AFSSI_8580_Remanence_Security.pdf

BY ORDER OF THE AIR FORCE SYSTEMS SECURITY INSTRUCTION 8580

SECRETARY OF THE AIR FORCE 17 NOVEMBER 2008

Communications and Information

REMANENCE SECURITY

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publication is available for downloading on the Information Assurance website at: https://private.afca.af.mil/ip

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: AFCA/EVPI Certified By: SAF/XCPPI (Kenneth Brodie) Supersedes AFSSI 5020, 17 April 2003. Pages: 40

This instruction, authorized by Air Force Instruction (AFI) 33-102, Communications and Information Specialized Publications, establishes and manages the Remanence Security program required by AFI 33-202, Volume 1, Network and Computer Security (will become AFI 33-200, Information Assurance (IA) Management). Additional references include: National Institute for Standards and Technology (NIST) Special Publication (SP) 800-88, Guidelines for Media Sanitization, September 2006;

Committee on National Security System Instruction (CNSSI) No. 1001, National Instruction on Classified Information Spillage, February 2008; Department of Defense Instruction (DoDI) 8500.2, Information Assurance Implementation, February 06, 2003; Department of Defense (DoD) 5220.22- M-Sup 1, National Industrial Security Program Operating Manual (NISPOM) Supplement, December 29, 1994; Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6510.01E, Information Assurance (IA) and Computer Network Defense (CND), August 15, 2007; National Security Agency Central Security Service (NSA/CSS) Policy Manual 9-12, NSA/CSS Storage Device Declassification Manual, March 13, 2006; Assistant Secretary of Defense, Networks and Information Integration (ASD/NII) Memorandum, Disposition of Unclassified DoD Computer Hard Drives, June 04, 2001. It provides guidelines and management procedures for clearing and sanitizing various information systems media for release and for reuse. This instruction applies to Air Force military, civilian, and contractor personnel under contract to the DoD, who develop, acquire, deliver, administer, or manage remanence security for Air Force information systems. This publication applies to the Air National Guard (ANG) and the Air Force Reserve Command (AFRC). The term major command (MAJCOM) as used in this instruction also includes field operating agencies and direct reporting units. Request you direct questions or comments on the contents of this instruction, through appropriate command https://private.afca.af.mil/ip channels, to Headquarters Air Force Communications Agency (HQ AFCA/EVP), 203 W. Losey Street, Room 2100, Scott AFB IL 62225-5222. Refer recommended changes and conflicts between this and other publications, using AF Form 847, Recommendation for Change of Publication, to HQ AFCA/EASD, 203 W. Losey Street, Room 1100, Scott AFB IL 62225-5222. Ensure that all records created as a result of processes prescribed in this publication are maintained in accordance with Air Force Manual (AFMAN) 33-363, Management of Records, and disposed of in accordance with Air Force Records Information Management System (AFRIMS), Records Disposition Schedule (RDS) located at https://afrims.amc.af.mil/rds_series.cfm. The use of the name or mark of any specific manufacturer, commercial product, commodity, or service in this publication does not imply endorsement by the Air Force. See Attachment 1 for a glossary of references and supporting information.

