TRANSCRIPT
John Gilroy: Hey, John Gilroy here. Everybody knows there are an estimated 300 data centers in Northern Virginia. Very few people know what happens when they upgrade those servers in the data center. Today, we found out.
John Gilroy: Hit the music, Manny.
<VOICE> Welcome to the Federal Tech Podcast, where industry leaders share insights on innovation with a focus on reducing cost and improving security for federal technology. If you like the Federal Tech Podcast, please support us by giving us a rating and review on Apple Podcast.
John Gilroy: Welcome to the Federal Tech Podcast, a podcast that connects you to federal technology leaders. My name is John Gilroy, and I will be your moderator. Our guest today is John Salvetti. He’s the executive vice president of a company called Securis, S-E-C-U-R-I-S. I would be remiss if I didn’t tell our audience that we are recording this from Monk’s Barbecue in lovely downtown Percival, Virginia. This is a high-class joint, Sal.
John Gilroy: And so I’ve seen this thing from iSigma, and it says, here’s the headline. Personally identifiable information was found on 40% of used devices in the largest study to date. So my personal stuff on those servers in Ashburn can be recovered. What happens in this whole transition and upgrading?
Sal Salvetti: So one of the options you gave me, I could tell you if you’re out of your mind, right? But yeah, you’re out of your mind, but nothing to do with that, okay? No, it’s great to meet you, John. Great to be here as part of your Federal Tech Podcast. And so yeah, that’s true.
Sal Salvetti: There are organizations out there when they want to, they’re under the life cycle for their hard drives, or their solid-state drives, laptops, desktops, anything that’s data-bearing, you want to make sure you dispose of it properly. And that’s what we do. We are an ITAD company, IT Asset Disposition.
Sal Salvetti: Some people use the D as in disposal, but we will bring that from, we’ll pick it up from you and bring it to our location and shred it as one of the ways of dealing with it. Or we could actually take care of it at your location and we could either shred it or disintegrate it, depending on what type of equipment it is.
John Gilroy: Now, Sal, I’ve driven through Ashburn a million times. In fact, I recorded a podcast a couple of times at Monks, at the Ford’s Fish Shack, right there.
Sal Salvetti: I know what you’re talking about.
John Gilroy: And I’ve never thought about what happens to those servers, but obviously, they’ve got servers in there. There’s new hard drives, new Nvidia drives and graphics chips, and so they take them out. So what kind of choices does a federal agency have when they’re upgrading some of their data centers?
Sal Salvetti: So one of the things you want to look at is it an end of life piece of equipment. As you look at it, if it’s end of life and there’s no reuse or recycling, no reuse that you can do to it. We will help you look at that. So here is a server. We look at the server. If we think it can be resold, which should be good out there because that’s great of not having something end up in a landfill, we will take it off your hands.
We will bring it to our location. We will refurbish and resell, for example, on either a wholesale or a eBay or Shopify type website.
Sal Salvetti: So that’s if it can be resold. If it’s end of life, we want to make sure that it does not end up in a landfill. In fact, only about 18% of e-waste, electronic waste out there gets properly disposed of. We are one of the ones who can dispose of it properly. We have so many certifications that are along with that.
Sal Salvetti: So let’s talk about if we want to dispose of it. We’ll bring it to our location. We will actually disassemble it. We’ll take it down to its component parts because of the focus materials that are in there. Gold, silver, platinum, palladium and copper. And then we will go ahead and resell that for reuse out there on the open market. Some of them might have some plastic. We also take apart the plastic and we build a plastic and we resell that also for reuse.
John Gilroy: So Sal, in doing my research for this interview, I came across an acronym that I’ve never heard before and maybe other listeners have, but it’s a Certified Data Destruction Specialist, a CSDS. So that’s the certification we’re talking about here, huh?
Sal Salvetti: Yes, we have them in our organization and really it’s just like any certifications out there, you don’t want to just operate off of what you think is right. There’s formal organizations that show you the proper processes to follow and also keep you updated on the rules, regulations and policies that are out there.
John Gilroy: Let’s talk about commercial company in Chicago, say. If they do not dispose of hard drives properly, can they get fined?
