Apathy, Fear, Suspicion and the SME

Most people work hard and have busy days. Managers and business owners have a lot of things to think about, a lot of rules and regulations to consider, and it all takes time. That is why recycling and the idea of sustainable business is not as high on the agenda as we would like it to be.

EReco sits in a sector fraught with risks, regulations and rules, but the biggest feeling I get from the majority of SME’s I talk to is a strange mixture of apathy, fear and suspicion.

Let me take those three emotional responses in reverse order.

People are suspicious of someone taking away their old IT equipment purely because they suspect that they are missing out on something. It’s not so bad with old wires, keyboards and the like, because they did not cost a lot in the first place and they have been well used and abused, and possibly don't fit the replacement kit which in any case come with new wires etc, but when it comes to desktops, laptops, servers and stuff, the cost kicks in. Remember, this is the man who has just paid to replace this stuff. He knows what it cost him down to the last penny. And even if that pile in the corner is all now redundant, he has this nagging voice in his head that tells him he is giving away money. It makes him reluctant to let go.

Fear is there too. He is no fool. He knows about hard drives, or at least he thinks he does. He does not think there is anything bad on the old machines, he may even have checked, and he does not think any criminal mastermind would be that interested in his old files anyway, but there is a nagging doubt there. He is not really sure what he should do, so he does nothing much at all, except deleting everything he can see.

Which brings me to apathy. Because this is not one of life’s bigger decisions. Not in the great scheme of things. This is redundant kit. If you have bought replacements and you have put the old stuff in a dark corner somewhere whilst your mild fears and suspicions fester, you cannot really be bothered to chase the solution too far. There is no problem hanging on to IT rubbish. It is not decomposing. So unless you need the storage space back, keeping it is relatively risk-free. It is actually easier to do nothing at all.

I absolutely guarantee that if you root around in any business premises you will find a bit of redundant kit somewhere. Damn it, most family homes are the same. I have a Virgin Media box they just left with me when I upgraded to TiVo. It has been at the bottom of my wardrobe for two years for heaven’s sake. And I could just drop that down the dump, for free.

There are thousands of tons of WEEE we could be recycling right now sitting there doing nothing other than take up space. And that is quite important, don’t you think? The idea that our electrical goods can be broken down at worst and reused to make something else is an incredibly good one, but far too often the good message gets lost in the reality of the situation, and that causes fear, suspicion and apathy.

So if you are a slightly nervous, suspicious sort of person who hasn’t summoned the energy to do the right thing with that pile of rubbish in the storeroom, it’s time to buck up. Call me (there are other IT recycling businesses out there, if you really must, but hey, we’ve come this far together, give a guy a break!) and I will sort it for you. It doesn’t hurt, you might get a few quid ahead at the end of the process and you will be doing something good for once.

Come on, you know it makes sense.

http://www.ereco.co.uk

One of our laptops is missing!

If you lost your laptop this morning what would you be worried about?

It is a good question, isn’t it? Inconvenience springs to my mind. How long would it take to get a new one sorted out? In the office, IT could probably sort me out with an old desktop. I could log on to the network but most if not all of my documents are on my own hard drive. I am not great at saving to the shared drives. 

So it is going to be a mess.

Not to mention the embarrassment of admitting it. And reporting it. And just how am I going to do that presentation on Thursday with no laptop? Which incidentally I have to re-write because the file was only saved on the laptop. No backups.

And then I realise something else. Lots of things are on that laptop. The staff budget for a start. A lot of salary information, even National insurance numbers. That big confidential contract. I saved that to the hard drive so that I could go through it one last time over the weekend. Oh and I used it to do my personal banking...what about my own account details?

Scary isn’t it? I have never lost a laptop or had one stolen but I know lots of people who have. And of course many a data breach has been caused by this sort of thing. Stolen laptops give up their secrets in the wrong hands.

And yet, guess what? When we change our laptops, do you give a second thought to the old one? I have given mine back to IT loads of times, and never worried about it at all. It was safe, in the hands of the professionals.

Redundant things are forgotten about. You have your new toy and the old one gets tucked away somewhere. In the old storeroom with that broken chair, 3 old desktops, that old server, the table that used to be in the conference room, an old projector. When we replace the accounts PC’s in April we will think about having a clear out.

