Breach is a word with typically negative connotations. “Breach of duty”, “breach of contract”, “breach of trust”.

It’s also a word that, when it comes to the data center industry, we should be thinking about more proactively. When masses of sensitive data are at stake, preventing a breach should be as important as responding to one. When the worst happens, it’s in the public interest to know what happened, how it happened, and what could have been done to prevent it. Morgan Stanley, Cloudflare, SK Telecom, Snowflake, and the Pentagon are all well-documented cases, but in reality, breaches are happening far too often. One common theme appears to be unsubstantiated reliance on third parties – a situation that can be avoided with the right intel and expertise.

As data protection laws tighten, the consequences of a data breach increase. The fallout is expensive, business-detrimental, and, in many cases, avoidable.

Millions of dollars, hundreds of thousands of compromised customers, and tens of thousands of crucial pieces of hardware and software are all on the chopping block. Since the cost of an average data breach reached $4.45 million in 2023 (up 15 percent over the previous three years, by the way), that number has continued to climb and now sits at $4.99M – a 12 percent increase on that previous figure and an all-time high.

And what’s different today from 2023? The sheer dissemination of AI technology.

The rapid proliferation of AI is driving record volumes of data through infrastructure at an unprecedented rate. As facilities expand swiftly to keep up, operators face heightened security risks and a vastly expanded attack surface for potential compromises of sensitive, confidential information. According to a study in Nature Computational Science, the vigorous rate of AI hardware advancement and subsequent obsolescence could lead to a staggering 2.5 million tons of e-waste per year by 2030 – a significantly larger rate of e-waste production than the previously recorded 2,600 tons per year in 2023. As Andrew Kelleher, SEM’s president, warns:

“With data centers at the forefront of AI storage, it’s up to the companies that own them and the people who operate them to stay on top of evolving privacy and destruction standards. Knowing the regulations and acting on them will protect data centers from the consequences of data breaches.”

Regulatory-approved decommissioning methods

While many data centers aren’t storing data that would be labeled classified, they would still face damaging consequences if the sensitive information they hold were to fall into the wrong hands. That is precisely why data erasure and media device decommissioning methods are standard procedure in the data center. But if these safeguards are already commonplace, why are breach events still occurring so prolifically?

According to Kelleher, there are some very key differences between standard and regulatory-approved methods that we need to understand – and that distinction ultimately comes down to one thing: how much risk are you prepared to accept?

“The difference between standard data erasure and regulatory-approved decommissioning comes down to the security level of data that needs to be purged and how much risk is acceptable when it comes to possible information breaches,” says Kelleher.

With standard erasure, data is cryptographically erased or overwritten at the block level. The drive is not physically destroyed and can be used again. This approach does offer key advantages, namely in the form of added ROI from reusing storage media and support for companies’ sustainability goals. But, as Kelleher exclaims, those benefits come with an inherent risk:

“There is still a possibility that data can be recovered due to machine or operator error when erasing the drive. This can lead to possible information breaches, which can come with penalties such as fines, damage to a company’s reputation, and, in extreme cases, criminal liability.”

Regulatory-approved decommissioning, on the other hand, follows government and industry end-of-life destruction standards, which include both magnetic erasure and then physical destruction of the device. It can also include destruction tracking and auditing requirements, adding another layer of security and accountability to the process.

“Data is no longer recoverable, which means no chance of a breach. However, the device cannot be reused. Also, recycling, while still possible, can be more difficult,” Kelleher says.

And therein lies the dilemma. If the most secure approach removes the possibility of data recovery but makes reuse more difficult, where does that leave data centers trying to balance security, compliance, cost, and sustainability?

Don’t fret – we’ll get to that.

Federal, state, and international regulations and standards

First, let’s explore what it means to integrate regulatory-approved magnetic degaussing and decommissioning practices into everyday operations.

There are a number of regulatory entities that govern data privacy and protection – most notably HIPAA for the healthcare sector and GLBA for financial services in the US. And in a global economy, US companies are often held to international standards and rules, such as Europe’s GDPR. Other industry-based laws include FACTA and Sarbanes-Oxley (aka SOX).

These regulations seek to protect consumer data from breaches, including when data-bearing media reaches the end of its useful life. And most carry significant consequences when not followed properly, often including fines or even criminal penalties. However, while these laws tell organizations what they need to protect, they don’t necessarily tell them exactly how to do it.

That makes understanding standards and frameworks such as the National Security Agency (NSA), NIST, and ISO paramount. These frameworks help translate regulatory obligations into practical processes for securely erasing and decommissioning media.

The NSA is one of the most pivotal organizations in information security. Its media destruction standards are among the most stringent requirements for the destruction of sensitive and classified information.

“NSA’s data decommissioning standards are the gold star, trusted by governments around the world,” says Kelleher.

Most US governmental departments, including the US military, use these standards. Products evaluated by the NSA and listed on its Evaluated Products List (EPL) meet the qualifications required for the destruction of top secret/classified information. As a data destruction expert, SEM takes a proactive approach to regulations, ensuring many of its solutions are listed on the NSA EPL, meaning they have been evaluated against the US government’s strictest standards for classified information.

For data center operators evaluating data destruction equipment, solutions that meet strict government standards, such as those set by the NSA, can provide additional confidence that their decommissioning processes are secure and fit for purpose. Kelleher explains:

“SEM can guide companies on what types of equipment they will need based on their industry, types of media they use, and the number of devices they need destroyed. If a custom solution is needed, SEM will work closely with companies to develop a device or devices to meet the requirement.”

