Channel slams MP for promoting 'free' IT disposal services
No such thing as a free lunch, MP Aidan Burley warned by established IT recycling players
An MP has come under fire from the channel for promoting "free" IT asset disposal (ITAD) services such as those offered by a firm in his local constituency.
Comments made last week by Cannock Chase MP Aidan Burley in a debate about the cost of IT recycling in the public sector have enraged many of the industry's established outfits, including Sims Recycling Services, as well as industry body ADISA.
Burley called the debate, which was held in Westminster Hall on 5 March, after attending the opening of a new IT recycling facility in Cannock by local firm PRM Green Technology.
He claimed PRM had saved clients in the education sector £5m - the cost of employing 237 teachers - by providing the collection, secure recycling and data wiping of their old IT kit free of charge. This contrasts with the norm in the IT recycling industry, where end users are charged for the disposal of their end-of-life equipment, he added.
Burley then pushed for the government to make more public bodies aware that there are companies such as PRM that will absorb the costs of recycling all their old IT equipment.
He also accused those that do charge of "skimming extra cream off the top".
"Perhaps we as a society need to rethink our negative attitudes to people who offer something for nothing," he said, adding that PRM provides all the secure services its competitors do but without charging.
This includes having staff accredited to BS7858 standards, protecting its premises with several layers of physical security, government-approved software for destroying data assets and satellite-tracked vehicles, to name but a few, he said.
"How does PRM manage to offer such a service?," Burley asked. "It does so because it extracts every little bit of residual value from every kilogram of every item that it collects and processes, and because it has chosen to model its business in this way it ensures that it extracts maximum value from IT equipment, therefore guaranteeing minimum waste and landfill.....The difference is that some companies, such as PRM, have the social conscience not to skim extra cream off the top."
However, his comments have been seized upon by some of the UK ITAD market's longest-standing operators, including Sims Lifecycle Services director Jon Godfrey.
In an open letter (which can be viewed in full below), Godfrey (pictured) slammed Burley's "shameful promotion" of one firm and said focusing on price will result in uncontrolled risk, although he emphasised it was not a personal attack on PRM.
"Your suggestion of a 'free for all' will result in a data breach," he wrote.
"What is shameful is your complete lack of understanding of the technology recycling industry and the government standards which protect restricted government data and the sale of assets."
"I support new recycling businesses. In fact, in my career, I have established two; both successful and I have created over 500 jobs as a consequence and therefore I understand the importance of supporting small growing recycling businesses. I also have nothing against PRM and wish them all the very best. You have, however, been 'sold to'."
In June 2012, Brighton and Sussex University Hospitals NHS Trust was fined a record £325,000 by the Information Commissioner's Office after hard drives containing patient data were flogged on eBay by a contractor it employed to destroy them.
Godfrey said more such data breaches are inevitable if the government lowers its standards in relation to how it disposes of old IT kit.
PRM directors Paul Mullet and Tim Hawkins responded by branding Godfrey's open letter a "puzzling attack" on their company. They also said the letter contained "glaring mistruths", which they have addressed in a nine-point response, which can be read in full here.
Sims is one of 27 UK firms certified by ADISA, an industry body that was set up in 2010 to monitor the sector. Its members are required to go through rigorous inspections and spot checks.
There are about 650 firms working in the UK ITAD market, many of which have merely invested about £1,000 in a basic environmental licence and do not operate secure services, ADISA chief operating officer Steve Melling told CRN.
Melling also emailed Burley to vent his frustration, arguing that by recommending a business model that "cannot be guaranteed to cover costs", the MP is playing "Russian roulette" with his 75,000 constituents' data. When firms cannot cover costs, they will either cut corners on the service or "look for more nefarious outlets for their equipment" - increasing the danger of it ending up in landfill in Africa, he said.
"The only service which is sustainable is a charged-for service and then a secondary residual agreement where the issuing entity receives their share of the value of the equipment they released," said Melling.
Like Godfrey, Melling laid the blame at Burley's door rather than with PRM, which he conceded may be an "excellent business".
"I have seen many 'free' companies go to the wall in the past few years and many more operating hand to mouth," Melling said. "This is not a sustainable business model and a more sensible position would be to promote PRM as a charge-for service which returns money to government.
"When I read your piece I laughed at first because it is the rhetoric this industry fights against every day. However, I am now annoyed because as a serving MP you should not be so easily led as there are many who still respect and react to recommendations made by those who hold this position and as such, your misguided piece cannot be left to go without comment."
The University of Glamorgan conducts an annual disk study that sees it purchase several hundred hard drives from the broker market.
Professor Andrew Blyth, head of the internet security group at the University of Glamorgan, said roughly half of the drives it purchases and subsequently examines are found to contain sensitive information, some extreme examples of which have been covered in the national press.
He agreed that it would be hard for any IT asset disposal firm to cover their costs if they are securely disposing of hard disk drives, given their relatively low residual value..
"The MP has shown a lack of understanding of the maturity of the sector and the financials and quality costs involved," he said.
Jan Smith, chief executive of EOL IT Services - an ADISA member that had been operating since 1996 - claimed the press we-pay-you outfits are currently enjoying is a setback to the progress the industry has made in recent years.
