Sources of risk

People recognize risks based on their education and experience. If you’d ask people to identify the risks associated with social media, you’d get different answers related to their expertise or profession. A member of your IT department would see viruses or malware as a major threat and be worried about the impact of data loss to the company. A lawyer would be concerned about potential litigation from such things as discrimination, sexual harassment, and liability from personal messages. A records manager would be concerned about retention of data, data leakage, and sensitive information sharing. An educator or a parent might see cyberbullying as a primary risk and the lack of safeguards to protect children. While some problems may be unique to a person or business, many share similar risks that can be handled in similar ways.

Because everyone focuses on risks that affect them directly, it’s always wise to gather input from a diverse selection of people. Departments in an organization will be able to identify any would-be issues that are unique to them and provide input on how to mitigate those risks and their potential impact. You can also benefit by asking peers, partners, and others who have similar situations.

If you feel improvements could be made in safeguarding yourself from potential threats, you’re not alone. The Ponemon Institute conducted a survey of IT professionals and found that 63% saw social media as a serious business risk, and only 29% felt their companies had adequate controls to manage the risk. All too often, people will jump into using social media without recognizing the pitfalls and taking proper precautions. However, even if you’ve been using social media for a while, you can backtrack and take steps to protect yourself in the future.

The content you post can and will be held against you

If you post something that could be seen as threatening, potentially violent, or slanders another person, it could result in serious consequences. The hurtful breakup of a relationship may have you spitting venom about the person, or a bad day at work may have you venting about your boss or job. Even if you meant nothing by it, a coworker could show your boss what you said or be concerned as to whether your comments are an indicator of workplace violence. Similarly, bashing someone online could be seen as libelous and results in a civil suit. Again, if this happens, delete it and make a generic apology that doesn’t contain your original comments. After all, you don’t want to repost what you just deleted. The fact that you deleted the offending remarks and apologized may be taken into consideration by those you’ll have to answer to.

As we’ll discuss later in this chapter, prior to deleting a post that could get you in hot water, make sure you make a copy of it. This could involve making a screenshot, printing the page, or making a backup of the content. If you need to defend yourself, you may need a copy of the post to accurately show what was said and what you did about it.

You should also be aware that social media sites commonly have policies that limit the types of content you’re allowed to post. Sites may forbid offensive or abusive images, video, comments, or messages and may close down your account if you post content to deliberately humiliate someone. As we’ll see in Chapter 7, such actions could be considered cyberbullying or harassment and lead to civil or criminal litigation.

What’s allowed will vary from site to site, and sometimes differ to dramatic degrees. If you look at content communities, you would see that YouTube doesn’t allow pornography, but RedTube (www.redtube.com) is a video sharing site for pornographic video. What’s offensive on one site may not be seen as offensive on others. Before posting or reporting content, you should review the Terms of Service to identify what kinds of content aren’t allowed.

Removing videos from YouTube

Old videos and photos of us being silly can be a major source of embarrassment. While anyone might be mortified at being featured in an online video, some are better able to keep it somewhat private. In 2013, the Tajikistan President Emomali Rahmon had to relive awkward moments from his son’s 2007 wedding, when a home video was uploaded to YouTube under the title of “Drunk Tajik President Sings a Song.” The video shows the leader merrily dancing and singing out of tune and was viewed almost 300,000 times. To prevent people in his country from seeing the video, YouTube access was blocked in Tajikistan.

Since most of us can’t block content in this way, we have to settle with privacy controls on the videos we post. On YouTube, you can set a video to any of the following visibility levels:

Even if a video is unlisted, people can still view it if they know how to find it. You or another person may have shared a link on other sites or acquired it via email. Your settings also won’t stop people from viewing and sharing any copies that have been downloaded from YouTube and uploaded elsewhere. To change the privacy setting of a video on your YouTube channel:

Of course, these settings only apply to the videos you uploaded to YouTube and not those belonging to other people. If you’re uncomfortable with the content of a video, you can report it by flagging it as inappropriate. In doing so, YouTube staff will review the video to determine if it goes against their community guidelines and should be removed, or should be restricted so that younger users can’t view it. To flag a video, you simply click on the flag icon beneath the video and check the option that applies to your complaint. Options include the video containing objectionable content or that it infringes on your rights.