Sal Salvetti: They sure can. There’s been, in the news, there’s been people who have been fined. Let me see, there was Morgan Stanley. That was the breach that I was trying to think of. Morgan Stanley data breach, $35 million fine. Health Reach in Maine, 100,000 citizens had their information exposed just due to bad data sanitization. State of New Jersey, 79% of their laptops that they auctioned to the public had data on them. So besides thinking about getting fined with improper disposal of it, you’ll also get fined for actually not taking care of personally identified information on those hard drives.
John Gilroy: Okay, fines are one thing. Let’s go back and talk about the military and maybe some three-letter agencies and other organizations. And I’m gonna quote a movie, the movie is Forrest Gump.
Sal Salvetti: Okay.
John Gilroy: And Lieutenant Dan famously said, don’t do anything stupid. And I think when you have upgrading equipment, you have hard drives you’re replacing, you don’t wanna do anything stupid. So what kind of guidelines can you give our federal listeners for not doing anything stupid, replacing their existing hard drives?
Sal Salvetti: What we found, it’s actually funny, but not in a laughing manner so much, is that, like I mentioned earlier, really about the 18% only disposing of properly, there’s no reason to just, once you upgrade, everybody goes through their life cycle replacement. Once they get the new stuff, they actually kind of forget about the old stuff.
John Gilroy: Right, a typical human.
Sal Salvetti: Yeah, and they’ll put it in, they’ll just stash it away, until somebody comes into the organization, opens up a closet and things are, old stuff is falling on top of them, and that’s when they call us. So if you want to go ahead and dispose of that equipment properly, and we’re the ones, we can actually do it, we can shred your hard drives.
Sal Salvetti: So once again, think of data bearing devices, and I’ll just talk about hard disk drives and solid state drives for right now, in addition to that, we can also shred laptops and desktops. But a hard disk drive, there’s different regulations out there. It all falls under the umbrella of sanitizing the information. Depends on the classification of that information, of how far you want to go with sanitizing it.
Sal Salvetti: And underneath that sanitize umbrella, there’s different classifications depending on the document that you’re looking at. So for example, the NSA uses degauss, disintegrate and incinerate, burning it, smelting it, all right.
Sal Salvetti: Another degaussing, that renders the equipment, what it does, think about what degaussing does. It destroys the magnets in there. So now you can ever use that again. Disintegration, that’s for a solid state drive. And there are machines out there and we have one of them that are certified to disintegrate down to the two-millimeter-size particle.
Sal Salvetti: So when you think of two millimeter, just think of walking on the beach. That’s what it’s looking like, all right. And then for incineration, that’s just thrown in a big furnace and nothing’s on that.
Sal Salvetti: If you talk about the NIST special publication 800-88, revision one, because that’s important, you can clear, purge or destroy. And then, of course, and then you have the subcategories underneath that. And I’ll just throw a little vignette out there. So I was on Wheel of Fortune. When I was spinning the wheel on Wheel of Fortune, they have this thing called a mystery round. And it’s two wedges that are on the wheel. Underneath one of the wedge, we’ve got to land on it. If you call the letter, it’s in the puzzle, you get to pick up the wedge. One of them is going to have $10,000 underneath it.
One’s going to be bankrupt. It’s a guess. You don’t want to turn your data sanitizing process into a guess. Calling us, we’re the experts, we can remove all the mystery from any mystery wedge that you have out there.
00:08:42.460 –> 00:08:51.320
John Gilroy: The mystery for many of our listeners is the budget mystery of when do you use software to clear your old hard drives? When do you have it shredded? When’s it disintegrated? I guess smelt it or something. So what kind of guidelines do we have here? Is it just the type of information or there’s budget considerations here too, aren’t there Sal?
00:09:02.500 –> 00:09:02.960
Sal Salvetti: There are. So think of cost versus security versus sustainability.
Yeah, I always like to explain it as a thing of going into the car wash. You could do the basic level of service and that gets you a certain level. Or you could say, okay, I want to wash it, but I want to dry it. I want to wax it. I want to clear coat it. I want to get the tires worked on.
Sal Salvetti: So we can work with you on what you actually need and what you want. And we’re going to make it so you don’t overpay for what you need based on the level of what the information is. Now, for example, there may be some information you don’t have a choice. It’s because it was this. You remember the classifications level out there are confidential, secret, and top secret. So if something falls in there, there is no choice. You must either disintegrate or you must work this for your destruction.
