Shredding is the ultimate defense, right? Once it's shredded, it's gone!
No longer. It was always vulnerable if your attacker had the shredded chaff and plenty of free time. Think of the shredded embassy documents from the Iranian Hostage crisis of 1979. Those students reconstructed the pages with nothing more than scotch tape and patience. More recently, methamphetamine users have been hired by identity theft ringleaders to do the same thing.
Bill Wilson of the Big I recently found a number of services which make the "unshredding" problem much more manageable. In the Enron case, the government hired ChurchStreet Technology to scan the chaff, then used computer algorithms to piece the documents together. They claim to take the recovery time from hundreds of hours down to mere minutes. It's expensive but not terribly complicated. And your trash is in the public domain - anyone can take it back out of the dumpster without breaking any laws.
So how do you fully protect your waste paper from those ID thieves with too much time on their hands?
- If you're still using a strip-cut shredder, get rid of it now. Upgrade to a cross-cut that chops the paper into very small bits of chaff.
- Feed your pages into the shredder vertically, that is, with the words perpendicular to the shredder blades.
- Don't have unusual-colored paper. Or if you do, shred enough of it that it can't be easily picked out. The rule in the army used to be no less than 20 sheets of any given paper type in each shred "lot".
- Stir the chaff before disposal. A careful attacker could exploit the fact that pieces from the same document tend to come out of the shredder close to each other and remain so in the waste bag. A few quick stirs can randomize the chaff and make reconstruction much harder.
- Send the chaff to a paper recycler. Even the best reconstructors can't bring a page back after it's been turned into new paper pulp. Of course, you have to be sure that your waste isn't intercepted before it hits the recycler but there are several bonded shredding companies that will do that for you.
How much is enough? It depends on who's out to get you. For most home users and small businesses, one and two are probably enough. If you really have something to hide, consider three and four and look into five when your shredding contract comes up for renewal. Find the right balance, remembering that identity theft is real but that most of us are not dealing with DoD nuclear secrets.
Bill Wilson publishes a bi-weekly newsletter filled with useful information including a technology column in almost every issue. His target audience is an independent insurance agent but many of his topics are applicable to any small business owner. If you're not subscribed already, I recommend looking them up.