Digital Photocopiers Loaded With Secrets

Your Office Copy Machine Might Digitally Store Thousands of Documents That Get Passed on at Resale

NEW YORK, April 15, 2010 (CBS)  At a warehouse in New Jersey, 6,000 used copy machines sit ready to be sold. CBS News chief investigative correspondent Armen Keteyian reports almost every one of them holds a secret.

Nearly every digital copier built since 2002 contains a hard drive - like the one on your personal computer - storing an image of every document copied, scanned, or emailed by the machine.

In the process, it's turned an office staple into a digital time-bomb packed with highly-personal or sensitive data.

If you're in the identity theft business it seems this would be a pot of gold.

"The type of information we see on these machines with the social security numbers, birth certificates, bank records, income tax forms," John Juntunen said, "that information would be very valuable."

Buffalo Reacts to CBS News Investigation

Juntunen's Sacramento-based company Digital Copier Security developed software called "INFOSWEEP" that can scrub all the data on hard drives. He's been trying to warn people about the potential risk - with no luck.

"Nobody wants to step up and say, 'we see the problem, and we need to solve it,'" Juntunen said.

This past February, CBS News went with Juntunen to a warehouse in New Jersey, one of 25 across the country, to see how hard it would be to buy a used copier loaded with documents. It turns out ... it's pretty easy.

Juntunen picked four machines based on price and the number of pages printed. In less than two hours his selections were packed and loaded onto a truck. The cost? About $300 each.

Until we unpacked and plugged them in, we had no idea where the copiers came from or what we'd find.

We didn't even have to wait for the first one to warm up. One of the copiers had documents still on the copier glass, from the Buffalo, N.Y., Police Sex Crimes Division.

It took Juntunen just 30 minutes to pull the hard drives out of the copiers. Then, using a forensic software program available for free on the Internet, he ran a scan - downloading tens of thousands of documents in less than 12 hours.

The results were stunning: from the sex crimes unit there were detailed domestic violence complaints and a list of wanted sex offenders. On a second machine from the Buffalo Police Narcotics Unit we found a list of targets in a major drug raid.

The third machine, from a New York construction company, spit out design plans for a building near Ground Zero in Manhattan; 95 pages of pay stubs with names, addresses and social security numbers; and $40,000 in copied checks.

But it wasn't until hitting "print" on the fourth machine - from Affinity Health Plan, a New York insurance company, that we obtained the most disturbing documents: 300 pages of individual medical records. They included everything from drug prescriptions, to blood test results, to a cancer diagnosis. A potentially serious breach of federal privacy law.

"You're talking about potentially ruining someone's life," said Ira Winkler. "Where they could suffer serious social repercussions."

Winkler is a former analyst for the National Security Agency and a leading expert on digital security.

"You have to take some basic responsibility and know that these copiers are actually computers that need to be cleaned up," Winkler said.

The Buffalo Police Department and the New York construction company declined comment on our story. As for Affinity Health Plan, they issued a statement that said, in part, "we are taking the necessary steps to ensure that none of our customers' personal information remains on other previously leased copiers, and that no personal information will be released inadvertently in the future."

Ed McLaughlin is President of Sharp Imaging, the digital copier company.

"Has the industry failed, in your mind, to inform the general public of the potential risks involved with a copier?" Keteyian asked.

"Yes, in general, the industry has failed," McLaughlin said.

In 2008, Sharp commissioned a survey on copier security that found 60 percent of Americans "don't know" that copiers store images on a hard drive. Sharp tried to warn consumers about the simple act of copying.

"It's falling on deaf ears," McLaughlin said. "Or people don't feel it's important, or 'we'll take care of it later.'"

All the major manufacturers told us they offer security or encryption packages on their products. One product from Sharp automatically erases an image from the hard drive. It costs $500.

But evidence keeps piling up in warehouses that many businesses are unwilling to pay for such protection, and that the average American is completely unaware of the dangers posed by digital copiers.

The day we visited the New Jersey warehouse, two shipping containers packed with used copiers were headed overseas - loaded with secrets on their way to unknown buyers in Argentina and Singapore.

Watching this video compilation showing the results of people running "red" lights it may get you to think twice as you approach any intersection. Just because the light is "green" in your direction doesn't mean it's totally safe to go through the intersection expecting all traffic is stopped at the red light. Some of these show that people are totally asleep at the wheel. Probably texting.

 Steven Simon is an adjunct senior fellow in Middle Eastern Studies at the Council on Foreign Relations and the co-author of “The Age of Sacred Terror” and “The Next Attack.”
Video surveillance would not have stopped the Times Square attack. Does this mean that it would be useless? Not necessarily.

The challenge: exploiting this visual information while protecting the privacy of citizens.

Swift and accurate analysis of video surveillance information might prevent the next attack, even if it is powerless to stop the last one. Imagery can be used to assist in the identification and location of individuals at the scene of the crime.