Sal Salvetti: But if there’s not, if it’s a lesser classification of information and you just want to make sure it’s not available to the public, we will take you through the various options. Like I said earlier, the degauze, the shredding, disintegration and incineration.
John Gilroy: Now, Sal, you company is very successful, very well known all over the world. There’s questions I think people would ask of how. Okay, so do I get in my little truck and drive my hard drives over to your office? Do you come to me? Do I FedEx them to you? I guess there’s gotta be, depending on the agency, a certain chain of command here, there’s certain security here.
Sal Salvetti: So the answer to that is yes, yes and yes. All right, that’s one thing that we differ from a lot of other organizations out there. We run the whole gamut under the ITAD, once again, the IT asset disposition process. All right, so let’s just go back to step one of what you asked about, John.
How can I, I’m an organization, I have my hard disk drive, I have it in my possession, what do I do? So it all depends on the classification of the information for one thing. So we can go to your location, our trucks, our capability is mobile. We have a mobile capability that has the shredder, disintegrator, and the degausser inside of the truck.
Sal Salvetti: What’s important about that when we go to your location to do it, is that we are self-sufficient. The truck has its own power. So it’s not like we’re gonna be bothering you. Once we pick up whatever equipment we have to pick up, we’re not, hey, I need to plug in, where’s your plug here? No, we can pull off of the, wherever we’re at by the office, by the, you know, the dock and move away and do whatever equipment we want.
Sal Salvetti: Some people want to do it onsite because they want to just keep an eye on it. Now, if it’s a lesser level of classification, we’ll bring it back to our facility and we have all the same capabilities inside of our warehouse. And then, but if it’s incineration, that’s where we actually have to go third party.
John Gilroy: And when you say shredding, I think paper. So nothing to do with paper, shredding hard drives.
Sal Salvetti: There’s different capabilities out there. We have two different ones that meet industry standards. We will put a hard drive into a shredder and one of them gets it down to inch and a half strips. One of it gets it down to one inch strips. What I talked about for the solid state drives previously, we get it down to two millimeter, which is the one that is NSA certified.
John Gilroy: Your company is Securis, S-E-C-U-R-I-S. And what I’m going to do is in the show notes for this, I’m going to include a video testimonial from your customers. Can explain a lot of these concepts you’re talking about because some are kind of interesting.
John Gilroy: So look for that video and I’ll put it in the show notes.
John Gilroy: When I lived in old town Alexandria, my next door neighbors worked for a three letter organization and they always had good stories and we were good friends. And it would seem to me that an organization like that might have very, very sense of information in the hard drive and then what they might want to do is have armed guards physically take it to your location and observe it being shredded.
John Gilroy: I mean, this happens in Washington DC, I’m sure. I mean, yeah, I think that’s what happens, isn’t it?
Sal Salvetti: So we have had, we’ve picked up equipment from a place that’s been escorted back to our facility. And because of the capacity of it, they wanted to use the bigger shredder to, you know, it’s throughput. And they have sat there and watched us shred. They’ve, I’ll just say observed, observed us, take apart cell phones, remove the battery and put it through the shredder. Yeah, they watched us take apart laptops, remove the battery, take out the, whatever the hard drive is, the regular SSD or not, and shred those too.
John Gilroy: You know, I talked about Forrest Gump and don’t do anything stupid. I never even thought of cell phones. I mean, cell phones could have compromising information on them. I mean, who thinks about that?
Sal Salvetti: And we do.
John Gilroy: Yeah, and tablets. Wait a minute, I’m thinking about tablets now, and of course laptops and desktops and servers, but it’s not just servers in Ashburn, huh?
Sal Salvetti: Think about anything that has data on it and you don’t want it to end up in the wrong hands, right? And I’ll go back. There may be something on there where I want to give you this hard drive. I want you to just, I’ll use the vernacular, wipe it, erase the data that’s on there, but if you resell it, I’d like to get a little kickback on what you resell.
Sal Salvetti: So when you talk about the budget numbers, if there’s the ability to say at the level of classification, it doesn’t have to be shredded so it’s not used, doesn’t have to be degaussed so it can’t be used, we will sell it and we will give you a rebate according to the proceeds from that sale.
John Gilroy: I was listening to a podcast with a person at NIH, joking all kinds of information. It would seem to me that there would be medical studies that have personally identified information but have much more sensitive information.
