HOUSTON – The Harris County Institute of Forensic Sciences has investigated claims from a computer repair technician that a computer sold at a surplus auction still contained data from the agency that provides medical examiner and crime lab services for the county.
The repairman, Johnny, who asked that we not use his last name, said he recently received the 2009 Hewlett Packard computer from a client who asked him to refurbish it.
Recommended Videos
“She bought it from a Harris County public auction,” Johnny said.
Johnny said he was surprised to find the hard drive was still inside the computer and became alarmed when he says he discovered it appeared to contain data from the Harris County Institute of Forensic Sciences.
“There were folders, files, excel spreadsheets with DNA records, and notes about sampling results with case numbers attached,” he said, describing what he saw on the computer which he believes was last used in 2015.
Johnny turned over the hard drive to IFS Monday afternoon. He said even if the information turns out not to be sensitive in nature, he’d rather government agencies be safe instead of sorry.
“The overall concern is data security. Generally, no data should be given out to the public when you sell a computer because it’s not their data,” he said.
After examining the hard drive, the Harris County Institute of Forensic Sciences released the following statement to KPRC 2:
“Thank you for providing the recently surplussed hard drive to us for examination. The Institute of Forensic Sciences (HCIFS) takes information security very seriously and we were glad to have the opportunity to inspect the hard drive and determine if any protected information was accidentally released to the public.
After extensive examination, we have found most files remaining on the hard drive were operating system files used for the computer to run. This computer was used solely to operate a DNA instrument that prepares samples for DNA testing. In essence, the software on the computer “drove” the machine, but it did not house any results or confidential DNA information. The one casework-related Excel file found on the drive was used by laboratory staff to log samples that were being re-tested. That file contained testing numbers and sample itemizations, but it did not include offense or lab cause numbers, the results of any DNA testing, nor any case notes or sensitive DNA case information. Aside from the Excel log, the files on the drive included program code to operate the instrument itself, and service technician maintenance records which do not contain any casework information. Any folder labeled “test result” was used by the service technician for running quality control tests on the instrument (not to be confused with HCIFS DNA test results). There is no information on the hard drive that could be used to identify any victims, potential defendants, or DNA test results.
We are taking steps internally to ensure all information technology staff who are tasked with the surplus of computer equipment are retrained on the proper procedure, and a formal corrective action is being taken to ensure the protocol for wiping or destroying the hard drive of surplussed devices is always followed in the future.
Thank you again for bringing this matter to our attention.”