https://afrims.amc.af.mil/rds_series.cfm

Table of Contents

Chapter 1—General Information 5

1.1. Purpose ……………………………………………………………………………………… 5

1.2. Introduction …………………………………………………………………………………. 5

1.3. Objective ……………………………………………………………………………………. 5

1.4. Applicability ………………………………………………………………………………... 5

1.5. Responsibilities ……………………………………………………………………………... 6

Chapter 2—Overview 7

2.1. Type of Media ……………………………………………………………………………… 7

2.2. Handling Classified and Sensitive Media ………………………………………………….. 7

2.3. Overwrite Products ………………………………………………………………………… 8

2.4. Overwriting Software Specifications …………………………………………

2.5. File Overwriting Programs ……………………………………………………

2.6. Overwriting Sampling ……………………………………………………………………... 10

Chapter 3—Clearing Media 11

3.1. Clearing Media …………………………………………………………………………….. 11

3.2. Procedures …………………………………………………………………………………. 11

Chapter 4—Sanitizing Media 13

4.1. Sanitizing Media …………………………………………………………………………… 13

4.2. Procedures ………………………………………………………………………………….. 13

Chapter 5—Degaussing and Degaussers 17

5.1. Degaussing ……………………………………………………………………

5.2. Degaussing Standards and Procedures …………………………………………………….. 17

5.3. Bulk Erasure ……………………………………………………………………………….. 18

5.4. Degaussing Wand ………………………………………………………………………….. 18

5.5. Using Approved Degaussers ………………………………………………

5.6. Testing Degaussers ……………………………………………………………

5.7 Replacement of Non-evaluated Degaussers ………………………………………………… 19

5.8 Malfunctioning Degaussers ………………………………………………………………….19

Chapter 6—Physical Destruction 20

6.1. Physical Destruction ……………………………………………………………………….. 20

6.2. Procedures ………………………………………………………………………………….. 20

Chapter 7—Disposing of Unclassified Computer Hard Drives 24

7.1. Disposition ……………………………………………………………………

7.2. Government-Owned Hard Drives …………………………………………………………. 24

7.3. Lease Computers…………………………………………………………………………... 24

7.4. Warranty Actions……………………………………………………………………………26

7.5. Forms Adopted and Prescribed…………………………………………………………… 26

Attachment 1—GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 27

Attachment 2—SANITIZATION/DESTRUCTION VERIFICATION LABELS AND

RECORDS 32

Attachment 3—DETERMINING RISK 34

Attachment 4—GUIDE TO SANITIZING CONTAMINATED SYSTEMS NETWORKS 37

Attachment 5—GUIDE TO CLASSIFIED MESSAGE INCIDENT (CMI) ON PERSONAL

DIGITIAL ASSISTANT (PDA) DEVICES 39

Tables

3.1. Clearing Media…………………………………………………………………………… 11

4.1. Sanitizing Media .…………………………………………………………………….….. 14

5.1. Degaussing Media……………………………………………………………………….. 18

6.1. Media Destruction Methods …………………………………………………………… 20

6.2. Destroying Media ……………………………………………………………………… 21

A4.1. Sanitization Options and Impacts…………………..………………………………

Figures

7.1. Sanitizing an Operable Air Force-Owned Hard Drive ……………………………

7.2. Sanitizing an Inoperable Air Force-Owned Hard Drive ………………………………………..24

7.3. Sanitizing Hard Drives That Have Been Leased and Warranty Actions ……………………….25

A2.1. Format for Sanitization and Destruction Validation Label……………………………………32

A2.2. Verification of Sanitization and Destruction of Hard Drives…………………………………33

Chapter 1

GENERAL INFORMATION

1.1. Purpose. This instruction implements the Air Force Remanence Security requirements of AFI 33-202, Volume 1 (will be AFI 33-200, Information Assurance (IA) Management). Remanence is the residual representation of data that was previously erased in some way. After an information system’s media is “erased,” some physical characteristics of the system may still allow reconstruction of data.

Remanence security is the use of prescribed safeguards and controls to prevent reconstruction or disclosure of sensitive or classified information to persons who do not have the proper clearance or need-to-know for this information. Specifically, this instruction provides:

1.1.1. A discussion of the known threats and vulnerabilities (risk) associated with clearing, sanitizing, and destroying media.

1.1.2. Procedures for clearing media and the restrictions on the cleared media’s reuse thereafter.

1.1.3. Procedures for sanitizing media and other information systems components (e.g., monitors, laser printers, etc.).

1.1.4. Approved destruction techniques for various types of media.

1.2. Introduction. During the life cycle of information systems, media is sometimes reused, released, or destroyed. In addition, classified information stored on media may be downgraded or declassified. Information assurance officers (IAO) and other personnel responsible for remanence security must know the procedures for clearing, sanitizing, and destroying media. These procedures must strike a balance between the risk of inadvertent disclosure of classified and sensitive information and operational necessity.

1.3. Objective. All Air Force personnel must prevent unauthorized disclosure of processed or stored classified and sensitive information, especially during system hardware, firmware, or software upgrade or replacement. To do this, personnel must be knowledgeable of clearing, sanitizing, and destroying procedures and have the tools available to assist them. To meet these objectives, this instruction provides the necessary remanence security procedures for most common types of media.

This instruction does not, and cannot, specifically address all known types of media.

1.4. Applicability.

1.4.1. Media that contain classified communications security (COMSEC) keying material marked “CRYPTO” must retain the highest classification of any information previously recorded until destruction. Any media marked “CRYPTO” cannot be declassified. COMSEC managers must consult the controlling authority of the keying material for disposition instructions and review AFKAG 1N, (FOUO) Air Force Communications Security (COMSEC) Operations, for additional information.

1.4.2. This instruction does not apply to media that is controlled by other rules such as sensitive compartmented information (SCI), single integrated operational plan, special access program (SAP), special access required (SAR), and North Atlantic Treaty Organization (NATO) information. In these cases, follow the guidance provided for that information. For SCI systems, contact the systems IAO and use Director of Central Intelligence Directive 6/3, Protecting Sensitive Compartmented Information within Information Systems and Joint Department of Defense Intelligence Information Systems(DoDIIS)/Cryptologic SCI Information Systems Security Standards.

1.5. Responsibilities. In addition to the roles and responsibilities listed in AFI 33-202, Volume 1 (will become AFI 33-200), organization and individual remanence security responsibilities include:

1.5.1. Designated Accrediting Authority (DAA).

1.5.1.1. Approve site, system, and situational specific sanitization procedures (e.g., e-mail message on a server, e-mail message in a local .pst file, data file on a local hard drive, or data file in flash memory) for media affected by spillage of classified information.

1.5.1.2. Approve tools for sanitizing media affected by spillage of classified information.

1.5.2. Wing Information Assurance Office (WIAO).

1.5.2.1. Maintains information on the location of approved degaussers, nearest incinerators, metal destruction facilities, and personnel who are trained in the use of chemical disk surface removers.

1.5.2.2. Supports unit IAOs on Remanence security matters.

1.5.2.3. Consult with HQ AFCA/EVP, as required.

1.5.3. Information Assurance Manager (IAM).

1.5.3.1. The system IAM evaluates and validates procedures for clearing, sanitizing, and destroying media.

1.5.3.2. Consults with WIAO, as required.

1.5.4. Information Assurance Officer (IAO).

1.5.4.1. The system IAO develops and maintains procedures for clearing, sanitizing, and destroying media.

1.5.4.2. In coordination with the Wing IA office, provides information on remanence security to unit information system users so that they can make informed remanence security decisions based on known risks, regulatory requirements, and established procedures.

