Data Still Left on Storage Devices for Sale 403
cluedweasel writes "According to a BBC story many people are still putting up their old PC's and storage devices for sale without taking basic precautions to ensure that confidential data is erased. The suggestion at the end of the story is to get a professional forensics firm to wipe your data or just destroy the item in question. With the low price of storage devices, the latter is probably preferable."
Not only good drive but also bad drives (Score:5, Insightful)
That said I used eraser [sourceforge.net] every night.
Re:Not only good drive but also bad drives (Score:5, Informative)
However, sticking a decently strong household or lab magnet against the drive housing may tense parts of the delicate mechanism inside, causing the bearing to go south or the actuator arm to cease working. It's still probably possible to pull the platters and remount them in a new housing (if the platters weren't too damaged by whatever mechanical failure you induce), and there are a few outfits that can do it for ~$3000 per drive.
Now, get real: Want to know the BIGGEST, best-kept secret in data forensics? The most effective way to forever put your data beyond the reach of cops and courts is:
dd if=/dev/zero of=/dev/hda
That's right, just a single-pass overwrite with zeros will do. Everything else you hear is either 8+ years out of date, or uninformed bullshit, or a scare story.
Re:Not only good drive but also bad drives (Score:5, Informative)
dd if=/dev/zero of=/dev/hda
/dev/urandom is a better source... With zero, analog analysis can be used to determine the drive's prior contents. Of course, if somebody is willing to do that to recover data, they already have your house bugged...
Re:Not only good drive but also bad drives (Score:5, Informative)
That's right, just a single-pass overwrite with zeros will do. Everything else you hear is either 8+ years out of date, or uninformed bullshit, or a scare story.
May as well do a second pass with /dev/random, though it's not like the cops are going to send your drive in for forensic recovery unless you're a big fish.
Re:Not only good drive but also bad drives (Score:3, Informative)
May as well do a second pass with /dev/random, though it's not like the cops are going to send your drive in for forensic recovery unless you're a big fish.
Exactly. If it's not undeleted, in the recycle bin or your internet history/cache, I find it highly unlikely that anyone will ever see it. CNET just recently ran an article [slashdot.org] that alternative browsers "impede" investigations, because detectives can't figure out where to find the files. LOL
Granted, I'm sure the NSA, DoD, and CIA have much better me
Re:Not only good drive but also bad drives (Score:4, Interesting)
Now, as said above, if you were a really big fish, they have ways, but its not a typical forensics op.
Re:Not only good drive but also bad drives (Score:5, Funny)
I tried using 2000+ passes using /dev/urandom, but somehow I ended up with a full installation of Windows 95.
Then a friend of mine told me something about monkeys hitting typewriters and Shakespeare's complete works...
Re:Not only good drive but also bad drives (Score:3, Informative)
Re:Not only good drive but also bad drives (Score:2)
Re:Not only good drive but also bad drives (Score:3, Informative)
UNLESS YOU ARE DEALING WITH A VERY OLD HARD DRIVE (pre 1997, at least), YOU CANNOT RECOVER DATA THAT HAS BEEN OVERWRITTEN.
Go read the Gutmann paper from Usenix '96, and note that he never actually performs any recovery tests, nor does he cite anything other than reports of data recovery in lab situations under ideal conditions.
Also, note that he REVISED that paper in 2000 or 2001 (not quite sure) to take into account the fact th
Re:Not only good drive but also bad drives (Score:5, Interesting)
That's right, just a single-pass overwrite with zeros will do.
Um...no. Not to be argumentative here, but I have personally been able to recover data from a hard drive after being zeroed. This is why the DoD standard [active-eraser.com] is a bit more stringent than simply zeroing.
Re:Not only good drive but also bad drives (Score:4, Informative)
And what drive generation/size was that? If it was an older, lower capacity drive, I have no trouble beliving you. If it was a current >= 200GB drive, I think you need to elaborate a lot.
Re:Not only good drive but also bad drives (Score:5, Interesting)
1) Talking about recovery from an old drive, pre-1997, OR;
2) You're full of shit. Yes, a liar.
So explain yourself, please, because I will apologize immediately if the case is (1) or you can prove me wrong. Cite me some evidence--press releases from the company you worked for, or a paper written by the research team you worked with. Anything, hell--even your blog is something.
