Most of the news I have seen lately about San Francisco information security has centered around a disgruntled employee who “locked” the city’s management from the network after he claimed they were not to be trusted. Now there is a new twist to the city’s troubles as a TV crew stumbled upon a physical security breach of identity information:

It’s trash day in the city and the scavengers are out rifling through the garbage bins in a San Francisco alley. A KTVU cameraman caught two individuals with pick-up trucks stopping briefly before hauling away armloads of paper. No one challenges them as they steal from the unsecured blue bins.

A closer look shows some of what they left behind: confidential documents from the San Francisco Human Services Department.

The station believes thousands of records were exposed. As the sale of personal shredders has skyrocketed in recent years city staff remain unaware of the need to secure these documents? Hard to believe. There were two individuals with pickup trucks? Did the TV crew get their license plates, even though they did not challenge them? This story raises a number of strange questions.

Perhaps the most interesting question is whether disposal bins should be open containers. Many dumpsters are locked to prevent unauthorized sources from filling them, but how many full dumpsters should be locked to prevent theft? It is, in fact, illegal to remove anything from city containers and yet there is no actual mechanism provided to secure the material. For example, what if the garbage trucks had an RFID emitter that would unlock bins upon arrival? The bins would need little more than a lock controlled by a tag. The procedure could be for buildings to leave the bins open while inside their physically secure premises, and then to close the lid (activating the lock) when they set them out on the street.