By TARA SIEGEL BERNARD
It’s tax time, which means millions of Americans are probably in the midst
of collecting the many documents needed to prepare their returns.
When I was going through this exercise last week, I had to download a 1099
form from my bank’s Web site, which naturally included all sorts of sensitive
information. So how do you virtually shred these documents after you are done with them? Or how would you securely save a
sensitive document like a completed tax return?
According to several computer security experts, there are several approaches
If you want to delete the files:
Mac users have access to a nifty built-in feature that acts as a virtual
shredder. It’s called “secure empty trash,” which overwrites the data
you want to delete, making it essentially impossible to recover, said Rich
Mogull, an analyst and chief executive officer of Securosis, an independent
security research and advisory firm. (Go into the Finder menu on the top of the
screen, and select “Secure Empty Trash.”) He said there was still
some risk if the file had been saved on Time Machine – the Mac’s backup
system – but he said the odds were low that an attacker would look there.
“To be honest, the odds of being exploited on a Mac are really low
these days, especially if you’ve upgraded to Lion,” he added, referring to
one of the Mac’s newer operating systems.
Windows-based computers do not have an equivalent function, but Mr. Mogull
said that “emptying the recycle bin does a reasonable job unless the
attacker is motivated to hunt around.”
But that does not delete the data; it just allows it to be overwritten over
time, which can take years. So if you want to take things a step further and
overwrite your files, some experts recommended considering file shredding
software. (I found some reviews on CNET.)
“It looks at the things you have deleted and it writes over them,”
said Nikki Junker, a victim adviser at the Identity Theft Resource Center.
“Even if they brought in the forensics team, it would be difficult to pull
up that information.”
Many people may simply delete their files and then do a final scrubbing
before getting rid of their computers. “When you dispose of the computer
or donate it, at that point, you want to use specialized software to wipe your
hard drive clean,” said Paul Stephens, director of policy and advocacy at
the Privacy Rights Clearinghouse in San Diego, though he cautioned against
waiting to delete your files securely if you are working on a laptop that you
travel with. He said a number of products, known as disk wiping utilities or
disk erasers, would do the job.
If you want to save the files:
One option is to save the files using an external hard drive or a smaller
USB thumb drive. You then have to decide how you want to store the drive
securely. “Do you want to put a password on it?” Ms. Junker asked.
“Do you put it in the safety deposit box or the safe in your house?”
You can also store your documents “in the cloud” – think Mozy or Carbonite – but you have to be
comfortable with the company’s security. “You want to go to a reputable
company that really has something to lose if they are breached,” she said.
It’s also possible that if someone breaks into your computer, he or she may
be able to recover those files, Mr. Mogull said, but the odds are really low.
Nevertheless, Apple and Microsoft have encryption services built into their operating systems. Mac users can
create a password-protected “encrypted disk image” – think of it as a secure storage container for a group of
files (for instance, the files created by tax software). Alternatively, you can
create a password-protected PDF file, which encrypts a single document. (When
you click the “Save as PDF” button, there is a “Security
Options” button that lets you set a password requirement for various
functions, including opening and printing the document.)
More general tips:
Before doing taxes online, update all of your software to the latest
version, since it often will include security patches. And if you use antivirus
software, update that as well. And be sure your computer is password protected.
Finally, do not leave financial documents, or credit card or Social Security
numbers, in your e-mail. “If someone compromises your account, they may
look in there,” Mr. Mogull said. “You should delete those sorts of
messages, then go into your deleted items folder and delete them from
How do you save and delete tax documents with sensitive information? Please
drop your thoughts in the comment section below.