The industry keeps retelling what went wrong. It’s time to talk about what would have made it right.
Years after Morgan Stanley’s IT asset disposition failures became public, the industry is still talking about them.
The auctioned hard drives. The missing servers. The unencrypted data. More than $160 million in documented penalties and settlement funds, plus additional costs.
The story has become a cautionary tale, repeated in articles, presentations, and webinars. Almost none of them answer the question that matters:
What would have prevented it?
Not another certification, another policy, or another promise from an ITAD vendor.
Independent verification.
Additional notice, administration, legal, and remediation costs are not included in this total.
These amounts relate to multiple ITAD failures, not solely the missing servers. But the incidents share a fundamental accountability problem.
In 2016, Morgan Stanley decommissioned two major data centers in Poughkeepsie, New York, and Columbus, Ohio.
According to the SEC, Morgan Stanley hired a moving and storage company with no experience or expertise in data destruction to handle approximately 4,900 IT assets, including servers and hard drives containing customer information [1].
The moving company was supposed to work with a designated IT asset disposition partner to wipe or destroy data before equipment was resold or recycled. Instead, it stopped working with that partner and began selling unwiped equipment to another company without Morgan Stanley’s knowledge or approval [1].
Some of the equipment eventually reached an internet auction site. Morgan Stanley learned of the problem when an IT consultant who had purchased hard drives contacted the company to report that he could access its customer data [1].
But the SEC’s findings reveal something more troubling.
Morgan Stanley had opportunities to discover the problem long before that phone call.
The original disposition partner maintained an inventory tracking database documenting equipment collection, wiping, and resale. Morgan Stanley had direct access to it.
According to the SEC, nobody at Morgan Stanley monitored the database or contacted the disposition partner to confirm that equipment was being handled properly [1].
When the moving company stopped using the original partner, the database stopped being updated and the expected destruction certificates stopped arriving.
That should have been an immediate warning. Instead, the process continued.
The replacement company provided Certificates of Indemnification acknowledging possession of equipment and assumption of risk. The moving company forwarded those documents to Morgan Stanley, describing them as Certificates of Destruction.
Morgan Stanley did not review them. The SEC found that reviewing them would have revealed the involvement of an unapproved subcontractor and the absence of data wiping [1].
The failure wasn’t simply that the vendor did something wrong. It was that the process allowed unsupported claims to be accepted without independent verification.
Independent verification at a critical control point requires reliable evidence that equipment was received by an approved party, properly accounted for, and processed as authorized.
If that evidence is missing, inconsistent, or unreliable, the process stops. Not because the verifier has proven wrongdoing, but because the vendor has failed to establish that the required work was completed.
In 2016, the inventory database was no longer being updated. Required destruction documentation was missing. The documents submitted did not support the claimed disposition. Any one of those failures would have triggered an exception, an investigation, and a hold on further disposition.
A dishonest vendor might still have tried to move equipment outside the approved process. But those actions could not have passed independent verification.
The absence of evidence is not evidence of completion. It is a reason to stop.
In 2019, Morgan Stanley decommissioned approximately 500 local branch servers as part of a hardware refresh [1].
In February 2020, the company discovered that four could not be located. A subsequent inventory of historical branch equipment in 2021 identified another 38 [1]. In total, 42 branch servers potentially containing sensitive customer information were unaccounted for.
The same investigation revealed that, although the servers had encryption capabilities, Morgan Stanley had not activated the encryption software until 2018. A manufacturer flaw meant that some data stored before activation remained unencrypted [1].
Morgan Stanley could not establish the final disposition of the missing servers through adequate chain-of-custody and destruction documentation [1]. Court papers in the customer class action later indicated the servers were recovered [6], but only after the fact, when the exposure had already occurred.
The company discovered the discrepancies through its own reconciliations.
The question is why those discrepancies were not identified and resolved at the time of disposition.
An independent verification process would have reconciled the expected inventory against actual receiving and disposition records at each control point. The missing servers would have become exceptions requiring investigation while the equipment, the custody records, and the people involved were still within reach.
The distinction is fundamental.
A reconciliation performed long after equipment leaves your control tells you what you cannot account for.
A reconciliation performed at a critical control point, combined with a verification hold, prevents unresolved discrepancies from being accepted as completed disposition.
In 2017, Morgan Stanley engaged the same moving company to decommission 61 servers, containing 244 hard drives, at its Weehawken, New Jersey location [1].
The initial destruction certificate did not identify the individual drives as required. When Morgan Stanley obtained an updated certificate, the reported serial numbers did not match its own records. The discrepancy raised concerns about a possible break in the chain of custody and triggered an internal investigation [1].
Investigators eventually determined that the drives had multiple serial numbers and that Morgan Stanley and its vendor had recorded different identifiers. But the equipment had already been destroyed, so the discrepancy could not be resolved by inspecting the drives. Morgan Stanley had to obtain information from the manufacturers to validate the records [1].
This time, the discrepancy was explained. But the incident exposed a weakness that could have produced a much worse outcome.
The equipment was destroyed before its identity had been reliably reconciled.
Had independent verification required matching the expected inventory against the equipment received before destruction, the discrepancy could have been investigated while the drives still existed. Verification tags would have provided an independently controlled identifier, reducing reliance on ambiguous serial numbers. An Equipment Verification Hold would have prevented irreversible processing until the discrepancy was resolved.
