To help fight that security threat, Toshiba recently announced a new set of hard disk drives that offer both self-encryption and a “key wipe” feature. The new 2.5 inch drives are being marketed especially for use in copier and printer multifunctionals.

The drives protect companies in two ways. They automatically use a security key to encrypt all data written on the disk. Then, when the device is unplugged and moved, it destroys that key. Therefore, when the disk is moved out of the company, all the stray data on the disk is totally unreadable.

All this is far easier than having to blank out the disk using disk erase software or overwriting the disk sector-by-sector, best practices that often get omitted when companies transfer disks. This feature also works if someone manages to detach the hard disk and walk it out the door.

Of course, you wouldn’t want to store any permanent data on the hard disk for the multifunctional, even though copier companies keep offering that as a feature. In our opinion, critical data belongs on centralized and (presumably) secured servers.

Quentyn Taylor, director of information security at Canon, issued a warning about the devices in a recent Infosecurity.com article.

“People don’t realise that most office [high-end] printers are actually a server,” Taylor. “I always ask my audiences at conferences whether they know this and a good 40 per cent say they don’t.”

One of the biggest problems: a lack of communication between different departments. As Taylor notes, in many businesses facilities management teams are responsible for leasing the machines, while IT is in charge of keeping them secure.

So the equipment leased doesn’t necessarily match up with what the company needs in terms of security.

Taylor also recommends companies:

1. Pony up and pay extra for encrypted drives on their copiers and MFPs, and
2. destroy drives themselves at the end of a devices life, rather than relying on third parties to take care of it.

1. Require authentication: In departments that regularly print confidential documents, consider getting a printer that requires a user to enter a password into the machine before it prints. Other models use swipe cards, or even biometric fingerprint readers.
2. Overwrite data: If your device prints off its own disk, you can probably set it to erase the disk after every job.
3. Check the OS: Some printers use a proprietary operating system, making them relatively safe from virus attacks. But others use a common OS and are therefore vulnerable. Find out what’s on your devices and plan accordingly.
4. Print from memory: It takes a little longer, but some printers let you bypass the hard disk and print straight from RAM. Or, buy a model without a hard disk — that’s an option you may not even need.

Not much, according to a recent survey.

Despite the dangers of releasing copiers into the wild after they’ve been used to scan sensitive documents (which we covered previously here), 68% of companies don’t wipe data from copy machines when they’re decommissioned, according to a TechRepublic poll.

Most modern copiers and multifunctional printers have hard drives that store documents before they’re printed out — and can store the images until someone actively deletes them.

That means many copiers are re-sold or re-leased with sensitive documents stored, available to anyone with the means to extract them.

What are your options for wiping that data? Of the businesses polled that do erase copier hard drives, they did so using

• internal staff
• a service from the copier dealer or leasing company
• a built-in feature on the copier, and
• a third-party service.

We’ve covered it before, but the tale of the all-too-vulnerable copier hard drive keeps coming up, this time in a recent CBS News exposé.

Investigative reporters bought four random copiers from a New Jersey used office equipment dealer. When they checked out the hard drives, they found that two of the copiers had been owned by the Buffalo, NY, police department.

And on the disks were a number of shockingly confidential police files, including lists of wanted sex offenders, details of domestic-violence complaints and lists of targets in a drug ring investigation.

The two other copiers also had confidential information, One, from a construction company, had lists of employees and their social security numbers. The second, which had been used by an insurance company, had confidential medical records of its customers.

In every case, the data was unencrypted, and not password-protected. And getting access to the data took only a little expertise and software tools available online.

What’s amazing is that all four randomly selected copy machines had data that would be of interest to prying eyes, information which would leave their former owners open to lawsuits.

The lesson is that, unknown to most people, most copier-multifunctionals in the workplace today come with hard drives, and they store jobs you print or scan, without users being aware of it. When the lease expires and the old copier is traded in, most users do not take any steps to clear off that data, and thus leave themselves open to embarrassment, fraud and legal action.

Watch the video of the CBS report here.