I've spent my last four years working as an examiner at a computer forensics firm. I have exhaustively researched this topic several times, hoping against hope that something is out there. There is nothing.
I have encountered a number of documented cases where a party to ligitation claimed that incriminating or exculpatory evidence had been overwritten on a hard drive. In at least two of those cases, the defendants spent more than $500K funding people who said "Oh yeah, I can do that--I just need cash for a lab and a magnetic-force microscope." Nobody EVER recovered over-written data, in any of these cases.
So prove me wrong.
Re:Not only good drive but also bad drives (Score:3, Interesting)
This is why people keep propagating the myth that you can recover overwritten data from current generations of hard drives. It USED to be true, with older drives, and it's just spooky-sounding enough to be intriguing, so people want to believe it.
But it's still bullshit. Seriously, I
Re:Not only good drive but also bad drives (Score:5, Informative)
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure
(sorry if the link gets tangled). The author is Peter Gutmann. The paper you see on that link is actually an updated version of the original, which was published at USENIX '96, minus the "epilogue" section at the end. That's the critical part, where Gutmann basically backs off all the important conclusions about hard drive data recovery. He's still pretty optimistic in the epilogue (he talks about recovering one or two previous write passes of data), but you have to notice that he doesn't support himself, there, and the original citations don't support him, either.
Not to speak ill of Gutmann--he's done a lot of great work in UNIX security over the years, and he's a stand-out researcher. But he doesn't prove what he's saying.
Hopefully, the Gutmann terminology will be enough to get you started if you want to research the issue further. I used to have a couple dozen pages of cites and summaries on the issue, but I lost most of it when I left my last job. It's still out there, but it took me a couple of months to do it originally.
Re:Not only good drive but also bad drives (Score:5, Funny)
Have they made some change to zero in the last 8 years that makes it less constant?
Re:Not only good drive but also bad drives (Score:5, Informative)
To give an example, suppose a part of your drive had this pattern written on it --
and you overwrote that with 0s. So you'd expect to seeand you would, if you read the drive in the normal way. However, underneath the covers, the data on the drive would really look more like this --the exact values are just guesses, but there is a pattern here -- if a bit used to be 0, it's very close to 0 now. If the bit used to be 1, it's still close to 0 now, but a good deal further than if it was a 0.With some different firmware, one could read most of the data that was on a drive that had been erased like this.
This is why people 1) write random or semi-random patterns to the disk to erase it, and 2) do it more than once.
Still, writing 0's just once to the entire disk will stop 99% of people who might read your disk. Writing random patterns several times will probably stop even the NSA, but if they want you bad enough, they'll stick probes into your brain and extract it that way :)
Re:Not only good drive but also bad drives (Score:3, Informative)
No, nothing so drastic. Hard drive technology has fundamentally changed in the last few years, and there was a huge industry-wide turnaround in methods that happened around 1997. The bulk of the changes had to do with the encoding mechanisms used to write and read data from the platter.
Even back then, these attacks were just theories, at least in public. It's possible that some spook-lab made them work, but there was never
Re:Not only good drive but also bad drives (Score:3, Funny)
Re:Not only good drive but also bad drives (Score:3, Informative)
But you're right if they do.
I've had to pull 4 GB of rm -rf *'d data off a drive before using some tools and vi. Worked well, took hours, and I got 90% of his files back.
I also got several versions of each file, some of them dating back over a year. Scarry...
But if you dd a drive... it's gone from all the tools I had at my fingers. And I had a *lot* of tools.
I've also done the "platter swap" thing once successfully (in a shower clean room) (twice failed) and several controller
Re:Not only good drive but also bad drives (Score:2)
However, the most *fun* way to forever put your data beyond the reach of cops and courts can be found here. [magnumresearch.com]
Re:Not only good drive but also bad drives (Score:2)
dd if=/dev/zero of=/dev/hda
That's right, just a single-pass overwrite with zeros will do. Everything else you hear is either 8+ years out of date, or uninformed bullshit, or a scare story.
I completely agree, except that
dd_Rescue
is better wince it gives you a nice progress i
Re:Not only good drive but also bad drives (Score:3, Insightful)
Not saying you're wrong, but I think an important qualifier might be "the edge of what physics allows" at any significant rotational speed. I have to wonder if you're willing to spend 100s of hours scanning a single platter with specialized equipment if you couldn't still make out a bit more. I really don't know, just wondering.
