8 ms·

Kanagawa government hard disks swiped, sold online

63 points by ytch 7y ago

ossworkerrights 7y ago
I am curious why they chose to rent them instead of buying them, and how many times over they paid their price by doing so?
- gibolt 7y ago
  Maybe there was some reliability guarantee or it is just a tiny government office will little technical background.
- pizza234 7y ago
  The leasing model (it's not 100% certain from the article that they have been leased) may make sense for disks, if the idea is that after some time they must be necessarily replaced. Assuming they were leased, since the client returned them (instead of purchasing them), physicial space may have been a reason.
  - ossworkerrights 7y ago
    Wouldn't it mean that the lessor would be allowed to sell the drives? I mean if you rent them out, and they are handing the goods back would you just destroy them? Something doesn't sound right here.
    - agustif 7y ago
      Well recycling heavily used disk drives sounds more like waste disposal, I mean who can you sell that shit and get away with it? Maybe give em away if they work, idk.
bobthepanda 7y ago
If you want something done right (like making sure your data is no longer on someone else’s hard drive), you should really do it yourself. Zeroing filling a hard drive isn’t hard.
- GrumpyNl 7y ago
  Every hd i ever had and didnt use anymore, i smash a 2 inch nail through it. Thats permanent.
  - bobthepanda 7y ago
    They said they rented the disks, so that probably wasn’t possible. Renting physical hard drives does seem pretty dumb, though.
    - tpmx 7y ago
      http://www.asahi.com/ajw/articles/AJ201912060021.html http://www.asahi.com/ajw/articles/AJ201912060021.html The hard drives had been used for data sharing servers at the prefectural government office and were replaced with new ones in the spring. The prefectural government had deleted the data, but the successful bidder of the hard drives was able to restore them by using special software. The government is trying to locate the remaining nine hard drives, which were also sold online in July to August. The data servers had been leased from Fujitsu Leasing Co., which commissioned Broadlink Co. to scrap the replaced hard drives.
      - bobthepanda 7y ago
        There’s deletion, and then there’s deletion. Zero-filling, one-filling, and random-filling all the bits of a hard drive is sufficient to make previous data effectively unretrievable. That doesn’t sound like what happened here. https://skeptics.stackexchange.com/questions/13674/is-it-possible-to-recover-data-on-a-zeroed-hard-drive https://skeptics.stackexchange.com/questions/13674/is-it-pos...
      - raverbashing 7y ago
        "deleted" I would bet a lot of money they dragged the files to the "recycle bin" then maybe emptied it If they were external drives it's likely they were on FAT32 which makes it even easier
    - 7y ago
blondin 7y ago
off topic -- it made me happy to see a news paper from japan and in english too. i browsed around to see what they were covering and even if the news was gloomy, it was somewhat refreshing to see another perspective on what's going on in the world.
- ytch 7y ago
  From my personal experience, reading data in japanese language is the only reliable source to understand what happened in Japan. Their news, press releases, announcements in English are usually too loose.
- mpiedrav 7y ago
  There's also The Japan Times [1]. Several non-English speaking countries do have at least a newspaper in English [2]. [1] https://www.japantimes.co.jp https://www.japantimes.co.jp [2] https://en.m.wikipedia.org/wiki/Category:English-language_newspapers https://en.m.wikipedia.org/wiki/Category:English-language_ne...
  - mikekchar 7y ago
    What follows is a completely biased opinion, but I don't really have a high opinion of The Japan Times. IMHO they have an editorial slant that tends to cater to the foreign reader's biases rather than reporting news from a Japanese perspective. Like all newspapers, it's a mixed bag and there are often well written and insightful stories. However if I were looking for a place to stoke my confirmation bias for common misconceptions about Japan, The Japan Times would be the absolute first place I would look. The NHK world news linked in the original article is probably the best place to get Japanese news from a Japanese perspective in English, but you also have to be a bit careful. While the NHK is very similar to the UK's BBC in many ways, news stories are frequently very soft on government policy. So it's sort of the opposite of the Japan Times ;-) The quality in general is much better IMHO, though. If you don't mind relying on Google Translate (which is getting quite good these days) the TBS news website is very good: https://news.tbs.co.jp/ https://news.tbs.co.jp/ There is video for most stories and a transcript written under the video. This is actually what I used for studying to learn to understand the news. The quality of the stories vary, but they make a good counterpoint to the NHK. Keep in mind that all Japanese news offices tend to have a cozy relationship with the government, so you need to keep your mind open. If you have an interest in Japan, keeping abreast of these Japanese news is useful as I have found numerous blatant errors in foreign reporting of Japan -- sometimes to the point where they translate something a Japanese official says exactly the opposite to what they are saying. I don't think this is true only of Japanese news either. World news is full of shenanigans and it really is an eye opening experience to follow the news from the perspective of a different country/culture.
notadev 7y ago
Likely unrelated, but Kanagawa prefecture is home to a large US Navy base in Yokosuka city. A lot of military and US government employees likely have some of their data somewhere on those servers.
- jki275 7y ago
  I'm hoping this isn't the case as I spent a lot of years there. Most of us had little contact with the local government -- road tax was the only thing we were liable for to the local government. Well anyway, the US Government has managed to export all my personal data multiple times anyway, this can't be worse than that. The most they'd ever be able to get out of the Kanagawa government is the address where I lived when I was there and probably the license plate to the car I had.
_wldu 7y ago
Years ago, I bought an old Sun Netra server from ebay. It had the original OS and apps still installed. Before installing OpenBSD, I changed the root password and looked around. It had customer data from a large, well-known online company. I looked-up the company's contact info and emailed them. They called the next day and asked for the server's serial number (which I gave them). A few days later one of the company's executives called back and asked me to confirm the serial number (which I did), he said he was holding a certificate of destruction for that server's hard drives and would be taking some action against the contractor that had been hired to destroy them. I had already wiped the data and installed OpenBSD (or was about to). Anyway, I'm not surprised this type of thing still occurs. To be sure data is not exposed, companies ought to wipe drives themselves and encrypt them before handing them over to contractors. Once the gear is gone, no one knows where it will end up.
- tyingq 7y ago
  I had a similar experience. Bought a 1U server on eBay. It was apparently the central controller for the flight information displays at a big airport. Lots of plain text passwords for upstream services in config files, etc.
- mc32 7y ago
  If things are that sensitive and important no disk should leave a building whole. You have to have a ridiculous process in place that is unforgiving that says that unless physically destroyed a disk cannot leave a building (unless it’s in a sealed bag from mfg —obviously disks have to get from receiving to where they’ll be used).
  - avar 7y ago
    You make that policy and pay a contractor to enforce it, and now you're back to square #1. Usable hard disks are just heavier and more inconvenient money. Truly ensuring their destruction is going to cost, including but not limited to security guards, people to watch those people, searching through or destroying the trash generated in the building, looking through "parts" to see if they're disassembled hard disks etc.
C14L 7y ago
There should be no need to wipe or zerofill the drives. They should be full disk encrypted from the start.

