Zhang wrote a note and put up flyers about the theft, which was picked up by ABC News and which a friend of his posted to his Facebook page, and which was then posted to Reddit and many other websites beyond that. He offered $1000 to the thieves for the data, telling them exactly where on the disk they could find it, giving them the password, and telling them they could keep the computer already; he just wanted to graduate.

Now, in honor of the “Everything Wrong With … in X Minutes” CinemaSins YouTube movie spoofs (and they’re hysterical), here’s everything wrong with this story.

1. “Zhang’s laptop had been in an unlocked room in Wright-Rieman, which houses laboratories.” People can walk into Rutgers University lab rooms and walk out with laptops? Doesn’t campus security worry about thieves stealing other equipment, student records, dangerous chemicals, and so on?
2. “Rutgers is an open campus,” said [Rutgers Police Lt. Paul ] Fischer. “It’s not like a small liberal arts college where it’s gated in. So, even if the buildings are secured, people can piggyback in.” This is the reaction of the security guy, whose job it supposedly is to keep the campus secure? Oh well, people can walk in and take things?
3. Campus security doesn’t have security cameras, even in laboratories where people are working with chemicals and on laptops?
4. Does Rutgers really want their security guy on national television telling everyone how easy it is to steal things from the campus?
5. Just how many things get stolen from Rutgers, anyway?
6. If it’s so easy to steal things from Rutgers, wouldn’t it be a good idea for the campus police to tell this to the students, before students lose five years of research?
7. “Fischer said that he wouldn’t suggest offering monetary rewards in the future” because it can invite fraud. Okay. What should the student have done differently (other than your barn-door suggestion that he hang on to his laptop next time)? Can’t he get the student to withdraw the reward if it’s such a bad idea?
8. Is the Rutgers security guy working with this student to ensure he doesn’t agree to meet someone, get bopped on the head, and also be out $1000? Or to otherwise protect him from fraud?
9. Does the Rutgers security guy think that having the theft nationally publicized on ABC News is a smart move? And on Facebook? And on Reddit?
10. Shouldn’t the Rutgers security guy suggest to Facebook that maybe it would be a good idea to redact the student’s personal information from the posting, which has more than 33,000 shares?
11. Is the Rutgers security guy maybe checking Craigslist? And eBay?
12. Doesn’t the chemistry department have a server to which students can save their data? Hell, I went to Boise State and we had that.
13. If it’s this easy to steal things from campus, and there’s no provision for students to back up their data on campus, and nobody warns students their work is that vulnerable, and the student may have to start his research over, doesn’t he have the basis of a nice lawsuit?
14. Just what sort of chemical research is this student doing, anyway? Do we need to worry about a new kind of poison gas or IED springing up in New Jersey?
15. How competitive is the chemistry research program at Rutgers? Is it possible the thief is someone in his department who’s fighting with him for grants or something?
16. What are the chances that the student isn’t actually ready for his thesis defense and this is his way of procrastinating until the laptop is “found”?
17. This student’s been going to Rutgers for five years and he didn’t know the buildings are insecure?
18. “…from where his computer was taken sometime between 10 a.m. and 5:15 p.m.” This student leaves his laptop unattended in an unlocked room from 10 am to 5:15 pm and is surprised that it’s gone? Are we sure that Lost & Found didn’t pick it up?
19. We’ve got a student smart enough to be getting a PhD in chemistry but not smart enough to keep from leaving his laptop in an unlocked room?
20. Or to copy his data to a DVD?
21. To a thumb drive?
22. To a cloud storage service?
23. To an external hard disk?
24. To email it to himself?
25. To do a backup? “’A lot of people are asking me why I didn’t back up my data,” Jim told the Daily Dot. ”I think the reason is that I am pretty busy recently and this kind of thing never happened to me before.’”
26. “The posters contained very specific instructions and details regarding his dilemma, including his laptop’s password.” Well, that certainly makes it easier for the thieves to use the laptop.
27. Where is the student getting the $1000, anyway? And how did he come up with that figure?
28. The posts also included his phone number. If the thieves even wanted to call, would they be able to make it through the blizzard of harassing phone calls he must be getting by now?
29. He has also suffered several scamming attempts. “’There are a few people sending me messages saying they have my laptop and asking for money, but when I asked for proof, they cannot give anything to me,’ he said.” You think?
30. Really, should this student even be allowed to be messing with chemicals in the first place?
31. Does the student think that the thief is stupid enough to show up to a meeting to exchange the data and money?
32. Or to pick it up at a mailbox?
33. How exactly does the student think this is going to work? The thief will send him the data and trust him to send the money? He’ll send the money and trust the thief to send him the data? The thief will hand him the data and hang around while he checks it?
34. Even if he gets the data back, how is he going to know that the thief didn’t change some of the data just to mess with him?
35. How many backup companies are offering to pay all the student’s expenses in return for his doing an ad for them?

