Lawmaker Questions Reselling of Federal Tapes

U.S. Rep. Betty McCollum is questioning a Government Accountability Office report that claims federal agencies reselling cleaned magnetic tapes pose no privacy or national security risks.

The GAO report, issued in September, concluded that “based on the limited scope of work we performed, we conclude that the selling of used magnetic tapes by the government represents a low security risk, especially if government agencies comply with NIST [National Institute of Standards and Technology] guidelines in sanitizing their tapes.”

However, according to Imation, a Minnesota firm that produces magnetic tapes, the results were quite different on a study of several “recertified” tapes provided to the company by GAO investigators. Imation was able to recover bank account data, employee information, employee savings account balances, audit procedures and results, and the origin of the tapes.

McCollum, D-MN, now wants the GAO to reopen its investigation to initiate a broader investigation to ensure that government agencies — including the Federal Reserve and U.S. Air Force — are not reselling used tapes from which personal or national security-related information could be recovered.

“If federal agencies are selling used magnetic storage tapes on the open market with this level of recoverable sensitive data available to anyone with minimum technical skills or equipment, we should all be alarmed and demanding greater accountability from federal agencies engaged in such sales,” McCollum wrote in a Jan. 18 letter to the GAO.

According to McCollum, Imation used no specialized diagnostic equipment to rover the data. The study was conducted using a standard tape drive and a PC. Imation applied widely known and publicly available programming knowledge.

“The result of the work conducted by Imation clearly challenges the earlier CAO conclusion that used tapes represent a low security risk,” McCollum wrote. “Federal agencies could be under the impression that the sale of these used tapes is secure.”

She added that “substantial amounts of highly sensitive government [data] and the personal data of citizens may be circulating in the open market on ‘recertified’ used tapes.”