And so the risk calculator rises up into the red right there. We have company assets, all neatly recorded in a register by the financial controller, but he has no idea where each one is. It is just within the company somewhere. He will only be told if it is disposed of. And the person responsible for company data, the nominated data controller, is not worrying about stuff in the IT store. It is safe enough. No one ever goes in there.

So life goes on. You replace the accounts PC’s and a fax machine in the sales office dies. The store is quite full but everyone is flat out rolling out Windows upgrades. Clearing out the storeroom is not a priority.

And then the board approves the new budget and you can replace all the laptops, get those new servers and upgrade the mobile phones. The whole team are flat out on procurement, working to a deadline, and young Damian is told to clear out the storeroom. Get someone in Damian; recycle like it says on the company website. ACME Widgets PLC support the environment.

Damian is a willing lad, of course. Bright too. He had his NVQ in IT and everything. He has a word with the boss to check his brief and does some research. There are rules. You cannot just dump this stuff, and you need to think about the data.

And this is where it all goes Pete Tong of course. It is now down to luck who Damian rings and what he is told. If he is the conscientious sort, he might do ok, but if he is just a box ticker, and if the boss expects to get his storeroom cleared for free, ACME Widgets could be about to lose more than one laptop. They could be about to help the criminals load them into the van. And they would be none the wiser until they hear the Mongol hordes ride into the car park and see Genghis Khan leap out of the saddle, scimitar in hand.

Ironic really. Leaving one laptop on a train is careless, giving 20 to Arthur Daley is negligent. One allows you to claim on the insurance, the other gets you a £500k fine. But which do we actually worry about most?

I once had an employment contract which stated that I must not leave company property in the boot of my car. They meant the laptop. Now you could add in the Smartphone I suppose. They were intent on taking disciplinary action if negligence allowed a theft. I am sure someone in HR is writing a clause or two about bringing your own devices into work these days, and using the company wifi to do all sorts of things that might cause a data breach. Meanwhile, down in the storeroom, Arthur Daley is picking up another load of redundant IT equipment for free.

It’s not as if people have not been fined for this sort of thing. The deterrent is there. But it does not happen enough to worry anyone. The threat is not as ‘real’ as someone breaking into your car and stealing your laptop.

We all carry our data around with us and theft or just plain misplacement is a daily problem if, like me, your brain is addled with age. I can barely remember my name, let alone where I put my phone so you can see the problem. But what has to happen to raise the awareness of what can happen when we throw things away?

For you sake, I hope it is not a £500k fine.

PS

Did you hear Genghis on the radio this morning? The Daily Mail have done an expose on pension data being freely available on the dodgy deals front and Chris Graham rolled up on the Today programme threatening beheadings and £500k fines to all and sundry. There was a huge assumption made that all the data involved had been collected illegally. 

That may well be true but the story the journalists should be following up is how this data is collected and what permissions are being granted by the consumer at the time. For instance, a lot of the data was allegedly mortgage application data. If a box has been ticked (or not unticked) to say the data can be used for marketing purposes, it is not illegal data and it is just another Daily Mail scare story.

More on this subject another day.

African Roulette

I am 53. I am also a cynical old git. I understand Murphy’s law and appreciate irony. Nothing much surprises me anymore and almost everything annoys me. I mean it. Everything. I have even been known to moan about cute kitten pictures on Twitter. But at the end of the extremely long day I do understand business and I realise that you win some and lose some.

Sales are like that. Getting a new customer is that perfect conjunction of proposition, need and timing all coming together at just the right moment, like an orgasm of sorts. Make the first call a day later and you might miss out. Call too soon and the need might not be front of mind and the chance will never come. So there is no point in beating yourself up about a loss. If you did your best, you just dust yourself down and move on, perhaps allowing yourself a rueful grin.

Every business should have values. There should be lines that we will not cross no matter what. Sales people do not like lines, rules or boundaries, but we need them, to keep us honest and to make sure that the bills get paid. Here in eReco land, we have some values. We are passionate about sustainability and very against anything unnecessarily ending up in landfill, for instance. We are uncompromising about data security because the consequences of being slapdash are so appalling. And we firmly subscribe to the theory that there is no such thing as a free lunch.

