Focus on Security: Taking Control

Secure destruction professionals may want to consider offering their clients a variety of key control options that correspond with their security needs.

Is document shredding a recycling or a security operation? Many companies merely want to dispose of piles of paper, but for many businesses, especially in the retail, legal, medical and research industries, there is a lot of valuable information in those secure bins, information that is valuable to competitors and to criminals.

Document destruction industry marketing brochures emphasize locked containers, the chain of custody and bonded drivers. Current NAID (National Association for Information Destruction) AAA Certification standards require drug-tested drivers and locked containers.

The concept of a “locked container,” however, covers a wide range of security levels.

A locked cabinet or bin is supposed to prevent the kind of document theft that hits the headlines every month, whether it’s a celebrity’s medical records or financial information. The customers of shredding companies are told to keep their bins and cabinets locked. Shredding companies usually make the collection process convenient for their drivers by using the same key for all their customers. That means they also give the same key to each of their customers. But, if that’s the same key the company down the street or the competitor across town has, or if the company doesn’t control its key, that convenience can potentially destroy the security.

If every customer of a shredding company has the same key, the console or bin may be tamper evident or even tamper proof, but that console or bin is not secure. And what is even worse, that console or bin appears to be secure when it is not. If a shredding company provides a locking console or a bin with a padlock to a customer without telling that customer that he shares the same key code with all the company’s other customers, there is only an illusion of security. You could even say that that “the illusion of security” creates a greater level of liability than no security at all.

APPROPRIATE CONTROL

To protect the chain of custody, the first step is to ensure that you help your customers control the keys in their possession. Renee Keener, president of American Document Securities Inc., a Carrollton, Ga.-based records management company specializing in shredding, storage and consulting for the information protection industry, recognizes the role of key control in maintaining the chain of custody. Her company provides locked containers to its customers and provides keys only to people the customer has authorized. Customers need access to documents awaiting shredding, but to protect the chain of custody, American Document Securities and its customers control that access. As Renee says, “There are liabilities on both sides.”

The necessary second step in protecting the chain of custody is to take a long look at the convenience vs. security question. What if a bank or medical customer keeps careful control of its keys, but another customer does not. People change jobs and go to work for a competitor, and a secure company could be victimized by the loose procedures of another company that doesn’t control its key.

At a minimum, a shredding company that promises secure shredding should consider providing a different key code for each of its customers and should emphasize that security feature in all its marketing, for example, by stating, “For your protection, only your company has your key code.”

PROVIDING OPTIONS

A shredding company also can provide additional levels of lock security for padlocked bins and cabinets beyond assigning an individual key code to each of its customers.

A five- or six-pin tumbler padlock can provide low or medium security. Until recently, it took more than a casual thief to pick a five- or six-pin tumbler padlock, but now a new method, “the bump key,” can turn an amateur picker into a pro in a few minutes. If you haven’t heard of “the bump key,” just enter the term in Google or any Internet search engine. You’ll find dozens of videos that show you how to file down a standard key and easily “bump” open virtually any pin tumbler lock. It’s so easy that one video shows a 10-year-old girl opening a lock in seconds.

Some companies offer a combination lock, which allows the customer to set a unique combination. Unfortunately, a face dial “gym locker” lock is easier to pick than a pin tumbler lock. For a higher level, shredding companies should provide a four-wheel combination lock.

However, if a thief isn’t concerned about hiding the data theft, a pin tumbler padlock or a combination lock can be easily cut off with a bolt cutter.

A disk lock, popular in the self-storage industry, employs a “hidden shackle,” which resists a bolt cutter. With a pick resistant key and keyway, this type of lock becomes stronger than the console or bin. A pick resistant keyway works with rotating disks and side bar rather than a series of pins and cannot be picked or bumped with any tool or technique available on the Internet.

These options provide security against a casual thief and evidence of tampering.

A console provides stronger protection than a bin. The way to increase the lock security of a cabinet is to go beyond a standard cut key and use and use a high-security lock in combination with a camlock. Because a console is harder to break into than a bin, its lock should have a higher level of security than an ordinary lock.

SECURITY PLUS CONVENIENCE

When Lock America’s CEO Frank Minnella spoke to cabinet manufacturers who were exhibiting at a recent industry conference, many of them wanted to know if he could supply them with locks with the same key code as other lock manufacturers. They didn’t just want the key code that they already had—all these manufacturers wanted the same key code. As I have said, this situation creates potential security liabilities, for shredding companies, for
their customers and for the shredding industry.

Shredding contractors take measures to keep their customers’ consoles and bins secure and tamper-evident. But can any company’s consoles and bins be secure if another company has the same key? If the shredding company wants to provide secure shredding, it needs to provide a key control system, with the marketing message: “The bin contains your data, and it is secured with your unique lock and key.”

A shredding company can set itself apart from its competition by using different lock systems to provide appropriate levels of security and convenience for its customers. For customers who need high security, such as banks, labs, law offices and medical facilities, it can provide a high security key and keyway with a master system. A high security master key system provides millions of usable key codes, so that each customer can be assured that no other customers have the same key code. And a high security keyway is virtually pick and drill-proof. The master key, controlled by the driver, allows the driver access without requiring a ring of keys.

Even if they do not go to the high security master key level, shredding companies need to go beyond generic retail market padlocks and provide genuine security for the flow of confidential information to protect their company’s reputation and their customers’ data. This added value will attract the high-end security-conscious customers that provide a long-term revenue stream.

Rich Morahan is a marketing consultant for Lock America International. He frequently writes and conducts seminars on self-storage marketing and security. To reach him, call 617.240.0372; e-mail rmwrite@comcast.net; visit www.laigroup.com.