To ensure media and IT equipment that cannot be sanitised is safely destroyed before disposal in an environmentally responsible manner.

]]> This section covers information relating to the destruction of media and IT equipment. Further information relating to the destruction of IT equipment can be found in Section 12.6 - Product Sanitisation and Disposal.

]]> Any IT, electrical or electronic equipment MUST be destroyed and disposed of in an environmentally safe and responsible manner.  This reflects an increasing responsibility for improved equipment end-of-life treatment and environmentally responsible disposal solutions, while continuing to meet security and data protection requirements.

]]> The capability of various types of electronic equipment to store data has increased significantly with technology advances such as solid-state drives (SSDs) and on-board memory devices.  In turn these present a rich target of opportunity to, amongst others, cyber-criminals, unauthorised investigators, and foreign intelligence services.  Data may include, for example, identity, account numbers, physical addresses, transactions, cryptographic keys, strategic, financial or other private documents, and classified information.

]]> Where data from a discarded device is recovered, it may also result in a privacy or data breach - potentially incurring sanction from data regulators.

]]> Media and IT equipment can contain a number of elements such as arsenic, lead, mercury, barium, selenium and cadmium in their manufacture.  These elements can be poisonous, carcinogenic or toxic in particulate or dust form.  If allowed to accumulate in dumps or poorly managed recycling or disposal centres, they can create a serious health risk or environmental hazard.

]]> Lead was traditionally used in solder on printed circuit boards, although it has been banned in many countries in the last decade. Lead oxide may still be found in cathode-ray tubes and older equipment.  Lead is toxic to humans and medical research has raised concerns about the impact of low-level exposure on the development of the brain and central nervous system in children.

]]> Other elements used in the manufacture of IT and electronic equipment may include flame retardants and plasticisers, and should be treated with caution.

]]> Some flame-retardant materials used in computers can be toxic if released as dust into the atmosphere.  Research has shown that they interfere with brain and skeletal development.

]]> Phthalates are probably best known as plasticisers and are widely used in the electronics industry.  One of the most widely used phthalates, DEHP, is classified by the EU as toxic to reproductive health. For example, in 1999 an EU-wide ban was imposed on the use of six phthalates in children's chewable toys.

]]> There are many risks associated with the incineration of electronic waste. Up-to-date guidance is available on the Ministry for the Environment website (see reference table 13.5.21).

]]> Incinerators discharge into the atmosphere and create emissions and ash residue. There is potential for contamination of air, soil and water through the release of pollutants such as hydrocarbons, heavy metals and dioxins. 

]]> There are two main by-products of incineration.  Firstly, inert bottom ash which is primarily formed from inorganic elements, and secondly, flue gases. These facilities must include gas cleaning systems designed to contain pollutants and safely exhaust to the atmosphere.  Properly designed, installed and operated facilities will be able to manage and safely dispose of the waste, particulate matter and contaminants produced by incineration. 

]]> It is essential that any incineration facility is properly rated, inspected and authorised or licenced to process WEEE.  Any relevant national environmental legislation and regulation must also be complied with.  In particular the Resource Management Act and the National Environmental Standards for Air Quality must be observed.

]]> Some electrical and electronic waste materials cannot be safely incinerated.  This includes:

  • Alkaline batteries;
  • Glass;
  • Lithium batteries; and
  • Mobile phones.
]]> While sanitisation of media and IT equipment can be highly effective in controlled conditions and when applied for specific purposes, it does not provide the high level of assurances on the irrecoverably of data when the media and equipment has left the control of the owner, agency or other organisation.

]]> Destruction provides considerably higher levels of assurance to agencies where non-recoverability of any agency data is a consideration.  In many cases destruction is essential, rather than sanitisation and disposal.

]]> The GCSB approves destruction facilities (see also 13.6.11).  It is important to note that such approval is specific, confined to the destruction process and DOES NOT endorse or approve the use of any sanitisation process, method or software.

]]> NZEO endorsed material requires additional protection at every level of classification.

]]> In general terms, media and IT Equipment containing NZEO material should be sanitised and redeployed or sanitised and destroyed in accordance with the procedures in this section. Media and IT Equipment that has contained NZEO material must not be disposed of, to e-recyclers or sold to any third party.

