit of company confidential information still available on these machines.

Xerox responded that it is still the customer’s responsibility to enable the image overwrite feature or wipe the hard drive clean before a lease expires, the machine is sent out for repair, or discarded in any other way.

Invention of the Copying Machine

Chester Carlson, a patent attorney who invented products in his spare time, was the father of the first copying machine.

“He filed a patent application in April, 1939, stating, ‘I knew I had a very big tiger by the tail.’ The Xerox Corporation trademarked the name ‘Xerox’ and has protected the name carefully,” according to an article on the about.com website.

Chester tried to sell the idea of a copying machine unsuccessfully from 1938 to 1944. Among those who didn’t buy into the invention were International Business Machines (IBM) and the U.S. Army Signal Corps.

“Business executives and entrepreneurs didn’t believe there was a market for a copier when carbon paper worked just fine,” according to history about the beginnings of the Xerox company.

In 1947, the Haloid Company, producer of photographic paper, based in Rochester, N.Y., bought the rights to Carlson’s invention. The company produced the first copiers under the name Xerox, renamed the company to Haloid Xerox Inc. in 1958, and in 1961, to Xerox Corporation.

By 1976, more than 200,000 copiers had been sold worldwide. Today, almost all medium-sized and large companies, as well as many small companies, own or lease a digital copying machine.