What to do with forgotten flash drives?

November 10, 2009 5:04 PM

For those of you who work in computer labs, what is your policy for dealing with flash drives that have been forgotten by a student?

I'm a teacher at a small college in the computer department. Three or four flash drives are forgotten by someone in our computer labs every week. The lab supervisor puts these drives on a plate near his desk, which is accessible to anyone walking by. I do know of at least one case where a drive was found, and the next day, it was gone (and it wasn't picked up by the owner).

Shouldn't these drives be treated with the same care as someone's wallet or purse? Could we be liable if someone is a victim of identity theft because their drive was easily taken from the lost-and-found? If we look at the contents of a drive in an effort to figure out who it belongs to, what happens if a student blames us for anything from deleting their homework file to stealing their passwords?

There is no campus-wide policy on this, as far as I know. The lab supervisor is really a good guy in general (and has been there forever and is well-loved), but I don't think he really gets how valuable these drives can be to someone who has all their work (and possibly passwords and other sensitive information) saved on it. Or how valuable they can be to someone who wants easy access to that kind of information.

So, what do you do in your lab? Do you lock drives up? Do you plug the drive in and look through the contents in order to figure who the owner is? Do you make an effort to contact the owner? Is there a sane policy or procedure we could put in place that doesn't cause too much extra work for the lab staff and also protects the drives and ourselves?

Apologies for the length and anonymity, but I don't have tenure yet, so I'd like to not associate my name with potential conflicts with long-time beloved employees. If you want to email me directly, use [e-mail].

posted by anonymous to education (26 comments total)

I plug it in and look. If I can't figure it out without too much prying, I take the drive to our department lost and found.
posted by donpardo at 5:19 PM on November 10, 2009

We didn't do anything special -- we stuck all lost items in a desk drawer, we asked for an accurate description of the item and some form of identification if anyone came looking, and, once a week, we shipped everything off to the campus police lost and found. Is there a college-wide policy regarding lost and found that you could just ship everything off to?

If something was actually reported to the cops as stolen, campus police would sometimes question some of the student staff in the lab, hence the shifting of responsibility (and the recording of identification).
posted by SpringAquifer at 5:26 PM on November 10, 2009

I work in a core center primarily used by graduate students and postdocs (no undergrads here). It seems like most people only use their USB sticks for work stuff. I generally toss them on my desk; if no one claims it in a few months I wipe them and use them for my own work.

I only think two have been left in the last three years, though, so I haven't had much reason to formualte a policy.
posted by pombe at 5:28 PM on November 10, 2009

I've seen a policy posted where:

a) non-encrypted thumb drives will be physically destroyed,
b) encrypted thumb drives will go into lost & found.

Seems to be a good compromise between returning data to their owner, preventing data theft, and minimizing administrative overhead.
posted by randomstriker at 5:29 PM on November 10, 2009 [1 favorite]

-Encourage them to label their drives.

-Keep the recovered drives out of sight and if a student forgets one, they can ask you ("did you find my little blue drive?")

-Do what don pardo says.
posted by rumsey monument at 5:29 PM on November 10, 2009

I also teach in a university and have classes in a computer lab. Our students do occasionally forget their drives. We almost always take them to the department secretary. She puts them in a drawer and a student has to ask for it back. The secretary often asks the student to describe it or name the brand, etc. I don't think we've had someone take one that didn't belong to them yet... Good luck.
posted by Slothrop at 5:29 PM on November 10, 2009

I think that, in general, it would be helpful to at least have a baseline of "the forgotten flash drives are in a locked drawer, and people should be able to describe them by content or color or manufacturer's name or some combination of the three."

"On a plate near the desk" is nuts. Nuts.
posted by Sidhedevil at 5:30 PM on November 10, 2009 [5 favorites]

California State University here. Flash drives found in our computer labs are turned in to the University PD's Lost & Found.
posted by porn in the woods at 5:37 PM on November 10, 2009

(who are open around the clock, versus the limited computer lab operational hours. Not sure what the onus of proof is for students retrieving their drives...)
posted by porn in the woods at 5:42 PM on November 10, 2009

We kept them locked up with the CS department admin staff.

off-topic: Also, you should really try and discourage the existence of flash drives that have "all their work (and possibly passwords and other sensitive information) saved on it." Big signs saying that staff/the university have no responsibility for data on a lost flash drive would be a start. If it was that sensitive, they shouldn't have left it in the lab in the first place.