]]> Further references can be found at:

Reference Title Publisher Source
  Secure Destruction of Sensitive Items CPNI Protect sensitive information and assets from creation to verified destruction. | CPNI
  Proposed amendments to National Environmental Standards for Air Quality: Particulate matter and mercury emissions Cabinet Paper June 2020 https://environment.govt.nz/publications/approval-to-release-discussion-document-proposed-amendments-to-national-environmental-standards-for-air-quality-particulate-matter-and-mercury-emissions/
   

Consultation document

February 2020

 https://environment.govt.nz/publications/proposed-amendments-to-the-national-environmental-standards-for-air-quality-particulate-matter-and-mercury-emissions-consultation-document/
   

Summary of submissions

December 2020

 https://environment.govt.nz/publications/proposed-amendments-to-the-national-environmental-standards-for-air-quality-summary-of-submissions/
  Guidelines and recommendations for WEEE reuse and recycling operators Ministry for the Environment https://environment.govt.nz/publications/waste-electrical-and-electronic-equipment-guidance-for-collection-reuse-and-recycling/guidelines-and-recommendations-for-weee-reuse-and-recycling-operators/
  Overview of other WEEE good practice guidance/advice and standards Ministry for the Environment https://environment.govt.nz/publications/waste-electrical-and-electronic-equipment-guidance-for-collection-reuse-and-recycling/overview-of-other-weee-good-practice-guidanceadvice-and-standards/
  Health and safety considerations when reusing or recycling WEEE Ministry for the Environment https://environment.govt.nz/publications/waste-electrical-and-electronic-equipment-guidance-for-collection-reuse-and-recycling/health-and-safety-considerations-when-reusing-or-recycling-weee/
  Hazardous Air Pollutants Ministry for the Environment https://environment.govt.nz/facts-and-science/air/air-pollutants/hazardous-air-pollutants-effects-health/
  New Zealand Waste list (L-Code) Ministry for the Environment https://www.mfe.govt.nz/waste/guidance-and-resources/waste-list
  Environmental Health Intelligence NZ – Air quality Massey University https://www.ehinz.ac.nz/indicators/air-quality/
  E-Waste Management National Environmental Agency (US) https://www.nea.gov.sg/our-services/waste-management/3r-programmes-and-resources/e-waste-management
  Hazardous Substances National Environmental Agency (US) https://www.nea.gov.sg/our-services/pollution-control/chemical-safety/hazardous-substances
  A-Z Topics and Industry Worksafe NZ https://www.worksafe.govt.nz/
  Stewart, E. S., & Lemieux, P. M. (2003, May). Emissions from the incineration of electronics industry waste. In IEEE International Symposium on Electronics and the Environment, 2003. (pp. 271-275). IEEE. Stewart and Lemieux, Office of Research and Development, US EPA, 2003,IEEE https://www.researchgate.net/publication/4020282_Emissions_from_the_incineration_of_electronics_industry_waste
  Gurgul, A., Szczepaniak, W., & Zabłocka-Malicka, M. (2017). Incineration, pyrolysis and gasification of electronic waste. In E3S Web of conferences (Vol. 22, p. 00060). EDP Sciences. Gurgul et al, Wroclaw University of Science and Technology, Poland, 2017, https://www.e3s-conferences.org/articles/e3sconf/pdf/2017/10/e3sconf_asee2017_00060.pdf [PDF, 519 KB]
  Black, H. (2005). Getting the lead out of electronics. Environews,113(10). Harvey Black, published in Environmental Health Perspectives, 2005 Oct; 113(10): A682–A685, https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1281311
  EU bans baby toys containing phthalates. (1999). BMJ : British Medical Journal, 319(7224), 1522. Xavier Bosch, The Lancet, Volume 354, Issue 9195, p2060, December 11, 1999, https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1174644/
]]> Documenting procedures for media and IT equipment destruction will ensure that destruction is carried out in an appropriate, consistent and responsible manner within the agency.

]]> Agencies MUST document procedures for the destruction of media and IT Equipment.

]]> The destruction methods given are designed to ensure that recovery of data is impossible or impractical. Health and safety training and the use of safety equipment may be required with these methods.

]]> To destroy media and IT Equipment agencies MUST use at least one of the methods shown in the following table.

Item

Destruction methods

Furnace/ Incinerator

Hammer mill

 Disintegrator

Grinder/ Sander

 Cutting

Degausser
Magnetic floppy disks  Yes  Yes  Yes  No  Yes  Yes
Magnetic hard disks  Yes  Yes  Yes  Yes  No  Yes
Magnetic tapes  Yes  Yes  Yes  No  Yes  Yes
Optical disks  Yes  Yes  Yes  Yes  Yes  No
Electrostatic memory devices   Yes Yes   Yes  Yes  No  No
Semi-conductor memory  Yes  Yes  Yes  No  No  No
Other Circuit Boards  Yes  Yes  Yes  No  No  No
]]> Where an agency does not perform its own destruction of media and IT equipment, an approved facility must be used. Agencies that do perform destruction of media and IT equipment must use equipment that complies with the NZISM.

]]> A variety of equipment for media and IT Equipment destruction exists. Evaluated products will provide assurance that the product will be effective. Approved products are discussed in Chapter 12 - Product Security.

]]> Where a product or service is not an evaluated product or is NOT listed in the PSR, agencies must consult the GCSB for advice.

]]> Equipment can be dismantled or pre-processed before disposal. Care MUST be taken to ensure safe handling of any potential poisonous, carcinogenic or toxic materials.  