Affinity Health Plan, a New York-based non-profit managed care plan, recently notified 409,000 employees, providers, members and applicants that their personal information may have been breached.

The source of the potential breach: an old copier hard drive.

The organization was informed that a leased copier returned to the leasing company may contain personal information — including Social Security numbers, birth dates and medical info — on its hard drive. It’s currently trying to retrieve the machine to examine the drive, Affinity said in a press release.

According to a CBS news report, the machine was found in a warehouse in New Jersey, ready to be sold.

Affinity officials admitted a lack of knowledge can be blamed for the situation: “Like many organizations across the country, we were not aware copy machines contained hard drives that need to be wiped,” said Abbe Abboa-Offei, senior vice president of Customer & Community Connections.

The organization’s now learned its lesson and is changing its practices when returning leased equipment.

Hard disk drives have been a standard part of midrange to high-level copiers for about five years. They have various uses, including saving frequently printed forms and guides, storing digitized incoming faxes, and securing print jobs until you actually get to the machine and identify yourself with a password or biometric.

But the main function is that they make a temporary save of incoming prints and copies before putting toner on paper.

It used to be that a hard disk drive was an expensive add-on. More and more, it’s becoming standard equipment, especially on the faster copier-multifunctionals. And there are tools for protecting that data. First there are so-called “disk scrubbing” utilities that systematically remove any temporary data stored on the disk so that even the smartest cyberthief can’t find a trace of it. Then there are data encryption utilities that allow you to scramble the files that you do store.

But here’s the rub — most copier companies charge you hundreds of dollars extra for those tools. Therefore, they become an afterthought, an added expense that seems like a last-minute sales trick. Here we blame the copier companies — the security tools should be shipped along with any hard disk, not presented as an extra that a non-tech savvy purchasing agent sees no need for.

The reality is many unprotected hard disks are brimming with confidential data, as shown in a recent Toronto Star article.

As one security expert points out, these unprotected copiers are open to outsiders. “Any web-savvy, techno-whiz kid could easily access the hard drive, or send all scans to e-mail or, if they have the password, retrieve copies of confidential documents by simply hooking their laptop up to the copier.”

In fact, the Toronto Star reporter got a demo on how easy it is to target copiers anywhere in the world from the comfort of home. “The activity of photocopiers linked to an unsecure network can be seen and tracked online. With a few clicks of a mouse, and no knowledge of how to hack, we could see the latest activity of a photocopier in Korea, which included copies of invoices and employee expenses.”

From previously unimagined uses of printers to an unhealthy fascination with dead celebrities’ documents, we saw a lot of strange stories in 2009. Here are the top 10:

1. Michael Jackson’s death certificate hacked by Coroner’s Dept. employees

Is nothing sacred? Where computer systems are concerned, it seems not. More…

2. Don’t toss used paper — flush it

A new machine promises to help businesses give discarded sheets of paper a second life. A short, but not so sweet second life. More…

3. Police mistake toner cartridge for a bomb

A toner cartridge was recently caused an unusual amount of excitement in a Pennsylvania town. More…

4. Print out your dinner

Of all the things printers have been used for, here’s one you may not have considered: More…

5. Drunk worker keeps his job because of printer malfunction

Anyone working in an office knows how much trouble equipment glitches can cause. But here’s a case where a printer problem put one business in an unusual predicament. More…

6. Paper that erases itself: Coming soon?

All offices have to balance the need to cut paper use with employees’ reliance on paper documents. Here’s an innovation that might soon let you achieve that balance. More….

7. Used toner cartridge? Sit on it

Here’s a creative new use for those spent toner and ink jet cartridges. More…

8. Feds try to buy back their own printers

If you required users to return office equipment, would you pay them for bringing back something the company already owns? One government agency thought that was necessary. More…

9. Monks bless green printing

It’s not the most obvious place to get your supplies, but a religious order in Wisconsin is one of the latest businesses to sell soy-based toner and ink. More…

10. A new use for copier paper

Here’s a scientific breakthrough that comes under the category: “What will they think of next?” More…

Time to negotiate a new copier agreement? You’re starting out at a big disadvantage.