John Gilroy: So someone at HHS or NIH, they may say, no, no, no, we want a NSA certified shredder and that’s what you provide. I mean, I never thought a NSA, of all the things NSA does, really they worry about hard drive shredding machines?
Sal Salvetti: Yeah, the big one that they do this certification on are the SSDs because that’s where everybody’s going now, even though we still have quite a few hard drives out there, the solid state drive, more information, smaller, that type of thing and you want to get it down so any adversary out there, it could be because of where we are in DC, any adversary, you do not want them getting any information off of that.
Sal Salvetti: And the NSA will say, if you use this piece of equipment, now they’ll certify different companies that are out there and we have then purchased that equipment from that company who makes those machines. We don’t make the machines, we use the machines, just like anything else.
So they will say, I want this done to that level of destruction so there’s nothing I have to worry about.
John Gilroy: So as an individual, let’s say I buy a new iPhone.
Sal Salvetti: Yep.
John Gilroy: My old iPhone and I trade it in, is that doing something stupid or is that a reasonable thing for normal human beings or not worry about that?
Sal Salvetti: You better take out the SIM card and anything else that can hold that on there.
John Gilroy: Yeah.
Sal Salvetti: So it’s, and to be on the safe side, give it to us and we’ll make sure there’s no data on it. Maybe we resell it. And now this is for big organizations. We don’t want you driving up to our door and say, here’s my cell phone. No, we want a thousand of them at a time.
John Gilroy: It makes sense.
Sal Salvetti: And we can make sure that the information’s off and we can either resell, like I said, or we shred it.
John Gilroy: I, maybe I’ve read, I have watched too many Jason Bourne movies, but I have this image. I’m looking at you taking notes going, okay, so let’s say an operative named Kurt. So he goes out and he does some dumpster diving behind a company and pulls out some hard drives. I mean, has that even happened?
Sal Salvetti: There’s no doubt in my mind that that has happened. People, whether it’s incompetence or laziness or a combination of the two, right? Or just not knowing. Ignorance is one of them also. It’s like, hey, I can just toss this stuff. So, like I said, no mystery wedges, no gambling. Let us get the equipment and clear the information that needs to be cleared off of it.
John Gilroy: Most of my interviews have been about newer systems, designing systems. It seems like this is a checkbox that’s not checked on the life cycle of hardware. It’s not on the list or maybe very few companies think.
I’m sure that the three other agents think about it, but look at NIH or HHS. They have information that’s just as sensitive and maybe there are people working there that don’t know about Securis.
Sal Salvetti: That’s a great observation. There’s been an evolution in people thinking about how easy it was or is for information to be pulled off of this stuff and those hard drives or SSDs that end up in the wrong hands. It’s great to see the level of information and education that’s out there so then they know, hey, look us up.: We already know. Hey, if you don’t remember anything about today’s podcast, remember four things, all right?
Sal Salvetti: Remember our name, Securis, so our website’s securis.com, and remember if you want industry standard making it happen the right way, we are secure, we have great accountability and sustainability.
John Gilroy: Okay, you were on Wheel of Fortune, is that right?
Sal Salvetti: I was, yes. Twice actually, John, twice.
John Gilroy: So Wheel of Fortune, let’s say a topic comes up and it’s ESG.
Sal Salvetti: So the topic would be Jeopardy, or yeah, Jeopardy, not Wheel of Fortune.
John Gilroy: So what is ESG, and what’s it got to do with hard drives?
Sal Salvetti: Yeah, the big thing we like to hone in on that one besides the E and the G is just the sustainability aspect. And that goes back to, years and years, people just, remember, the landfills.You would just take it to the landfill, no matter what it was. Think about big TVs, the cathode ray tube TVs. Think about flat screen TVs, which we treat as somewhat disposable right now.
Sal Salvetti: A lot of people will just chuck them into the landfill. Well, we’re getting better about that. We want to sustain the environment. It’s bad for the environment to have the plastics that don’t decay for hundreds of years, or the toxic metals that are in there. So bring it to us. We’ll take it through its end of life, so that’s what we want to say.