Now in its third year, the event — deliberately scheduled for the day before April Fool’s Day, to ensure your data is backed up in the case of a prank gone awry — is intended to encourage people to make sure their data is backed up, much like the days that daylight saving time starts and ends get piggybacked by Change the Batteries in Your Smoke Detector Day.

Last year, I didn’t find out til afterwards, but this year, I found out in plenty of time to celebrate it properly.

As of Thursday, almost 4500 people had pledged to observe the day, which not only includes making backups of your own data and checking your restores, but also alerting your friends and family.

Vendors such as Carbonite and Kroll also released surveys associated with backups. The Carbonite study found that 30% of small businesses believe their backup plan is insufficient, 45% said their organization had experienced data loss, and 14% were never able to restore their lost business information.

Small businesses often lack a formal disaster recovery plan is because they do not have the budget, the survey showed, but there’s an average cost of about $9,000 for a small business to recover their data after a failure, Carbonite said.

Surveying its own users, Kroll Data Recovery found that of the 81% who do have backups now, 53% use an external hard drive, while 15% used tape and 15% used online or cloud backup services. And while 60% of its customers did have a backup running at the time of the data loss, it wasn’t current or was operating incorrectly, Kroll warned.

World Backup Day now also has posters and t-shirts, as well as a Tumblr. In addition, the event asks people to take pictures of themselves celebrating. “Be sure to take pictures or videos of you promoting World Backup Day!” reads the website. “Just send them to hello@worldbackupday.com, tweet us @WorldBackupDay, or submit them to our Tumblr!” There’s also a Facebook page, an Instagram feed, and a Pinterest page.

In addition, there’s a full press kit, which includes an infographic.

All kidding aside, it’s not a bad time to re-examine your backup strategy; a number of vendors actually do have World Backup Day Sales.

There’s even a contest.

And as a bonus, this year’s World Backup Day is also followed the next day by my favorite holiday, Cheap Chocolate Day, though you can’t always count on that happening, plus some people hold out for the traditional February 15 for that one.

That’s the question that the Electronic Privacy Information Center (EPIC) is asking the Supreme Court to decide, in a friend-of-the-court brief it has filed in the case of Jennings vs. Jennings.

“The privacy group is filing an amicus brief asking the high court to accept an email privacy case from South Carolina that’s exacerbated confusion over what courts consider electronic storage,” writes the political journalism site Politico. “In the filing, submitted on behalf of nearly 20 privacy advocates, EPIC tells the Supreme Court that email privacy rules and definitions have become increasingly unclear, thanks to the rise of cloud computing, and Congress has yet to step in to fill the gap.”

The whole issue of what “storage” is became an issue last fall, when a South Carolina Supreme Court ruled that, under the Stored Communications Act (SCA), email in a Yahoo! account should not be considered protected from unauthorized access because email sitting in the cloud was not “stored” the same way as it would be sitting on one’s own computer — which was protected.

This means that was also true for anyone who uses a cloud-based email system — not just Yahoo, but also Gmail and a plethora of other systems. Not to mention some components of the federal government itself that have moved to cloud-based email, EPIC notes in its brief.

