Data Security Solutions

Company zips away computer files 4

Corporate, private clients rely on QSGI to erase hard drives containing sensitive data
By BILL MOONEY


EAST WINDSOR -The kinds of stuff the folks at QSGI stumble across would make CEOs at major companies break out in cold sweats.

"We've found it all," said President and Chief Operating Officer Seth Grossman. "It would make your head spin."

The employees at this 5-year-old company on Lake Drive aren't dealing in incriminating photographs or mislaid stacks of cash. They're dealing in what in the 21st century has become the true coin of the realm: information. Specifically, the techies at QSGI specialize in erasing data permanently from computer systems.

But in addition to wiping clean the computer networks of Fortune 1,000 companies, QSGI also buys equipment to be converted for resale and many times finds that hard drives were not erased as completely as their former owners believed. Instead, those systems still retain sensitive data such as Social Security numbers or financial data about clients. "There are major entities that thought they were doing it right," Grossman said. "That's a great entree for us."

QSGI pledges Department of Defense-level certified data erasure, erasing a hard drive to a nonrecoverable state, and documenting it for the customer. Then QSGI refurbishes and sells the old hardware and splits the revenue with the customer. Less than 2 percent of the machinery they service ends up as trash. Most is refurbished and resold.

"When we are done," said company founder Marc Sherman, "the customer gets a very detailed description, the model number, the serial number, the hard drive information, and it says erased to a DOD standard, with a certificate of erasure."

Sherman, a 43-year-old Trenton native, took a curious route to such cutting-edge work. His grandfather and father were in the scrap metal business in the days when the state capital was still an industrial powerhouse. But by the time Sherman entered the field, Trenton's heyday as a manufacturing mecca was on the wane.

"I got more involved into doing silver recovery from hospitals," Sherman said. Reclaiming silver from X-ray film, and precious metals recovery overall, proved lucrative until silver prices fell in the 1980s.

"And I heard there was a demand for people to process big IBM mainframes for precious metal values. We were bringing in millions of pounds of mainframes and there was copper, steel, brass, gold, platinum inside these mainframes. We were really a recycling business.

"One thing led to another. We went from William Sherman and Sons Scrap Metal to Electronics Processing Corp. of America."

The change encompassed more than just a name. "I took a family business from $6 million to $150 million," he said. Eventually, he sold the business, took a year off, and moved his family to Palm Beach, Fla., where they still live. Meanwhile, he saw security issues becoming more important to the computer field and a new business took shape.

He began Windsor Tech in 2001 as an IT solutions company, purchased a mainframe remarketer called QualTech International in 2003, and QSGI evolved from that into a company that last year had gross revenues of $36 million.

But whereas most successful multimillion-dollar companies would gladly boast of their client list, at QSGI, mum's the word. "If we've never had a data breach, why should we expose ourselves," Sherman said is the attitude expressed by their clients. "If we do our job right, you'll never see their name."

So in announcing new business, QSGI tends to remain cryptic, such as earlier this month when QSGI announced it had won a contract and described the new client not by name, but as a U.S. subsidiary of a Paris-based financial institution, a business whose parent company employs more than 90,000 people worldwide.

QSGI has about 100 employees in offices in Palm Beach, New York City, Portsmouth, N.H., Eagan, Minn., and in a nod to the global aspect of the information age, a sales office in Delhi, India. A peek inside their unassuming office, a 40,000-square-foot site in a corporate park in East Windsor, offers a view of quiet efficiency as a crew of techies inside a warehouse-sized structure methodically erase data from machines.

The business of erasing data has advanced beyond the unsophisticated days of slipping a floppy into a machine, pressing a button and assuming it worked.

"You can't do it in your garage anymore," Grossman said. "A competitor slips a disk in and says, 'The data has been erased.' Someone forgets to do the erasure, or more than half the time they haven't erased. Ours is server-driven because there is human risk. This doesn't allow us to miss anything." They also have a de-magnetizer on site, which can wipe a computer clean of every last scrap of information. "You don't have the risk that software didn't work."

With major companies discarding old computers every three or four years, and with an estimated 130 million personal computers being trashed this year, that is a lot of bank accounts, proprietary formulae and personnel files at risk.

Recent changes in the law mandate that employers ensure such data does not fall into the wrong hands. Laws such as Sarbanes-Oxley, the Health Insurance Portability & Accounting Act and the Gramm-Leach-Billey Act all deal in some form with maintaining confidentiality of client data, and in some cases levy heavy fines for violations. A company breaching the Gramm act can incur a $100,000 fine.

"People say their information is encrypted," Sherman said, "but who holds the encryption key? The guy you just fired? You can't change encryption all the time. Codes can be broken and it is not that difficult. People have to understand you have to be concerned with the end-of-life cycle (of computers)."

Understandably, clients might worry about the mere act of transporting to a QSGI office the very material whose security is of concern. Grossman said they do a lot of their computer cleansing work at the client's office. "It eliminates risk."

For higher-volume clients, QSGI has two methods.

A tractor-trailer is driven to the customer. Inside is a carousel similar to the type seen in dry cleaners that can hold and service 180 computers. For a mid-volume customer, QSGI personnel bring what they call the "suitcase," albeit one weighing 140 pounds, that can service up to 24 units at once.

QSGI has not forgotten individuals with home-based computers. A company Web site, eraseyourharddrive.com, offers people the ability to wipe clean their hard drives before recycling their units.

"People thought computers were the end-all, but they never thought about information that resides on computers," Sherman said. "Some companies don't want to spend money on security. But how much is it worth you to damage your brand? We've been preaching this to our customers for the last six years," he said, adding that companies are listening to their advice.

And the company's financial picture has been improving as a result. For the second quarter that ended June 30, QSGI reported revenue increased 70 percent, to a record $15.2 million. Gross profit rose to $3.1 million, compared with $2.1 million in the same quarter of 2005.

Net income for the quarter ending June 30 was $305,000, up from a loss of $431,000 in the previous quarter. Total revenue for the quarter was $15.1 million, compared with $8.9 million in the same quarter of 2005.

As more companies have started paying better attention to computer security, competitors have started to spring up, but QSGI personnel feel their head start and track record serve the company well.

"What we do makes good sense," Grossman said. "You don't want your R&D going out the door."

PHOTO CAPTION: 1. Computer technician James Cooper works erasing data on hard drives at QSGI Data Security and Compliance. QSGI pledges Department of Defense-level certified data erasure, erasing a hard drive to a nonrecoverable state, and documenting it for the customer. CREDIT: 1. MICHAEL MANCUSO / THE TIMES

posted by Tirth @ 10:22 PM