Metro hard drives up for auction still had employees’ personal data on them

WASHINGTON — Metro failed to erase hard drives before putting them up for auction as surplus, exposing some employees’ personal information, an internal audit found.

The audit, accepted Thursday by the Metro Board’s Audits and Investigations Committee and completed last fall, notes that a similar issue was identified in 2012 in a separate audit also done by Metro’s Office of the Inspector General.

In this case, auditors looked at two PC hard drives that were available for public auction last August. Both had been used by the Department of Rail Services and still had accessible data.

One of the drives had tax software and 2,326 files. The other had 2,783 files.

“Both hard drives contained PII [Personally Identifiable Information], such as the names of 19 previous users,” the audit found.

The drives were sent straight to the storage facility, rather than first going to the IT Department to be erased.

The IT Department also could not show it conducted its own required audits to be sure hard drives and other electronic data storage systems are erased before being disposed of or sold.

“Failing to remove data from storage media prior to its transfer or disposal, increases the risk that critical and sensitive business data stored on storage media may be compromised and used for other than legitimate purposes,” the inspector general’s office found.

Metro management agreed with the audit, and agreed to make sure hard drives are properly erased in the future.

John Domen

John started working at WTOP in 2016 after having grown up in Maryland listening to the station as a child. While he got his on-air start at small stations in Pennsylvania and Delaware, he's spent most of his career in the D.C. area, having been heard on several local stations before coming to WTOP.


Like WTOP on Facebook and follow @WTOP on Twitter to engage in conversation about this article and others.

© 2017 WTOP. All Rights Reserved.

More from WTOP

Log in to your WTOP account for notifications and alerts customized for you.

Sign up