The original case was a domestic dispute — a husband was cheating on his wife, and the wife’s daughter-in-law figured out the husband’s e-mail password and logged in to his personal account to read the e-mails between the husband and his paramour, wrote Orin Kerr in The Volokh Conspiracy legal blog. ”The daughter-in-law found the e-mails and shared them. The husband filed suit under several laws including the Stored Communications Act, 18 U.S.C. 2701, which only allows a civil suit if the e-mails accessed were in “electronic storage.””

The Supreme Court may get involved because this decision conflicts with a similar case by the Ninth Circuit Court in 2004, wrote Andrew Hoffman at the Information Law Group blog.

“The Jennings opinion establishes a split with the Ninth Circuit’s opinion in Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004), which found that emails that had been received, read, and left on the server were stored “for purposes of backup protection” and therefore within the ambit of the SCA,” Hoffman wrote.

This is a problem because it’s not good for different courts to have different ideas of what does and doesn’t constitute a legal issue, Hoffman wrote. “Thus, until the split of authority is resolved, the same conduct will disparately subject some individuals to civil liability, depending on the interpretation of the SCA applied by the court.  Such disparate interpretations could create an incentive for forum shopping and pose conflict of law questions, when multiple states (and even nations) could be involved in an email hacking case.  Such disparate interpretations may also pose problems for employers investigating suspected employee misconduct involving webmail.”

Just to show how confused the South Carolina court was, its judges couldn’t even agree on why the email wasn’t stored, but instead had three different opinions, Kerr wrote.

Aside from the issue of protection, the issue of defining what storage is is important because it is the primary difference between the Stored Communications Act — the law under which the original suit was filed — and the Electronic Communications Privacy Act, according to EPIC.

A related question is “What is a backup?” because some of the legal arguments also hinged on whether the email retrieved from the account was the “only copy” or a backup — a question that is kind of irrelevant in cloud storage, which may feature multiple replicated copies of data, EPIC writes.

“A wealth of personal and private messages are now stored remotely in the cloud, and their protection depends on the interpretation of ‘electronic storage’ under ECPA,” EPIC writes.

Here’s a breakdown of the issues involved.

Was the disk drive solid-state or traditional spinning disk?  There has been increasing use of solid-state drives in computers, either due to interest in improved performance or in reaction to last year’s Thai flooding, which damaged a number of hard disk manufacturing plants and made spinning disk storage more scarce and expensive.

What’s the difference? While both kinds of drive are susceptible to damage — as anyone who’s lost a drive by dropping it knows — solid-state drives are even more susceptible to damage.

“Many SSD hard drive failures are in fact unrecoverable,” writes The Inquisitor. “If the remapping tables that keep track of data in memory cells get trashed the data is effectively randomized and mixed up with data blocks which were marked as corrupted and unusable even before the SSD failed. Many SSD models also come with internal encryption that will make the lives of data forensics experts difficult.”

If it was a spinning disk, how was it damaged? For the sake of argument, though, let’s assume it’s a traditional spinning disk drive. Then the question becomes, how was it damaged? Neither reporters nor crime investigators are necessarily computer experts, and the descriptions of the damage have been vague — they don’t even specify whether Lanza had a desktop or a laptop.

Some reports indicate that Lanza removed the hard drive from the computer before damaging it, which would make it more likely that the drive itself would actually have sustained damage.

But because the platters in the hard drives that hold data are so sensitive, manufacturers tend to do what they can to protect them. Consequently, depending on how the hard drive was damaged, the platters inside could have been anything from undamaged to shattered.

How could the data be retrieved from the damaged hard drive? There are all sorts of third-party data recovery services, and chances are the FBI — which has plenty of forensics chops itself — is talking to all of them about the best way to retrieve data from whatever remains of the platters, as well as, more than likely, the manufacturer of the drive itself. Even if the platters were shattered, they could conceivably be reassembled and at least partially read.

“The level of detail they can rip out of systems these days seems incomprehensible to most people,” Rob Lee, a forensic specialist who has examined computers seized from terrorists for the U.S. intelligence community, told the Washington Post, which wrote in detail about the various ways data could be recovered. Even data from the crashed space shuttle Columbia was nearly 100% recoverable, the article noted.

