Hard drive sales pose security threat

BOISE – Idaho Power sold used computer hard drives on eBay, allowing the new owners to access confidential information, including the Social Security numbers and names of some employees and memos to the company’s top officers.

The hard drives had not been completely “scrubbed” as required by company policy, officials said. Company officials were trying to track down all the purchasers, and so far about 95 percent of the released data had been accounted for, according to an Idaho Power news release.

The problem was noticed after Boise television station KTVB and an NBC affiliate in Cincinnati – where some of the hard drives were purchased – conducted an investigation, KTVB reported. The Boise station told Idaho Power about its findings, and the company issued a news release acknowledging the problem Friday afternoon.

“Idaho Power takes very seriously its responsibility to protect confidential information,” company security manager Robin Rice said in a prepared statement. “The company is committed to fully investigating the matter, and is taking steps to secure the return of the equipment and information.”

In the future, Rice said, all information disks and equipment containing confidential information will be destroyed.

“Our practice that had been in place was to scrub to the specifications of standards set by the Department of Defense,” said Jeff Beaman, Idaho Power spokesman. “So, those are very stringent standards. But what we will be doing going forward is we will not be recycling or salvaging any discs that contain data, we will be destroying them instead.”