The ATM IndustryAssociation wants ATM deployers to exercise more caution whendiscarding decommissioned ATMs.

“With over 2.2 million ATMs already installed worldwide, afigure forecast to increase to 3 million by 2015, this presents theATM industry with a challenge on a huge scale. What happens to thethousands of machines which become obsolete each year?” theinternational association asked in “Best Practices forDecommissioning ATMs,” a white paper the association recentlyprepared on the topic.

Not only can the machines contain the same sorts of materialsthat make disposing of other sorts of electronic items hazardousfor the environment, the machines also contain technology thatunscrupulous people want to use to learn to defeat existing ATMs,the association added. This security risk presents what might bethe most serious ATM security threat left unaddressed, theassociation argued.

“How does the industry prevent machines from falling into thewrong hands where they could potentially be used for criminal formsof reverse engineering?” it asked.

The association noted recent media reports about organizedcriminals trying to obtain discarded ATMs from junkyards in theU.S. Criminals seek this information to both improve their effortsto skim card data from unsuspecting consumers through operationsthat modify ATMs and efforts to simply hack the machines.

“In many ways this problem has been building for some time, butalways under the surface or off the radar,” said one governmentsecurity analyst who declined to give his name because his agencydid not allow him to speak for the record. “Both as ATMs began tobe able to do more and as they became more hooked into the overallfinancial system, their profile as possible targets has risen.”

The ATMIA said there were four circumstances under which it wasmost important for ATM deployers to guard their machines mostcarefully: when ATMs are moved from one site to another; when beingremoved for storage; when being removed for destruction; and whenthe ATM is being decommissioned but left in place.

The most important things to safeguard about ATMs in thesesituations are the secure technologies each machine has and anyuser data that a machine might have stored, the associationsaid.

The latter has become less of a concern as ATM hardware andsoftware manufacturers have gradually eliminated ways user datacould wind up stored in an ATM longer than regulations or securitypractices permit, but the former has become more of a concern aftereach ATM was mandated to include an encrypting PIN pad to be ableto encrypt users' PINs before sending them through the transaction.These EPPs have become a significant target for thieves who wouldlove to be able to hack one and better understand how itworked.

In order to make sure the EPPs and other secure elements of themachine are safe, deployers must “use secure transportation andensure the ATM is either sanitized or never allowed to be leftunattended by staff. Again, it is important to stress the need forsecure storage and that the time ATMs are left in storage awaitingdisposal is kept to a minimum,” the association said.

The association recommends that deployers like credit unionseither completely disable an EPP or simply destroy it outright andthat the credit unions not do this on their own but insteadoutsource the task to a certified firm. This is important, theassociation said, in order to protect the chain of custody thateach EPP has. In other words, guarantee that each EPP has beenaccounted for from the time it was manufactured, through when itwas installed in the ATM, through to when it will be finallydestroyed. A certified ATM scrap firm will also make sure thatenvironmental regulations are met, the association wrote.

“This secure data disposal process is essential to the properdecommissioning and disposal of ATMs at the end of theirlifecycle,” the association wrote. “ATM owners wishing to disposeof ATMs should first ensure that the scrapping company has followedthe appropriate certification process and inquire as to how itsupports green initiatives. A certified scrapping company will besure to remove and destroy bank branding. It will also segregateplastics, ferrous metal and cables for the purpose ofrecycling.”

It is difficult to know how much of a challenge this representsto credit unions. While there are likely some credit unions withold ATMs stored in various places and perhaps not secured, industryexperts believe that number is very small. ATMs represent such asignificant investment for most credit unions that they take painsto trade them in or otherwise use the old machines to mitigate thecosts of their replacements.

In addition, when viewed on industry terms, the number of ATMsdeployed by CUs directly remains extremely small. According to NCUAnumbers, credit unions have directly deployed, historically,between 4,000 and 5,000 ATMs, a small percentage of the hundreds ofthousands of ATMs financial institutions collectively deploy.

For its part, CO-OP Financial Services, parent to the largestcredit union-owned surcharge-free ATM network, said it works tohelp CUs handle decommissioning their old machines and acquiringnew ones.

“The cost of physically disposing of an ATM is expensive forcredit unions. We recommend that credit unions hold on to them anduse them as a trade-in when they need to purchase a new ATM,” saidKimberly Hester, executive vice president for network services forCO-OP. “If there is no trade-in opportunity, we recommend that aspart of the negotiating process with a vendor, credit unions buildinto the agreement that the supplier will take the old ATMs offtheir hands at no charge. A third option is that some third partieswill purchase your old ATMs if they are within three to five yearsof age, as they can be fairly easily upgraded,” she added, beforeurging CUs to “make sure that the hard drive and PIN pad aredestroyed” no matter what approach they use.