11/26/2012 -

The Nassau County Police Department won’t say if it has any new information on how law enforcement sensitive documents that had previously been shredded ended up as confetti during the Macy’s Thanksgiving Day Parade, but it is saying it will review its document destruction policies.

“We aren’t releasing any information. We just have the statement we issued already,” Officer James Imperiale of Nassau’s public information office said by phone Monday before sending a copy of the statement.

“The Nassau County Police Department is very concerned about this situation,” it reads. “We will be conducting an investigation into this matter as well as reviewing our procedures for the disposing of sensitive documents.”

The shredded papers were picked up by a college freshman and his friends after he noticed a Social Security Number printed on a strip of paper that landed on one of their jackets.

The documents were comprised of incident reports and arrest records and more sensitive information likenames of undercover detectives and banking information for police employees, WPIX-TV reported Friday.

CEO of the National Association for Information Destruction (NAID) Bob Johnson says the information breach is a good example of whyorganizations should outsource shredding operations, suggesting Nassau County Police did its document destruction in-house.

“If those documents had gone to a NAID member, they would have never ended up on the street like that,” Johnson said. “There is no way a qualified service provider would have ever allowed that to happen,” he said.

The business of outsourcing document destruction has exploded over the last decade, but some organizations are still reluctant because of perceived security risks, Johnson says.

Documents outsourced for destruction “never see the light of day” after they’re picked up,” he said. They’re pulverized in massive volumes, comingled with the papers of hundreds of other businesses, and sent to a paper mill for destruction and recycling.

Outsourcing to companies isn't perfect though. In May, a hospital was fined $750,000 for forgetting to tell its destruction company that two boxes of unencrypted computer tapes contained protected health information. The companylost the boxes in transit to destruction and they were never recovered.

The Nassau County Police Department did not respond to requests for information on its current document destruction policies or if it outsourced the task.

Many want to keep destruction activities in-house, but most businesses don’t have the tools to do it securely. The docs end up getting shredded – then placed in a nearby trash can or recycling bin.

And then thrown out the window.

At least, that’s whathappened at the parade for the Yankees after they won the World Series in 2009.

Excited city workers used shredded paystubs, trust fund balance sheets, and financial information as confetti,throwing it  from skyscrapers as the Yankees made their way up Broadway.

photo byErwin Bernal/flickr