Everyone agrees you should have multiple, geographically dispersed backups but most don't do anything about it. I thought I'd post some ideas here, inspired by Martin Focazio's "mutual assistance" post from last week.

First of all everyone should read the site The Tao of Backup to get some general understanding of backup issues. Yes, it's a sales site for a specific product, but it's entertaining and informative.

The next obvious thing is you can get free email accounts from Google, Yahoo, etc. that wil hold up to 1GB of files. So if you have something important you can just email it to yourself and that gives you one level of protection. Of course for privacy you should encrypt it: www.gnupg.org . And it can't hurt to use multiple such accounts. But this is only really practical for small, individually important files.

For whole-system backups I've been using hard drives. Just buy a new drive once or twice a year, copy my whole system to it, and stash it. Safe deposit boxes are good places (rental space in a bank vault!) for that. Again, encrypt.

Finally I'd like to discuss an idea for mutual assistance with geographic dispersal. The idea is you'd set up reciprocal agreements with say five other people (people you know, ETS members, or whoever), at least a couple of them in distant states and at least one on another continent. The idea is you send them your backups for safekeeping, and they send you theirs. I'll spell out a concrete proposal based on the idea of sending out a backup once a week. So you'd send a backup to person A the first week, person B the second week, etc., cycling around to person A after 5 weeks so each person would get a backup from you about once a month. The backups would be differential backups on CD-R or DVD-R, usually not more than one or two discs per mailing. When Blu-ray or HD-DVD becomes available, you can use that.

The basic agreement would work like the following. I'm describing a protocol between a "sender" (who sends out these discs) and a "receiver" (who stores them) but the idea is it's a reciprocal agreement, so each participant would be both a sender and a receiver and therefore carry out both parts of the protocol. Comments and improvements are requested. The idea is to come up with something standard that ETS members can use among each other, if they so desire. Obviously individual participants can come up with their own modifications as well.

====

1. Receiver obtains an empty CD-ROM "cake box" container (cylindrical case that holds 50 cd-r) and writes sender's name on it (not too visibly). Receiver puts this container someplace reasonably secure (e.g. in a drawer or on a bookshelf, where it won't get easily lost) in his home or office. It's not necessary to go to great lengths (like a fireproof safe) to protect the container--that's why it's a /redundant/ backup.

2. Every now and then (say once a month), sender mails a differential backup (normally one or two discs) to receiver. Receiver puts these discs into sender's container. Receiver doesn't have to keep any records or confirm that the disks have arrived. The idea is to keep this as simple as possible. Receiver should probably confirm getting the first set of discs (so sender knows the system is working) but after that sender should just assume that it works, maybe exchanging status messages by email once or twice a year.

3. If the container gets full, receiver simply throws away the oldest 20 or so discs from the container to make space for new ones, and notifies the sender by email that this has happened.

4. (Recovery): If sender requests it, receiver will mail sender up to 3 discs at receiver's expense (having the receiver pay avoids pre-funding or reimbursement headaches, and 3 discs should weigh just a few ounces. Since it's a reciprocal arrangement, it's fair) to any address (worldwide) specified by the sender. Receiver will use ordinary postal first class mail or air mail as applicable. Sender can invoke this provision only once. If sender wants more than 3 discs or more than one recovery, sender must get receiver's agreement and may be required to pay any mailing expenses in advance. (In practice, sender would normally just reimburse the receiver after a recovery, and ask for an agreement to reset the protocol). Sender should avoid special requests (like overnight shipping) that cause inconvenience for the receiver unless absolutely necessary, or unless agreed to at the very beginning.

5. (Privacy) Sender and receiver will keep their participation in the agreement confidential (i.e. I won't tell anyone that I have your backups, and vice versa). They will keep each other's personal contact info confidential. Receiver won't attempt to read sender's discs. Sender should, however, encrypt any info on the discs, in case they fall into the wrong hands (such as when receiver throws away old ones). Exception: sender can include receiver's contact information in sender's will, so sender's estate can request recovery if sender is deceased.

6. (More privacy--optional) Any recovery requests should be accompanied by a security password preagreed at the start of the agreement. That includes requests from sender's survivors if sender is deceased--sender should supply them with the password (write it into the will).

6a: Sender's instructions for disposal of the discs if sender is deceased are: [-----fill in-----].

