3d Memo

TO:        Deans, Vice Presidents and Department Heads

FROM:        Cathy Bates, University Information Security Officer
        Kirk Ketcham, Director, Procurement and Contracting Services

DATE:        June 8, 2010

RE:          Digital Photocopier Security

Since the CBS Evening News story (Digital Photocopiers Loaded with Secrets, at http://www.cbsnews.com/stories/2010/04/19/eveningnews/main6412439.shtml) broke regarding digital copiers and the potential for having sensitive information stored on the hard drive, the UA has been gathering information for the university community on digital copier security management.  The security concern involves a section of the hard drive that is used for the temporary storage of copied or scanned images and print jobs.

For the U of A, the majority of the machines used on campus are from our Strategic Alliance Vendors (Xerox or IKON). Both vendors have provided the Information Security Office (ISO) and Procurement and Contracting Services (PACS) with information to help units in assessing potential risk in regard to the hard drives in digital copiers, as well as options for securing hard drive data. 

The ISO recommends that hard drives in digital copiers be treated the same as hard drives in computers.  If possible, software should be installed on copy machines to overwrite the temporarily stored data and ensure that image traces are not left on the hard drive while still in use.  At the time of disposal, hard drives should be erased, overwritten, or physically removed from machines.  PACS will work with copier vendors to assist in getting hard
drives to UA Surplus Property, but if a department has a copier/printer or hard drive for disposal they should also work with Surplus Property as is the case when disposing of any university-owned equipment.

Both Xerox and IKON have agreed to assist their customers in securing data on the hard drives either with options for data overwrite or for hard drive surrender at no cost, or very minimal cost.  We have gathered specific information on copier security options and vendor offerings on the ISO website at http://security.arizona.edu/copiers.

If you have any questions, please contact the Information Security Office at 621-8476.