Re:Not only good drive but also bad drives (Score:3, Funny)
Re:Not only good drive but also bad drives (Score:5, Interesting)
Re:Not only good drive but also bad drives (Score:2)
The tri
Re:Not only good drive but also bad drives (Score:5, Informative)
From what I saw in defect drives I opened, none at all, just some centimeters distance. The "strong magnet" meme is an urban m"yth. You need far stronger static magnetic fields to damage a drive without opening it than you can buy.
In addition, if you succeeded, it would likely void the warranty anyway, so why not be sure and just decline the warranty or use an encrypted filesystem in the first place?
Re:Not only good drive but also bad drives (Score:5, Informative)
Strong magnets (as strong as you're likely to have at home anyways) will erase (ruin) floppy media just fine. And cassette tape media. And probably 8 tracks. I don't know what they'll do to QIC-150, 4 mm or 8 mm media. But they won't erase DLT media, and won't erase modern hard drives, probably not even if you put it right next to the platter itself.
(Now, opening the drive up and scraping the magnet over the drum, physically damaging it, that may be effective. But a non-magnetic wire brush would work as well.)
Personally, I erase my media with some variation of this --
and let that go until it's done. Repeat if you're extra paranoid. Sure, there may be some data left in sectors that have been re-allocated by the firmware. Sure, the NSA might be able to recontruct my data bit by bit with microscopes. But if I'm really worried about that, I'm not going to sell my disk -- I'm going to physically destroy it.As for warranty repair, that's a tough call. If the dd can't be done, the odds are good that the company can recover almost everything on the disk. You'll have to consider the pros (you get a new disk! free!) vs. the cons (they might be able to recover all of your data.)
Re:Not only good drive but also bad drives (Score:5, Informative)
You don't need to worry about this level of security if your threat model is phishers and the like. The people selling hard drives would like you to be so paranoid you won't let others make use of your old hardware, but there is no real need for that. If someone with the resources to go over your HDD nanometer by nanometer with SQuIDs wants your data, they'll first try a sneakier, more effective way than buying your old disks.
For quick destruction of encrypted data, assuming the encryption-block size is several times the disk-block size, overwriting just one of the disk blocks for each encryption block will effectively make the data unrecoverable. Similarly, if you use an encrypted file of long, secure keys to access your other encrypted data, once that file is destroyed, everything else is effectively gone until the encryption can be brute-forced a few decades down the line.
But for sensitive data that may need to be quickly destroyed, you're better off using CD or DVD media. Five seconds in the microwave followed by a quick couple of rubs with a piece of sandpaper to remove the flakes will do more than just about anything you could do to an HDD in a similar amount of time. This also gives you an excuse to get a really fat UPS and to have your microwave on your desk. Of course you still need to find a way to get the time needed to destroy the data when your door is being broken down or if your machine is tampered with when you are away - left as an exercise for the reader.
Re:Not only good drive but also bad drives (Score:4, Insightful)
Now if it's just some random joe with an undelete program he got for $19.99 at the local shop then a single pass is often enough, more sophisticated software only tools might get past a few, but with hardware equipment (probably not used often below the fbi/ pro foresnics places) you might want to do something a bit more secure.
With good knowledge of how the data is actually stored on the disk you can figure out patterns that tend to degausse the bits being wiped and help eleminate the residual images left by the micro imperfection in head positioning (which are shrinking to almost nothing these days) and simular effects a trully sophisticated data recovery effort might use.
Peter Gutman put out a paper about this that can be read at http://www.cs.auckland.ac.nz/~pgut001/pubs/secure
that explains it better.
Though with remapping and newer recording techniques things change and software only erasure becomes more and more problematic. At the highest levels of secrecy I believe most governments require over-kill levels of outright hardware destruction.
Mycroft
Re:Not only good drive but also bad drives (Score:4, Informative)
I had to send the DLT tapes off to a professional service to have them erased (they had to be erased for the new tape drive to make them work in the new high density mode.) The hard drive was just me seeing if I could do it :)
The tigher your cram data in there, the higher the magnetic fields needed to make changes. And modern media has it cramed VERY tightly ...
