Security Theater in Data Destruction: When Looking Secure Isn’t the Same as Being Secure

A mobile shredding service is a business that comes directly to your location in a truck equipped with shredding equipment to obliterate documents and media. When you order the service, a security-screened truck driver arrives on-site, collects your materials in locked containers, and shreds them inside an industrial shredder built into the vehicle. 

Many mobile shredding services have their truck drivers wear matching uniforms, badges, patches, gloves, and other credentials that project authority. To customers, the truck drivers’ appearance can resemble that of law enforcement or a government security officer. At the same time, the truck drivers’ attire is a harmful form of security theater because it prompts customers to place trust in their company apparel in lieu of the security controls that protect their information. 

A part of data security boils down to the trust you have in your data destruction team. This trust can be dangerous if customers assume that professional shredding clothing guarantees secure handling of their information. At the same time, the truck driver's attire does not prevent misconduct or ensure that the documents are properly destroyed. On every mobile shredding hire's first day of work, they get a badge and a uniform, making it valueless. The badge on a truck driver’s chest does not strengthen chain of custody, refine the destruction process, prevent data recovery, or satisfy a privacy regulation. 

This kind of security theater is not free, and can be costly. Every mobile shredding invoice customers receive helps pay for these truck drivers to play dress-up as security professionals. The mobile shredding companies do not invest in measures that meaningfully improve data security.

In fact, a dishonest truck driver could remove documents containing personal, financial, or business information rather than shredding them as promised. The uniform itself does not prevent this type of abuse. Authentic security comes from reliable destruction methods instead of from visual symbols of authority. When an elaborate outfit becomes confused with protection, it crosses into security theater.

A hard drive degaussing report is a document that records and verifies the disposition of hard drives that have undergone a data destruction method called degaussing. The report is a component of IT asset destruction (ITAD), which is the entire practice of securely retiring IT equipment. The primary purpose of a hard drive degaussing report is to document which assets were destroyed and when they were destroyed.

Some data destruction degaussing systems take photographs of hard drives before or after destruction. The images are included in hard drive degaussing reports alongside serial number records. Initially, this may seem like a valuable security feature. After all, more documentation must mean more security, right? Ultimately, hard drive degaussing reports filled with hard drive photographs are another form of security theater. They produce the appearance of greater oversight and accountability without providing substantial evidence that data destruction occurred.

Degaussing is a data destruction technique that uses a powerful magnetic field to erase the data stored on a hard disk drive. Unlike HDD shredding or HDD crushing, this approach leaves the physical drive intact. If someone takes a photo of a degaussed hard drive for a hard drive degaussing report, it is still going to appear the same as it was before the destruction procedure. A picture cannot demonstrate that the magnetic media was successfully sanitized. 

Feeling secure should not be confused with being secure. Organizations may feel reassured by pages of images and visual documentation, but the photographs do not validate the effectiveness of the degaussing technique or prove that data is unrecoverable. Another drawback to hard drive degaussing reports is that every hard drive image collected, stored, organized, and transmitted becomes another piece of information that must be managed and protected.

The photographs of hard drives may reveal asset labels, inventory markings, customer names, location information, meta data, or other details that organizations would prefer to keep private. These image-heavy hard drive degaussing reports increase storage requirements, expand the organization's data footprint, and introduce additional privacy and security risks. 

This type of security theater can also be expensive. Integrating a camera system into a degausser adds hardware, software, storage, and reporting capabilities that increase the overall cost of the equipment. Depending on the system, these camera-based reporting features can double the price of a degausser. Organizations end up paying extra for pages of photographs that do not provide additional protection during the destruction process.

When documentation is mistaken for proof, organizations can end up investing in the appearance or feeling of security rather than security itself.

A certificate of destruction documents when the data destruction was carried out, who executed it, and which assets were included. Numerous organizations require certificates of destruction because they believe that the document is final proof that their confidential information has been securely demolished. The problem is that a certificate does not eradicate data. 

The National Institute of Standards and Technology (NIST) released a set of guidelines for media sanitization called NIST SP 800-88 Revision 1. NIST states that organizations should verify the effectiveness of their media sanitization process when removing data from hard disk drives, solid-state drives, USB flash drives, magnetic tapes, and optical media. Verification means confirming that the selected sanitization method successfully rendered the data unrecoverable. A certificate alone cannot provide that assurance.

For example, a certificate cannot erase a hard drive, shred a solid-state drive, or crush a disk platter. It is simply a record that indicates that the data destruction operation was performed. A professionally designed certificate containing company logos, signatures, serial numbers, and official language is a form of security theater. This is because it makes organizations feel confident. They think that the document is polished, even though it does not provide technical evidence that the media was successfully sanitized. 

Because certificates are often created using common software such as Microsoft PowerPoint, or proprietary software, they can be relatively easy to reproduce or fabricate with no explanation for the requirements. A convincing-looking fake certificate can be assembled in a matter of minutes, and can be sold at a high price.

The danger of this type of security theater is that organizations start measuring security by paperwork in place of outcomes. Instead of contemplating whether a paper shredder generated particles of the required size, whether a degausser developed a magnetic field strong enough to meet industry standards, or whether the sanitization process was verified in accordance with NIST SP 800-88, they only focus on if they received a certificate at the end of the data destruction job. 

Documentation has value, but it is not security. When a certificate becomes the only reason an organization is positive that their data is protected, it has shifted from becoming a useful record to an expression of security theater.