Businesses and private users are failing properly to delete sensitive information stored on their computers before the machines are sold on. This has made the burgeoning trade in secondhand computer parts a potential treasure trove for blackmailers, paedophiles and fraudsters.

A research team from Glamorgan University analysed 111 supposedly clean hard drives, bought for less than £1,000, and found that more than half still contained personal information. This included national insurance numbers, evidence of a married woman’s affair and detailed biographical information about children.

Ninety-seven of the hard drives were bought on eBay and four at car boot sales. As a control experiment, ten drives were also sourced from LCS Remploy, a company specialising in the destruction of data. All proved to be clean.

The original owners of the other 101 drives included universities, multinational companies and a Church of England primary school in East Yorkshire, all of which were breaking the Data Protection Act by failing to dispose of the information effectively.

Andrew Blyth, the head of the research team, said that they had found more than enough compromising information to blackmail several individuals even though they had looked only at a small proportion of the recovered data.

Hard drives used by staff members at Hull University, Southampton University and Harrow College included details of special interest sex sites visited by users and a document template for one of the university’s degrees.

Information retrieved from a drive owned by a charity included e-mails from a married female employee in which she discussed intimate details of her marriage and an apparent affair.

Dr Blyth picked out the information retrieved from a primary school headteacher’s computer in East Yorkshire as particularly disturbing. It included school reports, an extensive list of pupils, personal letters to parents and psychological information about particular children.

“I would be horrified if that information was about my child,” Dr Blyth said. “The personal details that were on there could easily have been used by a paedophile.

“Everything that we did could have been done by an individual with a little bit of know-how and some free software obtained from the web.”

Under the Data Protection Act companies have a duty to store personal information securely and delete it when it is no longer required. However, a hard drive from the Swedish insurance giant Skandia, which has invested heavily in data destruction, still contained private information. A spokeswoman welcomed the investigation but described the findings as “absolutely horrifying”.

Monsanto, the US firm involved in the production of genetically modified plants, confirmed that the company would begin an investigation after details of its crop research appeared on one hard drive.

National insurance numbers for employees of Scottish & Newcastle’s pubs division, since sold to the Spirit Company for £2.5 billion, were found on another drive.

The National High-Tech Crime Unit was concerned but not surprised by the Glamorgan team’s findings. “This research demonstrates just how easy it is to access information which is not adequately protected,” Tony Neate, its industry liaison manager, said.

“Encryption and other security measures are vital to ensure that security is not compromised — something as simple as a hard drive password can deter the opportunist. Companies have a duty of care to their customers and employees.But unless you physically destroy it there will always be a risk that a computer will be read by people who buy it or pick it up from a skip.

“From a consumer’s point of view the only way truly to clean a hard drive is to put an axe through it.”

Burglar is caught on web camera

A BURGLAR was caught after being photographed on the web camera of the computer he was stealing.

Benjamin Park, 19, broke into a house in Cambridge, stealing computer equipment, a mobile phone, suitcase and briefcase. But Duncan Grisby, the homeowner, had installed a motion-activated security camera on his computer.

Mr Grisby, 30, a software developer and victim of a previous burglary, had also activated a back-up system which transferred the captured images to his private website when the computer was stolen. Police, who tracked down Park to flats in Cambridge, said it was a pleasure to see the expression on his face when he was shown the pictures. He was sentenced to 11 months in jail.

Explore UK News

• Crime News

• Education News

• Health News

• Science News

• Scotland News

Times Recommends

• Anne Darwin's performance of a lifetime
• Renaissance for canals as new boaters come aboard
• Case study: forced to marry a cousin at 17