Utility May Face Investigation for Selling Unscrubbed Drives

State and federal regulators have not yet determined whether Idaho Power Co. will face penalties after a salvage operator offered unscrubbed hard disk drives from the utility for sale on eBay Inc.'s auction Web site.

The utility had sold 230 disks to a salvage operator, which sold 84 of them on eBay. Most of the drives have been returned to Idaho Power. The incident was disclosed earlier this month.

The Federal Trade Commission would not confirm or deny whether the incident is under investigation.

"In theory, there are different statutes that might come into play, but whether it was a basis for action would depend on the underlying circumstances," said Alain Sheer, an attorney in the bureau of consumer protection at the FTC.

The Idaho Public Utilities Commission, which governs Idaho Power, will only investigate the incident if it has a direct financial impact on rate payers, a spokesman said.

If Idaho Power were to file a request for a rate increase that included costs related to the incident, "we'd probably deny those costs," he said. Otherwise, "the only way we would be involved is if a rate payer filed a complaint that he was harmed."

Failure to Respond

Meanwhile, Karl Hart, director of IT at the University of Cincinnati who bought unscrubbed Idaho Power drives over eBay, said he publicly disclosed the problem only after the utility failed to respond to his inquiries for a month.

Hart bought 10 drives, in two lots of five, from eBay for $40 per lot. "That batch came from Idaho Power completely full of data, not cleaned up at all," he said.

Data on the drives included diagrams of the electric supplier's power grid; confidential data stored by the legal department about lawsuits, contracts, property transactions and complaint letters; and employee data, including Social Security numbers, birth dates and payroll information, Hart said. "There were hundreds of thousands of files on these drives," he said.

Hart said he has been contacted by Blank Law & Technology PS in Seattle, a law firm hired by Idaho Power to investigate the situation.

The Boise, Idaho-based utility, which supplies electricity to customers in southern Idaho and eastern Oregon, said it hired Grant Korth of Nampa, Idaho, to recycle the drives.

Hart said that Idaho Power should have required its outsourcing firm to certify that the drives had been cleaned.

Copyright © 2006 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon