postalref

Secure Destruction

Secure Destruction is an opt-in USPS service that shreds and recycles undeliverable First-Class Mail letters and flats that would otherwise go back to the sender. A mailer asks for it with a Secure Destruction STID, a code in each piece's Intelligent Mail barcode. USPS then sends a daily electronic notice of the pieces it sorted for destruction.

Updated October 28, 202642 sources

What it is

Secure Destruction is an opt-in mail service under USPS BlueEarth, the USPS brand of sustainable customer programs. It covers only letter and flat-sized First-Class Mail with an Intelligent Mail barcode. USPS charges no additional fee for it. The service became available nationwide on November 18, 2014.

Every participant is also enrolled in ACS, short for Address Change Service. ACS sends the mailer a piece's new address or the reason it was not delivered.

Its users are mailers whose undeliverable First-Class Mail carries personal information. It suits mailers who risk liability if they fail to destroy that information properly. Participating mailers spend less on receiving, handling and destroying returned mail.

USPS returns over 1.2 billion pieces of undeliverable First-Class Mail to mailers each year. Each piece destroyed instead is one USPS no longer processes, carries and delivers. USPS estimates that destroying 25,000 carrier-delivered returned pieces cuts carbon emissions by about 1 metric ton of CO2 equivalent. All destroyed mail is recycled.

How it works

The STID is a code the mailer places in the barcode to name the services it wants. A Secure Destruction STID matters only when a piece turns out to be undeliverable.

USPS sorts undeliverable letters with the Postal Automated Redirection System on CIOSS sorting equipment. Flats go through the flats version of that system on an AFSM100 flat sorter. The system reads the STID, applies an ACS or Nixie label and diverts the piece to a bin kept only for Secure Destruction mail. Mail without a Secure Destruction STID gets standard First-Class handling.

The steps for letters at a CIOSS plant. Flats follow similar steps on a modified AFSM100.

  1. Letter-size First-Class Mail enters a USPS plant with CIOSS equipment.
  2. The redirection system identifies, labels and sorts undeliverable pieces that cannot be forwarded.
  3. USPS trays and placards the sorted pieces and sends them to the shredding area.
  4. USPS feeds the pieces into an industrial cross-cut shredder at the facility.
  5. The facility recycles the shredded mail.

USPS records an event for each piece routed to the Secure Destruction bin. The Integrated Data System collects these events, and USPS builds the notification file from them. The mailer gets the ACS notice, with the new address or the reason for non-delivery, separately.

Choosing an STID

Each Secure Destruction STID combines an ACS Change Service Requested option with Secure Destruction. Change Service Requested lets USPS recycle or securely dispose of undeliverable mail unless forwarding is requested. Under Option 1, USPS discards all undeliverable mail. Under Option 2, USPS forwards a piece if it can and discards the rest. With a Secure Destruction STID, discarded mail is securely shredded and recycled.

USPS gives the Secure Destruction STID numbers only to mailers who have completed registration. IMb Tracing is an available option, not a requirement for the notices or for ACS.

Signing up

A mailer registers for Secure Destruction with the National Customer Support Center, the USPS office in Memphis that supports ACS.

  1. Use an Intelligent Mail barcode on letter or flat-sized Full-Service or Basic First-Class Mail.
  2. Use an existing OneCode, SingleSource or Traditional ACS account, or open a new one.
  3. Get access to Electronic Product Fulfillment, the website that delivers the notices.
  4. Complete and submit the Secure Destruction Enrollment Form.
  5. List on the form every Mailer ID that will request Secure Destruction.
  6. Choose a Secure Destruction STID from the list USPS sends after registration.

The notification file

Secure Destruction notices arrive as a file in the EPF account tied to the mailer's ACS account. USPS posts the file once a day around 8 am, 7 days a week. The file is a ZIP archive protected with an 18-character password. A day with no destroyed pieces still gets a file, with a record count of zero.

The ZIP file's name follows the pattern D??????_??????_YYMDD.ZIP. Its parts are:

  • D marks a Secure Destruction file.
  • Each ?????? is the six-digit Secure Destruction or ACS account ID.
  • YY is the two-digit year.
  • M is the month: 1 to 9 for January to September, A to C for October to December.
  • DD is the day.

The ZIP holds one CSV file named the same way without the second account ID, such as D100300_13225.CSV. The file is comma-delimited, with fixed-length fields and fixed-length records. It starts with a header record holding the account number, the date and time, and the record count. The account ID has six digits and is not the Mailer ID, which has six or nine.

After the header, each detail record reports one destroyed piece. Its fields are:

FieldWhat it holds
Record typeD, marking a detail record
Mailer IDThe USPS Mailer ID
Intelligent Mail barcodeThe barcode's digits, set off by =” and ” so Excel shows them as text
Scan dateThe date of the original transaction, as MM/DD/CCYY
Scan timeThe time of the original transaction, as HH:MM:SS
Facility ZIPThe 5-digit ZIP Code of the processing facility

Commas separate the fields, and spaces fill each record out to its fixed length.