63 points by ytch 7y ago

I am curious why they chose to rent them instead of buying them, and how many times over they paid their price by doing so?

gibolt 7y ago
Maybe there was some reliability guarantee or it is just a tiny government office will little technical background.
pizza234 7y ago
The leasing model (it's not 100% certain from the article that they have been leased) may make sense for disks, if the idea is that after some time they must be necessarily replaced. Assuming they were leased, since the client returned them (instead of purchasing them), physicial space may have been a reason.
- ossworkerrights 7y ago
  Wouldn't it mean that the lessor would be allowed to sell the drives? I mean if you rent them out, and they are handing the goods back would you just destroy them? Something doesn't sound right here.
  - agustif 7y ago
    Well recycling heavily used disk drives sounds more like waste disposal, I mean who can you sell that shit and get away with it? Maybe give em away if they work, idk.

bobthepanda 7y ago

If you want something done right (like making sure your data is no longer on someone else’s hard drive), you should really do it yourself. Zeroing filling a hard drive isn’t hard.

GrumpyNl 7y ago
Every hd i ever had and didnt use anymore, i smash a 2 inch nail through it. Thats permanent.
- bobthepanda 7y ago
  They said they rented the disks, so that probably wasn’t possible. Renting physical hard drives does seem pretty dumb, though.
  - tpmx 7y ago
    http://www.asahi.com/ajw/articles/AJ201912060021.html http://www.asahi.com/ajw/articles/AJ201912060021.html The hard drives had been used for data sharing servers at the prefectural government office and were replaced with new ones in the spring. The prefectural government had deleted the data, but the successful bidder of the hard drives was able to restore them by using special software. The government is trying to locate the remaining nine hard drives, which were also sold online in July to August. The data servers had been leased from Fujitsu Leasing Co., which commissioned Broadlink Co. to scrap the replaced hard drives.
    - bobthepanda 7y ago
      There’s deletion, and then there’s deletion. Zero-filling, one-filling, and random-filling all the bits of a hard drive is sufficient to make previous data effectively unretrievable. That doesn’t sound like what happened here. https://skeptics.stackexchange.com/questions/13674/is-it-possible-to-recover-data-on-a-zeroed-hard-drive https://skeptics.stackexchange.com/questions/13674/is-it-pos...
    - raverbashing 7y ago
      "deleted" I would bet a lot of money they dragged the files to the "recycle bin" then maybe emptied it If they were external drives it's likely they were on FAT32 which makes it even easier
  - 7y ago

blondin 7y ago

off topic -- it made me happy to see a news paper from japan and in english too. i browsed around to see what they were covering and even if the news was gloomy, it was somewhat refreshing to see another perspective on what's going on in the world.