You can also contact the person who posted the video and ask them to remove it. If they don’t remove it or you’re uneasy about contacting the person directly, you can file a complaint with YouTube through their Policy and Safety Hub at www.youtube.com/yt/policyandsafety. There are different kinds of complaints you can make, including copyright complaints where someone has copied a video that you created. If you’re identifiable within a video, you can also file a privacy complaint. In doing so, the request will be reviewed, so the video can be removed from the site.

Removing photos and tags that others post on Facebook

Embarrassing photos can cause problems for businesses and individuals alike. A person may indicate where they work on their profile page and then upload a photo that doesn’t mesh well with the corporate image. Perhaps it’s a silly image that looks unprofessional, shows the employee drinking or involved in drunken antics, or depicts something unflattering or even offensive. Depending on the picture, once it’s associated with an employer, it could damage the brand or reputation of the company.

Even if an employee is mindful of the photos they upload, others may not be. You may appear in a photo taken by another person that’s uploaded to Facebook. The photo might focus on you or show you in the background, where you would have gone unnoticed if someone hadn’t tagged the photo and identified you. By tagging you in the photo, others will see who you are and be able to follow the tag to your profile page.

If you are tagged by someone in an embarrassing photo, you can remove the tag yourself. Untagging a photo is done from the Activity Log of your account. After logging onto Facebook, do the following:

Once a tag is removed, the photo no longer has a link indicating you in the picture. However, the photo is still visible to others. People will be able to see it in the album of whoever posted it, when it’s shared, and may still appear in search results. If the photo is truly embarrassing or damages your reputation, send a request to remove the photo so that no one will see it.

Removing posts on Facebook

Facebook also provides ways to report other people’s posts as abusive or offensive. When you click the Report Story or Spam link, you have the option of clicking undo, hiding all stories from that person, or submitting a report (Figure 6.1). If you click submit a report, the post is flagged for review.

Reporting abuse

In addition to the methods already mentioned, sites commonly have an email address or a process in which you can report abusive users, such as those who are harassing you. The methods of reporting abuse vary from site to site, with some providing email addresses and others using online forms that you use to submit a report. Some resources to report abusive behavior include:

These aren’t your only options. You should always contact the police if threats are made, and/or you’re concerned about your safety. A threat is a threat, and there’s no difference between threatening someone in person or online. By contacting the authorities, an investigation can be conducted and the person may be charged.

If you see content that is illegal, you should also make an effort to report it. For example, if someone uploaded child pornography or posted information on child prostitution, molestation, or sexual tourism involving children, you should contact authorities immediately. In the United States, you can make an online report through the National Center for Missing and Exploited Children’s CyberTipline at www.missingkids.com/cybertipline. In Canada, you can make an online report to the Canadian Centre for Child Protection at www.cybertip.ca. Once a report is made, the appropriate law enforcement agencies will be notified.

Misrepresenting yourself

The Internet gives a false impression of anonymity, and many people use it to create an artificial persona. Many people will tweak their age to look a little younger or change minor details to appear more interesting. Others will go farther. A person may provide false information about their experience, education, or personal details to misrepresent themselves to potential employers, clients, or romantic partners.

Omitting information or providing some misleading information may be used as a defensive measure. For example, rather than providing the city you live in, you might exclude that information from your profile or say you live in a nearby larger city. However, there is a difference between protecting yourself and creating a façade.

If you use dating sites or social networking to meet others, you’ll want to stay honest. If you misrepresent yourself, eventually the ruse is discovered when the other person meets you. As you associate yourself with others on the basis of similarities and common interests, you’ll also miss out on making genuine connections if the facts about you are false.

In chat rooms, it’s common to find people who have created a false profile, complete with fake pictures and personal details. In some cases, it’s harmless. The false information may be used as a defensive measure to keep others at a safe distance, or the person may be uncomfortable about his or her appearance and post a picture of someone more attractive. Of course, the person may have more sinister reasons. Serial killer John Edward Robinson met many of his victims in chat rooms and became known as the Internet’s first serial killer. As we’ll discuss in Chapter 7, pedophiles, rapists, and other predators may introduce themselves to victims through social networking sites or chat rooms prior to meeting them. The false persona may be used on social networking or chat room sites to deter you from finding a criminal record or an inclusion in a sex offender registry.

