In electronics recycling and IT asset disposal, chain-of-custody is a process that documents exactly where electronic items are during all stages of recycling. It includes an item’s custody, transfer, analysis, and disposal. Why does this matter? If a company doesn’t know where items are, there’s no way to prove information on those electronics wasn’t stolen and used illegally.
There’s another reason you want a strong chain-of-custody with your ITAD and e-recycling. If a customer’s information is leaked and you’re questioned, you can prove you’re not at fault if you have complied with the proper protocol when it comes to recycling electronics. The chain-of-custody helps find if there are weak links in your process or if it’s someone else’s fault.
Morgan Stanley learned this the hard way when the company was fined $60 million. During a data center decommissioning, the company didn’t take steps to make sure those subcontractors destroyed data before reselling the devices.
Not Every Company Properly Disposes of Electronics
Back in 2019, Blancco, an international data security company, released details into a survey into what companies do with end-of-life electronics and office equipment. The findings of this survey are concerning.
- Over 50% of the companies surveyed admitted that their devices sat for at least two weeks before the data was wiped.
- Close to 40% admitted they use free data wiping software and don’t rely on physical destruction. Almost 20% do not audit the steps taken during the destruction process.
- More than 30% do not record serial numbers during data destruction and recycling.
How well does your company do? Are you tucking away unused electronics in the back of a storage closet for years? Do you keep an inventory of electronics and their serial numbers? If something did go missing, would you even know? To better understand chain-of-custody, take a closer look at what each of the steps entails at ERI.
#1 – Collection and Recording
Collection is the first step where chain-of-custody is important. An ITAD provider comes to your place of business to pick up end-of-life office equipment. The person sent should be reputable and knows the rules to follow. If a random person comes in and fails to follow the correct protocol, the risk of loss or theft increases. Ideally, you want to partner with a company that carefully vets its employees and partners with the appropriate level of truck driver, such as a TSA-certified drive for Enhanced Compliance services.
You need a list of the items that are being sent for e-recycling and data destruction. With that list, you need to have the serial number for each item. Once it’s created, where is the list stored? Keep a copy saved on your hard drive, but it’s also important to print the list out and secure it in a safe or lockbox. Supervise the process to make sure something that is not on the list isn’t accidentally taken.
What if you’re doing some of the work yourself. You order secure recycling boxes. When the driver comes to pick up the boxes, ask for ID. Verify that the driver is, in fact, from the company the ITAD provider works with. Make sure you get or keep a copy of the packing slip with the tracking number. ERI partners with UPS and allows you to follow the package on its way to ERI’s processing facility.
#2 – Transportation/Tracking
Partner with an ITAD provider that allows you to track your shipment’s location with real-time tracking. You want to know where items are at each stage. If you can’t see where your items are, it’s harder to track them down if something goes wrong. Knowing where items are at each stage makes them easier to find if they get misplaced.
ERI uses Optech for real-time management and tracking. While it ensures you know where your items are through the process, it does a lot more. This in-house software builds a list of items by their category, weight, and serial number. Bill of ladings and status updates are also available in this software. For customers using secure recycling boxes, package tracking is available. A list of electronics that can be refurbished is available, too. When the process is complete, users also get a detailed certificate of ITAD and recycling and can print out their final invoice.
#3 – Data Destruction
Make sure data is destroyed with reports certifying it. Depending on the services you choose, you can opt to have data destruction occur in your place of business or at the provider’s secure facility. If you decide to have data destroyed in a facility, look at companies that have 24/7 security, video monitoring, RFID card readers, metal detectors, and protocol where only authorized personnel are allowed.
Choose the appropriate level for ITAD services. Standard Compliance may be enough for your store, but a government agency may need to partner with a company that provides Demilitarization Services. This extremely secure level is designed for devices with top-secret materials.
Once data is destroyed, items are evaluated to see if there is any value to them. This all happens in the next step, processing.
#4 – Processing
Before processing electronics, a company will look at the item to see if it has value. If there’s the chance you could have the items refurbished and sold for a profit, you’ll recoup some of your ITAD expenses. An item may not have much life left, but some of the parts inside it could be valuable. See if remarketing is an option with your provider.
Items that have no value left are sent to shredders. The shredding area is where electronics are chopped into tiny pieces and separated into different components like glass, metal, and plastic. Those components go to processors who melt them down for reuse. Shredding areas are secured and only authorized staff go into this area.
At ERI, even the recycled components go only to approved companies. The chain of custody doesn’t end once the item is in the shredder. The downstream processes have to go through an application process with the Downstream Vendor Management Program and audit to ensure security.
#5 – Reporting
At the end of the ITAD and electronics recycling process, you should receive a certificate providing proof that the items were recycled completely and correctly. Ask about a Certificate of Destruction if you’re not offered one. It needs to show the date of destruction and how many of each item was destroyed.
A lot goes into electronics recycling and IT asset disposition to ensure no device is lost or improperly disposed of. How do you choose a company that will complete the job correctly and not take shortcuts? Pay close attention to the certificates your ITAD provider holds.
A company that follows federal and local guidelines is going to be e-Stewards certified, which is only given to companies that do not ship electronics to other countries for processing. The R2 Standard is awarded to companies that follow strict guidelines regarding e-recycling. NAID AAA is only given to ITAD companies that adhere to strict guidelines involving secure data destruction. Companies with NAID AAA, R2, and e-Stewards certificates are audited regularly to make sure adherence to safety, quality, and documentation hasn’t become lax.
ERI is certified by e-Stewards, NAID AAA, and R2. Plus, we hold three ISO certificates for electronic recycling and asset management that protects the environment, quality measures, and workers. We pride ourselves in ITAD practices that protect the world from environmental damage and people from data theft. Call us to discuss our ITAD chain-of-custody measures.