Opening of TFA:

"My company could have wiped those drives and sold them on. Such a waste!"

Later in TFA:

"Morgan Stanley was fined because a company didn't, in fact, wipe the drives before selling them."

Those two sentences could have saved paragraphs of electrons, IMO. Sure, it seems like a waste until some chucklehead company decides to add a little more profit on that contract by assuming no one will ever find out if the drives skip the "wipe" step.

Dunno why HN let me submit this again, more discussion from hours earlier here:

https://news.ycombinator.com/item?id=33105269

Ars syndicated: https://arstechnica.com/information-technology/2022/10/why-b...

My first tech job I worked in IT for a finance company. One of my jobs was to write over full disks with 0s, 1s, a few times over _and then_ smash the drives with a hammer.

I spent a couple weeks in a Google data center, and drive sanitation there is taken crazy seriously. Everything is encrypted at rest with decryption keys and standard storage kept on separate forms of media. Drives are wiped several times and then verified. If they pass verification and are still useful they get recycled in. If they aren't then they get crushed one by one. You need to go through a metal detector and a mantrap on the way in and out. The TL;DR is that you aren't getting a drive out of there that isn't destroyed.

But the really impressive part is the custody chain. If a drive isn't accounted for for an hour, the person responsible starts getting pinged and it escalates fast. And this includes all sorts of automated hooks from the machines themselves. So not only are you not getting your drive out of there, you won't have time to image it without someone finding out.

Can’t read because paywall but they do recycle them… right?