If you use sites like LinkedIn to interact with colleagues or meet potential employers, you’ll want to be honest about your education and experience. If false credentials are used as part of your application for employment, you can be fired for misrepresenting yourself. Again, whether it’s in person or online, honesty is the best policy.

Misrepresenting your business

Under no circumstances you want to misrepresent your business on social media sites by making false claims about your company or its products. Just as consumer protection laws prohibit making misleading or deceptive claims about products and services in traditional media, these same laws apply to false claims made online. Not only can you be subject to litigation, but the negative public relations of showing you can’t be trusted will damage your brand.

You also don’t want customers or fans making false claims. If a person makes a comment that misrepresents your business, you should address the comment and correct them and/or delete the misleading comment. For example, let’s say someone said your company’s product was 100% environmentally friendly, but it was incorrect or there was no research to support the claim. Alternatively, a fan of your brand might make negative comments about a competitor that you know is false. Leaving such comments unaddressed is essentially the same as endorsing it as being valid. As a business, you need to be responsible for the claims you make and those of people posting on your page.

False information isn’t necessarily bad

While falling for a hoax or spreading false information can make you appear foolish, a good campaign can use false information to promote a product or brand. Every year, the BBC, Google, and other companies create false commercials and news reports as a joke for April Fools Day. When it’s good-natured fun or well crafted, most people laugh off the hoax and appreciate how it was done.

A great example of how false information can promote a brand is seen in the 2007 campaign in which a ghost was seen in the window of a house in downtown Toronto, Ontario. The ghost of the young girl was actually an image from a holographic projector, which passersby could see skipping, walking, and doing other movements. In the second week of these sightings, a video of the apparition was posted on YouTube, Google Video, and other sites. It quickly went viral and became the topic of discussion on blogs and various sites. A second video was released a short time later, and the two generated an excess of 2.1 million hits. When the address of the house was “leaked,” even more people visited it, hoping to catch a glimpse of her nightly appearance.

After 3 weeks of the engineered phenomena, the ghost was seen in the window holding a sign that said “Get scared more often” with the logo of a subscription horror channel called Scream TV. The paranormal promotion was advertised as a hoax in television commercials, online, and by media outlets covering the story. For a cost of $50,000, the campaign resulted in an immediate subscription increase of 35%.

Another horror example that used the Internet is The Blair Witch Project. The 1999 movie was the first movie to use the Internet as a primarily target for marketing, spreading rumors in chat rooms, message boards, and other online venues that the film was authentic found footage. The claims were “verified” as legitimate by a Web site, which provided manufactured television news clips about the disappearance of people in the movie. Box office sales resulted in it becoming one of the most profitable independent movies of all time. Results like this show that if you can make the false information entertaining, it can have a positive effect on what you’re selling.

Be clear about what’s private

Since revealing company information can jeopardize your job and devastate a business, it’s important to understand what can and can’t be discussed in public. Training and policies can assist in this regard, showing employees how they should handle the information available to them in their day-to-day work. If you’re unsure what you can share, then follow a basic rule: if it’s not in a press release, don’t discuss it.

You should determine whether your organization uses an information classification scheme, which categorizes records and data based on their sensitivity. Strict policies and procedures may exist as to what kinds of information can be shared with the public and under what circumstances it can be accessed or released to others. For example, information may be categorized as follows:

Organizations may also use a more basic scheme, consisting of classified and unclassified data. Classified information may consist of information about technology being used and current and upcoming projects. Unclassified information might be anything that can be discussed openly with partners, vendors, or even the public. Whatever method your organization uses, it’s important to identify it before you accidently reveal something that could cost you your job.

Providing too much information

Everyone’s had the experience of getting or giving a little too much information. Someone may tell you the indiscrete details of a personal experience or some office gossip they heard at the water cooler. Some people have trouble keeping their own information private, so you can understand why a business would be concerned about the confidentiality of corporate data.

The terminology that strangers are “friends” on social networking sites can lull you into a false sense of security. You can feel like you’re addressing your family and friends and forget that a post may be read by coworkers, acquaintances you barely know, or even strangers you’ve added to play games. People using their personal accounts to discuss work-related information can cause dramatic problems for themselves and the business. They may cause damage to the corporate image by complaining about staff or the brand itself, violate privacy by mentioning employees or clients, or mention a key piece of information that a competitor may use to their advantage. A tweet or public post can be displayed for the world to see, and even more secure posts may be copied or shared for others to see. What you say on social media can be a public announcement.

