McCollum calls for investigation into government sales of tapes

(AP) - U.S. Rep. Betty McCollum has asked the Government Accountability Office to reopen an investigation into privacy and national security risks when the federal government sells used magnetic data tapes, saying a Minnesota company, Imation, has demonstrated that sensitive material can be pulled off the tapes.

Last year, the GAO, Congress' investigative arm, issued a report to the Senate Homeland Security and Governmental Affairs on the sale of such tapes, which are used for data storage.

"Based on the limited scope of work we performed, we conclude that the selling of used magnetic tapes by the government represents a low security risk, especially if government agencies comply with NIST guidelines in sanitizing their tapes," the GAO concluded last September.

The NIST is the National Institute of Standards and Technology.

In a recent letter sent to the GAO, released by McCollum on Tuesday, the Minnesota Democrat said that GAO investigators spent some time at the offices of Imation, an Oakdale-based maker of magnetic data storage products.

According to McCollum, the investigators left behind several "recertified" used tapes purchased on the open market for the company to analyze.

Imation then did a more thorough review of the tapes, McCollum said, and found that although the tapes were supposed to be "clean," the company found data such as bank account numbers, employee information and international tax benefits documents.

"If federal agencies are selling used magnetic storage tapes on the open market with this level of recoverable sensitive data available to anyone with minimum technical skills or equipment," McCollum wrote, "we should all be alarmed and demanding greater accountability from federal agencies engaged in such sales."

She urged the GAO to do a broader investigation to ensure that government agencies are not reselling used tapes from which sensitive information could be recovered.

An Imation spokeswoman confirmed McCollum's account of the testing and data recovery from used tapes Tuesday night, and said the company had no additional comment. GAO officials declined to comment Wednesday morning.

In its report last year, the GAO said that although there is no general legal requirement that the government erase data on magnetic tapes before disposing of them, the NIST has issued guidelines for agencies to sanitize the tapes of sensitive data before they leave the control of the agency.

The GAO said it obtained used magnetic tapes and tested them to see if data could be retrieved.

"In summary, we could not find any comprehensible data on the used magnetic tapes we tested," the GAO said. "We obtained these tapes from the only company (of the five we investigated) that told us it resells tapes purchased from the federal government."

According to the report, there is a substantial secondary market for used magnetic tapes in the U.S.

The GAO did raise questions "about the lack of oversight regarding the sanitization or disposal of used magnetic tapes by agencies."

(Copyright 2008 by The Associated Press. All Rights Reserved.)

Gallery

Fullscreen SlideshowPrevious Slide

1 of 1

Next Slide