When Data Security Ends at the Trash Bin: What the USAID Device Disposal Situation Teaches Us

Posted by Erick On April 27, 2025

The entrance to the now shuttered USAID office can be seen as black plastic covers a USAID sign at the Ronald Reagan Building and International Trade Center in Washington, DC on April 1, 2025. Photo: Getty Images

In the IT and cybersecurity world, how you manage assets at the end of their lifecycle is just as important as how you secure them during active use.

A recent report revealed that former USAID workers, after the closure of many programs, were told to keep their government-issued laptops, tablets, and phones. The devices would be remotely wiped and then marked as “disposed,” with the responsibility for physical disposal left to former employees.

From an IT security perspective, this situation highlights critical lessons:

Remote wiping is a valuable tool to help protect data quickly. However, without physical custody and verification, there’s no absolute guarantee the data is unrecoverable. Remote wipes can fail or be circumvented.

Chain of custody matters. Organizations, especially those handling sensitive data, should maintain strict control over devices until they are securely wiped, certified, and either refurbished, reassigned, or destroyed.

E-waste isn’t just an environmental issue; it’s a security one. Improperly discarded electronics can be salvaged, repaired, or exploited. In a security-minded IT program, physical destruction or certified recycling would be the standard.

IT governance demands stewardship. Devices, even when decommissioned, should be handled with clear policies that ensure security, sustainability, and compliance with local disposal laws.

In the end, cybersecurity isn’t just about protecting data while it’s in use — it’s about protecting it until the very end of its life.

Situations like this are reminders that good cybersecurity is deeply connected to good operations, governance, and trust. When we manage assets well — from acquisition to disposal — we don’t just secure systems; we safeguard our organizations’ integrity.