Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Say you were in charge of getting rid of a large quantity of paper - up to 1,000 in a row. It can't be used as scratch paper because it contains confidential information. It also can't be outsourced to third parties because the company isn't interested in refunding your expenses.

The scenario is real and is wasting the time of a person whose work is useful to me. The current method is tearing them all apart by hand or using a crushing machine when it's available. As mentioned, it takes a lot of time and could probably be done a thousand more efficient ways.

What is the cheapest and fastest method to destroy a large quantity of paper containing confidential information?

share|improve this question

migrated from productivity.stackexchange.com Sep 13 '11 at 2:29

This question came from our site for people wanting to improve their personal productivity.

3  
In Brazil, as your profile indicates? Burn it. –  woliveirajr Sep 13 '11 at 18:19
1  
Who stands to lose if the destruction is not done? If it is the company that is refusing to reimburse the costs of destruction, the simple answer is to deliver the documents to their head of compliance with a suitably snarky cover letter. –  ruief May 16 '13 at 9:45
    
Ruief is right, if they are expecting you to dispose of materials in a security-safe manner, they should pay the expense or take care of it themselves. –  Jeff Clayton Aug 25 at 20:58

7 Answers 7

up vote 19 down vote accepted

The worst thing you can do is tearing them apart. It's time consuming and attacker just needs extra time and patience to put pieces together.

The same rule applies for shredding - if after shredding are left too large pieces, again, attacker just needs time and patience.

enter image description here

There are several shredding techniques (from wikipedia)

  • Strip-cut shredders, the least secure, use rotating knives to cut narrow strips as long as the original sheet of paper. Such strips can be reassembled by a determined and patient investigator or adversary, as the product (the destroyed information) of this type of shredder is the least randomized. It also creates the highest volume of waste inasmuch as the chad has the largest surface area and is not compressed.
  • Cross-cut or confetti-cut shredders use two contra-rotating drums to cut rectangular, parallelogram, or diamond-shaped (or lozenge) shreds.
  • Particle-cut shredders create tiny square or circular pieces.
  • Cardboard shredders are designed specifically to shred corrugated material into either strips or a mesh pallet.
  • Disintegrators and granulators repeatedly cut the paper at random until the particles are small enough to pass through a mesh.
  • Hammermills pound the paper through a screen.
  • Pierce and Tear Rotating blades pierce the paper and then tear it apart.
  • Grinders A rotating shaft with cutting blades grinds the paper until it is small enough to fall through a screen.

Also, there are several standards for shredding (from wikipedia)

  • Level 1 = 12 mm strips OR 11 x 40mm particles
  • Level 2 = 6 mm strips OR 8 x 40mm particles
  • Level 3 = 2 mm strips OR 4 x 30mm particles (Confidential)
  • Level 4 = 2 x 15 mm particles (Commercially Sensitive)
  • Level 5 = 0.8 x 12 mm particles (Top Secret or Classified)
  • Level 6 = 0.8 x 4 mm particles (Top Secret or Classified)

What I'm trying to say is - it's not about - "Let's torn this paper and we'll be fine!" It's about how hard is to put this pieces together. If it's next to impossible, then shredding is done well. However, if attacker is aiming for the lowest hanging fruit, then any kind of shredding is better then none.

Example of well done shredding (once it was a money) enter image description here

I guess setting them on fire or destroying them in chemical reaction would be the fastest, but this techniques should only be preformed in controlled environments by professionals!!! Alternative is to decompose paper in water, however, it's pretty long process (10-14 days) and you'll need enough space and water to do so.

share|improve this answer
    
do you have a link to decomposing paper in water? –  rox0r Mar 15 '12 at 3:40
    
@rox0r I'm sorry for late replay, but after few weeks of searching I couldn't find any link describing decomposing paper in warer. I did it about 15 years ago as school project, so only thing I can do is to edit my answer to describe how to decompose few sheets of paper. However, for larger scale, I'm in dark, unfortunately. –  StupidOne Apr 17 '12 at 17:22
    
