Truth 6 Dumpster diving for profit

In the previous Truth, I spoke about what people throw away when they are at home and the risks that come with it. However, those risks are nothing compared to what my coworkers and I have discovered while dumpster-diving throughout the years. While many states have started prosecuting companies for discarding consumers’ confidential information insecurely, it seems the majority of the world has simply not paid attention.

In early 2007, Radio Shack allegedly dumped more than 20 boxes containing private information for thousands of customers. A man rummaging through the dumpster found the boxes and reported it. In April, the State of Texas filed a civil law suit against Radio Shack for allegedly exposing its customers to identity theft. The suit claimed that the company “failed to safeguard the information by shredding, erasing, or other means, to make it unreadable or undecipherable before disposing of its business records.”

The fact that the data was discovered comes as no surprise. The simple fact is that throughout the hundreds of dumpsters that I have had the pleasure of “visiting,” it has been a rare day that I come away empty-handed. Most often I leave with enough confidential information to keep the average identity thief in business for months, or even years. I have found social security numbers, copies of drivers’ licenses, credit applications, credit card numbers, complete names and addresses, and phone numbers—all in the trash. And those are just the obvious things.

A company we recently tested was actually throwing away the drug test documentation on all of its potential new hires. Each document included the name, address, social security number, and the results of the test. Not only was the company putting that person at risk of identity theft, but it was also a walking time bomb for a lawsuit. Imagine if one of those potential employees had failed that test and the information was made public? The fallout could have been devastating on all sides.

At another location, a financial institution was discarding confidential information, including copies of loan applications, social security numbers, banking account numbers, and more. But in this case, instead of placing the items in the trash dumpster, the institution was placing the information in bins located outside the facility designated for recycling. I have noticed that this seems to be part of a growing trend in confidential information leaks. In general, people are interested in the green movement, and instead of throwing items that need to be shredded into the appropriate designated shred areas, they are placing the documents into the recycle bin.

Recycling versus shredding

When I have spoken with employees who have been caught placing sensitive documents into recycling bins, their explanation has been that they thought recycling was different from trash and, therefore, somehow safe. When asked to explain further, employees generally tell me that, while trash ends up at the landfills where anyone could get his hands on it, recycling is taken to a place where it will be reused. They often tell me they feel that it’s safe to place confidential documents into a recycling bin since the document will be destroyed instead of being shipped to a landfill. Let me be perfectly clear: Recycling is no more secure than throwing the items into the trash. For those out there who are worried about being green, most major shredding companies do recycle once they have shredded the documents.

What’s your company line?

I have found that the amount of confidential information I discover in the garbage is directly related to how much the organization preaches the virtues of shredding to its employees.

My personal theory is this: Walk up to an employee’s desk and stick your arm straight out like wings on an airplane. Now spin in a circle. Is there a place for the employee to place confidential documents that require shredding within your arm span? If not, I can promise you that the employees are probably not shredding everything they need to.

The problem is this: Often times an organization places a shred barrel on each floor of its facility. The employees are then expected to get up throughout the day and place any papers they have with confidential information on them into those bins. Of course, what ends up happening is that the employees begin to build a pile on their desks of questionable items. As the day goes on, the papers start to get in the way. Since the employees are busy and not willing to take the stack to the shred barrel, they often just put them in the trash or do what I refer to as the “poor man shred.” That is, they physically tear up the paper themselves. When I find documents that have been torn by hand, I take them home and give them to my 7-year-old son and tell him it’s a puzzle. He always puts them back together.

In other cases, if employees end up with only one document that needs shredded, they may not want to waste the trip to the shred barrel, so again, the document ends up in the trash.

Shredders for all

The best possible solution is to have a small shredder at each desk. This makes it easy for employees to shred every work paper, eliminating any confusion of what is and is not considered confidential. If that is not a feasible option, add a second trash can at each desk designated for shredding. If you choose this second option, be aware that it does come with additional risks. You must make certain that the recycling at each employee’s desk is removed at the end of each day. You do not want to be leaving an open box of confidential documents at each desk where the cleaning crew or other visitors may have access.

My last suggestion is the most important. I highly recommend that you get yourself some rubber gloves and a couple of empty trash bags and head out to your own dumpster. Find out for yourself what is ending up in your trash. You will probably be amazed and possibly even a little concerned about what you find.