The Need for Backup: Preserving our data and our memories

Sometimes, one gets asked a question in an informal context, and it triggers a whole line of thought. The other day, I was waiting for my car to have an oil change. Another customer asked what I did, when I told him, he asked if I thought that the whole “running a computer” thing would disappear in a few years. He was asking about whether the answer to backup was to put everything “in the cloud” and not worry about the details.

Coincidentally, I had just had a similar conversation with one of my smaller clients, who was seeking the best method to protect the information on his server.

To paraphrase the author Thomas Clancy, “A backup that cannot be successfully restored in a timely fashion, never existed.” In other words, depositing money in a bank has the eventual goal of being able to withdraw those monies. While a receipt is evidence of the deposit, it is only an artifact of part of the transaction. The ability to retrieve the funds at a later date is the true purpose.

Backing up “to the cloud” does not in and of itself address this issue; it merely re-apportions the responsibility for maintaining the data. Often, the responsibility and accountability can be compromised by this delegation. In effect, the questions have been resolved by moving them to someone else's desk. However, in both the personal and business cases, while the actual effort is outsourced, the liability in the event of a problem does not get outsourced. Thus, in many respects, it creates “off the books” risk.

This difference in responsibility is longstanding. Park your car in a parking lot, and the lot is at most responsible for the value of the car, as defined by its value as a car (typically set using a reference such as the “Blue Book”^[1]). If the car is a collectable that was given to you by your favorite late uncle, mother, or whatever, and is of great sentimental value, it is of no difference.

Many years ago, when I started taking pictures, long before the advent of digital photography, I learned an important rule: Never drop off all of your film for processing at the same place at the same time. An accident at the store, in transport to the processing laboratory, or an error in processing could destroy the images.

At that time, my preference was to drop off film one or two rolls at a time for processing by Kodak's own processing laboratories.^[2] Dropping the films off over a period of time meant that they went on different vehicles and were processed in different batches. When out of town or overseas, I would often drop off film to be processed wherever I was, and had the resulting slides mailed directly home, a trick my father had learned when he was in Europe during the 1950's.

Quality aside, no processing laboratory, Kodak or any other, accepted liability for the “consequential value” of the pictures. Liability was limited to an equivalent quantity of unexposed film and the related processing. Did I ever lose a roll of film? Fortunately, I did not. However, I do continue this practice whenever I deal with irreplaceable film.

How does this apply to backing up a computer? There are three issues surrounding backups:

cost
reliability
security

A remote backup service highlights its offerings often using a cost argument. Reliability and security must be taken on faith that the vendor will “do the right thing.” However, I have not seen any remote backup service, much less those on the consumer or small business level that will take responsibility for consequential damages if data is lost or compromised. These are serious issues, with large potential liabilities. Suppose one is a health care provider, and one's offsite backup provider loses control of unencrypted backup materials (or loses control of the encryption keys for encrypted backup data). While I am admittedly not an attorney, as a businessman, I would be concerned about the liability for disclosure of confidential patient information.

Similarly, third party providers often have less incentive to resist third party search warrants and subpoenas than one would like. On the reliability front, what are the non-financial guarantees that an outside service is actually taking reasonable precautions with your information? With the layers of infrastructure, hosting companies, carriers, and resellers, who is actually responsible?

Lastly, what about the privacy and security of your data? There have been a number of lawsuits against computer service technicians pirating interesting music, software, and images from computers that are brought in for service. If there is financial data on your drive, is it desirable for the data to be within someone else's control? If you have personal pictures do you want them potentially in circulation? At one site, it was reported that technicians had a habit of copying pictures of any attractive females.^[3]

In summary, the old saw “there are no free lunches” applies. Having a remote online service archiving your files is undoubtedly convenient. Whether it actually provides the security, privacy, and safety desired is a more complex question.

For businesses with multiple locations, I often recommend storing a set of backups at one (or more) of the other locations. Alternatively, a bank safe deposit box is a viable off-site location. Carefully consider your digital backup strategy. Now that many irreplaceable family moments are stored on portable hard drives makes it that much easier to lose irreplaceable memories by the simple act of having a shelf fail, or dropping something on the floor.

In a financial context, lost records can cause costs of thousands or tens of thousands in taxes and penalties.

In the end, digital media is certainly more compact than paper, but is far more vulnerable to a variety of hazards.

Notes

^[1]	The Kelley Blue Book, http://www.kbb.com
^[2]	As Paul Simon sang, “Don't take my Kodachrome away”
^[3]	“Geek Squad: A matter of trust”, May 1, 2008, Minneapolis StarTribune.

References

David Berlind “Should the law deputize computer technicians into nabbing child abusers?”, May 2, 2007.
Retrieved from http://blogs.zdnet.com/Berlind/?p=456 on May 4, 2009
National Conference of State Legislators “Child Pornography Reporting Requirements (ISPs and IT Workers)”.
Retrieved from http://www.ncsl.org/programs/lis/kidnet/reportreq.htm on May 4, 2009
Jeanne Sager “Should Computer Technicians be Mandated Reporters for Child Porn?”, Strollerderby: The Mother of all Parenting Blogs.
Retrieved from http://www.babble.com/CS/blogs/strollerderby/archive/2008/10/05/should-computer-technicians-be-mandated-reporters-for-child-porn.aspx on May 4, 2009
Chris Serres “Geek Squad: A matter of trust”, May 1, 2008, Minneapolis StarTribune.
Retrieved from http://www.startribune.com/business/18470879.html on May 4, 2009