Most likely you hammer out a deal once every four or five years; the copier dealers do this every day, and they’ve set up all kinds of ways to squeeze more cash out of the unwary.

However, there are a few tricks of the trade you should know about if you don’t want to get stung too badly. That’s the advice of copier guru Larry Hunt, who tracks trends and has been consulting for decades with front-line copier customers. A few pointers:

1. Get the real price

Figure out the approximate street price of the equipment you want to buy. The dirty secret of the industry: The list price has only a marginal relationship to the real price a dealer could offer you if there were no other way of getting the business. In reality, copier companies can come out with a brand-new machine with a list price of, say, $80,000, and yet sell it on the street — if they have to — at $40,000.

That big a price differential is not always available, but it’s surprisingly common. In any case, a 25% to 30% discount from list is customary in the industry, but no dealer will volunteer that. It pays to ask around to other buyers, if you can find them. (Tip: Hunt’s publications also have a lot of reader-generated details on recent deal, especially for higher-end machines.)

2. Work the competition

Give the dealer the clear indication that you don’t have to buy from their outfit. Start by getting at least three dealers involved in the bidding process. Even if you know exactly which machine you want, there are always at least two or three dealers in your area who carry the exact same equipment, and as the big differences between the vendors have smoothed out of the years, there are almost always perfectly good alternatives machines from other vendors. The key is not only to make them compete for your business, but also to make them aware they are competing.

The best negotiating attitude you can convey is: “I’d like to buy from you, but…” The “but” can include pricing, features, service costs and service levels (including repair turnaround). Decide what you want in terms of features, and if it’s not part of the standard package, require it free or at a reduced price to help seal the deal.

3. Learn the total costs

You need to get the actual purchase price for every element of the deal. Dealers would like to give you a single number for everything, but it is important to get a close look at all the costs over the life the deal. That’s especially the case if the leasing deal is going through the copier dealer. In those cases, there is often a big discrepancy between the nominal purchase price and the actual amount you will spend. Look out for hidden fees that can sneak into a financing agreement.

Note also that interest rates for leasing are going up in the industry, While for years they were very stable in the area of 10-11%, they have recently been jacked up to around 14%. Given the gap between that rate and the dismal return on savings, it makes sense to either buy outright or to find some better way of financing the deal directly through your bank, if possible.

4. Consider cost-per-page

The other big factor is the service payments, which are usually calculated in cost per page, what in the trade is called cost-per-click. Getting the cost right on this can be even more important than the lease/purchase price. A difference of a few tenths of a cent per page can, depending on volume, add thousands of dollars to your annual expenses. That’s especially true for color, where the costs can vary be several cents per click. Make sure you compare those costs in detail before you sign on the dotted line.

For companies that print frequently on 11″ x 17″ paper, be aware of a major, often overlooked discrepancy in the market. Some vendors and dealers charge just one click per 11″ x 17″ page, while others charge two clicks. If you are frequently using the ledger format (for signage, folded booklets or engineering diagrams, for example), that difference can mean a big difference for your budget.

• Canon operating profit was down 54% year-over-year and sales down 22% (in spite of good camera sales)
• Ricoh profits were down 69%, and
• Xerox profit was down a little over 50% and sales by nearly 20%.

Konica Minolta and Kyocera also reported fall-offs in profit and have readjusted their expectations for the year and have lowered profit predictions considerably.

We can assume that other, more highly diversified companies (like Sharp and Toshiba) are seeing similar issues.

And depressed sales may continue. A Reuters article quotes a stock analyst who says, “There’s a lot of pent-up IT upgrade demand among companies. But copiers and printers lag other things like PCs among their priorities.”

If your company is in the market for a new copier/MFP and you have the cash or credit available, this may seem like a good time to negotiate and buy a new one. There’s a lot of inventory in the pipeline, and thanks to frequent updates, dealers may well have machines they want to find a home for. But be aware of two issues: The declining dollar (and rising yen) makes for higher absolute costs of goods. And copier dealers are experienced at making offers that look a lot better than they really are.