A hard drive with external memory cards Photo: WeChat account of China’s Ministry of State Security

Discarded hard drives could become “hidden bombs” for data leaks, China’s Ministry of State Security (MSS) warned on Thursday, after disclosing a case involving the resale of “new” drives that still carried improperly erased internal data. The agency also stressed that idle hard drives containing classified information must never be discarded or resold randomly, according to a notice published on the ministry’s official WeChat account.

With the rapid advancement of digital governance and office informatization, hard drives, as core data storage devices, are being replaced and upgraded more frequently. Many people mistakenly believe that deleting files or formatting a hard drive is enough to erase data, but that is not the case, the notice said.

However, ordinary deletion only removes data indexes, while the original information still remains on the disk or chip and can be easily recovered through professional recovery tools.

The MSS warned that some illegal vendors seeking high profits often perform only superficial processing on recycled second-hand hard drives before reselling them as new products. Residual sensitive information, malware, and viruses stored on such drives could pose major security risks, it noted.
In the case disclosed by the MSS, a certain organization reported to state security authorities that it had purchased a batch of “new” hard drives. 

During subsequent security inspections, the organization discovered that the drives still contained large amounts of residual data, including internal documents from Party and government organs, universities, banks and other institutions.

Subsequent investigations found that an employee at another organization had violated confidentiality regulations by simply deleting data from internal hard drives before selling them as scrap. Relevant personnel were ultimately held accountable in accordance with regulations and disciplinary rules.

The MSS cautioned that such cases are not isolated incidents, warning if sensitive information stored on refurbished hard drives falls into the hands of criminals or overseas espionage agencies, it could endanger individuals, organizations and even national security.

The notice also provided guidance on the safe procurement, use and disposal of hard drives. It advised consumers and organizations to purchase storage devices through official channels of reputable brands, carefully verify product certifications and anti-counterfeit labels, and conduct professional security inspections before putting hard drives into use to detect residual data or malicious programs.

For ordinary hard drives, the ministry said properly processed devices may be traded on second-hand platforms or recycled through official collection services. However, idle hard drives containing classified information must strictly follow regulations governing the destruction of confidential carriers. Such devices should be handed over to qualified professional institutions for complete data removal and physically destroyed through methods such as drilling, crushing or degaussing to ensure the information cannot be restored.

“The proper disposal of idle hard drives is a key line of defense in safeguarding data security,” the notice stated. “Through the joint efforts of all sectors, every discarded hard drive can safely complete its mission.”

Global Times