"This business is not about what I can get for my old kit," Smith said. "IT directors today aware their jobs are on the line if they don't deal with the right organisations. If anyone is suggesting this business is all about money, they are off their trollies.
"It has taken me 17 years and cost me a huge amount of money to get to where I've got as I want to be taken seriously.
Mark Saunders, operations manager at ADISA member 99Delta, added: "No service is free of charge. As we all know, there is no such thing as a free lunch, and the end user should not have the wool pulled over their eyes with the inference there is."
Gerry Hackett, managing director of Computacenter-owned ITAD RDC - which is not an ADISA member but is one of the market's largest and longest-standing operators - said public clients should choose suppliers based on both price and data protection concerns.
"It cannot be summed up as either ‘cashback is bad' or ‘it's all about data wiping'," Hackett said. "It's about both optimising the amount you might get back while ensuring you are not taking a gamble on data."
Aidan Burley could not be reached for comment.
An Open Letter to Aidan Burley MP
Dear Mr Burley,
I read with despair your shameful promotion of one specific company "PRM Green Technologies Ltd" (PRM) who are located in your constituency. What is shameful is your complete lack of understanding of the technology recycling industry and the government standards which protect restricted government data and the sale of assets.
I support new recycling businesses. In fact, in my career, I have established two; both successful and I have created over 500 jobs as a consequence and therefore I understand the importance of supporting small growing recycling businesses. I also have nothing against PRM and wish them all the very best. You have, however, been "sold to".
The issues of cost are complicated - I know - I run 10 technology recycling businesses across Europe. PRM's services are not "free". They keep the value of the recycled material and they sell the parts and whole units which they collect. There are two transactions in this business model, one masking the other. Firstly there is the provision of a service - logistics, processing and tracking and of course secure data destruction and safe disposal of hazardous waste. Secondly there is the purchase (in this case free to PRM) of the asset value in material and working parts or units. Most IT recycling companies return money for the value of material and assets. At this link you will see the Office for Government Commerce - Guidance for disposal of surplus assets. "Free" could be the most expensive option.
To undertake this work for government there are standards which companies must meet and then be accredited to. PRM do not have accreditation to such standards and they have not had to invest to achieve them. For example; they are not accredited to handle restricted data, they are not ISO (9000,14000,18000,27000) accredited, they are not ADISA accredited, they do not make reference to criminal record checking - really I could go on and on and on. This means they are not paying for the controls such standards require. This means they are taking risks. I am sure with time they will grow and make these investments - I hope so.
http://www.cesg.gov.uk is a good place to start. PRM say they use their standard for a data-wiping tool but are not accredited. Crushing disks in a press is not compliant to government standards. They have no MOD accreditation to even handle protectively marked data - restricted, confidential, secret or top secret. Their web site does not even make reference to being Registered of Data Controllers - Information Commissioner's Office. Companies who are accredited to handle restricted data must maintain a "List X" status but are not allowed to publicise this as this in itself would be a risk.
On the recycling side they are a broker and trader of waste. This means they can buy and sell it but they are not licensed to process it. Some reading at this link for you: http://www.environment-agency.gov.uk/business/topics/waste/141518.aspx.
They do not appear on the register of authorised treatment facilities (AATF) as yet and have only just registered. They claim to use seven collection warehouses which should also be registered for waste transfer. They don't show their Waste Carrier's Licence either.
A so-called "free" service is also misreporting and potentially avoiding VAT. Where a service is provided, VAT must be changed and in the case of a barter (swap of asset or service) a VAT-only invoice must be created.
Lastly, there are detailed, legally binding tender processes which government MUST go through when awarding contracts. There are between 400 and 500 companies in the UK employing many thousands of people in this market. Some are good and some are bad. It is the job of your civil servants to make objective selection decisions against agreed standards.
Your sales pitch ignores all of the above (and an awful lot more) with a misguided wish to save money which WILL result in uncontrolled risk. I have witnessed data from NHS hospitals being traded in Nigeria due to already inadequate data security controls. Your suggestion of a "free for all" will result in a data breach. The reason is as follows; If all the services are compliant and to the required standards, the only option is to recover operating costs from the value of material. As this value drops (which it always has done - computers are getting cheaper) at some point the operating costs will equal the value. The company will either fail (as many already have) or reduce the quality of the service.
I believe the only way PRM can provide the service "free" is that they don't have the costs associated with the required standards. Government could lower the standards. If they do, we will see more data breaches and environmental breaches. We will see more stories such as "NHS Trust fined £325,000 following data breach affecting thousands of patients and staff".
For those of us who live and breathe this issue it is frustrating and disappointing to read of your one-company promotion. I have no issue in competing fairly with PRM and I hope to do so in the future.
Therefore, the only "free" is PRM are given valuable public assets for free. "Free" is not good for government. Free security and recycling services are a significant danger to the security of the country. "Free" could also be the most expensive decision of your career. You might not be able to afford "free".
Yours sincerely
Jon Godfrey
Director - Sims Lifecycle Services - Europe