Information security is important on both a personal and work-related level. A 2010 survey conducted by the Consumer Reports National Research Center found that 38% of people posted their full birthdate and 8% posted their street address. The same study projected that approximately 1.7 million online households had been victims of identity theft over the previous year. The number of victims is not surprising when you realize how transparent some people’s personal information is on social networking sites.

As we’ve seen throughout this book, the tidbits of information you reveal about yourself or your work can be compiled into a telling profile. As we’ll see in Chapters 7 and 11, the address on a LinkedIn profile, a birthdate on your Facebook page, and other fragments of information can be useful for the purposes of identity theft or to identify passwords and other security information that can leave you and your organization vulnerable.

Small bits of information can be accumulated from any number of sources, even the most unlikely ones, and used to access other information. During the 2008 US presidential election, vice presidential candidate Sarah Palin’s email account was hacked by David Kernell, the son of Memphis Democratic state representative Mike Kernell. The hacker obtained Palin’s birthdate and other personal details from a Wikipedia page and then used the information to reset the password with Yahoo!’s account recovery for forgotten passwords. The password was posted by Kernell on the site 4chan, and screenshots of the email account were uploaded to WikiLeaks. What started as a few innocuous factoids became clues to hack her account, so that private emails could be leaked to the public.

WikiLeaks

Leaking information can be done in a number of ways. It may be done directly, as in the case of someone writing a blog or post and mentioning sensitive facts about the organization or its employees. It can also be done through traditional methods, where the data is given to a journalist who then parrots what you’ve provided or does additional investigative reporting. With the Internet, people can now leak information to third-party sites that make the information available to everyone.

One such site that has received much publicity and been the focus of controversy is WikiLeaks (www.wikileaks.org). Since 2007, the whistle-blowing site has published classified and sensitive material belonging to government and high- profile organizations. The site provides a secure drop box, where people can upload files anonymously, which is then reviewed by members of their staff and volunteers who are part of mainstream media outlets or journalists. The information is then published on their site, but unlike many wikis cannot be edited by visitors to the site. This keeps the content unaltered from its intended publication.

Sites that post leaked documents are seen as a serious security risk. In 2010, WikiLeaks released a list of infrastructure sites that was compiled to protect US interests from terrorist attacks. It’s one of numerous incidents that have led to WikiLeaks being called a threat to national security. Another issue is that some information has been provided by hackers. In 2012, WikiLeaks began publishing over 5 million email messages belonging to the global intelligence company Stratfor. In 2011, a hacking group called Anonymous admitted to stealing email and credit card information from the company and uploaded the data to WikiLeaks.

While such sites are an obvious risk for organizations and governments, they’re also not without merit. Content on WikiLeaks has been widely reported by mainstream news. In 2010, WikiLeaks released classified footage taken by US Apache helicopters on July 12, 2007 showing civilians being injured or killed in air-to-ground attacks. The video showed a group of eight men (including two Reuters war correspondents) being shot at with 30 mm cannons. After the first airstrike, one of the correspondents was dead and the other was severely wounded and tried crawling away. In an act of compassion, a father and his two children saw the wounded man and decided to pull over, and several others tried to carry the correspondent into their van. When the helicopter opened fire again, the father was killed and his children were seriously wounded. Audio on the video shows the children were denied evacuation to the military hospital. Instead, they were given to Iraqi police and sent to a local hospital. The soldiers are heard blaming the Iraqis, saying “it’s their fault for bringing their kids into a battle.” After the incidents, Reuters requested the video under a Freedom of Information Act request but their request was denied. The US military defended the incident as correct actions taken against insurgents. It wasn’t until the classified video appeared on WikiLeaks that the truth was revealed publicly.

When you leak information to the public, it’s important to realize that you’re putting your job at risk and making yourself vulnerable to civil litigation and criminal prosecution. In May 2010, Bradley Manning was arrested for leaking the Baghdad airstrike video and hundreds of thousands of other documents to WikiLeaks. It is the largest leak of classified documents in the US history. The FBI discovered his involvement through a hacker named Adrian Lamo, who confided that Manning admitted in their online chats to leaking the information. In 2013, Manning pled guilty to a number of lesser charges, and at the time of this writing is facing trial. If convicted, he could face life imprisonment.