A sample detail record shows the fields in order, up to the filler spaces:

`` D,912345678,=”0051391234567865432138134754857”,04/14/2013,17:25:54,38111, ``

It reports a piece with Mailer ID 912345678, scanned on 04/14/2013 at 17:25:54 in a facility at ZIP Code 38111. Spaces fill positions 74 to 168, and a carriage return and line feed end the record.

A redirection barcode is the barcode USPS prints on the label of a forwarded or returned piece. A notice can carry one when a forwarded piece proves undeliverable at its new address. It keeps the mailer's STID, Mailer ID and serial number. Its barcode ID, 93, and its routing ZIP Code differ from the mailer's barcode.

How the mail is protected

USPS employees shred the pieces with industrial cross-cut shredders inside secure USPS facilities. The shredding happens in the same plant that found the piece undeliverable. Destruction normally takes place within 24 to 48 hours of a piece being marked for it.

A piece stays live mail until it is shredded. Like all mail, it has the full protection of the law. An employee who tampers with it or takes it out of a facility faces penalties under 18 USC 1708.

The Postal Inspection Service monitors Secure Destruction operations, independently of USPS management and employees. It also makes periodic security assessments of the process. The USPS Office of Inspector General investigates any allegation of mail theft by contractors in the process.

USPS shreds to at most 0.24 inch by 1 inch, a surface of 152 mm2. That is smaller than the NAID shredding standard allows. NAID, the National Association for Information Destruction, promotes standards for the secure destruction industry.

The personal information Secure Destruction protects falls in the Confidential class of DIN 66399, the international standard for destruction. Secure Destruction meets and exceeds the level that standard requires for confidential information. Its cut size falls within P-Level 4 for both letters and flats.

USPS has no access to the personal information inside a piece. The notices it sends carry no personal information either. They hold only data from the front of the envelope, read from the mailer's barcode.

Data security rules

Access to personal information is a core factor in whether most data security rules apply. USPS has no such access, so it holds that the rules in the table don't apply to Secure Destruction. Mailers that use the service don't have to oversee a third-party handler to prove they comply with their industry's rules.

Rule or standardHow USPS holds it applies
HIPAA, the Health Insurance Portability and Accountability Act, whose rules protect health informationUSPS is not a covered entity, such as a health plan. Nor is it a business associate, a third party that handles health information for one, because that information stays sealed in the piece. The Security Rule names USPS as a conduit that needs no business associate contract.
PCI DSS, the Payment Card Industry Data Security Standard, for anyone that stores, processes or transmits cardholder dataUSPS mail services don't store, process or transmit cardholder data, which stays sealed in each piece. The standard doesn't apply to Secure Destruction.
NAID certification, which many mailers require of the companies that destroy their returned mailUSPS found that it doesn't apply to USPS and would conflict with the USPS mandate to protect the sanctity of mail.
The Federal Information Security Management Act of 2002It doesn't apply to USPS, which isn't an agency under the law. USPS complies with it voluntarily as a general rule.

USPS screening of new employees, set by Handbook EL-312, exceeds the NAID standard and has no time limit on the criminal background search. NAID criteria for drivers and vehicles don't apply, because USPS never moves the mail to another facility for destruction. USPS sends a notice for each destroyed piece, which exceeds the NAID standard of bulk notices. USPS is self-insured, so the NAID insurance criterion doesn't apply either.

USPS counts mail sent for destruction as live mail, so a mailer's liability risk is no greater than for outgoing mail. The Federal Tort Claims Act's postal matter exception excludes claims arising from the loss, miscarriage or negligent transmission of mail. USPS holds that the exception covers employees who misappropriate the information in a piece.

Rules

Within that intelligent mail barcode, the mailer must include one of the available SD service type identifiers (STIDs).

Each piece must carry a Secure Destruction STID in its Intelligent Mail barcode. Without one, the piece gets standard First-Class handling.

Before a mailer uses and SD STID on a mailing, they must first register (see section 3 Mailer Requirements) for the service with the USPS National Customer Support Center (NCSC) in Memphis.

A mailer must register with the National Customer Support Center before using a Secure Destruction STID on any mailing.

As a pre-requisite, mailers must be enrolled for Address Change Service (ACS™) prior to enrolling for SD mail service.

A mailer must be enrolled in ACS before enrolling in Secure Destruction.

Only letter and flat-sized First-Class Mail® with an IMb® is eligible for SD service.

Secure Destruction covers only First-Class Mail letters and flats that carry an Intelligent Mail barcode. Other mail classes don't qualify.

If a printed endorsement is desired, it is recommended that either “Change Service Requested” or “Electronic Service Requested” is used.

First-Class Mail with an Intelligent Mail barcode needs no printed endorsement. A mailer who prints one should print Change Service Requested or Electronic Service Requested. Any other endorsement overrides the barcode, and the piece gets no Secure Destruction.

It is not possible to receive SD notices in an ACS account that is for Traditional ACS only.

An account set up only for Traditional ACS can't receive Secure Destruction notices. Adding a Mailer ID makes it a Combined ACS account, which can.

If these MID’s are not in the ACS account indicated on the form, they will have to be added to that account.