1.5.4.3. Maintains records of sanitization, downgrade and declassification of media according to AFI 31-401, Information Security Program Management, and AFRIMS RDS located at https://afrims.amc.af.mil/rds_series.cfm.

https://afrims.amc.af.mil/rds_series.cfm

Chapter 2

OVERVIEW

2.1. Types of Media. The proliferation of various types of information systems media has resulted in the development of separate procedures for clearing, sanitizing, and destruction. Information systems may contain multiple, non-contiguous, similar or dissimilar media. This may include a central processing unit (CPU), Random Access Memory (RAM), RAM buffers, Static RAM (SRAM), Flash Memory (e.g., thumb drives, flash drives, etc.), Dynamic RAM (DRAM), Read Only Memory (ROM), Programmable ROM (PROM), Erasable PROM (EPROM), Electrically Erasable PROM (EEPROM), hard and floppy disks, optical disks, drum transfer technology, video monitors, etc.

Several types of media may be found in Personal Electronic Devices (PED), a generic title used to describe a wide variety of small electronic items that are readily available for use with information systems. PEDs include, but is not limited to, cellular phones, Personal Digital Assistants (PDA; i.e.

Blackberry®, Palm®, Cassiopeia®, etc.) handheld computers, smart cards and digital cameras.

Multi-Function Devices (MFD) such as combination network printers, copiers, fax machines, and scanners may also contain various types of media. Consequently, apply the appropriate remanence security procedures for MFDs based on media types they contain. Follow the procedures for each different type of media to render the information it contains unretrievable. Consult manufacturer documentation to aid in determining types of media present. New media is continuously expanding and falls under one of the basic areas. Paragraphs 2.1.1 through 2.1.5 list the most common types of media used.

2.1.1. Flexible magnetic media consist of magnetic tapes, floppy disks, diskettes, magnetic cards, etc.

2.1.2. Rigid magnetic media consist of removable disk packs (e.g., single and multiple platters), sealed disk drives (Winchester drives), hard disks, hard disk assemblies, Bernoulli cartridges, magnetic drums, etc.

2.1.3. Magnetic memory devices consist of core memory and magnetic bubble memory.

2.1.4. Optical media consists of compact disks (CD), compact disk-recordable (CD-R), compact disk read-only memory (CD-ROM), compact disk-rewriteable (CD-RW), digital versatile disks (DVD), digital versatile disk-recordable (DVD-R), digital versatile disk-rewritable (DVD-RW), magneto-optic disks, etc.

2.1.5. Semiconductor memory devices consist of RAM, DRAM, Synchronous DRAM, PROM, EPROM, EEPROM, Thumb Drives, etc.

2.2. Handling Classified and Sensitive Media.

2.2.1. Due to the proliferation, wide spread use, interoperability, data storage density, susceptibility to theft, and low cost of removable media technologies (e.g., thumb drives, jump drives, flash drives, etc.) throughout the Air Force-provisioned portion of the Global Information Grid (AF-GIG), removable media that is no longer required to store or process classified information shall be destroyed. Destruction shall be done according to Chapter 6 of this instruction.

2.2.2. When technically feasible, clear media (according to Chapter 3) before using that same media for the first time. This precaution helps prevent undesired recovery of data stored later.

2.2.3. Protect media that retains data after power is removed (nonvolatile) at the highest classification of information processed or stored on the information systems. Retain classification controls until the media is sanitized and declassified or destroyed in an approved manner. Mark classified media with the appropriate classification label according to AFI 31-401.

2.2.4. Cleared media retains its previous classification. Use a Standard Form (SF) 711, ADP Media Data Descriptor Label, annotate it “cleared” and include the date, initials, and office clearing the media. Mark and control the media according to AFI 31-401.

2.2.5. After sanitization, declassify media by removing the classification markings after the information owner provides evidence that no information resides on the media (see Table 4.1 and Attachment 2). If the media is no longer needed, destroy the media as unclassified. Maintain a record of declassification as required by AFI 31-401 or other applicable directives. Ensure hard drives are labeled according to Attachment 2.

2.2.6. After the information owner provides evidence that stored information is reclassified at a lower level (downgraded), change the classification labels and control the media at the new classification level.

2.2.7. Unless prohibited by other policies (such as COMSEC), sanitize and declassify media whenever there is a need to make it unclassified. In particular, sanitize and declassify media prior to release from the Air Force inventory or transfer to a hardware or software reuse repository.

2.2.8. During sanitization of media, verify no data is retrievable. This means a person knowledgeable of the process witnesses the sanitizing action, and then verifies (if possible) that the media was in fact sanitized.

2.2.9. If features or malfunctions of the media inhibit overwriting, degauss or destroy the media.

An example would be a hard disk platter that has developed damaged or unusable tracks and sectors, where sensitive or classified data may be recorded. These areas of the disk cannot be overwritten.

2.2.10. Evaluate the risk factors (Attachment 3) prior to clearing, sanitizing, declassifying or releasing any media.

2.3. Overwrite Products. Overwriting is a method for clearing and sanitizing media. Overwriting programs perform a security-related function and shall be validated to confirm features are fully functional, protected from modification, and effective. A commercial off-the-shelf (COTS) product or a government off-the-shelf (GOTS) product may be used. GOTS products must be evaluated and validated by NSA or in accordance with an NSA-approved process. COTS products must be evaluated and validated by the National Information Assurance Partnership (NIAP) Common Criteria Evaluation and Validation Scheme (CCEVS). In addition, COTS products used for overwriting classified media must be NIAP validated, as specified in Common Criteria, above Evaluation Assurance Level (EAL) 4. Limit products to those listed on the AF Evaluated/Approved Products List (E/APL) or the Infostructure Technical Reference Model (i-TRM) at https://itrm.hq.af.mil. In the absence of approved software overwriting products, media must be degaussed or destroyed, as applicable. Use of software overwriting for clearing or sanitizing media in the event of a classified information spillage is a special case and is addressed in Attachment 4 of this instruction.