Corporate espionage

Governments and corporations will use social media to obtain intelligence. While a government agency will spy on a person or group of interest for national security reasons, corporate espionage is used to gather and analyze on competitors for commercial reasons. By obtaining privileged data that’s available to insiders of a company, a competitor gains a clear advantage over other businesses in an industry.

Gathering sensitive data doesn’t necessarily require finding a disgruntled employee or whistle-blower that’s ready to hand over the keys to the kingdom. Often, anyone will do. By doing a simple search for a company name, you’ll find numerous accounts where people mention their place of employment. You can then follow their tweets and posts to scrape together key pieces of information that can be used to your advantage. Often, it involves getting the big picture by gathering smaller pieces of a puzzle.

In 2011, the security company CyberRoam released information about an online study they conducted on 20 businesses over a 6-month period. By looking at the tweets made by the sales director, a department head, and designers of a company in Singapore, they saw that several people were looking elsewhere for employment and salaries were not being paid. Obviously, if this was public knowledge, you would think twice before applying for a job, being a supplier or even being a customer. CyberRoam was able to accurately predict they’d file for bankruptcy.

Another company in the study targeted the financial director of a New York firm. Finding that he was recently divorced, a male consultant for CyberRoam created a fake Facebook account and posed as a female. By appealing to loneliness and desire for romance, confidential information was obtained. In initial chats, the financial director mentioned that he couldn’t disclose the revenues of his company but later revealed that they were $6.5 million.

Such confidential information doesn’t have to be obtained through full-time employees of the company. It can be acquired through partners, vendors, temporary employees, volunteers, or anyone else who has inside knowledge of the company. Consider how many businesses take coop students from high schools, colleges, and universities. The students may only be at an organization for a short time, but may be exposed to volumes of information. If they work in an IT department, they gain knowledge of the network, know procedures, and may even have administrator passwords. Students may be aware of upcoming projects, the release dates of new products, or overhear information that indicates the stability of the business.

To protect your organization, it’s important that employees know that they shouldn’t discuss business-related information through their own accounts. The disclosure of information should only come through official channels, as in the case of an official social media account. By employees not mentioning anything that’s business-critical, or involving ongoing or upcoming projects, your organization will be much safer online.

eDiscovery

The content posted on social media sites is subject to the same laws and regulations as other information. Because a record is a record regardless of its form, it may be used as evidence in criminal or civil legal cases. Electronic discovery or eDiscovery is the process of searching, locating, and securing information for the purpose of using it as evidence.

Digital information is extremely useful as evidence. When you save a file, it’s time-stamped to show the date and time of its creation and the last time it was accessed. Such files are also easy to search, unlike paper documents that need to be scrutinized manually, and can be quite revealing. People tend to be less reserved when conversing in email, chat rooms, or other electronic methods of communication. In many cases, people will reveal information that they normally wouldn’t through traditional documentation.

As social media has become a popular medium for communication and publishing information, it has also come into focus as important evidence. In 2011, Gartner, an information technology research and advisory company, predicted that by the end of 2013, half of all companies will have been asked to produce social media content for eDiscovery. Even in personal law suits or court cases like divorce or child custody battles, the information you post on social media sites can be used as evidence.

If you don’t have the information backed up and available when needed, you could face strict penalties. For example, the Sarbanes–Oxley Act has strict regulations regarding information that may be used in an investigation, including documents in an electronic format. It imposes fines, imprisonment, or both for “altering, destroying, mutilating, concealing, falsifying records, documents, or tangible objects with the intent to obstruct, impede, or influence a legal investigation.”

Inappropriate use of social media is a major problem for organizations, and many employees have been fired for mistakes they’ve made. If someone made a libelous comment about you, you wouldn’t want the evidence disappear by someone deleting it. At its most basic level, printing out the page containing the comments or taking screenshots could be useful evidence to support your claim. Similarly, if an employee deleted content that was contrary to confidentiality agreements, social media policies, or legislation, you might be unable to prove it occurred if it was removed from the site. Archiving the site, printing, or taking screenshots will be necessary to support any discipline taken against the person.

If you’re the person who needs to defend against something that was posted or tweeted, it’s equally important to have an accurate copy of any content that is relevant to the accusations. This would include a copy of the information, as well as dates it was posted and deleted, and actions taken afterwards, such as an apology or updates that were posted.