Take our toner recycling service. We courier out a box that holds about 20 cartridges, bottles or whatever toner comes in these days, and you call us when it is full. Then we come and get it, give you some nice paperwork and charge you £34.50 for the privilege, whilst guaranteeing that nothing will end up in landfill to boot. Simples. And yet some people are horrified that we charge. Honestly. Other people do it for free.

No they don’t. Recycling the toner may come with your printer package, lease or whatever, but it is not free. You are paying for it in the price. Your stationary supplier may take your old stuff too, but only if you buy new ones from them, so again you are paying for it in the price. Don’t be fooled by the word free. It remains relative.

The same is true of the free IT equipment collections. You have to read the small print. You have to find out where they are cutting the corners to pay for their labour. Is it on your data? That data which could cost you a £500k fine if it all goes wrong? Free is turning into a bit of a gamble. But when I pop this little objection onto the table you would think that I had insulted some people’s intelligence. Of course they are removing the data. What with? Fairy liquid?

The next cliché that comes trotting out is the charity one. It’s for charity. We have donated it to children in Africa. Well let me tell you something mate, Africa don’t want it. They have said so. Their governments are starting to ban it. They would quite like some food, maybe some clean water and a few Paracetemol but they are fine for 8 year old desktops thanks very much. The odd Harrier jump jet would be much appreciated, but they are OK for battered LaserJet’s. And the only children who get to see most of this stuff are the ones working the acid baths trying to get the precious metals off the mother boards.

So a free lunch is a bit like playing Russian roulette. There are a lot of possible outcomes here, one of which is that you get exactly what it said on the tin. Don’t get me wrong here. I understand Murphy’s Law and you probably won’t be the one that gets caught out. That is why I always say that this game is about risk management. Using a free service and not really knowing what they are going to do with your stuff is taking an unnecessary risk.

Which you might think is fine. But I don’t like the other outcomes. If the ammunition chambers rolls round to the wrong place, someone gets hurt. Your company, financially. Maybe fatally if you cannot stand a large fine. It will not do the reputation any good either. The environment too. Some kids in Africa. It’s all just a little bit distasteful for the want of paying a few hundred quid.

And yet, I am a cynical old git, of course. So I write another post for this blog and hope that just one person reads it and changes what they do. I don’t expect to make a difference but I know I have to dust myself down, pick myself up and start all over again.

But stop it with the pesky kittens, ok?

Mine is Bigger than yours!

Size matters. In terms of IT recycling if you are a really big business you are constantly going to be refreshing assets, so you will have the necessary partnerships, build the internal knowledge and have a good idea about what you want and need to do. Hopefully. Not always the case but in my experience the best businesses ‘have a plan’.

This makes a sense to me. I spoke to one customer this week about their plan, and it was quite revealing. They budget for asset disposal and look to enhance that budget by selling on their kit through us.

The thing that really struck me was the level of realism. They knew they were not giving us anything with great residual value but it was our ability to squeeze every last drop out of assets that made us an important part of the equation.

Take laptops. They dispose of 200 at a time and although they are usually beaten to within an inch of their lives, matching sets like that retain value to some people in the market. Maybe only £15 per laptop but for 200 that is £3,000 and that paid for the collection and data wiping of the laptops and two full van loads of assorted WEEE (Better described as waste in this case).

Our client has 3 priorities – data security, responsible disposal and the right paperwork. When you are running an IT system that covers the globe and several thousand users you need to be organised and keep detailed records, and you need to comply with all regulations. He is fully onboard with my first principle of managing risk.

The really refreshing part of this was the realism about what we actually do. For a start, collecting 2 full van loads of stuff is not easy or cheap. 3 guys were gone for eleven hours door to door. It then took another three hours to unload and track it all in, because it had to be secure before we shut up for the night of course. Then the data erasure of some 300 machines begins. And the paperwork starts churning out waste transfer notes and asset lists. We then have to think about PAT testing everything and finding a buyer. Do we have to clean, repair, reload software?