2.3.1. Overwriting Caveats. Hard disks are delivered from the manufacturer with some surface areas that are identified by the system software as being questionable or bad (i.e., bad blocks). The system software marks these areas as unusable and will not write any information to them.

https://itrm.hq.af.mil/

However, throughout the life cycle of a hard disk, areas that contain information might go bad, be marked as unusable, and remain in the marked area. As such, the software user must ensure:

2.3.1.1. The read and write device hardware is functioning properly before beginning the overwriting procedure.

2.3.1.2. Overwrite products (software routines) write to every addressable location on the media. The product must write to active and inactive file space, bad sectors and tracks, the space between the end of a file and the end of a block or sector, file allocation tables, directories, block maps, etc. Note: Some overwrite routines are not able to write to bad sectors. In these cases, the media must be degaussed or physically destroyed.

2.3.1.3. Procedures and products used for clearing and sanitizing computer media are documented in the certification and accreditation package of the information system.

2.4. Overwriting Software Specifications. The software specifications discussed in paragraphs

2.4.1 through 2.4.6 are the minimum requirements that apply to overwriting hard drives. Software products and applications not meeting the minimum stated specifications are not acceptable for overwriting hard drives. Overwriting software that merely reformats or repartitions a hard drive is not accepted within the scope of this policy. Software users should verify the compatibility of selected software products with the particular hard disk being sanitized. In addition, some software product versions may not have the capability to remove the operating system during the overwriting process.

To ensure the integrity of the overwriting process, overwriting software must have the following functions and capabilities:

2.4.1. The ability to purge all data or information, including the operating system, from the physical or virtual drives, thereby making it impossible to recover any meaningful data by keyboard or laboratory attack.

2.4.2. A compatibility with, or capability to run independent of, the operating system loaded on the hard drive.

2.4.3. A compatibility with, or capability to run independent of, the type of hard drive being sanitized (e.g., Advanced Technology Attachment/Integrated Drive Electronics or Small Computer System Interface type hard drives).

2.4.4. A capability to overwrite the entire hard disk drive independent of any basic input/output system or firmware capacity limitation that the system may have.

2.4.5. A capability to overwrite using a minimum of three cycles of six passes of data patterns on all sectors, blocks, tracks, and slack or unused disk space on the entire hard disk medium.

2.4.6. A method to verify that all data has been removed from the entire hard drive and to view the overwrite pattern.

2.4.7. Although not mandatory, selected software should also:

2.4.7.1. Provide the user with a validation certificate indicating that the overwriting procedure was completed properly.

2.4.7.2. Provide a defects log, or listing of any bad sectors, that could not be overwritten by the software.

2.5. File Overwriting Programs. The programs must meet the same specifications as software that overwrites the entire hard drives listed in paragraph 2.4.

2.6. Overwrite Sampling. Sample overwritten hard drives on a random basis by a trained individual other than the one who performed the overwrite process to verify that the overwriting process has been successfully completed. Examine no fewer than 20% of all overwritten hard drives in the sampling process. Document the sampling process and maintain records of hard drives sampled.

Chapter 3

CLEARING MEDIA

3.1. Clearing Media. Clearing removes information from information systems media to render the information unrecoverable by normal system utilities or non-technical means. You cannot recover cleared information by software programs, but you can recover them by technical means such as found in a laboratory environment.

3.1.1. Routines that only remove pointers and leave data intact (i.e., delete or format) are not acceptable methods of clearing media.

3.1.2. Use clearing when the media is reused within the same information system, environment, and classification level.

3.2. Procedures for Clearing Media.

3.2.1. Clear media when changing modes of operation or prior to reuse at a higher classification level.

3.2.2. Media that contained sensitive information must be cleared before reuse within the same information system environment and classification level.

3.2.3. Ensure the classification markings for the highest classification processed remains on the media. For example, if the cleared information was classified SECRET, the media retains the SECRET classification marking. Use a SF 711 to annotate in the comment block that the media is “cleared;” and include the date, initials, and the office clearing the media.

3.2.4. Protect the cleared media appropriately depending on its classification.

3.2.5. Several different types of media may be contained within an information system, such as a printer with a hard drive and RAM. Ensure all types of media (i.e., disks, RAM, buffers, etc.)

contained in the information systems are cleared. Clear media based on the procedures in Table 3.1.

Table 3.1. Clearing Media.

Type of Media Clear by:

Sealed Disk Drives Overwriting all addressable locations with a pseudo-random pattern twice and then overwriting all locations with a known pattern. (e.g., “00110101” followed by “11001010” then followed by “10010111”). Verify by randomly rereading at least 1% of the overwritten information to confirm that you can only recover the overwrite character.

Removable Disk Packs

Magnetic Bubble Memory

Core Memory

Floppy Disks, Diskettes

Magnetic Cards

EEPROM

Flash Memory (includes Flash Drives, Thumb Drives, Memory Stick)

Magnetic Tapes Degauss with an NSA-approved degausser.

EPROM Perform ultraviolet light erase according to manufacturer’s recommendations, but increase the time requirement by a factor of three.

Next, overwrite all bit locations with arbitrary unclassified data.

SRAM Overwrite all locations with a character, its complement, then with a random character. Remove all power including batteries and capacitor power supplies from SRAM circuit board.

DRAM Remove all power, including batteries and capacitor power supplies from DRAM/RAM circuit board. RAM

PROM No procedures exist for clearing. Media retain their highest classification until destroyed. Optical media

Printers and Printing Systems

Run three blank copies through the system. If any images are printed, protect the output at the highest classification processed. Repeat the process.

