Disposal of Northwestern University Computers

Audience:

All members of the Northwestern Community who utilize University-owned computers.

Definition:

University Services offers a service to formally dispose of Northwestern University (NU) computers and peripherals. This service has been designed to help NU meet the Environmental Protection Agency (EPA) regulations for equipment disposal. Information on this service can be found on the Computer & Peripherals Recycling Program Web page.

Northwestern University Information Technology (NUIT) recommends utilizing this service as it also offers data removal for no charge. For equipment acquired using federal funds, you must get approval of Accounting Services for Research and Sponsored Programs (ASRSP) for disposal. Information on ASRSP can be found at http://www.northwestern.edu/asrsp/.

Equipment with inventory tags (or cost exceeding $5,000) must be reported to the Accounting Services Equipment Inventory Coordinator.

Policy Statement:

It is the responsibility of the department or individual in possession of NU owned computer(s) to ensure that data has been properly removed from the hard drives of computers before removal or redeployment by one of the following two methods:

  • For computers that are slated to be removed from NU ownership, please utilize University Services' Computer & Peripherals Recycling Program to handle the proper removal of data and recycling of hardware. This program is further detailed in the Program Summary section below.
  • For computer redeployment within NU or for disposal not by University Services, the steps given in the Procedure section below must be followed for the proper removal of data. For departments and individuals who require assistance with these procedures, Distributed Support Services is available to assist.

Background Issues:

Procedure

Deleting files from the computer does not remove the data. Data that has been "deleted" without utilizing the methods listed below can simply be "undeleted."

Desktop computers must have their hard disk drives sanitized (data overwritten) with software that completes a three-pass binary wipe. A three-pass binary wipe writes zeros, ones and then pseudo-random over existing data. This procedure should be completed prior to removing the equipment from the existing environment.

NUIT recommends products such as DBAN (opensource software/freeware) for erasing hard drives prior to disposal.

Software

Generally, Microsoft licenses its original Windows operating system to the processor and motherboard of the desktop computer. So, while it is required that all data be erased using the method above (including the operating system) it is appropriate to pass on the original Microsoft Operating System installer disk with the computer when it is sold or repurposed in another department.

However, any software purchased from the NUIT's site licensed program (examples include: Microsoft Office, Adobe Photoshop, etc.) must be retained by the University and can be redeployed by the department that originated the purchase. Note: This includes operating system upgrades.

Satisfies ISO 27002 9.2.6

Last Review Date: 

December 2013

Original Issue Date:

July 2004

Revision Dates:

February 2006

March 2008

July 2011

December 2013

Additional Information:

It should be noted that U.S. Department of Defense (DOD) standard for sanitizing hard drives is significantly more stringent and primarily involves the destruction or significant magnetization of the hard drive.

For additional information, please see:

Support Contact:

DSS General Support (1-HELP)
847-491-4357
consultant@northwestern.edu