Verification after destruction is fundamentally weaker than verification before destruction.
Independent reconciliation compares the assets expected to be retired against the equipment actually received and documented through disposition.
It should occur at critical custody and disposition control points, particularly before equipment is irreversibly processed or a project is accepted as complete. It need not require a full physical recount at every handoff; controls can be designed around risk, shipment integrity, receiving records, and disposition documentation. But every expected asset must ultimately be accounted for, and discrepancies must be resolved or explicitly escalated.
The reconciliation must be independent of the party handling and processing the equipment.
No one should grade their own work.
Serial numbers can be missing, misread, mistranscribed, or ambiguous. As the 244-drive incident showed, a device can even carry multiple serial numbers.
Verification tags establish a second, independently controlled identifier before equipment leaves the customer’s control. Combined with the expected inventory and independently recorded receiving information, they make it harder for assets to be omitted, substituted, or misidentified without detection.
A verification tag does not physically prevent theft. It strengthens the ability to detect and investigate discrepancies.
The party performing an activity should not be solely responsible for verifying its own performance.
Yet many ITAD programs rely on the same vendor to collect equipment, inventory it, process it, and provide the documentation used to establish compliance. That is how, in 2016, a moving company could route equipment through unauthorized downstream buyers and submit documents that did not establish the destruction being claimed.
The vendor handles the equipment. An independent party tests whether the records and supporting evidence establish the required outcome.
An Equipment Verification Hold prevents disposition from proceeding until defined inventory and accountability requirements are satisfied.
If equipment is missing, identifiers do not match, custody records are incomplete, or disposition evidence is unreliable, the process stops. The discrepancy must be resolved or formally escalated for an authorized decision.
This matters most before irreversible processing. Once equipment is destroyed, resold, or transferred beyond effective control, the ability to investigate is severely diminished.
Verification detects the discrepancy. The hold prevents the discrepancy from being treated as an acceptable outcome.
Much of the Morgan Stanley discussion focuses on encryption. Proper encryption could have substantially reduced the data exposure associated with missing equipment.
But suppose every missing server had been properly encrypted. Would Morgan Stanley no longer need to account for the equipment?
Of course not. Encryption protects information against unauthorized access. It does not establish where equipment went, who handled it, or whether it was disposed of as intended.
Encryption can protect the data on a missing asset. It cannot account for the missing asset.
In November 2023, Morgan Stanley reached a $6.5 million multistate settlement concerning the disposal incidents [3].
The settlement required stronger information security, vendor oversight, and hardware inventory controls, including manual processes and, where practicable, automated tools to regularly inventory, classify, and report on hardware containing consumer personal information. It also addressed vendor contracts, documentation of disposal activities, and the extension of security requirements to subcontractors [3].
These requirements do not expressly mandate independent third-party verification. But they recognize the underlying problem: organizations must know what equipment they possess, where it goes, and whether the parties handling it are meeting their obligations.
The logical next question is whether organizations should rely exclusively on the vendors responsible for disposition to establish that those obligations were met.
Most organizations have ITAD policies. Many use certified vendors. Most receive certificates documenting destruction or recycling.
Certification establishes that a provider has been assessed against defined requirements. Documentation records what the provider reports happened.
Independent verification tests whether the available evidence accounts for what was supposed to happen.
It requires an independently established expected inventory, reliable evidence of custody and disposition, and a process for identifying and resolving exceptions.
A vendor’s records may be internally consistent and still be incomplete or inaccurate. Verification must test those records against evidence the vendor does not exclusively control.
It cannot guarantee that equipment will never be stolen, misplaced, or mishandled. What it can do is expose missing assets, inconsistent records, and unsupported claims before those problems are accepted as completed work.
And when sufficient evidence is unavailable, the correct response is not to assume compliance. It is to stop the process and investigate.
The SEC’s findings point to a lesson the industry has largely missed.
Morgan Stanley had access to records it did not examine. It accepted documents that did not establish the destruction they purported to certify. It discovered missing servers through reconciliations performed long after disposition. And in another project, it tried to reconcile serial numbers after the drives had already been destroyed.
These were not simply failures of data destruction.
They were failures of accountability.
Independent verification, supported by verification tags, segregation of duties, and equipment verification holds, would have stopped the 2016 disposition before unwiped equipment changed hands. It would have turned the missing branch servers into exceptions at the time of disposition rather than discoveries years later. And it would have reconciled the Weehawken drives before they were destroyed, not after.
Organizations should ask whether the same thing could happen to them:
If reliable evidence is unavailable, does the process stop?
If the answer is no, they may have the same underlying control weaknesses.
The industry doesn’t need another reminder that Morgan Stanley lost control of customer data. It needs to explain why independent verification of chain of custody is still not a standard part of IT asset disposition.
We know what went wrong. We know which controls would have made the difference.
What are we waiting for?
ITAD has moved from trust to certification to documentation. Each step reduced the blind faith…
Reconciling what you sent against what your ITAD vendor reports used to be expensive, so…
AI doesn’t create the ITAD accountability gap. It makes it visible. As comparing expected and…
When new technology makes something that was once difficult to verify suddenly easy to challenge,…
Two-Key Tracking uses two independent identifiers to verify that retired IT assets are actually accounted…
This website uses cookies.