Archive Facebook

Facebook provides a feature to download a copy of the content you’ve posted online. This includes status updates, photos, videos, messages, chat conversations, information from your profile, and more. To download your Facebook content, follow these steps:

The link you receive in the email from Facebook will only work for a few days. After that, you’ll need to repeat the process again. The content will be downloaded as a compressed zip file and can be quite large depending on the amount of photos and other content you’ve published since joining Facebook.

Once you’ve downloaded and extracted the contents of the zip file to a folder, you can open a file called Index.html to navigate between your settings, photos, and other content. The Web page opens in your browser and provides a quick and concise way of viewing your information and finding specific content in your profile.

Archive Twitter

Twitter also provides a feature similar to the one we just discussed. In archiving your Twitter account, every tweet you’ve made since starting your Twitter account will be available to view on your computer.

After following these steps, you’ll be emailed a link that allows you to download all of your tweets. After clicking the link, the page that appears has a button you’ll click to download your Twitter content in a compressed zip file. By opening a file called Index.html in the zip file, you’ll see a graphical display of the number of tweets you’ve made each month and can navigate between the months to view tweets you’ve made.

Multisite third-party tools

There are a number of tools and services on the Internet that can be used to backup your content. Many social media sites provide Application Programming Interfaces (APIs) that developers can use to access services and content on the sites. The backup tools query your account through the APIs, gaining access to the data so it can create a copy of new and updated files. Before choosing a tool, it’s important that you compare features and identify how often it backs up data, what it backs up, and the sites it can access. Not all of services are the same, so it will require some shopping.

A popular social media backup site is Frostbox (www.frostbox.com). Using the site, you can create a copy of multiple social media accounts, including Facebook, Twitter, LinkedIn, Foursquare, Flickr, Instagram, and Gmail. The backups are performed weekly and stored securely on their server. The site also provides other tools, such as social media dashboards for monitoring various sites from a single location.

Backupify (www.backupify.com) is another online service that will automatically back up Gmail, Facebook pages, Twitter accounts, Google Sites, and more. The data is backed up to their site, but information can be exported. For example, Twitter feeds can be exported to PDF files, allowing you to keep a copy on your local computer. Should you need to restore the data, it provides an easy one-click restore. The free version of the service allows you to back up to three services on a weekly basis, but subscriptions are available for daily backups and an increased number of sites.

While the previous services back up your content to their site, SocialSafe (www.socialsafe.net) is an application that backs up social network content to your computer. After installing it, you can authorize SocialSafe to connect to numerous sites and back them up to your machine. The sites you can backup through it include Facebook, Twitter, LinkedIn, Google+, Pinterest, your blog, and others. New updates to your social networking can be automatically downloaded and organized for your review. As seen in Figure 6.3, by clicking on icons in the left pane, you can search through content, navigate through all of your social network interactions by date, or view photo albums from all sites using a single interface. It also provides information on the most popular photos, posts, days with the most activity, and other information about your social network use.

Other tools for individual sites

In addition to the multisite tools, there are some useful tools for individual sites. Downloadr (www.janten.com/downloadr/) and FlicrEdit (www.sunkencity.org/flickredit) are tools for downloading copies of the photos you’ve posted on Flickr. Both will allow you to search and backup photos, but FlickrEdit also provides the ability to edit and upload new versions of the picture.

Free YouTube Download (www.dvdvideosoft.com/products/dvd/Free-YouTube-Download.htm) is a tool that allows you to save and convert videos found on YouTube. This not only includes individual files, but all the videos from a playlist or channel. You can convert them to MP4, AVI, and WMV formats and also save the download history of the video.

Selling and recycling equipment

The latest technology doesn’t stay cutting edge for very long. The computer, tablet, mobile phone, and other devices that you buy today will become outdated and need to be upgraded or replaced. There are good reasons to upgrade your equipment. Once a device has reached a certain age, the cost of maintaining and supporting it increases, and it may be more exposed to security risks. Devices will run slower, break down more often, may not support the latest operating system and software, and have more known vulnerabilities than newer equipment. While a person or company may avoid replacing devices during tough times like a slow economy, Intel recommends that the optimal time to upgrade a computer is every 2–4 years.