Personally I think fake '$100 reward for my lost flash drive containing two assignments due this week and all my notes' signs are a good way to raise awareness.
posted by jacalata at 5:46 PM on November 10, 2009

Our computers have a loud noise that goes off if you try to log out without removing your flash drive (don't ask me the technical details). You would literally need to be deaf to forget to take it with you. If anyone does anyway, they go straight to the university's Lost and Found.
posted by tracicle at 6:29 PM on November 10, 2009 [1 favorite]

What we did was to plug the drives into a computer, root around to see if we could identify the owner. Then, email/facebook/call the owner of the drive to tell then where it was. We then stapled a piece of paper around it & writing date found and owner, and stuck then in a drawer behind the lab assistant desk.
posted by mustcatchmooseandsquirrel at 6:29 PM on November 10, 2009

I've worked in 2 academic libraries where this happened regularly. Each place had similar but slightly different "policies". At one, we would open a few files and try to find the owner's name. We'd look them up in the campus directory and e-mail them to let them know it was at the circulation desk. We kept it in a locked drawer with other small lost items - id cards, necklaces, glasses (you would not believe how many people leave their eyeglasses at libraries).
At the second library (at a much bigger school) we simply stashed it with the other small lost items. Same with cellphones. We did call campus security if wallets were turned in or found by staff, and we did send e-mails for found id cards.
At both places, people had to describe the missing item they lost before we would hand it over. At the first library we kept a lost-and-found log, which helped us periodically purge stuff that had been hanging around for over a year or two. We also wrote the person's name on a note and attached it to the drive there.
These were not true policies (although we did have written policies for some types of lost items like cellphones and wallets or even personal books dropped in the bookdrop accidentally - we went to great length to determine their owners if at all possible) they were just what we did. I'd suggest writing up a policy for this with your co-workers, especially if it happens often. It removes any ambiguity for everyone involved.
posted by k8lin at 6:39 PM on November 10, 2009

Former computer lab assistant. We had two policies: what was on the books and what actually happened. The books say we turn them over to lost&found, operated by campus security. This rarely happened for thumb drives, but high capacity disks often found themselves there due to the price of the drive itself.

The more common scenario was the lab asst would keep it in a lost / found drawer and turn it over to lab supervisors at the end of the day, who would label it. When a student shows up they're directed to the lab supervisors' office, who then directs them to lost&found if nothing is there. This is a holdover from the era of floppy disks; when I started we had a massive archive of lost floppies.

Frankly, thumb drives are cheap and Facebook is a far easier target for identity thieves.
posted by pwnguin at 6:48 PM on November 10, 2009

When I worked at a helpdesk--we would try to identify the owner based on info on the drive and contact them. This almost always works, because you find papers with the student's name on them or whatever.

Flash drives or other potentially valuable lost and found items (like wallets) are kept in a locked box behind the helpdesk. Lost items not claimed for a certain amount of time (a month?) get handed over to the campus police lost and found.
posted by phoenixy at 7:04 PM on November 10, 2009

Put up a sign that says "All flash drives are required to be labeled with name and contact phone number. Abandoned flash drives without this information may be destroyed."

Really, how hard is it to put a tag or little sticker with your name on the thing?
posted by ctmf at 8:44 PM on November 10, 2009

I keep left-behind flash drives behind my desk until they're asked for - up to a year. Then I wipe the unclaimed ones and use them for loaners. (high school librarian/computer lab supervisor)
posted by Lynsey at 8:49 PM on November 10, 2009

Drives are collected and put behind the lab monitor desk (which is always staffed) with all the other lost and found items. I'd like to think the monitors use common sense and don't hand the box to anyone who asks... but I bet that happens more often than not. Still, better than out in the open for anyone who walks by.

Couple times a month all the valuable lost and found items are moved to the business office. They try to identify any drives by looking through files, etc. Then they send out emails. You have to describe the item and what's on it in order to claim it.

Point is that lab monitors are not allowed to email clients when they find a lost item. It's a liability issue. If we tell a client we have their lost item, and then it disappears before they claim it, then we're liable for replacing it. That's why we don't notify them until the item is secure.
posted by sbutler at 10:30 PM on November 10, 2009

please don't destroy non-encrypted drives. i can't tell you how many weeping students i've reunited with their flash drives. physical descriptions never posed a problem.
posted by anthropomorphic at 1:14 AM on November 11, 2009

Primarily lost and found. We know who logs into our workstations throughout the day, so it is possible to track down an individual (or ensure they were the ones who left them in the drive) and contact them. This is hardly ever done though.

We also have a logoff script that will detect whether a USB drive is plugged-in and alert the user. We had a significant drop-off in forgotten drives after it was implemented.
posted by purephase at 4:01 AM on November 11, 2009

I'm constantly surprised by what students leave behind. We collect all thumb drives, wallets, cellphones, laptops, power cables, and so on in a cabinet drawer. I give the students until the end of the semester to reclaim their stuff, then dispose of them. This posed a problem recently when one of my student employees was caught stealing from our lost and found. The cabinet is now locked and we keep a log of anything that looks like it's worth more than 20 bucks.

As for wallets, though, I'll seal them in a large envelope and walk around the library to see if I can reunite them with their owner. If I can't, I turn it over to campus police who then track the student down.