Sal Salvetti: We are the pros in making sure that you, as an organization, can say, I have done my part for the environment, and I am disposing of this equipment properly. In fact, we will produce a sustainability report for you based off of, right now we’re looking at about 23 different factors as part of that report
John Gilroy: Sal, several years ago, I had a podcast called Inside Data Centers, and I would literally go inside a data center and record it and talk about heating and cooling. I mean, all kinds of issues that no one ever thinks about. You wouldn’t even want to guess that large organizations like, I’m gonna name names here, like Jerry Seinfeld, so I’m gonna name names like Google, Microsoft. I imagine they have life cycle policies for this or are you part and parcel? Do you contract with them or do you normally contract with federal agencies? So what’s the typical relationship you have with one of these bigger companies?
Sal Salvetti: So those hyperscalers out there, they’re doing their own stuff now because they like to keep it in house. So the Amazon Web Services out there, they’re not gonna call us up. Now they did about five years ago and we got until they figured out what they needed to do, and we actually got them through the process to clear and dispose of their equipment properly.
Sal Salvetti: But the other ones out there, there may be an owner of a data center and they have tenants inside of that.: So they want us to take care of their tenants because the tenants are going through life cycle replacement.
Okay, I got this stuff, who do you want me to call? Hey, I know Securis.
Sal Salvetti: Or it could be just the tenant itself says, hey, Securis is gonna be coming in here to take care of our life cycle replacement. We’ll go in there, we’ll take the server cabinets out, we’ll decommission to a level. There’s a certain level that we want them to get to a point on the decommissioning.
Sal Salvetti: And we’ll be, in one of our jobs, we actually rolled the stuff out a half a mile, because you’ve seen some of the size of those data centers. So from the cage in the data center to the truck, half a mile, and we did it about 25 trips that way.
John Gilroy: Wow, that’s a trouble. I know one thing about the data center people is that they don’t talk about who their customers are. It’s like, who’s in here? Well, we can’t say. There could be sensitive organizations, not sensitive organizations. When you look at the future of this whole idea of making sure the swoles of your equipment, where do you see it had anything? More and more people could be coming. Or do you think there’s gonna be an incident where a dumpster diver grabs something and it compromises some organizations? Some organizations, let’s say.
Sal Salvetti: Yeah, so we like to use just to gauge trends right now. We’re tracking the numbers that are coming in for hard drives and SSDs and see if, what I call it, the lines are crossing. Are we finally seeing the downhill spiral in hard drives and the uphill starting to go up in the quantity of SSDs? It hasn’t happened yet. There’s a lot of hard drives out there. Another funny, flat screen TVs still going up.
Sal Salvetti: You know, we’re not talking about the data and stuff like that, but think about other things that we do for the environment. We’re gonna have a flat screen TV and we’ll once again disassemble it and get it to the right location so it doesn’t end up in a landfill.
John Gilroy: I’m asking a question about data centers. I was at Monks Barbecue two weeks ago. I was with my neighbors, walked down here, we had some lunch and he works for a large organization and he said, you know, John, all those data centers in Ashburn, they may have to get like a nuclear reactor to power them.
John Gilroy: They don’t have power. This is a problem that’s not going away. I mean, artificial intelligence, it’s such a strain on so many data centers and they’re constantly buying new equipment and guess what that means is this existing equipment has to be replaced. So this isn’t a problem that’s going away.
John Gilroy: It’s kind of like car repair. That problem isn’t going away. The whole idea of replenishing equipment and new technology and new servers, it’s just something we can’t get away from.
Sal Salvetti: That’s exactly right and that’s one of the things that we’ve noticed now is we’re starting to get more servers. Obviously we’re in a great location.Northern Virginia, like you said, I think you said the number really got 358 or something like that of the data centers and yeah, they’re going through their life cycle replacement and by the way, it’s not a normal life cycle replacement anymore.
Sal Salvetti: As technology advances to AI, that’s going to require more powerful servers. So the old stuff, all right, now by the way, the old stuff to them, there are still some, we can still get that reused at the clients in other locations who may say, this is still good for me. I’m going through my life cycle replacement, but I’m not up to AI yet. So it is a constant revolving door right now of all the equipment that we’re getting, especially what you see in the data centers.
John Gilroy: Yeah, what equipment brokers say is used is not a four letter word for certain businesses.
Sal Salvetti: Exactly, and especially going overseas. We have clients that are overseas.