7. (Disposal--optional) If sender requests it (accompanied by password), receiver will dispose of all of sender's discs, preferably with minimal delay (imagine the sender being hassled by stalkers) and unrecoverably (i.e. physically destroy the discs if convenient, and throw them away at multiple locations reasonably distant from receiver's home). This can only be invoked once without setting up a new agreement.

7. (Performance): The basic standard of performance in this agreement is that if you've said you'll do X, that means you'll do it if it doesn't cause significant inconvenience. Heroics are not expected. If you have to bug out, don't take other people's discs with you--you have much more important stuff. If you have an earthquake, you don't need to search the rubble afterwards for other people's backups, just bulldoze it. Sender is responsible for having enough redundant agreements like this to withstand such losses. If you're supposed to do X but you don't manage to do it or don't get around to it, or if you lose someone's discs, etc., try to notify the other person. If the other person notifies you that he was supposed to do X for you but didn't, don't get upset. If you think the other person has gotten flaky, don't lose your cool, just set something up with someone else instead. Please do notify other participants of things like address changes or if you need to exit the agreement. Also, try to accomodate the other person's schedule. If he says he'll be exploring Antarctica for the next 3 months and won't be able to fulfill your recovery requests during that time or accept discs from you til he gets back, but he wants you to meanwhile keep storing his discs, try to accomodate if the request is reasonable. If things get too one-sided, back out gracefully. Use common sense.

8. (Liability) This agreement describes an informal exchange of personal favors, and personal favors don't always work out. Its complexity is just to spell out precisely what's expected. It's not a business document and it's not a legal contract. It implies no guarantees that any expectations that it spells out will actually be met (though they normally will be, assuming participants are basically responsible people, which is another one of those risky expectations). Businesses needing disaster data recovery should sign up with professional disaster recovery services and not rely on a loose (but cheap) scheme like this. Participants accept no liability whatsoever for anything that might happen with the another person's backups, including through negligence. However, participants are still responsible in the case of deliberate, improper privacy breaches.

9. (More liability) No participant is expected to do anything illegal and this takes priority over everything else. If you get a valid judicial or law enforcement order to hand over someone's discs, then hand them over. If you get a disposal request and you have concrete reason to think sender is trying to illegally destroy evidence of something, refuse the request. If you read in the newspaper that sender has gone on a terror spree and is being hunted by the FBI, call the FBI and give them whatever you have (assuming you think the manhunt is legitimate). But except in such extreme cases, if you don't have concrete reason to think laws are being broken, then follow the agreement according to your best judgement, favoring the other person's privacy when possible. E.g., if you get a civil subpoena for someone's discs, try to promptly notify the sender so he has a chance to oppose it in court, rather than just handing them over (normally there's a several day deadline in these situations, so wait til the end). Note that the confidentiality provision is intended to avoid most of these situations--if no one knows you have the discs, they can't hassle you for them.

10. (Termination) Any participant can terminate the agreement by notifying the other party, preferably with some advance warning (say 1 month). After termination, no new discs will be accepted but if possible, old discs should still be retained and recovery requests honored, for an additional 3 months or by agreement with the other person. After that, receiver should dispose of any stored discs. If a receiver hears nothing from a sender for 6 months and sender doesn't respond to contact attempts, that should be considered a termination. Receiver should retain the discs for another 3 months, then dispose of them unless contact is reestablished.

You laid that out very well, Paul. Nice job. I'll second reading the "Tao of the Backup."

Your idea is a very good one.

I think it's much simpler though to bring a burned DVD to work and chuck it in a file drawer (encrypted of course), or once in a while, give a DVD to family that lives a certain distance from where you are. My point is that the mailing issue might be too much of a hassle for some people.

My two cents. <img src="/images/graemlins/blush.gif" alt="" />

The trouble with leaving discs at work is your work can be clobbered at the same time as your home (think of hurricane Katrina a couple weeks ago, and maybe Rita this week). The same goes for nearby friends and family. They have to be far enough away that it's not convenient to give them discs in person, which means using the mail.

Also, removing burned discs from an office can be difficult if you work in a security-conscious company, especially if your employment is ending for whatever reason. (We hired a programmer whose previous job was at a bank programming financial systems. When he gave them 2 weeks notice that he was leaving, they escorted him off the premises immediately and sent him a check for 2 weeks salary, standard procedure, nothing personal, anyone who was about to leave the bank simply wasn't allowed to touch sensitive systems or have other access to inside info).