Re:Not only good drive but also bad drives (Score:4, Informative)
But you want your drive to be erased in less than a month, right? Use /dev/urandom. It's more than random enough. (Use /dev/random when you need small amounts of `true' randomness.)
Re:Not only good drive but also bad drives (Score:3, Informative)
The magnets are at a far enough distance (a cm is huge, in magnetic terms) that they offer little problems.
Second, magnetic fields of the driver magnets is orreinted almost exclusively in one axis. A normal refridgerator magnet will stick to the fridge with (almost) equal force no mater which way it was stuck (assuming, of course, it's semetric). The voice-coil driver magents are orriented heavily on a north-south pole. If you manage to pull one of these out, you'll see what I mean. If y
Found data (Score:5, Interesting)
The interesting thing is that protocols for the destruction of data have existed for magnetic media since before the hard drive. With the advent of the hard drive and higher density media, other protocols have come into place, but the solution is not a technical one. It is the hardest of all solutions...... Behavioral change.
Re:Found data (Score:2)
Removing the hard drive might be OK for selling some uberovergamerclocker rig, but most normal buyers don't just have a spare drive around to stick into the computer they just bought for $75.
Re:Found data (Score:5, Interesting)
In the course of this scrounging I learned something SlashDotters may not consider: There is an entire subculture in America of people who use second hand machines. These are poor folks who cannot afford the latest Alien ware or G5 iMac. People who just don't have the money for even cheap Celeron box. I am talkin' poor folks here. They get by on Windows 98 and Office 97, or even Mac OS 7.1 and MS Word 5.0 for their computer needs.
They use a old Performa Mac or a Mac Classic II, or a 486 or Pentium 166mhz PC to do what they need to do.
Tech support is supplied by a whole bunch of self taught techs who tinker. I know many of this sort.
The size of this population of users might surprise folks. There are a lot of them.
The problem with all the current talk of: "OH! I left Aunt Tillie's phone number in Outlook Express and all 26 of my credit card numbers in Quicken!" is the effect it has had on this catagory of user. They are not able to "upgrade" to a newer junker because everyone is afraid to dump their box for fear of the data being stolen. This means the bottom of the food chain looses. It also means there will ALWAYS be compromised Win 3.1/95/98 boxes on the net.
BTW....if anyone out there has any older Conner or Western Digital (pre-Caviar) 20-40-120-240mb hard drives I am looking for a few to reformat as Vulcan Gold Drives....
Re:Found data (Score:5, Interesting)
Hmmm. The biggest customer of NEXT was the CIA IIRC...
All aboard for Gitmo!
Re:Found data (Score:5, Interesting)
I do like the fact the on Mac OS X on any System Restore CD or OSX CD comes with Disk Utility.app, that does either seven or thirty-five random wipes of the disk. Plus the user could use Secure Empty Trash from the very beginning. Waiting for a 20GB to randomly write bits in every sector seven to thirty-five times is general too much of my time. The hammer is a lot quicker.
Signed: The impatient and destructive systems administrator
Re:Found data (Score:3, Interesting)
Re:Found data (Score:5, Interesting)
o) accounting data
o) sourcecode for web commerce backend for multibillion dollar corporation
o) server backups, including email
Re:Found data (Score:3, Interesting)
I also found data (Score:5, Interesting)
The saddest part was looking through the 'Recent Documents' list.
Letter x, letter y for boss, travel iteneries etc... then... typing tests... job guides, and finally the resume...
So sad... I wiped it good and proper before I gave it to who it was intended.
DBAN. Learn it, Live it, Love it. (Score:5, Informative)
Re:DBAN. Learn it, Live it, Love it. (Score:5, Informative)
dd if=/dev/random of=/dev/sda bs=512 count= (get this from fdisk) will do the trick in a pinch.
On the other hand, has anyone here actually tried to "secure wipe" at 200+ Gb hard drive? It can take DAYS.
Just drill a hole in the case; pour in some caustic drain cleaner or CLR (bathroom cleaner); plug the hole; shake vigorously then let sit for a couple days before throwing it out.
-Charles
Re:DBAN. Learn it, Live it, Love it. (Score:3, Informative)
Re:DBAN. Learn it, Live it, Love it. (Score:3, Insightful)
DBAN doesn't -- last I checked -- have SCSI or RAID drivers, so it is only viable if you're on a plain vanilla IDE system. I dont' know about SATA.
