State audit finds college generally sanitizes surplus IT equipment but recommends periodic testing

Olympia — At a Joint Legislative Audit and Review Committee (JLARC) I-900 subcommittee public hearing on Aug. 9, 2025, the Washington State Auditor's Office presented a performance audit finding that an unnamed Washington college generally removed or sanitized confidential data from surplus information-technology equipment, and recommended the college develop a documented procedure to periodically test sanitized equipment sold through auction.

The audit presentation, delivered by Olha Bilobron, senior performance auditor at the Washington State Auditor's Office, said the office examined 32 devices — including desktop and laptop computers, hard disks, iMacs and iPads — and conducted two separate verification tests. "We found that in all cases, hard drives had either been removed from the device or they had been properly sanitized," Bilobron told the subcommittee.

The audit evaluated the college's practices against the Media Sanitization and Disposal Standard developed by Washington Technology Solutions (WTS). That standard requires agencies to develop media sanitization and disposal procedures, select appropriate sanitization methods and test at least 10% of sanitized media. Washington state law also requires agencies and public institutions to destroy or arrange for destruction of confidential data before sending IT equipment to surplus, the auditor's office said.

Bilobron said the college treats every device as if it contains confidential information, resells only equipment that can be sanitized and destroys the rest. The audit found the college uses professional sanitization systems and verifies some sanitization results through testing, but it does not verify equipment sold at auction because staff are "very confident in their sanitization protocol." The auditor recommended the college document a process to periodically test sanitized equipment sold through auction and consult with Washington Technology Solutions to determine appropriate sample sizes and testing frequency.

Bilobron said the college is not identified in the public report to reduce risk to the institution's data security and that the college did not provide comments at the hearing. She told the committee the college had already begun working to address the recommendation and that the auditor's office connected the college with Washington Technology Solutions to develop testing procedures.

Representative Gerry Pollet, assistant secretary of JLARC, chaired the hearing and thanked the auditor's office for the audit work. He noted eight people had registered to give public testimony and that the hearing was being recorded for archival viewing on TVW.

Two high-school students who said they are from Kirkland testified during the public comment period about the importance of protecting student data and urged consideration of statewide standards and environmental impacts. Rachel Chu, a high schooler in Kirkland, said she submitted "a great amount of sensitive information" during the college application process and welcomed the audit's finding that the audited college demonstrated "thorough and strong data sanitization practices." Chu urged the subcommittee to consider uniform statewide standards and methods that address both data protection and environmental concerns.

Paige Citron, a high school senior from Kirkland, said: "The thought of that information being left on an old computer or tossed into the trash without being properly destroyed honestly makes me nervous." Citron told the committee she hopes lawmakers will "support stronger rules to keep students' information safe." In her remarks Citron echoed concerns in the audit and asked the subcommittee to weigh reuse and recycling options that preserve data security while reducing electronic waste.

The auditor noted prior work by the office evaluating how state agencies remove confidential data from IT devices sold through the Department of Enterprise Services (DES) Surplus Program and said the higher-education setting in this audit does not participate in the DES surplus program and instead uses its own procedures.

No agency representatives were present to respond at the hearing. Representative Pollet told attendees how to submit written testimony and materials to JLARC (JLARCleg.wa.gov) or by U.S. mail to PO Box 40910, Olympia, WA 98504. The hearing record and video are available on TVW's archive.

No formal committee votes or actions were recorded during the hearing; the presentation concluded with the auditor taking members' questions and public testimony. The auditor's written report and the college's follow-up on the recommendation will be matters the subcommittee may examine in future oversight work.