If unable to get a clean output, print an unclassified test pattern or black copy; then run three blank copies. If the output is anything other than a blank copy, an image of the unclassified test pattern, or a black copy, the printer/system was not successfully cleared. Destroy the clearing copies as classified waste.

Chapter 4

SANITIZING MEDIA

4.1. Sanitizing Media. Sanitizing removes information from media to render the information unrecoverable by technical means (e.g., you cannot recover it in a laboratory environment).

Overwriting, degaussing, and sanitizing are not synonymous with declassification. Declassification is a separate administrative function. Declassifying media requires Information System Owner (ISO) and information owner approval. To prevent unauthorized disclosure, sanitize and declassify all media prior to release to individuals that do not have a security clearance and need-to-know for the information stored on the media.

4.1.1. Examples of where sanitization and declassification are appropriate include:

4.1.1.1. When you will no longer maintain the secured physical environment (where the media was used).

4.1.1.2. When you are releasing the media from a secure facility to a non-cleared maintenance facility.

4.1.1.3. When the media is inadvertently contaminated with data of a higher classification level than authorized.

4.1.2. Sanitize media inadvertently exposed to a higher classification or category of data than allowed prior to resuming normal operations at the intended classification level. The ISO and information owner should refer to Attachments 4 and 5 to determine the best course of action.

ISOs and information owners will strive to maintain a balance between mission requirements and the risk of unauthorized disclosure of information.

4.2. Procedures. Basic sanitization steps are:

4.2.1. Disconnect the information systems from any external network.

4.2.2. When degaussing, ensure the media’s coercivity does not exceed the rating of the degausser. See Chapter 5 for information about degaussing.

4.2.3. Sanitize media according to Table 4.1. Information systems may contain several different types of media, such as printers, copiers or MFDs with hard drives and RAM. Ensure all types of media (i.e., disks, RAM, buffers, etc.) contained in the information systems are sanitized. Note:

Routines that only remove pointers and leave the data intact (i.e., delete or format) are not acceptable methods of sanitizing media.

4.2.4. After sanitizing, verify its success by reviewing the media for data retention. For example, if an overwrite product is used to sanitize an information systems hard disk, dump random short sectors, blocks, or memory contents and verify that only the last character written is all that is readable. Where possible, review at least 1 percent of the media as a representative sample.

4.2.5. The IAO prepares and submits a label and letter according to examples in Attachment 2.

Declassify media by removing the classification markings after the information owner provides evidence that no information resides on the media. The letter is also the authority for the downgrading or declassifying the media.

4.2.6. If the information owner and ISO disapprove of the sanitization method, continue to mark and control the media at its original classification level.

4.2.7. If the equipment is a copier, facsimile (fax), printer, etc., check for and clear paper jams.

Sanitize media components depending on the type of media present in the devices.

4.2.8. Follow additional sanitizing procedures in Table 4.1.

Table 4.1. Sanitizing Media.

Type of Media: Sanitize by:

Sealed Disk Drives Using an NSA or NIAP-approved product, overwrite with a pattern, and then its complement, and finally with another unclassified pattern (e.g., “00110101” followed by “11001010” and then followed by “10010111” [considered three cycles]). Sanitization is not complete until six passes of the three cycles are successfully completed. Verify by randomly rereading at least 1% of the overwritten information to confirm that you can only recover the overwrite character.

Note: Overwriting classified media requires use of a NIAP-approved product at an EAL greater than 4 or an NSA-approved product.

Removable Disk Packs

Magnetic Bubble Memory

Core Memory

EEPROM

Flash Memory

Magnetic Tapes (Note 1)

Degauss with an NSA-approved degausser.

Floppy Disks, Diskettes

Magnetic Cards

EPROM Perform an ultraviolet light erase according to manufacturer’s recommendations, but increase the time requirement by a factor of three.

Then load all positions with zeros. Verify by randomly reading the information loaded in the EPROM.

SRAM Overwrite all locations with a character, its complement, then with a random character. Remove all power including batteries and capacitor power supplies from SRAM circuit board. If SRAM is not functioning, remove all power, including batteries and capacitor power supplies from SRAM circuit board.

DRAM Remove all power, including batteries and capacitor power supplies from DRAM/RAM circuit board. RAM

PROM Media retains its original classification until destroyed. Destroy using an NSA-approved optical media destroyer. Optical Media

Thermal Transfer (TT) Cartridges/Dye Sublimation (DS) cartridges (found in fax machines, high quality color printers, video printers, badging printers and labeling/bar coding printers)

Send to NSA or use NSA-approved shredder (see note 6).

Impact printer ribbons Treat a ribbon as unclassified when printer strikes the ribbon at least five times in the same place before moving to the next position.

Laser Printers Treat, handle, store, and dispose of used toner cartridges from properly operating equipment that properly completed the last printing cycle as unclassified. When a laser printer does not complete a printing cycle (e.g., a paper jam or power failure occurs) completing a subsequent print cycle before removal of the cartridge is sufficient to wipe residual toner from the cartridge drum. If the toner cartridge is removed without completing a print cycle, inspect the cartridge drum by lifting the protective flap and viewing the exposed portion of the drum. If residual toner is present; manually rotating the drum is sufficient action to wipe off residual toner material present. After completing actions for incomplete print cycles, treat, handle, store, and dispose of the toner cartridge as unclassified.