John Gilroy: So I didn’t realize that. I mean, not just the United States, you go overseas as well.
Sal Salvetti: So on our equipment, we have some buyers who then will move the equipment, whether it’s wholesale laptops, wholesale desktops, servers, switches, you know, think of anything you think can be reused. Our country is so advanced compared to a lot of countries out there. They would love our older stuff and they are buying it.
John Gilroy: It’s astounding to me. I interviewed someone from the Navy and they were talking about a ship and they said, you know what, it’s kind of like a floating data center. The ships now are like floating data centers. And so they have to worry about energy and guess what they have to worry about? Upgrades.
John Gilroy: And I’m sure there are ships coming in to Norfolk or somewhere where they’re going to have to replace the servers and then what do you do with that information? There’s a shredding application right there, isn’t it?
Sal Salvetti: Exactly. So as it is, we stand ready to support everybody and anyone out there who needs any kind of secure data destruction and or at least decommissioning of their equipment. And that’s what I say, if you don’t remember too much from this and me talking, securis.com, we are ready to support.
Sal Salvetti: And by the way, and what you’re seeing, there’s always something in the news of somebody who has a data breach about something. I mentioned a few earlier, but it always seems to be happening and it doesn’t need to, just call us.
John Gilroy: This has been a wonderful interview. You have been listening to the Federal Tech Podcast with John Gilroy. I’d like to thank my guest, John Salvetti, Executive Vice President at Securis, S-E-C-U-R-I-S.
<v SPEAKER_2>Thanks for listening to the Federal Tech Podcast.
<v SPEAKER_2>If you like the Federal Tech Podcast, please support us by giving us a rating and review on Apple Podcast.
In today’s fast-paced technological environment, businesses must effectively manage and dispose of outdated electronic assets, including computers, tablets, smartphones, and storage devices. This process, known as asset disposition, is essential for keeping equipment current while ensuring the safe and environmentally compliant handling of electronic waste (e-waste). Partnering with an R2v3-certified e-waste recycling company is the most secure and cost-effective approach to managing the inevitable IT refreshes that your company will need. 
The Responsible Recycling (R2v3) certification is a globally acknowledged electronics recycling and refurbishment standard. Developed by 
One of the primary concerns in asset disposition is ensuring data security in ITAD. 
Many companies have corporate social responsibility (CSR) considerations to fulfill. They must adhere to electronic waste disposal standards and e-waste legal regulations, ensuring that hazardous material disposal is properly managed. They must also implement best practices for recycling electronic waste that maximize material recovery and reuse, and minimize landfill use. 
Partnering with an R2v3 certified recycler enhances a company’s reputation by demonstrating a commitment to responsible e-waste management. This builds trust with customers, stakeholders, and employees and aligns with corporate social responsibility (CSR) initiatives. 
R2v3-certified companies follow standardized and transparent processes for e-waste management compliance. This includes thorough documentation and reporting, which is essential for auditing and tracking purposes. Strict chain of custody controls and downstream due diligence documentation is required, including the tracking of all electronic materials from receipt to final disposition, documentation of downstream recycling partners and their practices as well as verification of final material disposition. 
By partnering with an R2v3-certified recycler, companies can also realize economic benefits. R2v3 certified recyclers must efficiently recover valuable materials from e-waste, which can be refurbished and resold, thus reducing the overall cost of asset disposition. Having an R2v3 certification supports a circular economy, meaning that a vendor will ensure that all devices are used as long as possible, and then when devices can no longer be used, refurbish electronic devices and their components wherever possible. At the true end of life, a circular economy means recovering materials so they can become part of something new, whether that’s a new electronic device or something entirely different. 
Key Factors in Choosing a Secure and Responsible IT Asset Disposition (ITAD) Partner
Transparency is a crucial indicator of a responsible e-waste partner. Ideally, an ITAD partner should provide comprehensive and accurate reporting for the entire chain of custody. Ensure your chosen vendor:
Beyond security, accuracy, and sustainability, consider the following factors. 
The answer lies in the quality of the audit or inventory reports generated after the physical work of decommissioning is completed. This documentation becomes vital, serving as a record of exactly what was done, much like an insurance policy when you need it most, often under less-than-ideal circumstances, which is why we include it as an invaluable part of our e-waste and data destruction policy