ytch 7y ago
From my personal experience, reading data in japanese language is the only reliable source to understand what happened in Japan. Their news, press releases, announcements in English are usually too loose.
mpiedrav 7y ago
There's also The Japan Times [1]. Several non-English speaking countries do have at least a newspaper in English [2]. [1] https://www.japantimes.co.jp https://www.japantimes.co.jp [2] https://en.m.wikipedia.org/wiki/Category:English-language_newspapers https://en.m.wikipedia.org/wiki/Category:English-language_ne...
- mikekchar 7y ago
  What follows is a completely biased opinion, but I don't really have a high opinion of The Japan Times. IMHO they have an editorial slant that tends to cater to the foreign reader's biases rather than reporting news from a Japanese perspective. Like all newspapers, it's a mixed bag and there are often well written and insightful stories. However if I were looking for a place to stoke my confirmation bias for common misconceptions about Japan, The Japan Times would be the absolute first place I would look. The NHK world news linked in the original article is probably the best place to get Japanese news from a Japanese perspective in English, but you also have to be a bit careful. While the NHK is very similar to the UK's BBC in many ways, news stories are frequently very soft on government policy. So it's sort of the opposite of the Japan Times ;-) The quality in general is much better IMHO, though. If you don't mind relying on Google Translate (which is getting quite good these days) the TBS news website is very good: https://news.tbs.co.jp/ https://news.tbs.co.jp/ There is video for most stories and a transcript written under the video. This is actually what I used for studying to learn to understand the news. The quality of the stories vary, but they make a good counterpoint to the NHK. Keep in mind that all Japanese news offices tend to have a cozy relationship with the government, so you need to keep your mind open. If you have an interest in Japan, keeping abreast of these Japanese news is useful as I have found numerous blatant errors in foreign reporting of Japan -- sometimes to the point where they translate something a Japanese official says exactly the opposite to what they are saying. I don't think this is true only of Japanese news either. World news is full of shenanigans and it really is an eye opening experience to follow the news from the perspective of a different country/culture.

notadev 7y ago

Likely unrelated, but Kanagawa prefecture is home to a large US Navy base in Yokosuka city. A lot of military and US government employees likely have some of their data somewhere on those servers.

jki275 7y ago
I'm hoping this isn't the case as I spent a lot of years there. Most of us had little contact with the local government -- road tax was the only thing we were liable for to the local government. Well anyway, the US Government has managed to export all my personal data multiple times anyway, this can't be worse than that. The most they'd ever be able to get out of the Kanagawa government is the address where I lived when I was there and probably the license plate to the car I had.

_wldu 7y ago

Years ago, I bought an old Sun Netra server from ebay. It had the original OS and apps still installed. Before installing OpenBSD, I changed the root password and looked around. It had customer data from a large, well-known online company. I looked-up the company's contact info and emailed them. They called the next day and asked for the server's serial number (which I gave them). A few days later one of the company's executives called back and asked me to confirm the serial number (which I did), he said he was holding a certificate of destruction for that server's hard drives and would be taking some action against the contractor that had been hired to destroy them. I had already wiped the data and installed OpenBSD (or was about to). Anyway, I'm not surprised this type of thing still occurs. To be sure data is not exposed, companies ought to wipe drives themselves and encrypt them before handing them over to contractors. Once the gear is gone, no one knows where it will end up.

tyingq 7y ago
I had a similar experience. Bought a 1U server on eBay. It was apparently the central controller for the flight information displays at a big airport. Lots of plain text passwords for upstream services in config files, etc.
mc32 7y ago
If things are that sensitive and important no disk should leave a building whole. You have to have a ridiculous process in place that is unforgiving that says that unless physically destroyed a disk cannot leave a building (unless it’s in a sealed bag from mfg —obviously disks have to get from receiving to where they’ll be used).
- avar 7y ago
  You make that policy and pay a contractor to enforce it, and now you're back to square #1. Usable hard disks are just heavier and more inconvenient money. Truly ensuring their destruction is going to cost, including but not limited to security guards, people to watch those people, searching through or destroying the trash generated in the building, looking through "parts" to see if they're disassembled hard disks etc.

C14L 7y ago

There should be no need to wipe or zerofill the drives. They should be full disk encrypted from the start.