Path: utzoo!utgpu!news-server.csri.toronto.edu!rutgers!ucsd!ucbvax!agate!shelby!morrow.stanford.edu!pangea.Stanford.EDU!karish From: karish@pangea.Stanford.EDU (Chuck Karish) Newsgroups: comp.org.eff.talk Subject: Re: "Bad" backups Summary: Keep the tapes Message-ID: <1990Nov10.185429.2486@morrow.stanford.edu> Date: 10 Nov 90 18:54:29 GMT References: Sender: news@morrow.stanford.edu (UNIX News Service) Organization: Mindcraft, Inc. Lines: 40 In article Bob Izenberg writes: >A computer that you have responsibility for had a file on it >that contained fraudulently obtained information, perhaps credit card >numbers of celebrities or public officials. The file has been removed, >but you know that it's on regular backups that were made of that computer, >going as far back as six months. These backups represent protection against >disaster for you and the computer's users. Do you save the backups, knowing >that the illegal file is on them? Or do you erase or destroy the backups, >and possibly leave yourself in the lurch if they are needed? I'm following up on this subject rather than responding to the straw poll because I thiunk there are are interesting and relevant issues here that can't be summed up into 'YES' or 'NO'. My initial response to this question is that my responsibility is to see that the information in question isn't disseminated, not necessarily to remove all evidence that it was once available on line. Following this logic, I'd keep the backups secure, and keep a note with them to remind me that certain steps must be taken after a full restore (deletion of the offending data). It would be irresponsible for me to destroy the backups and risk significant harm to my business in the event of a data-loss disaster. In addition, I might be required by contract and, in some cases, by law to maintain certain records; in fact, I am working on two projects right now that have such requirements. To destroy backup tapes would reduce my assurance that the required records could be retrieved at any time. Nontheless, it might be the case in this situation and in the related situation where improperly-obtained copyrighted information is on tape that my approach would not stand up to a strict legal interpretation. I could wind up in a standoff with the rightful owner of the data in which neither of us would trust the other to safeguard his data, and the only solutions would be to destroy the tapes or to restore, sanitize, and re-archive the data. -- Chuck Karish karish@mindcraft.com