According to the website, "DBAN has all available SCSI disk drivers". As of Dec 2004 DBAN has SATA drivers. I'd think RAID wiping should be done on each individual drive rather than across the entire RAID array.
Your data = bonus (Score:5, Funny)
Then again... they probaby would see the reiserfs partition as "Unknown" in the Windows installer.
Re:Your data = bonus (Score:5, Funny)
Re:Your data = bonus (Score:2)
Re:Your data = bonus (Score:5, Funny)
Re:Your data = bonus (Score:3, Funny)
Old machines from pr0n sites. (Score:3, Funny)
Re:Your data = bonus (Score:2)
Re:Your data = bonus (Score:2)
In early Windows versions (and DOS) that was almost impossible.
Or just nuke it.. (Score:4, Informative)
The Government is the Biggest Culprit... (Score:5, Interesting)
I once received about 30 10GB hard disks from the US Army that were tossed in a collection bin (and someone called me to say they were there) which were not wiped and had a fair bit of info on them. Not talking National Secrets, but info that could have been used to cause problems, none the less.
By far the worst, however, was a batch of 15 PIII computers I recovered from the INS. Not only had they not been wiped, but all programs and files were fuctional. Talking about Social Security numbers, Green Card information, and on and on. It was terrible.
Of course, I do the right thing and both wipe and low-level format these before donating on to charity - but it still amazes me what info is given away.
Both of these cases were 1 year+ after 9/11 too. People don't change.
Re:The Government is the Biggest Culprit... (Score:2)
FYI (Score:2)
Other government agencies aren't held to the same standards, but the odds of national security secrets going out on a trash
Here's your "professional forensics firm" for free (Score:3, Informative)
Set that up for 27 wipes and you're set.
Use the military procedure for destroying the data (Score:5, Funny)
2) Use acetylene torch and reduce drive to slag.
3) Encase slag in concrete.
4)Drop concrete in Marianas trench.
Re:Use the military procedure for destroying the d (Score:5, Funny)
and the quick solution: (Score:2)
dd if=/dev/zero of=/dev/hdb bs=16384
Or, use
Re:and the quick solution: (Score:2)
As a side note, on Linux and the BSDs,
Most people don't know they can wipe the data (Score:2, Insightful)
I find a large sledgehammer used repeatedly does a fairly good job of handling data getting into the wrong hands, mind you
I find personal information on drives constantly. (Score:2)
The interesting thing is, my aunt who is beyond computer illiterate, had me come over and wipe her hard drives clean before she got rid of her old computers. I guess if you're someone used to destroying paper bills and information before you
Dban (Score:2, Informative)
Easy on the Mac (Score:2)
Re:Easy on the Mac (Score:2)
Re:Easy on the Mac (Score:2)
Re:Easy on the Mac (Score:2)
I don't get it (Score:2, Funny)
how do I get in on that scam? (Score:5, Funny)
how do I market myself as this and sell that service to people? sounds like a great article to whip up some Fear frenzy that we geeks can make good money on.
"Yup, I can safely eradicate your data and wipe that drive, no it's not easy, but that is why it costs $100.00.
thank you, no we dont accept personal checks."
adding that to my spyware cleaning racket and I can quit my job as a web programmer/IS manager.
This rocks, any way to get CNN to stir it up as well to help the fear factor in the general public?
Re:how do I get in on that scam? (Score:3, Funny)
format c: (Score:3, Funny)
format c:
how hard is that?
Re:format c: (Score:2)
Re:format c: (Score:2)
A standard format is usually a "quick" format. Which means that recovering the info is easy. You need to do a low-level format in order to actually destroy the data. Even then, there are no guarantees. Your best bet is to insert a Linux boot CD or floppy and run:
dd if=/dev/zero of=/dev/[drive name]
* Unformat was removed in Windows 95, so it doesn't work on modern machines. However, the existance of the command demonstrated that it was quite easy to restore the original file t
Smash it to bits? (Score:3, Funny)
My Experience with a Used PC (Score:4, Funny)
We were able to find a PC that had just turned in to a local "Cash Converters" and the OS had not yet been wiped/updated and got it for $50. We did try the PC before leaving the store but did not hook up a set of speakers.