At any given time, we have maybe 6-8 thumb drives on hand. Most of our students save their papers as email attachments, though, so I've never encountered the weepy student.
posted by robocop is bleeding at 4:36 AM on November 11, 2009

Be wary of viruses on thumb drives. A friend brought home a thumb drive from school that was infected while at campus - it hosed all of his home PCs before he realized what happened. Stray drives may be infected with something - unintentionally, or otherwise. If you do plug them in to anything (to check for iD, etc.), make sure it's heavily protected, a Mac or Linux box, offline, etc. to be sure.

While it may seem unlikely, "forgetting" a thumb drive in a school lab seems like an ideal way to spread malware mayhem. I do remember lab computers being used for uploading viruses when I was in college back in 92, as there was a big to-do when the kid in my class tried it and was busted by the FBI.
posted by GJSchaller at 5:09 AM on November 11, 2009

A sign saying "found drives will be destroyed in 10 days". Put a post-it with the date and any other relevant details on the drive, wrap a rubber band around it. Put it in a locked desk. Every so often, destroy the older ones.

I wouldn't look at the material for several reasons.
posted by kathrineg at 7:37 AM on November 11, 2009

FWIW: I have a small .txt file on all my flash drives titled: "If found please return to". Open it up, and there's my contact details (Email, Website and phone numbers).

Might be an idea to recommend this to the students so you don't HAVE to open any of their files to find the owner?
posted by JtJ at 10:34 AM on November 11, 2009

I work in a university computer lab that's open 24 hours a day except for weekends. We find at least three USB drives a day, and that's a slow day. We currently have well over 100 drives in our care.

Like robocop says, the amount of stuff forgotten in a computer lab is incredible. Part of this is because of the number of students that drop out and forgot they left anything. We have clothes, books, variations on love and hate letters, old homework, you name it. Wallets, purses, keys, and cell phones are frequently claimed quickly, and we have a policy for those things.

We look at the files on the drives, and, if we can determine the owner, send an email, tape it to a piece of paper with relevant info (date found, username, full name) on it, and put it in the alphabetically organized collection in my supervisor's office. There they stay until they are retrieved or they have been there for at least a year. After a bare minimum of a year, they are wiped and probably given to people who need them but can't afford them. (By this I mean, kids starting in middle school through high school here who are required to have usb drives, but are from big and/or poor families, etc.)

We found out that if we turn them in to the official lost and found for our building, they stay for a few days and then go to facilities management. There, they are kept for a couple weeks and mysteriously disappear. There is no official policy.

Some students are appalled by this. "OMG, you look at my stuff??!!"
Well, yeah, I do, if you want your drive back. I've only found one porn collection in as long as USB drives have existed, and I really wish I hadn't. When I see someone's party pictures, I generally think, "Hooray, looks like they had a great time," and haven't seen anything more scandalous than I've already seen on the lab computers themselves, saved on a server a half a campus away or on Facebook.

I've repeatedly recommended the "if found" text file that JtJ mentions. I love it when they have resumes saved on there. Extra email address that they might actually be checking!

The ones we can't identify (just this week, there's one with nothing but pictures and music), we attach to a piece of paper with the date found and roughly what is on there, especially file names that seem unique.

I have lost track of how many kids come in with this speech, "I lost my black 4-gig sandisk usb drive." Well, yeah, you and a half dozen other people this week and it's only Wednesday. These also tend to be the kids that are SHOCKED that I look at the files. I point out that I really don't want to know anyone's personal crap anymore than they want me to. Honest. I don't need that extra baggage. I'm very happy when a drive gets to go home.

And then there are the drives that just disappear. This makes me sad. But I'm only there 24 hours a week, and if the people who work there don't see it (including me, if it's a busy day and I don't check all 85 machines often enough), well, it may just end up in someone's pocket. Not everyone is honest. Just be glad they didn't steal the house and car keys that were attached, too, I guess.
posted by lilywing13 at 1:17 AM on November 12, 2009

My old department never had an official policy, but my personal one was:

1) Plug in, and see if there is any immediately obvious data that could pinpoint the owner, I'd contact them, using student info I had access to as an admin of the university
1a) examples of files that would be opened to check for owner's identity: documents labeled something like finalpaper.doc, classschedule.doc, iffound.txt etc. Things never touched: everything else.
2) If no obvious data was found, they would be put in my (locked) desk drawer, taped to a post-it note stating date found, where found
3) to be reclaimed, the student had to pass my sniff test (I'd ask what files were on it, when it was lost, where lost, color, etc)
4) If not reclaimed by the end of the semester it'd be wiped securely (two pass, zero out) and given out to faculty and students who had lost theirs...

I'd say maybe 25% were claimed. And I did have more than a few attempts to claim drives that did not pass the sniff test, so I kept them locked up.

Anectodal story: My favorite means to keep from forgetting a drive was one student who smoked like a chimney and so built his drive into his Zippo, which he claimed never to be without. Runner up would be the one that had a two-yard length of parachute cord tied to his drive and his belt loop.
posted by 1f2frfbf at 7:16 AM on November 12, 2009