Rossander’s Security Reader

Shredding is the ultimate defense, right? Once it’s shredded, it’s gone!

No longer. It was always vulnerable if your attacker had the shredded chaff and plenty of free time. Think of the shredded embassy documents from the Iranian Hostage crisis of 1979. Those students reconstructed the pages with nothing more than scotch tape and patience. More recently, methamphetamine users have been hired by identity theft ringleaders to do the same thing.

Bill Wilson recently found a number of services which make the “unshredding” problem much more manageable. In the Enron case, the government hired ChurchStreet Technology to scan the chaff, then used computer algorithms to piece the documents together. They claim to take the recovery time from hundreds of hours down to mere minutes. It’s expensive but not terribly complicated.

So how do you fully protect your waste paper in this new environment?

1. If you’re still using a strip-cut shredder, get rid of it now. Upgrade to a cross-cut that chops the paper into very small bits of chaff.
2. Feed your pages into the shredder vertically, that is, with the words perpendicular to the shredder blades.
3. Don’t have unusual-colored paper. Or if you do, shred enough of it that it can’t be easily picked out. The rule in the army used to be no less than 20 sheets of any given paper type in each shred “lot”.
4. Stir the chaff before disposal. A careful opponent could exploit the fact that pieces from the same document tend to come out of the shredder close to each other and remain so in the waste bag. A few quick stirs can randomize the chaff and make reconstruction much harder.
5. Send the chaff to a paper recycler. Even the best reconstructors can’t bring a page back after it’s been turned into new paper pulp. Of course, you have to be sure that your waste isn’t intercepted before it hits the recycler but there are several bonded shredding companies that will do that for you.

How much is enough? It depends on who’s out to get you. For most home users and small businesses, step two is probably enough. If you really have something to hide, consider three and four and look into five when your shredding contract comes up for renewal. Find the right balance, remembering that identity theft is real but that most of us are not dealing with DoD nuclear secrets.

Bill Wilson writes a weekly newsletter for the Big I Virtual University, an arm of the Independent Agent’s Association. It’s filled with useful information and includes a technology column in almost every issue. If you have a small business, you should consider subscribing to his newsletter even if you’re not in insurance.