State audit finds college generally sanitized surplus IT devices but recommends periodic verification testing

At a public hearing of the Joint Legislative Audit and Review Committee on Aug. 9, 2025, the Washington State Auditor’s Office reported that a performance audit found a college generally removed or properly sanitized confidential data from surplus IT equipment but recommended the institution document periodic verification testing for devices sold at auction.

The audit, conducted under Initiative 900 and presented by Olha Bilobron, Senior Performance Auditor for the Washington State Auditor’s Office, tested 32 devices and found that in all sampled cases hard drives had either been removed or properly sanitized. "That is why we recommend that the College develops and documents a procedure to periodically test its sanitized equipment sold through auction," Bilobron said, adding auditors connected the college with Washington Technology Solutions to help set an appropriate testing volume and frequency.

State law requires public colleges to destroy or arrange for destruction of confidential data before sending IT equipment to surplus. The audit evaluated a higher-education institution that does not use the Department of Enterprise Services surplus program and therefore follows its own procedures. The report does not name the college to reduce data-security risk.

Auditors said the college demonstrated several strengths: it resells only devices that can be sanitized, treats every device as if it contains confidential information, uses professional sanitization systems, and destroyed devices it could not sanitize. The audit also noted that Washington Technology Solutions’ Media Sanitization and Disposal Standard requires agencies to develop sanitization procedures and test sanitized media; the standard specifically requires testing at least 10 percent of sanitized media. Bilobron cited National Institute of Standards and Technology guidance saying agencies should either fully verify sanitization or verify a representative sample.

To test the college’s process, auditors examined 32 devices (including desktops, laptops, a variety of hard drives, iMacs and iPads) and ran two checks on each device to confirm drives were removed or properly sanitized; all tested devices met those checks. The audit found, however, that the college did not verify drives sold at auction because staff reported high confidence in their sanitization protocol. The office recommended the college develop and document a periodic testing procedure for sanitized equipment sold at auction and consult Washington Technology Solutions on volume and frequency.

Public testimony at the hearing included statements from students urging statewide standards and attention to environmental impacts. Rachel Chu, a high school student from Kirkland, said, "I submitted a great amount of sensitive information to college ... I was encouraged to read the industry auditor's report that the audited college information demonstrated a thorough and strong data sanitization practices," and urged development of uniform statewide standards. Paige Citron, a high school senior from Kirkland, testified, "The thought of that information being left on an old computer or tossed into the trash without being properly destroyed honestly makes me nervous." Citron also urged support for stronger rules to protect student information and for consideration of reuse and environmental impacts.

Bilobron told committee members the college reported it had started working on the recommendation. The auditor's office previously has completed two audits evaluating how state agencies remove confidential data from IT devices before surplus. Committee members closed the hearing and invited written testimony to JLARC’s website.

The audit presentation and public testimony are part of JLARC’s I-900 subcommittee hearing record for Aug. 9, 2025; the committee did not take formal action during the session.