Getting rid of a large quantity of paper

The worst thing you can do is tearing them apart. It's time consuming and attacker just needs extra time and patience to put pieces together.

The same rule applies for shredding - if after shredding are left too large pieces, again, attacker just needs time and patience.

There are several shredding techniques (from wikipedia)

• Strip-cut shredders, the least secure, use rotating knives to cut narrow strips as long as the original sheet of paper. Such strips can be reassembled by a determined and patient investigator or adversary, as the product (the destroyed information) of this type of shredder is the least randomized. It also creates the highest volume of waste inasmuch as the chad has the largest surface area and is not compressed.
• Cross-cut or confetti-cut shredders use two contra-rotating drums to cut rectangular, parallelogram, or diamond-shaped (or lozenge) shreds.
• Particle-cut shredders create tiny square or circular pieces.
• Cardboard shredders are designed specifically to shred corrugated material into either strips or a mesh pallet.
• Disintegrators and granulators repeatedly cut the paper at random until the particles are small enough to pass through a mesh.
• Hammermills pound the paper through a screen.
• Pierce and Tear Rotating blades pierce the paper and then tear it apart.
• Grinders A rotating shaft with cutting blades grinds the paper until it is small enough to fall through a screen.

Also, there are several standards for shredding (from wikipedia)

• Level 1 = 12 mm strips OR 11 x 40mm particles
• Level 2 = 6 mm strips OR 8 x 40mm particles
• Level 3 = 2 mm strips OR 4 x 30mm particles (Confidential)
• Level 4 = 2 x 15 mm particles (Commercially Sensitive)
• Level 5 = 0.8 x 12 mm particles (Top Secret or Classified)
• Level 6 = 0.8 x 4 mm particles (Top Secret or Classified)

What I'm trying to say is - it's not about - "Let's torn this paper and we'll be fine!" It's about how hard is to put this pieces together. If it's next to impossible, then shredding is done well. However, if attacker is aiming for the lowest hanging fruit, then any kind of shredding is better then none.

Example of well done shredding (once it was a money)

I guess setting them on fire or destroying them in chemical reaction would be the fastest, but this techniques should only be preformed in controlled environments by professionals!!! Alternative is to decompose paper in water, however, it's pretty long process (10-14 days) and you'll need enough space and water to do so.

Burning is a cheap and effective way to get rid of this data. Included are some links to some burning standards:

1. US Army Data Destuction (Check out Section V) http://www.apd.army.mil/pdffiles/r380_5.pdf
2. (Search for "burn") http://kdla.ky.gov/records/Documents/Destruction%20Guidelines.PDF

One of the biggest issues with burning is that you end up with either unburned product (i.e. white paper with writing) or burned product (blackened paper with obscured writing). Data can be recovered from both pretty easily. Everything has to be reduced to ash, no exceptions. Take pictures, and cook hot dogs.

Of course, you may not be allowed to burn stuff depending on your work safety practices. You're stuck with crosscut shredding, disbursing the shreds, and distributing the piles into multiple bins. A royal pain, but if you can't burn them it's your only other option.

A good long soak in a large tub of water will do the trick too. Stir daily, and leave the paper in there until it turns into goo.

No matter what, secure some approval for this method. The last thing you want is for somebody to come back and say the job wasn't done right. Also, if they reject all your options, you have a reason to tell them to dispose of their own data how they like.

Mike

Just chiming it to point that "unshredding" is not purely theoretical. It was done on a large scale with East German archives when the Iron Curtain fell, in order to determine (among other things) who was snitching on who.

More on the subject in Wired : http://www.wired.com/politics/security/magazine/16-02/ff_stasi?currentPage=all

Data destruction is serious business. Depending on how confidential the data is, if not done well it can get people killed.