Every Mailer ID on the enrollment form must be in the ACS account the form names. A Mailer ID that isn't there must be added to it.

If your primary method of matching Secure Destruction data and ACS notices to your mailing list is with the IMb data, you will need to use the 18-Digit tracking information (STID, Mailer ID, and Serial Number) to find the match.

A mailer who matches notices to a mailing list by barcode must use the 18-digit tracking part: the STID, Mailer ID and serial number. The barcode ID and routing ZIP Code can differ on a forwarded piece.

What goes wrong

Secure Destruction happens only when automation equipment sorts a piece to the Secure Destruction bin. If the barcode can't be read or the piece can't be sorted properly, the service cannot be provided. These circumstances keep a piece out of Secure Destruction:

  • An unreadable barcode.
  • A damaged or non-machinable piece.
  • A wrong STID in the barcode.
  • The wrong mail class.
  • A reason for non-delivery for which Secure Destruction isn't available.
  • A redirection system that cannot capture an image of the piece or read critical information from it, such as the mail class.

The reasons for non-delivery that keep a piece out of Secure Destruction are:

  • Deceased
  • False Representation and/or Lottery Law
  • Delivery Suspended to CMRA
  • Not Deliverable at CMRA
  • No Such Post Office
  • Returned for Better Address
  • Returned for Postage
  • Non-mailable

When the barcode isn't read, the printed endorsement decides what happens. A piece endorsed Electronic Service Requested is treated as unendorsed and forwarded or returned to the sender. A piece endorsed Change Service Requested is treated as Return Service Request and returned to the sender. Unendorsed First-Class Mail is forwarded or returned with no additional postage and no separate address correction notice.

Mail the redirection system rejects may go to the nearest Computer Forwarding Service unit, which processes it by hand. There it is forwarded if possible or returned to the sender. Secure Destruction isn't available in that unit.

ACS can fail when the barcode is unreadable or the Traditional ACS Participant ID is invalid or missing. The piece is then forwarded or returned, by its printed endorsement and any change-of-address order. USPS does not guarantee against a single sorting error for any piece.

A mailer can get a Secure Destruction notice in EPF with no matching ACS notice. For Full-Service mail, ACS notices come through the Business Customer Gateway. When USPS can't match the ACS data to the mailing's eDoc, the gateway shows no ACS notice. A forwarded piece gets a Secure Destruction notice only if it proves undeliverable at the new address.

Terms

Secure Destruction NotificationSD eNotifications
indicates the mailpiece was securely destroyed by the USPS
Service Type IdentifiersSTID, STIDS, STI, Service Type IDs, Service Type ID(s)
A unique three-digit code embedded in the Intelligent Mail® barcode (IMb®) that indicates the service type for an individual mailpiece.
Intelligent Mail BarcodeIMb, 4CB, Intelligent Mail barcode (piece level barcode), 4CB, 4-CB, USPS4CB, USPS 4-State Customer Barcode, 4-state customer barcode
The IMb is a height-modulated barcode that encodes up to 31 digits of mailpiece data into 65 vertical bars using a 4-state symbology.
Address Change ServiceACS, Address Correction Service
a post-mailing service that provides USPS with instructions on how to handle Undeliverable as Addressed (UAA) mail and provides you with electronic Change of Address (COA) information or the reason for non-delivery
Change Service RequestedCSR, CS
Allows the USPS to recycle or securely dispose of mail that is UAA, unless forwarding is requested
Green & SecureGreen & Secure option
allows USPS to dispose of undeliverable mailpieces in one of two ways, either with or without secure destruction.
Electronic Product FulfillmentEPF, Electronic Product Fulfillment (EPF) web site, Electronic Fulfillment Website
A secure web-based application managed by the National Customer Support Center in Memphis TN that is used to post and receive Address Management and Address Information System products, including ACS fulfillment files.
Postal Automated Redirection SystemPARS, Postal Automated Redirection Software, Postal Automation Redirection System, Postal Address Redirection System
Delivery Barcode Sorters were modified with reading and labeling modules to allow them to be used to automate the processing of Undeliverable As Addressed (UAA) letter mail.
Nixies
undeliverable for reasons other than a move
Mailer IdentifierMID, Mailer IDs, Mailer Identification, Mailer Identification Number, USPS Mailer ID
MID is a unique 6- or 9-digit number that identifies the mailer or the mailer’s client.
P-Level 4Particularly Sensitive & Confidential Data
Particularly Sensitive & Confidential Data surface area: ≤ 160mm2 and strip width: ≤ 6mm
Business AssociateBA
any third party who handles protected health information (PHI) in providing a service for a covered entity (CE)

Documents

Tech Guides

Fact Sheets

FAQs

Contact Lists

Applications/Forms

Contacts

Questions about enrollment, participation and the notices go to the ACS department at the National Customer Support Center. Its phone is 877-640-0724, option 1, and its email is acs@usps.gov. USPS recommends email, because it expects high call volume. Other program questions go to the Secure Destruction Program Manager on the USPS headquarters Sustainability Initiatives Team, at 860-463-1159 or ronald.f.robbins@usps.gov.

Sources