Is the data available anywhere else? Even if all the data on the drive itself is irretrievable, it might be available else, ranging from a backup, to a synchronization service such as Dropbox, to obtaining copies of data and other information from sources such as Lanza’s Internet service provider, email services such as Google, or his online gaming records.

“Many e-mail providers, such as Yahoo and Google, store data on their servers for a period of time, meaning that police might be able to subpoena Lanza’s provider for access to whatever data they have,” writes the Christian Science Monitor. “Google also stores information about users’ searches and other online activity indefinitely, although it anonymizes IP addresses after 9 months, making it impossible to tell what a given user was doing online prior to that time.”

While there has been increasing concern from civil liberties organizations about the amount of information that services collect and to which law enforcement organizations have access, in this particular case, it may be our best hope in trying to make some sort of sense of this tragedy.

What it takes is enough motivation and the right equipment — and the F.B.I. has both, writes Popular Mechanics. 

What makes this a big deal? As Wikibon mentions, nearly 30% of Oracle shops are managing more than 100 TB of data that needs to be backed up. And with ‘big data’ becoming a buzzword, not only is the data getting bigger, but people are paying more attention to it.

Wikibon points out several trends, including increasing virtualization, more space devoted to backups, and that tape is still around. 45% of customers report that more than half of backup data resides on tape, Wikibon says.

But one of the newer backup choices that Wikibon mentions is RMAN. And the advantage to that is brought up in one of the other big recent developments in Oracle backup, which is RMAN’s newer ability to back up to the cloud.

That’s where the Amazon Web Services white paper comes in. It describes how Amazon itself started backing up all its Oracle databases to the cloud using RMAN. While such white papers are often pretty self-serving — and now we’re talking about one where a vendor is using its own product, or what EMC’s Paul Maritz refers to as “eating your own dog food” — this one has some hard numbers behind it.

“The transition to S3-based backup started last year and by summer, 30 percent of backups were on S3; three months later it was 50 percent. The company expects the transition to be done by year’s end — except for databases in regions where Amazon s3 is not available,” writes Barb Darrow for GigaOm. Moreover, the company is saving $1 million per year for backups that take only half as long, she writes.

Whether you want to go the AWS route for Oracle backups or not, the Wikibon report has some interesting information on the backup subject. Granted, some of them are pretty Mom-and-apple pie — implement redundancy, test your backups, use dedupe — but others are more nuanced.

For example, the company notes, organizations are increasingly virtualizing their Oracle servers — which could have an impact on the speed of backing them up.  ”The big initial attraction of server virtualization is that it increased average utilization from 15% to about 85%,” Wikibon writes. “This means that virtualized environments will see a drastic reduction in overall server capacity, some of which was used to run backups.”

Last week it was Facebook’s Sub-Zero. This week it’s Amazon’s Glacier.

In both cases, the vendors are offering low-cost storage for long-term archiving in return for customers being willing to wait several hours to retrieve their data — though, in Facebook’s case, the customer appears to be primarily itself, at least for the time being.

“To keep costs low, Amazon Glacier is optimized for data that is infrequently accessed and for which retrieval times of several hours are suitable,” says Amazon. “With Amazon Glacier, customers can reliably store large or small amounts of data for as little as $0.01 per gigabyte per month.”

A penny per gigabyte equals $10 per terabyte (1,000 gigabytes) – compared with $79.99 for the cheapest 1-TB external drive from Amazon’s product search, while Dropbox’s 1-TB plan costs $795 annually, notes Law.com.

The service is intended not for the typical consumer, but for people who are already using Amazon’s Web Services (AWS) cloud service. Amazon describes typical use cases as offsite enterprise information archiving for regulatory purposes, archiving large volumes of data such as media or scientific data, digital preservation, or replacement of tape libraries.

“If you’re not an Iron Mountain customer, this product probably isn’t for you,” notes one online commenter who claimed to have worked on the product. “It wasn’t built to back up your family photos and music collection.”

The service isn’t intended to replace Amazon’s S3 storage service, but to supplement it, the company says. “Use Amazon S3 if you need low latency or frequent access to your data,” Amazon says. “Use Amazon Glacier if low storage cost is paramount, your data is rarely retrieved, and data retrieval times of several hours are acceptable.” In addition, Amazon S3 will introduce an option that will allow customers to move data between Amazon S3 and Amazon Glacier based on data lifecycle policies, the company says.

