Tech Features

Tricky legacies: Deleting web not easy

By Verena Wolff Sep 9, 2007, 3:13 GMT

Bonn - Paper documents are easy to dispose of. Shred them, put them in the recycling, and it's done.

Content on the internet, on the other hand, isn't so easy to remove. Once something has been placed online, it's often available to third parties for years thereafter. Brash forum entries, revealing photos from parties past or even postings that vent some spleen about your boss can be recalled by inquisitive souls at a later data. In many cases Web 2.0 participants realise only once it's too late that their postings cannot be removed from the web without a great deal of effort.

There are special tools to remove data from a hard drive, says Guenther Ennen, Director of IT security consulting from the German Federal Agency for Security in Information Technology (BSI) in Bonn.

It's more difficult to remove postings from the internet. Anyone who provides his or her data on the web or who has made a name for themselves through postings in forums has to presume that their data is out there to stay.

'The search engines drag the data into cache memory,' explains Daniel Bachfeld, editor at Hanover-based c't magazine. This means that data that seemed to be gone can in fact reappear much later.

'That's because the caches are normally overwritten on a continuous basis and then updated at regular intervals,' Bachfeld says. If the entries are deleted, then the system attempts to access data that no longer exists. 'The last entry is then visible - and remains there until the cache is overwritten and hence deleted.' That can last several months, Bachfeld notes.

Online portal operators emphasise that data is always deleted when a user deleted his or her profile. 'All information except for payment information is then deleted from our database,' says Daniela Hinrichs, a spokeswoman for the online singles web site Xing in Hamburg by way of example. By law, however, payment information must be kept longer.

'Everything else is no longer visible to the user, however,' says Hinrichs. Forum entries are also deleted when a user deletes his or her account, the company claims.

Yet anyone who has been active on the net often leaves behind traces. This is not just an intrusion of privacy, but can also aid data thieves.

'We continuously advise that people be careful with their personal data on the internet,' says Jochen Schneider, a lawyer from Munich. Yet most users don't hesitate to provide their name, address and birthday when signing up for an account.

This information is often enough for data thieves to open up various new user accounts -such as a mail address or an account with eBay. And then those thieves can turn those accounts to their own purposes: buying or selling items, making contacts with others, or slandering their targets of choice. While these are not necessarily trifling offences, lawbreakers often go unpunished. And the crime is only noticed if users are personally affected by the abuse. Online networks and auction houses have implemented improved codes for account activation and have increased cooperation with civil authorities in an effort to stem data theft.

While clearing data off the net relies both on thoroughness and a bit of luck, the deletion of data from one's own hardware is a more certain matter. 'The best thing is to demagnetise them with a strong magnet,' says Bachfeld, the editor. There are also standard deletion tools available on the Internet for those who see magnets as overdone. 'Just formatting the full hard drives doesn't do much,' says Guenther Ennen from the BSI. It's akin to just ripping out the table of contents from a book. 'All formatting does is make previously used areas available for new overwriting.'

It's important that the file or the folder be physically removed by overwriting it. Only then is it actually deleted and unrecoverable. Otherwise it is easy pickings for a hacker to reconstruct the file using appropriate software tools.

This is particularly important for anyone who wants to sell their PC or laptop. For government organizations there are even specifications that hard drives must be overwritten three times to truly destroy all data. Anyone not looking to sell their old computer can take a more hands-on approach: a hammer and brute force. Ennen says: 'The hard drive and storage media like CDs should all be physically destroyed.'