]]> Where incineration is the disposal method of choice, users must ensure the facility is properly rated for the incineration of electronic waste (WEEE) and the safe handling of any poisonous, carcinogenic and toxic materials produced in the incineration process.  The facility must also be properly authorised or licenced to operate.

]]> Media and IT equipment destruction MUST be performed using approved destruction equipment, facilities and methods.

]]> Where agencies do not own their own destruction equipment, agencies MUST use an approved destruction facility for media and IT equipment destruction.

]]> Where a facility is NOT an approved facility, agencies MUST ensure any incineration equipment is rated for the destruction of electronic waste (WEEE) and the operator is properly authorised or licensed.

]]> Where a facility is NOT an approved facility, agencies MUST ensure processes are in place for the safe handling of electronic waste (WEEE), including any residual material from the destruction process.

]]> Following destruction, normal accounting and auditing procedures do not apply. As such, it is essential that when an item is recorded as being destroyed, destruction is assured.

]]> Agencies MUST, at minimum, store and handle the resulting waste for all methods, in accordance with the classification given in the table below.

Initial media or IT Equipment classification

Screen aperture size particles can pass through

Less than or equal to 3mm

Treat as

Less than or equal to 6mm

Treat as
 TOP SECRET

UNCLASSIFIED

 RESTRICTED
SECRET

UNCLASSIFIED

 RESTRICTED
CONFIDENTIAL

UNCLASSIFIED

 RESTRICTED
RESTRICTED

UNCLASSIFIED

UNCLASSIFIED

Particle size: measured in any direction, should not exceed stated measurement.

]]> Degaussers are effective ONLY on magnetic media or storage devices. Coercivity varies between media and IT Equipment types and between brands and models of the same type. Care is needed when determining the desired coercivity as a degausser of insufficient strength will not be effective. The National Security Agency/Central Security Service’s EPLD contains a list of common types of media and their associated coercivity ratings.

]]> Since 2006 perpendicular magnetic media have become available. Some degaussers are only capable of sanitising longitudinal magnetic media. As such, care needs to be taken to ensure that a suitable degausser is used when sanitising perpendicular magnetic media.

]]> Some degaussers will have product specific requirements. Agencies will need to comply with any directions provided by the GCSB to ensure that degaussers are being used in the correct manner to achieve an effective destruction outcome. Refer also to Chapter 12 - Product Security.

]]> Agencies MUST use a degausser of sufficient field strength for the coercivity of the media and IT Equipment.

]]> Agencies MUST use a degausser which has been evaluated as capable for the magnetic orientation (longitudinal or perpendicular) of the media.

]]> Agencies MUST comply with product specific directions provided by the manufacturers, along with any provided by the GCSB.

]]> To ensure that classified media and IT Equipment is appropriately destroyed it will need to be supervised to the point of destruction and have its destruction overseen by at least one person cleared to the highest classification of the media being destroyed. To provide accountability and traceability, a destruction register is essential.

]]> Agencies MUST perform the destruction of media and IT Equipment under the supervision of at least one person cleared to the highest classification of the media or IT Equipment being destroyed.

]]> Personnel supervising the destruction of media or IT Equipment MUST:

  • supervise the handling of the media or IT Equipment to the point of destruction; and
  • ensure that the destruction is completed successfully.
]]> The Destruction Register SHOULD record:

  • Destruction facility used;
  • Destruction method used;
  • Date of destruction;
  • Operator and witnesses;
  • Media and IT equipment classification; and
  • Media and IT equipment type, characteristics and serial number.
]]> As accountable material is more sensitive than standard classified media and IT equipment, it needs to be supervised by at least two personnel and have a destruction certificate signed by both personnel supervising the process.  This includes any NZEO material.

]]> Agencies MUST perform the destruction of accountable material under the supervision of at least two personnel cleared to the highest classification of the media or IT Equipment being destroyed.

]]> Personnel supervising the destruction of accountable media and IT Equipment MUST:

  • supervise the handling of the material to the point of destruction;
  • ensure that the destruction is completed successfully; 
  • sign a destruction certificate; and
  • complete the relevant entries in the destruction register.
]]> Agencies may wish to outsource media and IT Equipment destruction for efficiency and cost reasons.

]]> Agencies MUST NOT outsource the supervision and oversight of the destruction of TOP SECRET or NZEO media and IT equipment or other accountable material to a non-government entity or organisation.

]]> Agencies outsourcing the destruction of media and IT Equipment to a commercial facility MUST use an approved facility and comply with the procedures and instructions in this Chapter.

]]> Requirements on the safe handling and physical transfer of media and IT Equipment between agencies or to commercial facilities can be found in the PSR.

]]> Agencies SHOULD sanitise media and IT Equipment prior to transporting it to an offsite location for destruction.

]]>