When we got home, we discovered that the previous owner of the PC was an affectionado of Jamacian S&M. The first time I turned it on, the PC started up with somebody screaming "Hurt me Mon!" and every mouse click produced a woman's scream.
I was able to reset the default sounds on the PC and delete the thousands of jpegs of bondage pictures, but my daughter (who was 8 at the time) was pretty much traumatized and refused to work on the PC until I could demonstrate it wouldn't make the "scary screams" any more.
We were able to run the speech therapy program, but my daughter never did trust that PC and made me sell it when the therapy was finished.
myke
Re:My Experience with a Used PC (Score:3, Funny)
7.62 x 39 (Score:2)
A Romanian SAR-1 does a great job!
A shot or two will penetrate all the platters and leave them a twisted mess.
Re:7.62 x 39 (Score:2)
For average people (Score:2, Informative)
USB keys (Score:5, Informative)
Apparently, a few seconds in the microwave does not qualify as obvious, physical damage.
Re:USB keys (Score:4, Insightful)
Re:USB keys (Score:3, Insightful)
Is the potential loss (even if it is a very slight potential) of your company's trade secrets really worth $50?
Eraser! (Score:2)
With Threads Like These... (Score:5, Insightful)
I should also point out that I don't doubt any individual's account- I just don't know that I trust the whole population. Just a thought...
*****BOOOOOM***** (Score:2)
For $200, I will use shaped charges and implode and obliterate your computer. I also sometimes opt to run computers over with one of my various broken-down cars.
[Disclaimer: This is a joke (attempt). While like to watch expl
Eve of Destruction (Score:2)
Thermite drive casings (Score:2)
Thermite can be purchased for 60$ US Per 10 Lb from most pyrotechnic suppliers in the US (Also see special Effects and Welding)
Muratic acid left to sit a few days will do the trick too ($5 US at any HW store).
encryption (Score:2)
Some recent motherboards have the right idea: they come with an encryption key (a physical object) that you plug into the motherboard for encrypting the disks completely without OS intervention as far as I can tell.
Let's hope that kind of feature becomes standard on all motherboards.
data destruction = open source growth opportunity (Score:2, Interesting)
Taking a sledgehammer to the box might be more fun, but then that box is headed
drives are cheap, take the loss (Score:2)
DO NOT DESTROY STORAGE THEN "DONATE" (Score:5, Informative)
Nooo!!!
I worked as the technology re-use manager at a nonprofit organization whose mission was to get donated goodies, including computers (my responsibility), to small local charitable organizations. Our warehouse had pallet upon pallet of donated computers whose hard drives were removed as part of corporate donors' policies regarding data safety. Did we get those computers to community centers, adult education programs, inner city kids, etc? Heck no, we had to send them to the metal recycler for 2 cents per pound. Sure, per-storage unit hard drives are cheap but to get enough for a couple of hundred computers is a major expense. And yes, we applied to Maxtor, Seagate, IBM, HP and a couple of others to try to get them to donate hard drives but no dice.
The late-middle aged lady who wants to type and print the church newsletter has ABSOLUTELY no use for a computer without a hard drive and even less of an idea how to install one even if she did have budget to get one. Get a commercially available eraser program; there are plenty of titles and methods. Said church lady has NO IDEA how to extract prior data from a drive that was just plain formatted and a fresh Windows installation put on.
Mac OS X has a decent answer to this (Score:4, Informative)
Re:Why Bother? (Score:2, Interesting)
My mother is the computer teacher at a local gradeschool. She HATES when people say they have a computer to give her. Invariably, it's some 7-year-old PC that runs Win95 or some old Mac that just doesn't fit in with her network.
Students and teachers in schools want crappy computers as much as you do. (This being Slashdot, probably less than you do.)
If you can find someone that genuinely wants the machine because t
Re:The best way... (Score:2)
The Neodymium magnets are quite useful for the fridge (they'll hold a whole buncha take-out menus without budging). I even have one of 'em under the wall-mounted bottle opener. It'll snag a beer cap from 4" away.
The platters make a nice coaster, mobile, or wind chime. Good tech art.
Re:The best way... (Score:2)
Re:State standards (Score:3, Interesting)
Re:Can't help but wonder (Score:3, Interesting)
Lots of interesting data was extraced from the drive. Documents about legal cases, account information of his personal e-mail account, kiddieporn, the works.
Of course he had to step down.