Notes:

1. Since it isn’t possible to distinguish Type I (coercivity between 0 and 350 Oersted [Oe]), Type II (coercivity between 350 to 750 Oe) and Type III (coercivity above 750 Oe) magnetic tapes from each other by physical appearance, mark or label each tape with its type at the time of receipt so it can be properly sanitized in the future. Do not remove or cover the label until the tape is destroyed. Also, refer to NSA’s Degausser Evaluated Products List (DEPL) at http://www.nsa.gov/ia/government/mdg.cfm?MenuID=10.3.1 for coercivity charts of magnetic storage media.

2. Sanitize Bernoulli cartridges by degaussing only.

3. Magnetic media made of barium ferrite cannot be degaussed and must be destroyed.

4. If unable to sanitize, mail classified media to NSA for destruction. See Table 6.2 for addresses.

5. Sanitize unclassified media before turning over to Defense Reutilization and Marketing Office

(DRMO).

6. How to identify TT/DS cartridges?

6.1. Locate fax machines, color printers, badging printers, bar-code or label printers or video printers.

6.2. Open unit where cartridges are installed.

6.3. Remove cartridge, if necessary, and inspect the following:

6.3.1. Is there an area of black carbon-like film stretched between the supply and take-up cavity or roll? Typically, the black film will be 8.5” wide. Some cartridges are simply rolls of black, carbon-like film. For color printers, the cartridge is a roll of multi-colored film (blue, red, yellow and black). On most of these types of printers, it is not necessary to remove the rolls for inspection. Upon opening the printer, the multi-colored film roll is easily inspected.

6.3.2. Badging printer cartridges are typically color rolls approximately 3” to 4” wide. The film roll contains color panels of blue, red, yellow, and black.

6.3.3. Bar-code or label printers typically use rolls of black, carbon-like film approximately 3” to 4” wide.

http://www.nsa.gov/ia/government/mdg.cfm?MenuID=10.3.1

6.3.4. Video printers usually have small (approximately 4” X 6”), self-contained cartridges, that have the multi-colored panels of film.

6.4. If you can see a negative image on the carbon-like film, of what was previously printed on the machine, you have identified a TT or DS cartridge. (On a TT machine, the image is clear, on a DS machine, the image is faint.)

Chapter 5

DEGAUSSING AND DEGAUSSERS

5.1. Degaussing. Degaussing is a process whereby the magnetic media are erased, (e.g., returned to a zero state). Degaussing (demagnetizing) reduces the magnetic flux to virtual zero by applying a reverse magnetizing field. Properly applied, degaussing renders any previously stored data on magnetic media unreadable by keyboard attack or laboratory attack.

5.1.1. Degaussing hard drives often destroys the drive’s timing tracks and servo motors, and usually demagnetizes the permanent magnets of the spindle motor on sealed (e.g., Winchester) drives, thus rendering them unusable.

5.1.1.1. The process of removing the hard drives from the computer, taking off the hard drives’ housing, degaussing and placing the hard drive back into the computer, and testing to ensure it still operates and no longer contains its original data, may make reutilization after degaussing cost ineffective.

5.1.2. Each type of magnetic medium is distinguished by the rate of coercivity required to ensure the medium is brought back to its zero state. Due to the variation of media formats and their corresponding magnetic densities, it is essential that a degausser with the right coercivity specifications is used to degauss the target media.

5.1.3. Coercivity strength of an applied magnetic field determines which type of degausser should be applied to the particular magnetic media being targeted for sanitization. Higher coercivity rates are usually required to degauss hard disk media and many degaussers designed for commercial uses do not have the magnetic energy required to erase media with a higher coercivity rate.

5.1.4. Coercivity of a magnetic media defines the magnetic field necessary to reduce a magnetically saturated material’s magnetization to zero. The correct use of degaussing products ensures that classified data is no longer retrievable.

5.1.5. Magnetic media containing barium ferrite cannot be degaussed for declassification purposes.

5.1.6. Degaussers are ineffective in erasing magneto-optic recording media and therefore are not used.

5.2. Degaussing Standards and Procedures.

5.2.1. Follow directions in NSA’s DEPL and the product manufacturer’s directions carefully.

Deviations from an approved method or rate of coercivity could leave significant portions of data remaining on a hard drive.

5.2.1.1. Use degaussers approved for the magnetic media being erased (i.e., degausser coercivity rating must be equal to or greater than the coercivity rating of the magnetic media).

5.2.1.2. Remove all shielding materials (e.g., castings, cabinets, and mounting brackets) that may interfere with the degausser’s magnetic field from the hard drive before degaussing.

5.2.1.3. Operate the degaussers at their full magnetic field strength.

5.2.2. The IAO and a witness certify the degaussing of a hard drive by affixing a signed label to the information system indicating the date and method of degaussing (see Attachment 2). Remove all classification labels and markings from the media or information system after the information owner provides evidence that no information resides on the media. The letter is also the authority for downgrading or declassifying the media. The IAO maintains documentation recording the same information for a minimum of five years according to the AFRIMS RDS.

5.3. Bulk Erasure. Bulk erasure consists of the following steps:

5.3.1. Remove the hard drive from the chassis or cabinet.

5.3.2. Remove any steel shielding materials or mounting brackets that may interfere with magnetic fields.

5.3.3. Place the hard disk drive in an NSA-approved large cavity degausser and erase at the required field setting. Note: Bulk erasure may damage the drive’s timing tracks, prohibiting its continued use. Use bulk erasure only on a case-by-case basis.

5.4. Degaussing Wand.

5.4.1. Sanitize sealed disk drives by disassembling the disk pack and erasing all surfaces of the enclosed platters with an NSA-approved hand-held degaussing wand.