There is also some concern about the cost to retrieve data, particularly because the formula for calculating it is somewhat complicated.

While there is no limit to the total amount of data that can be stored in Amazon Glacier, individual archives are limited to a maximum size of 40 terabytes and up to 1000 “vaults” of data, Amazon says.

While it doesn’t deal with the issue of data for software that no longer exists, the Glacier service could help users circumvent the problem of the “digital dark ages” of data being stored in a format that is no longer readable, notes GigaOm.

Can similar services for other cloud products, such as Microsoft’s Azure, or for consumers, be far behind?

Now it’s designing its own archival backup.

The story, broken by Robert McMillan at Wired, is that the company is, over the next six to nine months, working to design a storage archive system. Because it stores a second copy of data and is intended to be used only for restores, the system powers down the drives when not in use. Such technology could reduce power use by the data center to one-third, according to the Facebook spokesman quoted by Wired.

More generally, Facebook has been working on what it calls the Open Compute Initiative, which basically means that it is designing new, minimalist hardware for standard functions that — due to the enormous scale of the company’s hardware — saves space, money, energy, and so on. The intention, once the design is complete, is to open source the data and offer the designs to the industry.

It isn’t clear whether this method of archival storage is also going to be open-sourced, according to the Verge. However, Facebook has been talking about the notion of drives that spin down when not in use — what it calls a “hard drive thermostat” — for almost exactly a year in connection with the Open Compute project.

Storage that is saved but rarely used is called “cold” storage, so the proposed building, part of the Facebook data center complex in Prineville, Ore., is nicknamed Sub-Zero, presumably after the line of high-end refrigerators. The company is also considering building a similar facility as part of its Forest City, N.C., data center.

It’s important with such systems to ensure that the data on them really isn’t used very much, because it can take up to 30 seconds for the disk to start from zero, and up to 15 seconds from the slower speed.

Guess I should have. Slate, in writing an article about a copy of The Avengers almost being deleted, mentioned the Toy Story 2 episode in passing in the process — it was actually included as a special feature on the DVD — and suddenly it’s all over the place, though the story goes back to at least 2010.

It’s a teaser for a longer story on the Toy Story 2 DVD, which I watched with my son this weekend. It starts:

“When making a film like Toy Story 2, we use a bunch of UNIX and Linux machines. On those kinds of machines there’s a command, RM*, that removes everything on the filesystem as fast as it can.”

“Somebody had run RM* on the drive where all the Toy Story 2 files were kept, and things just started to disappear.””

In the process of trying to recover the two years’ worth of work on the film, the company discovered that two months of backups were corrupt, and it had no viable backups — which might have delayed the film by as much as a year.

Fortunately, Galyn Susman, visual arts director at Pixar, had just had a baby, and in setting up a system she could work on from home, had a copy of the film.

(Slate also has a copy of the 2 1/2-minute film from the DVD, which has since been deleted from the 2010 story.)

Happy ending, but he whole story is quite a comedy of errors.

[I]f you do enter a mistaken rm *, DON’T UNPLUG THE COMPUTER, YOU IDIOT!! That will just damage the file system and won’t be quick enough to save any files. Hit Control-C. It’s much faster and safer, though even that will probably be too late.

But it took 20 seconds to delete all the files. That says there were a lotof files. It also says they were all in a flat structure with no subdirectories, since rm * doesn’t remove subdirectories. OK, maybe the command was really rm -r *, but the makers of the video were trying to keep things simple and dramatic. If you type rm -r *, think four times [before hitting Enter]. If it’s rm -rf *, make it at least six.

Then, instead of bringing a drive to Galyn’s house and copying the files onto it, they wrapped her computer — the one with the only copy in the world of a year’s worth of work — in blankets and drove it in a car to the studio…But at least they had an offsite backup, even if it was by chance.”