To recoup some of the cost of upgrading, or environmental concerns of old devices going to a landfill, many people and companies will resell or refurbish equipment. For example, a mobile phone you’re leasing might go back to the manufacturer, where it’s restored to its original working condition and resold to someone else at a cheaper price. Similarly, you or your company might sell an old computer at auction or donate it to charity. When you purchase new equipment, the vendor may have a “buy your old device” option, where they’ll offer a rebate or discount for trading in your old one. In doing so, they may promise to wipe your old data, and in the case of a phone, erase your SIM card. However, are you comfortable enough with any company that you’ll trust them to do it for you?

While keeping up-to-date with technology is important, there’s a serious security risk in improperly disposing of old equipment. There are countless stories of people buying a used computer or hard disk, only to find it was full of information. In 2008, an IT Manager in Oxford, England bought a computer on eBay, only to find it contained sensitive information on several million bank customers. The old server was sold by a company that archived data for American Express, NatWest, and the Royal Bank of Scotland, but the data on its hard drives had never been properly erased. Similarly, in 2010, NASA sold a number of computers that were used for the Space Shuttle program. The hard disks contained highly sensitive information, but the data hadn’t been properly deleted. Unfortunately, residual or undeleted data on used disks isn’t uncommon.

According to a 2009 study by Kessler International, a computer forensics firm, over 40% of the hard disks for sale on eBay contains personal, private, or sensitive information. Similar results were found when BT Security Research Centre and the University of Glamorgan bought disks from the United Kingdom, France, Germany, Australia, and the United States. Of the 300 hard disks purchased, 34% contained personal information, inclusive to medical records and bank account details. One disk purchased on eBay contained details of test launch procedures for a ground-to-air missile defense system, while another contained security logs from an embassy in France.

Lost or stolen phone/tablet

A problem with mobile devices is they’re mobile; they can be taken anywhere, so it’s easier for them to be lost or stolen. When this happens, sensitive data stored on a tablet or mobile phone could fall into the wrong hands. This is where location and remote wiping features may provide a layer of protection.

As we’ll discuss in Chapter 9, mobile devices commonly have a location awareness feature, which is used to determine the physical location of a device using Global Positioning System, Wi-Fi data, or by identifying its position between radio and cell phone towers. By activating the “Location On” feature of a mobile phone or tablet, you can then use software or visit a Web site to see where the device is at that particular moment. This can be useful if you’ve forgotten the device somewhere and can still retrieve it.

If you’re concerned it’s irretrievable, then you should consider remotely wiping the device. When a device is wiped, personal information and other data on it are deleted. If it belongs to your company, you may need to contact your IT department. Depending on the systems and devices used by your company, they would send a command to the phone through mail server like Microsoft Exchange Server or middleware like Blackberry Enterprise Server. The command might have the handset erase all data, do a complete factory reset, and/or completely disable the device.

If you have a small company or using a personal mobile device, you can still protect your information if it’s lost or stolen. There are a number of apps available that will provide security and allow you to remote wipe a device. One example is Lookout Security and Antivirus, which runs on iPhone and Android devices. After going to the app store on your mobile phone or tablet and installing the app, you’re prompted to set up an account using your email address and a password. An email is sent with a link to confirm the new account, and you’ll receive notification emails whenever someone uses the app to locate your device, remote wipe it, or use other features. These notifications are useful in alerting you if someone has accessed your account, and may be using it to track your whereabouts or perform other remote actions.

Once the app is installed on a mobile phone or tablet, you can interact with it on Lookout Security and Antivirus’ Web site (www.lookout.com). On the site, you can view devices setup to work with your account, locate your device, and see the results of anti-malware and malware scans Lookout has run against your device. As seen in Figure 6.4, by clicking on the Find My Device tab on the left side of the screen, you’ll see a map appear showing the location of your device. At the top of the screen, you can click any of the following buttons to interact with it:

Wiping your device should be considered a final solution. In doing so, it’s reset to factory defaults, so it’s just like when you first bought the device. Your data, apps, and settings will be gone. If you tried using Lookout or another tracking app to locate the device, it wouldn’t work because the apps would no longer be on the device.

While remotely wiping or locking a device provides an element of protection in preventing others from having your information, it isn’t foolproof. These methods require a command being sent to the device, so circumventing it simply requires cutting off its ability to receive that command. In other words, if it can’t connect to the Internet, it can’t be located, locked, or wiped remotely. The easiest way to do this is to turn it off. However, even if it wasn’t turned off, the device couldn’t be wiped if it was in a location where it lost service or didn’t have a data plan and it couldn’t connect to a nearby Wi-Fi.