5.4.2. Wipe each active surface (top and bottom) at least three times with the magnetic wand.

(NOTE: Disassembling the sealed drive and degaussing the platters causes damage (loss of timing tracks, bent head armatures or damaged recording surfaces) that prohibits its continued use.

Disassemble disk drives only on a case-by-case basis.)

5.5. Using Approved Degaussers.

5.5.1. Use only NSA-evaluated degaussers to degauss all magnetic media containing sensitive and classified information. Except for magnetic hard disks, that are type-independent, make sure you use the appropriate type degausser for the media you are degaussing. Hard disk media is simply defined as coercivity and not as Types I, II, or III. When degaussing, observe the rules in Table 5.1.

Table 5.1. Degaussing Media.

If the Degausser is: Then, the Coercivity levels are:

It will sanitize or clear the following media:

Type I Type II Type IIA Type III

Type I 0 - 350 Oe S C C C

Type II 351 - 750 Oe S S C C

Type II Extended Range 751 - 1000 Oe S S S C

Type III 1001 - 1700 Oe and above

S S S S

(NOTE: The terms “Type I-III” are being replaced by the actual media coercivity rating.)

S – Media is considered sanitized and may subsequently be declassified.

C – Media is only considered cleared and retains its original classification.

5.5.2. The NSA DEPL shows the model identification of current equipment units that were evaluated against and found to satisfy the requirements for erasure of magnetic media that retains classified and sensitive data.

5.5.3. To determine the type of media, refer to the “Coercivities” list located in NSA’s DEPL.

5.6. Testing Degaussers. The DEPL requires that degaussers be tested to ensure continued compliance with the specification. Certify degaussers every 6 months for the first two years of operation. After the first two years of operation, recertify on an annual basis. These certifications ensure the degaussing equipment is functioning properly. Most manufacturers provide maintenance contracts to ensure the integrity of their degaussers.

5.7. Replacing Nonevaluated Degaussers. Initiate action to replace or augment nonevaluated degaussers with degaussers listed on the DEPL.

5.8. Malfunctioning Degaussers. The degausser owner should immediately contact the degausser vendor or a degausser repair service any time the degausser is suspected of not performing properly.

After repair, certify that the degausser operates within the applicable NSA performance requirements before using it to degauss classified media.

CHAPTER 6

PHYSICAL DESTRUCTION

6.1. Physical Destruction. Destruction of a medium is the process of physically damaging the medium to make it unusable in a computer and no known exploitation method can retrieve data from

it. Physical destruction is not required if the media is sanitized and declassified, as applicable.

However, if local policy directs physical destruction, sanitize the media before destruction.

6.2. Procedures.

6.2.1. Destroy media according to Table 6.1. Table 6.2 provides additional information depending on the type of media being destroyed.

Table 6.1. Media Destruction Methods.

Option Destruction Method

A Destruction at an approved metal destruction facility (i.e., smelting, disintegration, or pulverization). If an approved facility is not available, use the procedures in paragraph 6.2.2.3.

B Application of an abrasive substance (i.e., emery wheel or disk sander) to a magnetic disk or drum recording surface. Make certain that the entire recording surface is completely removed. Ensure proper safety measures to include protection from inhaling abraded dust and using protective eyewear.

C Application of concentrated hydriodic acid (55% to 58% solution) to a gamma ferric oxide disk surface. Use acid solution in a well-ventilated area and personnel must wear eye protection.

D Application of acid activator Dubais Race A (NSN 8010 181 7171) and stripper Dubais Race B (NSN 8010 181 7170) to a magnetic drum recording surface. Technical acetone (NSN 6810 184 4796) should then be applied to remove residue from drum surface. Do this in a well-ventilated area and personnel must wear eye protection. Extreme caution must be observed when handling acid solutions. Only qualified and approved personnel should apply the chemical substance to remove data.

(NOTE: Although approved methods, option B produces abraded dust, and C and D use dangerous acid, to remove recording surfaces. Before using any of these options, contact Bio- Environmental Engineering. Option A is recommended over B, C, and D.)

Table 6.2. Destroying Media.

Type of Media: Additional Information:

Floppy Disk Remove medium from jacket and shred in an NSA/CSS evaluated crosscut shredder or incinerate in a licensed incinerator.

Sealed Disk Drives Dispose of the chassis and electronic hardware from the disassembled disk drive by using appropriate procedures established for unclassified equipment. Incinerate hard disk platters in a licensed incinerator.

Magnetic Bubble Memory

Solid State Storage Devices (e.g., Flash Memory, RAM, ROM, EEPROM, EPROM, SRAM, DRAM, RAM, PROM, etc.)

Destroy by smelting in a licensed furnace at 1,600 degrees Celsius or higher or disintegrate into particles that are nominally 1 millimeter edge length in size using an NSA/CSS evaluated disintegrator.

Removable Disk Packs Destroy platters from disassembled disk packs at an approved metal destruction facility. Segregation of components (i.e., separate metal from plastics) for assembled disk packs may be necessary to comply with the requirements of the destruction facility. The information associated with the release or disposal of a large quantity of disk packs by a particular organization or facility may be considered sensitive. Disposal procedures should protect this sensitivity.

Core Memory When practical, remove the outer chassis and electronic circuit boards from the core memory unit to optimize the performance of the destruction device. Destroy by smelting in a licensed incinerator.

Magnetic Cards Incinerate card in a licensed incinerator.

Magnetic Tapes Take prepatory steps such as segregation of components (tapes and reels) to comply with the requirements of the destruction facility. Incinerate tape in a licensed incinerator.