NoFilmSchool.com, a website devoted to digital filmmaking, goes into great detail about how to prevent this sort of problem. While some of it is geared specifically toward digital filmmaking, much of it applies to the average enterprise as well.

]]> http://itknowledgeexchange.techtarget.com/storage-disaster-recovery/toy-story-2-lost-its-backup-too/feed/ 0 http://itknowledgeexchange.techtarget.com/storage-disaster-recovery/how-did-you-celebrate-world-backup-day/ http://itknowledgeexchange.techtarget.com/storage-disaster-recovery/how-did-you-celebrate-world-backup-day/#comments Sat, 07 Apr 2012 03:22:08 +0000 Sharon Fisher http://itknowledgeexchange.techtarget.com/storage-disaster-recovery/?p=274 I know I’ll never forget the heartwarming family traditions or the look on my daughter’s little face on the morning of World Backup Day.

Just kidding. Actually, it was last Saturday, and I didn’t even hear about it til a day or so afterwards. It was, in fact, only the second time the holiday had been celebrated.

As it happens, World Backup Day came into being from a reddit discussion a year ago.

I just think it would be for the good of everyone to have a reminder to save all your cherished pictures, videos and other important data to somewhere secure.

Companies should also get involved, making sure that their customers and their own data is secure and safe. Maybe even the back-up providers could offer discounts and rates based on the date to encourage sales and participation.

Why March 31? The theory was to have your computer all backed up in case there were tricks or viruses associated with April Fool’s Day. There’s now a web page and a Facebook page, as well as a Twitter feed that seems to look for people mentioning hard drive failures and then asks brightly whether they’d remembered to do a backup first — safe out of punching range.

Not surprisingly, backup vendors have jumped on the notion of World Backup Day, with — just as the original poster suggested — discounts and suchlike to encourage people to back up their data, as well as several helpful infographics and even Pinterest sites talking about the scourge of data loss. The holiday is also starting to make it to the mainstream media, and user organizations such as Lawrence Berkeley National Laboratory picked it up as well.

All kidding aside, it’s not a bad mnemonic idea, on the order of changing the batteries in your smoke detector during the switches to and from Daylight Savings Time. (By the way, when do people in Indiana and Arizona change their smoke alarm batteries, if those states don’t observe Daylight Savings Time?) Anything that encourages consumers to do backups is probably a good thing, though an annual backup probably isn’t that much help.

Unlike some holidays such as National Telework Week, which asks people to pledge to work at home and then calculates the hours they worked and the savings they made, World Backup Day doesn’t do any followup, so we don’t actually know how many people observed World Backup Day and from how many data losses we were saved. Perhaps that’s an idea for World Backup Day #3.

In a criminal case in Miami in 2009, a man named Randy Chaviano was convicted of second-degree murder committed in 2005 and sentenced to life in prison. As usual, a court stenographer was taking notes at the trial. But then there was a string of coincidences worthy of a Law & Order script.

• The stenographer didn’t have enough paper for her machine — a mistake she’d apparently made before
• Consequently, the notes she took were recorded only in the machine’s internal memory
• She transferred the stenography machine’s records to her own PC
• She deleted the records from the stenography machine
• She didn’t do a backup of the PC
• A virus hit the PC and deleted what was by then the only record of the trial, leaving only a pretrial hearing and closing arguments; it wasn’t clear when this happened

This was all discovered recently, when the case was appealed, and it was discovered that the notes no longer existed — meaning that the case will have to be re-tried from scratch, according to the Miami-Herald. The paper didn’t say how much re-trying the case would cost.

The court stenographer has since been fired — in fact, courts in Miami are now moving toward using digital recorders and no stenographers at all. Moreover, cost-cutting may have caused the problem in the first place, noted the Herald:

Court reporters in criminal court have also complained that plunging rates paid by the state have driven away experienced stenographers and forced firms to hang on to aging equipment.

“It seems very sloppy to allow the only record of a trial’s proceedings to be held on an individual’s PC – it’s like asking for trouble if it isn’t at the very least held securely as a backup elsewhere,” noted Graham Cluley in the security blog Sophos. You think?

No word on the fate of the IT person who should have been responsible for doing backups on the PCs.