Finally, friends and family are usually not willing to deal with stuff like getting crap in the mail and storing it, even at the level of just tossing the received envelope in a cardboard box and not losing it. It takes a preparedness buff (e.g. ETS inhabitant) who is into this kind of thing and thinks it's fun, or else ($$$$$) a professional who's getting paid for it.

Mailing discs is easy. You can get compact CD mailer envelopes that will hold up to 3 discs (that's why I chose the 3 disc maximum for recovery without special arrangement) and then just slap preprinted address labels and stamps on them and toss them in the mail like letters. So it's just a question of how often you get around to burning a disc. Yeah in practice I might do it just once a month, around the time I pay my bills and do other routine stuff like that. That's mostly because of the nuisance of burning them rather than mailing them.

Thanks, paulr. Very thoughtful post.

I would just add one clarification to your excellent protocol. This scheme is probably best limited to just data files, like documents, Quicken files, etc. The kind of scenarios that would necessitate having a backup in a geographically distant location (earthquake, flood, fire, etc.) would likely destroy your computer. Unless you were buying exactly the same model, you would unlikely need to recreate your operating system. You can keep those kinds of backups close by your PC (protected, of course). That should help minimize the number of CD's that need to be mailed.

Good point about data files, though that's "application layer" and not a protocol issue. The document should probably say something about it though.

There's another issue which is about disposing of old discs. Suppose you have 100 GB of data files. Maybe instead of having the receiver start with an empty CD cannister, you want to send him a complete backup set (12 DVD-DL dual layer 8.5 gb discs) at the beginning and further discs would be updates against that set. That means that the original complete set needs to be separated from the updates (maybe by using different colored discs or something) so that old updates are thrown out while the complete set is preserved. Anything like this needs to be as foolproof as possible for the receiver without adding inconvenience like a second cannister.

Maybe there's some kind of software solution possible that puts part of a full dump on every differential or incremental disc. I'll think about this.

Clearly you've put a lot of thought into this. My preference is to use an on-line backup service. Mine makes two mirrored backups at two widely distant remote locations. My software can Image, or Zip/compress a file small enough to upload daily. This is automatic, and unattended. It accounts for any changes I've made that day. It can be encrypted.
Retrieval can be from anywhere, or anyone to whom I've given access passwords. I have on my HD one folder into which I scan and keep updated critical personal documents.

YMMV, but for me this works well and costs ~$5.00 per month for a 140Meg compressed file. Costs may vary: mine is a part of my telephone DSL plan.

Yeah, online backups are by far the most convenient if you're talking about just a few MB of data at a time AND you have broadband. Send a few GB of digital camcorder video through your dialup modem and you'll see why mailing discs is still worthwhile <img src="/images/graemlins/wink.gif" alt="" />. This isn't just for critical personal documents, it's for backing up everything, like your photo or video collections (that's why you bought that 300GB hard disc in the first place). With a current high res digicam, even a few hundred vacation snapshots is over a GB of data. And a mini-DV camcorder chews up about 11 GB per hour.

Well thought out, and your response to Bee shows you've had experience in IT and user pitfalls.

One thing I did for a while while I was running an ISP was I gave a hard drive to a friend who also had an ISP but was 500 km away.
It went into one of his servers, and I used FTP to transfer my data for backup purposes.
Unfortunatly I got out of the ISP 8 years ago, and he followed 2 years later, so that ended. (and I didnt get my drive back)

My first office net was on Unix with 35 dumb terminals. Sometimes I miss the simplicty of the thing. We had two hard drives, one the mirror of the other. When we finally became aware [1990 or so] of how dependent on data we had become, we installed a pull out chassis for the second drive so somebody took it home at night,

Then, there was a fire in a high rise office building down the street, and they 'discovered' that it was laced with asbestos. Everybody was denied access for -- well, forever, without gear. All the client files, all the evidence, everything was 'contaminated.' They had no off-site backup.

They have now implimented a key-person system, based upon CDs. 3 people take home a current disc every night, un-encrypted, because who knows what it might take to get back up? They have about 1000 gig off site [imaged files] with a commercial service. But, their base data is still going home with 3 people, every night.