@rox0r It's a step in recycling paper. (You may want to look for how to make homemade paper, lots of videos on this topic are available on YouTube, and it's commonly done as a school project). Basically, paper is wooden fibers glued together (+ additives to make it white or glossy) and water separates them, breaking down the mesh. You may accelerate the process by shredding the paper sheets before putting them in water, for example with a mixer. –  ignis Sep 29 at 6:39

Burning is a cheap and effective way to get rid of this data. Included are some links to some burning standards:

  1. US Army Data Destuction (Check out Section V) http://www.apd.army.mil/pdffiles/r380_5.pdf
  2. (Search for "burn") http://kdla.ky.gov/records/Documents/Destruction%20Guidelines.PDF

One of the biggest issues with burning is that you end up with either unburned product (i.e. white paper with writing) or burned product (blackened paper with obscured writing). Data can be recovered from both pretty easily. Everything has to be reduced to ash, no exceptions. Take pictures, and cook hot dogs.

Of course, you may not be allowed to burn stuff depending on your work safety practices. You're stuck with crosscut shredding, disbursing the shreds, and distributing the piles into multiple bins. A royal pain, but if you can't burn them it's your only other option.

A good long soak in a large tub of water will do the trick too. Stir daily, and leave the paper in there until it turns into goo.

No matter what, secure some approval for this method. The last thing you want is for somebody to come back and say the job wasn't done right. Also, if they reject all your options, you have a reason to tell them to dispose of their own data how they like.

Mike

share|improve this answer
1  
+1: burning is the only real secure method, provided you really burn everything. There are so many research being done about reconstructing shreded papers that I wouldn't trust it. –  woliveirajr Sep 13 '11 at 18:11
    
Cross cut shredding + burning? Would that be effective? –  TheLQ Sep 14 '11 at 15:43
2  
@TheLQ Yep, and the crosscuts would likely allow fire to reduce the paper to ash a lot faster. –  MToecker Sep 14 '11 at 17:15
    
Burning, then water –  Dog eat cat world Aug 25 at 19:24

I just came across this thread by accident. By chance I've had exactly this problem recently. Instead of buying an expensive high quality shredder like the above suggests I tried disposing of everything in a big bucket of water.

Blendin'

To speed up the process, i used a blender to make it into a soup-like consistency/paste. I also added some bleach for good measure...

Just make sure you put more water in than you do paper otherwise it gets difficult. For about 12,000 pages of text we used about 10 buckets.

We disposed of some of it by flushing it down the toilet, and the majority of it by pouring it into bags and chucking it in the bin. Finally, we planned on turning some into dried out paper-bricks to burn for fires (for warmth!)

share|improve this answer

Just chiming it to point that "unshredding" is not purely theoretical. It was done on a large scale with East German archives when the Iron Curtain fell, in order to determine (among other things) who was snitching on who.

More on the subject in Wired : http://www.wired.com/politics/security/magazine/16-02/ff_stasi?currentPage=all

Data destruction is serious business. Depending on how confidential the data is, if not done well it can get people killed.

share|improve this answer

There are document shredding services. You place your to be shredded confidential docs in a bin, it gets picked up and shredded/incinerated. Since your company doesn't sound interested in saving money by outsourcing it, you are left with shredding them. (Tearing apart by hand is slower than shredding.)

share|improve this answer

Burn it.

If you shred it first, it'll catch fire more easily. I think there's no regulation about burning private papers in your country / city, so you can simple take all the daily paper and burn it.

And be sure to burn eveything. After the fire is gone, take a good look at the ashes, and burn again everything that wasn't well burnt before.

share|improve this answer

How many piece of papers do you want to destroy? 1000, 10.000, 1.000.000 ? Apart by hand and using crashing machine sound good.But also, you can burn them. Cheap and fast. And it doesn't take much time.

  1. Find a safe place there aren't any combustible stuff.
  2. Get a big combustible metal box. Close the around with sand.
  3. Keep enough water how much you can be need it.
  4. Burn them and keep watching when your burned. (Be careful)
share|improve this answer
2  
Regarding #4, watch for cops as well as spreading fire. Burning trash is illegal in many locations. –  Fambida Sep 13 '11 at 11:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.