One or two Social Security numbers were found on six of the seven departments' surplus computers — not a large number, but still a clear violation of the state's own internal information security rules. And sensitive information was found on 74 percent of the computers checked.

Credit card numbers, e-mails, private pictures, motor vehicle safety inspections, Human Services child and family case information, criminal court histories, and even individual medical data were found on the surplus hard drives, Johnson said.

Computers examined that had sensitive information on them came from the state's Department of Administrative Services, Department of Human Services, Department of Natural Resources, Department of Health, Department of Workforce Services, the Labor Commission, and the Utah State Tax Commission.

In some cases, the hard drives had not been "scrubbed" at all. One computer was reported as "dead," meaning it could not boot up, so department officials just sent it off to Surplus Property. But Johnson's auditors took the hard drive out, put it in another computer and it started up fine, with all the information on it.

In most instances some attempt had been made to scrub the hard drive, but it was somehow botched, and some information was retrieved "by simply buying recovery software off the shelf at any computer store and running it," said Johnson.

As the audit was proceeding, and information was being found on the surplus computers, Johnson ordered that all surplus computer sales "be frozen for several weeks" until all of the surplus computers could be properly scrubbed and checked.

"We're sure that no computers got out" last spring for sale that had information on them. "We totally rewrote the procedures (for scrubbing hard drives). And I'm fairly confident that (state surplus) computers are clean today," he said.

---

E-mail: bbjr@desnews.com