1 November 2005 – Members of an environmental group that purchased computer hardware at a Nigerian market say they found confidential data from Wisconsin's child protective services agency on the hard drive.

State officials are trying to figure out how and why the sensitive information, including children's names and locations, would remain on hard drives that had been reformatted to eliminate the information before being sent for recycling or disposal.

"We can't confirm or deny it's ours," says Stephanie Marquis, a spokeswoman for the Wisconsin Department of Health and Family Services.

"It's the type of data our agency works with, but it's also data that other agencies use."

The Seattle-based Basel Action Network posted on its website a copy of a 2001 spreadsheet that listed personal information of 45 children and their guardians in the state program.

All names were blacked out.

BAN co-ordinator Jim Puckett said his group purchased the hard drive for about $US20 ($26) from a market in Lagos, as part of an effort to track the hazardous disposal of computer and electronic refuse overseas.

The network says China and Southeast Asian nations used to be the main destination for discarded electronics, but Nigeria is becoming a new dumping ground because Nigerians, anxious to bridge the digital divide, want used computer parts.

"There are two reasons we gather hard drives: one, to find out where they're coming from, and two, to show liability beyond the environment, the protection of private data," Puckett says.

The network worked with a Swiss company to examine the hard drives.

"I call them examinations but there's not really much to it, when people format their hard drives, they erase nothing, just the table of contents. That's easy to recover," Puckett says.

"Many of these hard drives still had data that was alive, just waiting to be grabbed."

Marquis says her department takes the apparent breach very seriously because it goes to great lengths to ensure the safety of private information. Her agency's policy in 2001 was to wipe out and reformat hard drives before disposal, and after a more stringent policy was introduced in 2003, data is now not only erased but replaced with all-zero values.

If there are any problems, she says, the agency simply destroys the hard drive. The agency hopes to get the hard drive back from the network to assist its internal investigation.

Puckett says his organisation will have no problem returning it as long as the agency isn't trying to cover anything up.

Puckett says it's not a coincidence that a common email scam in which an individual claims to be exporting a large amount of cash is generally identified as Nigerian.

"I don't want to pick on Nigerians, but there are people who are ingenious about scamming money," Puckett says.

"If they have access to personal information, they can make their email scams so much more specific, more believable." Computer experts recommend that users dispose of a hard drive by first running commercial software that repeatedly overwrites information with ones and zeros.

Alternatively, a person can physically destroy the hard drive or keep it and dispose of the rest of the computer.