Region-specific regulations

Regulation for the data center industry is evolving more so toward state-level requirements. For companies that operate across multiple states or have customers across the country, that creates an increasingly complex compliance landscape. They need to understand and follow the regulations that apply in each jurisdiction in which they operate – and that can vary significantly.

For example, the California Consumer Privacy Act (CCPA) has significant implications for organizations that store, process, and transmit the data of California residents, including data centers and relevant cloud environments. As Kelleher affirms:

“It gives California residents more control over how their personal data is collected, used, disclosed, or stored. Consumers have a right to correct inaccurate information and request their data be deleted.”

That said, the added layer of regulation introduces complexity, with operators’ compliance and accountability requirements depending on factors including vendor classification, data inventories, and processing agreements. Owners and operators therefore need to take the time to fully understand the requirements that apply to them – not only at the state level, but across the wider industry and federal regulatory landscape.

Sector-specific regulations

Regulatory requirements can also vary depending on the industry in which an organization operates. For companies handling particularly sensitive data, sector-specific requirements can directly influence how data is managed and ultimately destroyed.

For example, the US Securities and Exchange Commission enacted SOX to address how public companies handle financial information and reporting. For organizations subject to SOX, this includes requirements that influence how electronic data and financial records are managed throughout their lifecycle.

Data and privacy requirements include retaining records and data for a defined period, maintaining a fully documented data destruction process to ensure chain of custody, and keeping records meticulously and accurately maintained. For data center operators, that means the process of decommissioning goes far beyond just removing obsolete equipment.

Method-specific regulations

Media devices are also becoming obsolete more quickly, creating a greater need for secure end-of-life destruction. Meanwhile, companies, governments, and industry organizations are working to keep up with the growing volume of data hosted in compute-intensive data centers and AI factories.

NIST 800-88 guidelines for media sanitization are among the most widely discussed frameworks for data destruction because they require the data owner to make a risk decision and provide guidance on three approaches – clearing, purging, and destroying data.

“All three methods have their advantages and disadvantages, so it’s necessary for operators to understand each, as well as know the security level of data they are handling,” says Kelleher.

Where clearing and purging allow for the reuse of undamaged media – an advantage for companies wanting to get more ROI from their technology or meet sustainability goals – they can also leave a residual risk of data recovery if the appropriate process is not followed.

Destruction, the final method, is the most effective and permanent approach to data sanitization. It involves electromagnetic degaussing followed by physical destruction through crushing, shredding, or disintegration.

Operators must also be able to prove and document the process throughout the chain of custody. Every handoff, whether internal or external, creates an opportunity for loss, theft, or human error, making strict controls and accurate documentation essential.

“When destruction is done in-house, the risk of breaches decreases even more due to a tighter chain of custody.”

That brings us back to one central challenge of data center decommissioning. If destruction means a device can’t be reused, does that undermine sustainability? According to Kelleher, security and sustainability do not necessarily have to be opposing priorities:

“Even though media can’t be reused after destruction, there are still options for recycling the destroyed material. Through destruction, companies can be assured that their data is secure while still maintaining sustainability initiatives.”

Sustainability as an integral part of data destruction

So it seems IT asset decommissioning and sustainable approaches can go hand-in-hand. From e-waste recycling and oil consumption to health and safety standards, sustainability can take many forms when it comes to asset decommissioning. Kelleher suggests:

“Recycling is usually the first thing that comes to mind when building out sustainability goals. When a storage device reaches end-of-life and needs to be destroyed, that doesn’t mean it has to go directly into a landfill.”

In fact, a shredded hard drive still contains several valuable, recyclable components, including aluminum, magnets, and a PC board.

For operators looking to build recycling into their decommissioning processes, SEM and its partner company, Garner Products, offer equipment designed to make the process more efficient. Their briquette compressors can turn shredded paper particles into compact pucks, reducing total volume by 90 percent. These briquettes can then be fully and easily recycled. SEM’s oil-free paper shredder also supports companies looking to reduce their reliance on fossil fuels while maintaining high security standards.

“The Model 1201CC is the only high-security paper shredder listed on the NSA EPL for use without oil, making it the ideal eco-friendly model,” he adds.

On the e-waste side, Garner’s automated DiskMantler can disassemble decommissioned hard drives into their largest components in less than 30 seconds per drive, leaving them ready to be sorted and recycled.

For air quality, data destruction machines need proper ventilation and filtration systems to limit harmful particles and emissions released when storage devices are destroyed.

SEM’s HDD, SSD, and combo solutions come with advanced HEPA filtration systems designed to capture the harmful particles and emissions released during destruction, helping to prevent them from entering the atmosphere and supporting better air quality.

Of course, health and safety cannot go amiss. Both SEM and Garner manufacture equipment with CE marking that meets essential European health, safety, and environmental protection requirements. Both companies also sell products that meet UL and cUL electrical and safety standards.

“Sustainability goals should also include health and safety initiatives, for both people and the environment.”

The only good breach is no breach at all

A data breach shouldn’t be another inevitable cost of doing business. The technology, regulations, and expertise to prevent it already exist.

While data erasure has the benefit of allowing media devices to be reused, degaussing and physical destruction offer a more secure and permanent solution. And destruction doesn’t have to be the end of sustainability – shredded and dismantled media can still be recycled, allowing operators to protect sensitive data while recovering valuable materials and reducing waste.

It’s the million-dollar question: how much risk is acceptable to you?

To learn more, visit semshred.com or contact SEM at [email protected].