Doing all that for free is simply not possible. We agreed with our client on a collection fee, data charges and a revenue share going forwards. He is in no hurry for the money. They are a world class multi-national business and a couple of grand would not cover the mineral water bill in their conference rooms around the globe, but at the end of the year his budget still has to hang together and hit the right figure, and that is when the bottom line matters.

On a smaller scale, I can see how this stuff gets difficult. Let’s run the scenario again making it 20 laptops, not £200. That is £300 resale value, of which the company share is £150 at best. Not really a lot to play with. We still have to send the van out and let’s say same distance but half the time. As long as I could match the collection up with others and fill the van that way and it was not way off the beaten track, collection and data erasure would be between £150 and £200.

But you do have to remember that this really is waste. Your people have beaten this kit into the ground and got every penny of life out of it. If you refreshed more regularly decent laptops can get £100-200 each depending on the specification and age. But you don't, do you?

Hence, smaller disposals seem to cost more. And of course most businesses are smaller. They do not do this stuff all the time, and therefore they do not necessarily have a plan. They are often not realistic about what it is all going to cost. They may not appreciate the risks they have to manage.

And yet no business can afford to take this stuff less than seriously. Those three overriding principles remain the same, data security, sustainability and value for money. The smaller you are maybe the third seems hardest to achieve, but we will work with you to help.

And big or small, the fine is still £500k.

One Direction for Data Security

Data security is an ever expanding nightmare. You are liable. Yes you. For everything. Or rather you are if you are the nominated data controller for your company. Soon there will also be a defined board responsibility too. We are months away from someone getting thrown in the clink because Mavis in accounts thought she was checking her Twitter account and ended up posting the database to North Korea by mistake.

Do you remember the good, old fashioned western? The sort of film where the sheriff, in an effort to clean up his town, made all the cowboys leave their guns at the jailhouse. Our offices will be like that one day...mobile phones left in lockers until the end of the day...rather like school. Because a Smartphone is a data breach waiting to happen, and companies will only want their staff using company owned (and regulated/controlled) kit on the wifi.

Which will drive their employees mad, and cause them to break the rules and sneak their beloved phones in anyway. It is all a recipe for disaster, not to mention dissatisfaction and angst.

However, we need to remember why this is all such a concern, and then apply it to all areas of the IT minefield, including asset disposal at end of life. It’s all about the data, and the harm that can be done if that data falls into the wrong hands. It could be data about you and me as consumers, as patients or pupils. It could be bank details, and therefore access to our worldly goods, or it could be medical records, criminal records, confidential information we would not like anyone else to see. In law, this data is enshrined and protected, so the person who loses it, or negligently lets it get lost, is liable to do twenty years in Pentonville.

But oh how blasé we all are about data! Come on, admit it, you know it’s true. I am a salesman and have been for over thirty years. I have been adding information to database’s throughout that time I suppose, starting with a pen and a rolodex and ending up with salesforce.com and all manner of other CRM systems. So I know what it is like, and although I no doubt tried to enter the right information at the time, we all know there is a lot of garbage in there. And of course if it isn’t all used on a regular basis, even good information turns to garbage. B2B data decays at the rate of about 30% a year, as companies close, move or merge, and people leave. And yet, lose that pile of old misspelt names and bounce back email addresses and you will feel the long arm of the law on your shoulder in next to no time.

I suspect that the latest plans to make a director of any company or organisation directly responsible for data security will wake a few people up. I have been a director of a limited company, and signed all the forms for Companies House, and I remember reading through the responsibilities. It was hard not to take them seriously. I sincerely hope that will be the case.

Because the current situation really is a bit of a worry. The penalties are there and the regulations are there but there is a lack of understanding and appreciation not only of the risks but of the solutions. We start with subject knowledge at ground zero, so there really is only one direction to go and that is up!

We need to educate. I know it is a fairly dry subject but just think about it. Do you search your staff when they leave the building for a USB memory stick? Do you make sure every printer has it’s memory dealt with when you get rid of it? What do you do with the company mobile phone handsets when you upgrade? It’s not just all about computers and hard drives anymore.

We are going to have to change. Data has got bigger but you can now steal it on a stick which you can hide in the smallest of orifice’s. You can attach a file to an email and post it out. Or you can let that nice man take those 5 broken desk tops and find your database on eBay the next day.