Governments and Public Organizations Spend $17 Million Yearly Destroying SSDs

Research launched by Blancco Technology Group reveals current practices and policies for device sanitization within the public sector.

For this study, The Price of Destruction: Exploring the Financial & Environmental Costs of Public Sector Device Sanitization, researchers spoke to 596 government IT leaders across 9 countries.

The survey revealed that the governments and public sector organizations represented spend as much as $17 million annually on the physical destruction of SSDs, a storage device used both independently and within laptops, desktops, and servers.

Additionally, replacement costs added another $40 million, bringing expenses up to $57 million for destroying public sector technology that is often still usable. For 70 organizations surveyed in each country, the costs for SSD destruction and replacement reached between $6.9 million and $7.3 million for the US and between $6.4 million and $6.9 million for UK.

Estimated total cost of drive destruction and new SSD purchases for survey respondents.
Numbers are as reported or calculated per annum, per respondent, unless otherwise noted.
Click to enlarge

Environmental Costs
With global electronic (e-waste) called the “world’s fastest growing domestic waste streamhttps://ewastemonitor.info/gem-2020/,” the study also explores the environmental costs of physical destruction and the public sector’s current engagement with sustainable alternatives. Unnecessary destruction increases IT operations and materials costs for fiscally constrained public sector organizations. It also fosters increased e-waste creation during a global call for more prudent environmental stewardship.

Despite 54% of respondents agreeing that reuse of SSDs is better for the environment than physical destruction and almost all respondents (93%) saying their organization had defined plans to reduce the environmental impact caused by destroying IT equipment, less than a quarter (21%) are actively implementing those plans.

Security Concerns
For security reasons, physical destruction is still mandated if decommissioned drives were used to store classified or secret data. For unclassified data-bearing assets, other data sanitization solutions are available.

On the whole, respondents were well informed of their country’s or region’s respective data protection laws. However, some respondents’ processes for carrying out compliant SSD sanitization are concerning. For example, 78% of respondents globally said they reformat drives to sanitize them. Unfortunately, formatting alone can still leave drives vulnerable during transport or storage, and much of the data can be recovered with forensics tools easily available online.

“Governments and public sector organizations are responsible for handling some of the most sensitive information in the world. But several factors, including accelerated digital transformation, rising numbers of public sector data breaches and global sustainability initiatives, are changing the data management landscape,” said Alan Bentley, president of global strategy, Blancco. “With growing environmental and funding pressures, there is a need for these public sector operations to be more sustainable and efficient while maintaining robust security. Public sector organizations must explore SSD sanitization alternatives to demonstrate prudent use of agency funds and a greater contribution to national and international sustainability efforts.”

“We’ve seen several public sector departments benefit from moving away from destroying data bearing assets to reusing them or building up the circular economy. Our study highlights that there are significant opportunities for policy reform surrounding SSD data protection as national policymakers seek to steward financial, environmental, and data resources entrusted to their care,” he added.

As the report concludes, governments and public sector organizations are committing to sustainability improvements, but very few have pushed forward with their implementation. This is resulting in a high cost of SSD destruction and replacement.

With governments and public sector organizations under the spotlight when it comes to spending, it is urgent that they consider sustainable alternatives that extend device life, maintain lock-tight data security on end-of-life SSDs and, ultimately, save public services millions of dollars.

According to this study of 596 public sector respondents:
• 41% of respondents say physical destruction is mandated by law to physically destroy SSDs that contain classified data, so they destroy all SSDs “just in case.”
• Almost a quarter (22%) are unaware of alternative methods of sanitization.
• Between 23% to 52% of organizations within a country believed that physical destruction was cheaper than other sanitization solutions, including those that would facilitate reuse and longer device life.
• 35% believe there is no certified or approved vendor or solution that provides another option for them.
• Between 37% and 45% of our respondents’ devices, or the drives alone, are sent offsite for physical destruction.
• 37% of respondents are “aware of only” the NIST SP 800-88 r1 and do not know guideline details.

Methodology:
The study was commissioned by Blancco and conducted independently by Coleman Parkes Research Ltd. in December 2021 and January 2022. Data was gathered from 596 government employees from 9 countries: USA, Canada, UK, France, Germany, Japan, Singapore, India, and Australia. 55% work for organizations between 1,000 and 4,999 employees, and 45% work for organizations with more than 5,000 employees. The countries represent the North America, Europe, and AsiaPac regions in which the vendor operates.

US findings:
• 15% of respondents are “aware of only” the NIST SP 800-88 r1 and do not know guideline details.
• 22% of respondents are actively implementing plans to reduce impact of IT equipment destruction
• 38%% of respondents believe physical destruction is cheaper than alternatives

UK findings:
• 31% of respondents are actively implementing plans to reduce impact of IT equipment destruction
• 83% of respondents use reformatting to sanitize drives
• Just 23% of respondents believe physical destruction is cheaper than alternatives

Canada findings:
• Average annual public sector spend on SSD destruction and replacement: $4.3 million to $4.6 million 
• 16% of respondents are actively implementing plans to reduce impact of IT equipment destruction
• 70% of respondents use reformatting to sanitize drives
• 38% of respondents believe physical destruction is cheaper than alternatives