Optical media Incinerate in a licensed incinerator or use an NSA/CSS evaluated optical storage device shredder or disintegrator to reduce CD and DVD storage devices into particles that have nominal edge dimensions of 5 millimeters or less and surface area of 25 square millimeters or less.

Display Devices: cathode ray tubes, picture tubes, fluorescent screen devices, and image tubes/displays (e.g., photo-electric, optical, plasma, etc.)

Consider display devices declassified if, after visual inspections, it is determined that classified information was not etched into the display. If there is any doubt after inspecting the screen, highlight the display by varying intensity from low to high. If sensitive information is visible on any part of the visual display face, the visual display must be destroyed before it is released from control. Destroy defective display devices that cannot be sanitized of classified information as classified waste.

Notes:

1. If facilities are not available to destroy, ship by U.S. registered mail to Director, National Security Agency (DIRNSA) for classified media up to SECRET classification-level. Include two copies of a complete list of materials for accountability purposes and a self-addressed, stamped envelope for return-receipt documentation and a notification that the tasks are complete. Maximum weight is 40 pounds per package. Separate accountable media from non-accountable media as well as sort by type of media within a shipment (hard drives with hard drives, etc.). Ensure classified mailing is accomplished according to the procedures detailed in AFI 31-401.

2. To destroy floppy disks, microfiche, aluminum disks, computer chips and circuit boards, mail to:

DIRNSA

ATTN: CMC, Suite 6890 9800 Savage Road Ft George G. Meade MD 20755-6890

3. To destroy magnetic media to include VHS, BETA, and reel-to-reel tapes, tape cartridges, Zip® disks, hard disks, or optical media, mail to:

DIRNSA

ATTN: CMC, Suite 6875 9800 Savage Road Ft George G. Meade MD 20755-6875

4. For questions on shipping TOP SECRET media, contact DIRNSA at 1-800-688-6115, option 3, prior to mailing.

5. Transfer sanitized unclassified media to DRMO for destruction.

6.2.2. Hard Drives.

6.2.2.1. Destroy hard drives by incinerating when they are defective or cannot be economically repaired or sanitized for reuse.

6.2.2.2. As an added security measure, when practical, operable hard drives no longer deemed economically viable should be overwritten or degaussed prior to destruction.

6.2.2.3. Under emergency circumstances only, accomplish physical destruction to an extent that precludes any possible further use of the hard drive. The following are acceptable means for emergency destruction of hard disk media:

6.2.2.3.1. Physical destruction/impairment beyond reasonable use.

6.2.2.3.1.1. Remove the hard drive from the chassis or cabinet.

6.2.2.3.1.2. Remove any steel shielding materials, mounting brackets, and cut any electrical connection to the hard drive unit.

6.2.2.3.1.3. Subject the hard drive to physical force (e.g., pounding with a sledgehammer) that disfigures, bends, mangles, or otherwise mutilates the hard drive so that it cannot be reinserted into a functioning computer. Direct sufficient force on top of the hard drive unit to cause shock/damage to the disk surfaces.

6.2.2.3.1.4. In addition, any connectors that interface into the computer must be mangled, bent, or otherwise damaged to the point that the hard drive cannot be reconnected without significant rework.

6.2.2.3.2. Emergency destruction videos are also available on NSA’s website (http://www.iad.nsa.smil.mil/resources/library/destruct_guides_section/e_destruct_video.cf m).

6.2.2.4. Certify the destruction of the hard drive by affixing a signed label to the computer indicating the date and method of destruction (see Attachment 2). The IAO maintains the documentation recording the same information for a minimum of five years according to the

AFRIMS RDS.

Chapter 7

DISPOSING OF UNCLASSIFIED COMPUTER HARD DRIVES

7.1. Disposition. Hard drives may be scheduled for reuse, repair, replacement, or removal from service for a variety of reasons and disposed of in various ways as described in this chapter.

7.2. Government-Owned Hard Drives.

7.2.1. Sanitize operable hard drives for reuse according to Chapter 4, prior to transfer or turn-in to Defense Reutilization and Marketing Office (DRMO) . If the operable hard drives are removed from service completely for any reason, degauss or destroy them according to Chapters 5 and 6.

Figure 7.1 highlights the process flow for disposing of operable Government-owned hard drives.

Figure 7.1. Sanitizing an Operable Department of Defense (DoD)-Owned Hard Drive.

IAO

overwrite, certify and label

Overwrite confirmed by sampling

Reuse

AF

Non-AF

Resale

Remove from Service

IAO

responsible for destruction or degaussing

IAO certifies destruction or degaussing

Hard Drive Operable

7.2.2. If the hard drive is inoperable and has reached the end of its useful life, degauss or destroy it according to Chapter 5 and 6. Figure 7.2 highlights the process flow for disposing of inoperable Government-owned hard drives.

Figure 7.2. Sanitizing an Inoperable Air Force-Owned Hard Drive.

Hard drive Inoperable

IAO responsible for destruction or degaussing

Witness certifies destruction or degaussing

7.3. Leased Computers (including assets provided under service-level agreements).

7.3.1. If the leased hard drive is operable, and is simply being relocated within a contract umbrella (i.e., it remains under the authority of the leasing agent), overwrite is not required.

However, if the hard drive is being redirected from the contract umbrella, then the leasing agent overwrites, certifies, and labels the hard drive according to Attachment 2.

7.3.2. If the leased hard drive is inoperable, the contractor makes a determination as to whether the hard drive is repairable or should be removed from service.

7.3.2.1. Repaired leased hard drives that are returned to the user need not be overwritten.