There is a huge hole in Britain's data protection regime. Russian and Chinese spies could simply buy end-of-life computers from the Prime Minister’s office, the Treasury or the Cabinet Office (which holds the security vetting records of government, military and intelligence staff) and lift sensitive data from the hard drives because they have not been wiped properly before they are trashed due to a glitch no one has noticed.

Currently, British institutions usually sell their old computers after they have reached the end of their useful life and use service companies to wipe their drives before they leave the building, Liverpool start-up Data Safe Solutions told IntelliNews. At the same time, when employees change, a work computer assigned to a different employee has to have its hard drive wiped first under GDPR rules. It is illegal to give that employee a computer if it still contains data belonging to the old user, even if the new one can’t read it.

The trouble is due to advances in technology, a gremlin has crept into the process of cleaning hard drives: service companies that do the job of wiping the memories issue a certificate confirming the memory has been erased, when it hasn’t. Sensitive data and even state secrets remain lurking on the hard drive as the methods used to erase disks miss portions of the memory and leave the data on the drive which can be extracted and partially restored by experts.

DSS says its patented method can wipe a drive completely in just a few seconds - and prove it. the firm is so sure of its method that it offers up to £10mn insurance to back its claim whereas the other firms doing a similar job can’t, as in effect their software is simply “guessing” which erasure method to use and they fall back on the brute force method of overwriting the disc when their methods fail – which is most of the time.

“Other software applies a preset method chosen for speed rather than for the drive, and when that fails it falls back to overwriting the parts of the memory it can see with ones and zeros,” Derek Johnston, co-founder of Data Safe told IntelliNews on the sidelines of Moldova Business Week in Chisinau.

You would have thought that if you know the name, make and type of a hard drive in a standard computer, the same method would work on all those models.

“It doesn’t work like that any more,” says Johnston. “You can have 60 identical models, but thanks to the quirks of software use, additional hardware use and other factors, each hard drive can be changed. It means there is no single way to wipe the disc that applies to all those models. You have to investigate the drive to see how it works before you can clean it.”

Old government laptops and servers can expose data to hostile intelligence services. If they are sold without a secure wipe, said Johnston, some data lurks on the hard drive and can be read with the right technology. A foreign agent does not need to hack a ministry. They need only, "go and find out who deals with the equipment at the end of its life, and go and buy it".

Data left on discarded drives can be pulled out in a lab by removing the memory chips, he said, and a company could even bid twice the going rate for a public body's old machines, say £40 a laptop instead of £20, to get hold of them.

The pitch lands as Europe braces for Russian hybrid attacks. European Commission President Ursula von der Leyen told the European Parliament in September that cyberattacks and sabotage were "ramping up every day", and German Chancellor Friedrich Merz said on October 1 that Europe was preparing for "severe" hybrid attacks. The company says it is targeting countries under pressure from Russia and China, and Moldova, on the front line of Russia's hybrid campaign against Europe, is part of that push.

Missing rooms

Most commercial data erasure overwrites a drive with zeros and ones in software, a method that cannot reach every part of a modern disk. Drives hold data in reserve sectors that are invisible to the operating system. The right erasure method depends on the make and model, as well as the quirks of that particular machine, the DSS founders said. Most technicians pick a method by hand, and when it fails the software falls back on a generic overwrite.

“It’s like going into a hotel that has a secret tenth floor to clean the rooms,” says Johnston. “If you don’t know about that then you go into the lobby and see there are nine floors on the elevator buttons and you clean them one by one. Our software is loaded onto the RAM and it investigates the chip’s architecture. We don’t use the lift. We get the hotel's blueprints and clean the whole thing at once.”

Data Safe Solutions' Smart Wipe Engine loads into a machine's memory over the network, reads the drive's own specifications and tells the drive's firmware to erase itself with the correct method. Loading takes about 30 seconds and the erase can take seconds, the founders said. In a test at one of the world's biggest recyclers, a 16-terabyte drive took one hour to wipe by overwriting and up to 16 hours in the worst case. As Data Safe’s software has worked out the exact architecture of the memory it typically takes three seconds to wipe the same drive clean, says Johnston. Overwriting also wears out a drive, while a firmware erase leaves it fit for resale.

"We charge only for the outcome," Littlewood said. Each wipe is backed by a warranty underwritten by £10mn (€11.7mn) of professional indemnity insurance, which can be extended to £50mn where a contract requires it. Rivals issue a certificate that a process has been run, but that is not a guarantee that the data itself is gone, the founders argue, but that certificate is what public bodies hand to their security officers.

Littlewood, the company's chief executive, sent 1,036 freedom of information requests in a personal capacity to UK public bodies, from government departments to the Bank of England and from this found that 241 of the public bodies that responded physically destroy their drives instead of wiping the drives which is the only way to be sure.

Around half of the others that responded rely on service certificates, which do not guarantee the drive is clean. DSS says it sent freedom of information requests to UK public bodies, from government departments to the Bank of England. Of 684 substantive responses, 437 held no outcome warranty and no device-specific evidence that data had been destroyed, according to its published research.

Funded by the founders

The business began as an IT asset disposal company that collected used equipment from government, schools and finance companies for free and resold it.

"As far as I'm concerned, all data is important," Littlewood said, recalling clients who handed over hard drives in a bag without a thought for what was on them. The company went into operation in 2019 when Littlewood was joined by chief technology officer Rafal Gorczynski. It holds a published UK patent for the method.

Data Safe Solutions has about 10 staff and another 10-15 working through resellers in other countries. Its main market is the UK, where it works with NHS trusts, and most of its business comes through IT asset disposal firms that use its software for their own clients, giving it hundreds of thousands of end users. Turnover is only about £110,000-120,000 a year, and the founders say they have put about £2.5mn (€2.9mn) of their own money into development over seven years. A new international sales team is joining as the company expands into Europe and the US.

The founders also plan to turn the product into a security tool that can wipe a lost or stolen laptop remotely the moment it is opened and cater to about 2,000 corporate clients in total.