There are also methods of jamming a mobile device so that it can’t connect to a data network. Jammers are devices that emit radio waves on the same frequencies as a digital cell phone. Even if a phone works on multiple bands, jamming a single band can prevent it from connecting to the network to send and receive calls. Jammers are illegal in most countries, as in the United States where federal law prohibits the operation, sale, and use of these devices. However, even if a country makes jammers illegal, there are often exceptions. Military installations or government agencies may use them as a security measure. Prisons might use them to prevent gang members from texting each other or other unauthorized communication by prisoners. Some countries like France and Japan have permitted jammers in areas where calls may disturb others, such as theaters, public performances, art galleries, and other venues. However, if someone were stealing a mobile device to acquire your information, would you really expect them to adhere to legalities of jammers?

Backup and restore

Losing personal photos and videos can be devastating, and losing company data like orders, contact lists, or important documents could equate to serious business losses. When you consider the consequences, you’d expect most people regularly backup their data, but this isn’t the case. The 2012 survey commissioned by Seagate found that 90% of people don’t back up data on a daily basis and 89% don’t use continuous backup, where the data is backed up at regular intervals or when changed.

While everyone agrees backups are important, there are many reasons why they don’t. Traditionally, lack of storage has been a common excuse. Backup devices used to be fairly pricey, and if a computer had an extra hard disk, the space was used instead of dedicating it to storing backup files. Fortunately, this is no longer an excuse. A person can use a rewritable DVD to back up important files, and the price of hard disks have dropped considerably, with a 1TB external hard drive costing just over $100. People can even back up their data to the cloud, so it’s stored on secure servers on the Internet.

Another perceived issue is cost. There are a number of excellent commercial solutions, such as Norton Ghost to back up files and make an image of your machine. The cost of such software is often marginal. If you’re looking for a free solution then you can use Windows Backup, which is included with the operating system and discussed in the next section.

Companies are usually better at having a backup plan than individuals, as the continuity of a business can depend on the stability of data. Since backups are handled by an IT department, this provides a worry-free solution for most people. In a larger organization, files are backed up using software designed for networks, such as CommVault (www.commvault.com), and saved to tapes that can then be stored offsite. In companies using SharePoint, files are uploaded to document libraries, with the actual data saved in a backend SQL Server. CommVault then backs up this data using SharePoint agent, which allows the software to back up and restore individual sites and documents. However, even in the best of places, not everything on a network is backed up. You’ll often find that a company will back up files on the network but not those saved on workstations, mobile devices, and social media sites. Policies or settings may be used to enforce where users should save their files and restrict them from saving files to a local hard drive.

Personal data or equipment

Some employees will use their own devices for business purposes or use corporate equipment for personal use. A phone or tablet might be set up to access work email or have additional apps installed to back up and wipe data. If your device is set up this way, you may be vulnerable to having the data wiped by your employer.

As we discussed earlier, a device can be locked or wiped by sending a command to it. If the employer installed security apps with this capability or set up the device to access work email, there is a possibility that your data could be destroyed accidentally or on purpose. If your employment was terminated or a command was accidentally sent to do a remote wipe, you would lose any personal and business data on the phone or tablet.

Another risk involves backups of data. An employee may do unauthorized backups of data on corporate devices they were issued. If he or she were fired, the employer could wipe the device but wouldn’t be able to delete any data the employee had backed up to a site like Carbonite. The fired employee could simply restore the data to another device at a later time.

To ensure the security of business and personal data, you should keep the two separate. A business laptop, phone, or tablet should be used for business purposes and locked down to prevent the user from installing any additional apps. In the same way, personal devices should not contain business data. While this might mean you have to carry two phones, it would protect the employee and business from data being destroyed or copied without authorization.

The other potential liability is related to damage of equipment. If you installed personal apps on a work tablet or phone, or malware was installed while visiting social networking sites without authorization, an employer might fire you or hold you responsible for repairs. Similarly, an organization might be held responsible for any personal equipment and data loss if they allowed employees to use their own devices for business purposes. A policy outlining proper use of equipment can help to clarify these matters and the rights of the employee and employer. As additional protection, if you get the IT department to configure a personal device to use corporate email, have them clearly explain what was installed and whether they have the ability to remotely lock or wipe the device.