It can also be used to track the progress of the bomb-laden vehicle from the its point of origin, or the point at which the truck was weaponized, to the place the terrorists have targeted. In combination with physical evidence acquired from the vehicle — fingerprints, hair, cloth fibers, soil, trash, forgotten personal items or a host of other bits of evidence — video surveillance can lead to the arrest of the bombers and to the unraveling of cells or networks and, if the attackers are foreign, the ratlines they exploited to enter the country.

At this point, the U.S. does not have the kind of pervasive surveillance systems in place that, say, the British have deployed. In the U.K., there is about one surveillance camera for every thousand residents. It took British authorities years to reach this level of intensive surveillance.

The U.S., as anyone who follows the debate over privacy loss in this country knows, is studded with cameras, but most of these are in stores to track consumption habits to facilitate marketing or deter shoplifters. They’re not where they’re needed, which is on the street. The two smallest jurisdictions in the U.K., very rural areas indeed, together deploy more surveillance cameras than the San Francisco police department.

The U.S., of course, does not have to match Britain camera for camera. Surveillance can be enhanced in areas that are assessed to be likely targets, a category that can be inferred, at least in a general sense, from targeting patterns and what the terrorists actually have said about the desirability of attacking this or that; and they do discuss this in their literature and on their Web sites.

More problematic, is the need to organize our law enforcement capabilities in ways that enable this visual information to be exploited effectively, while protecting the rapidly fading privacy available to ordinary citizens. Therein lies the real challenge.

Jeffrey Rosen, a law professor at George Washington University and the legal affairs editor of the New Republic, is the author of “The Naked Crowd: Reclaiming Security and Freedom in an Anxious Age.”

After every thwarted terrorist attack, there are predictable calls for more surveillance cameras. Before the failed Times Square bombing attempt, the N.Y.P.D. got a $24 million Homeland Security grant to install a security network in Midtown with surveillance cameras, chemical sensors, and license plate readers. Despite evidence that such a system wouldn’t have prevented last Saturday’s attack, many will demand an even more elaborate surveillance network as a result. But all the best empirical research suggests that it will be a waste of money.

Consider how Google, Facebook and other Web services could be harnessed to surveillance cameras to monitor everyone’s movements.

Here’s what we know about surveillance cameras. They’re more or less useless in deterring terrorism before it occurs. The best peer reviewed studies in Britain and America find no connection between the proliferation of cameras and the deterrence of serious crime or terrorism. They’re also not useful in preventing attacks in progress: the Times Square bombing was detected by alert street vendors who saw the smoke and called the police.

Cameras sometimes play a supporting role in identifying the perpetrators after an attack has occurred. But in all the major terrorist attacks since 9/11, including the London bombings, the perpetrators would have been identified without the cameras. In the Times Square case, there was so much forensic evidence at the crime scene that the police were able to identify the former owner of the Pathfinder through the vehicle identification number, leading to the arrest of the suspect on Monday night without necessarily relying on
the footage from more than 80 surveillance cameras.

If there are already so many surveillance cameras in midtown and lower Manhattan -– more than 4,000 below 14th Street, according to one count why should anyone care about a few more? Even if they’re a placebo that makes us feel safer without actually making us safer, what’s the harm?

Although the harms were largely hypothetical when I began writing about surveillance cameras in the Britain and the U.S. right after 9/11 they are about to become much more tangible.

Google, Facebook and other Internet services could be asked to carry out Web-based facial recognition technologies that will make it possible for anyone to snap a cellphone picture of a stranger on the street, plug the picture into Google, and produce tagged and untagged pictures of the person across the Web, challenging our expectations of anonymity in public as camera footage proliferates.

That challenge will become even more acute over the next decades, as Google and Facebook confront pressure to post live feeds from all public and private surveillance cameras online. As the surveillance network in world capitals becomes ubiquitous, it will be possible to click on a picture of me in Midtown, back click on me to see where I came from, forward click to see where I’m going, making possible 24/7 surveillance of everyone in the system. When confronted with this not-so-hypothetical scenario, most people balk. And to accept 24/7 ubiquitous surveillance in exchange for virtually non-existent security benefits seems like a bad bargain, by any sane cost-benefit analysis.

So what’s the solution? More cops are always useful. Human intelligence is invaluable, and it’s important to keep citizens on the side of the police so they’re willing, like the Times square street vendors, both disabled Vietnam vets, to go out of their way to help. The arrest of the owner of the explosive-packed S.U.V. shortly before midnight on Monday demonstrated again that security depends on investigative work, which is not about installing more cameras.

(KMOV) --St. Louis Police are searching for two suspects accused of robbing a Collinsville hotel Saturday.
Authorities said two male suspects entered the Comfort Inn at 8 Commerce Drive armed with handguns and wearing ski masks. They bound the clerk's hands and feet and fled the scene with an undetermined amount of cash and checks. The clerk was not physically injured during the robbery and no shots were fired.
One suspect was wearing jeans with a distinct thread design on the back pockets. Police released the surveillance video Thursday.
The investigation is ongoing.