Speaker Key: PB is Phil Brown, DW is David Whelan
PB: I'm here with David Whelan. It's Phil Brown and we're going to talk about backing up your electronic information. So, for starters, why would someone back up their electronic information?
DW: The worst case is that you have all of this information you have gathered from your clients or on your clients behalf, you've got discovery materials, you've got all sorts of things stored and then one day they're all gone and how do you recreate your practise, recreate your billings, recreate your clients documents, without any of the files that you've collected over all that time?
PB: And just to remind everyone, there are various vehicles to lose that information. It could be a complete computer failure and you're not able to recover the data, it could be a fire, it could be someone has walked off with your computer. Just a reminder there that physical security is also important.
DW: Absolutely and I think that that's one of the interesting things we haven't worried about too much when we dealt with paper, although we probably have made copies of things or placed our paper records in different places, but the types of things that can happen to your electronic records are from all different directions and although a lot of people think well, you know, that'll never happen to me, I'm never going to be involved in a natural disaster or, you know, my office is never going to burn down. I saw a good post the other day that said, it's not your office burning down that you have to worry about, it's your 18 year old kid coming in and hitting the delete key and wiping out all the files that you have on your machine. So the opportunity for disaster is present from all sorts of places.
PB: Right and we have to look at this from a couple of different angles, one being client confidentiality of course and the other is being able to protect yourself in the event of a claim further down the road. It's one of the reasons that we bother with file retention and file retention rules to begin with.
DW: Right! And I think that is going to be a trick. With paper you always have the paper, you can pull it out and you can show it to people, unless you've had a fire or water damage to it, you probably have a pretty good copy of the document you might have gotten very early in your practice, but with electronic data it becomes a lot more problematic. You might have created a document 20 years ago on WordStar and now you're faced with, how do you get access to that information if you haven't printed it off? What software are you going to use in order to get access to it?
PB: So I guess one important thing to mention here is, there is no point in backing up your information electronically if you don't do test restores of that information.
DW: I think that's one of the steps that's most commonly missed, which is that you download the backup software or you buy a backup system, one of those devices where you press a button and it backs up all your information, but just backing it up isn't enough. You need to make sure that once it's been backed up, whatever format it's in, that you can get back the information that you've saved.
PB: And maybe we can talk a little bit about different types of backups. You mentioned tape. I know there are a number of law firms out there that still use tape and there is nothing wrong with that as long as, again, you have the hardware to restore that information in the event of a loss.
DW: Right, and I think the proliferation of devices that you can now attach to your computer, whether they are network attached storage or USB storage, has really broadened the types of backup media that we have to store our backups on. I think there was a period of time where a lot of people were backing up onto CD RWs, CD disks and DVDs but I think it's probably more common now that if you are backing up into your office and you're in a solo or small firm practice you're probably going to be looking at something that you can plug into your computer or hang off your network and then store that way.
PB: So it could be something like a USB key or it could be an external USB hard drive.
DW: One of the things to keep in mind when you're looking at a device that you can plug into your computer is that if it's using flash memory like a USB key there are only a certain number of rights that it will take, so you need to be sure that you are using different hardware after a certain period of time so that once you've done a certain number of backups you get yourself a new USB key. You're probably better off using a mechanical hard drive if you're going to be backing up to an external hard drive. But in both cases you want to make sure that, as Phil said earlier, if you've got something that can be removed from your computer, that probably means someone can pick it up, which means that they can pick up your backup files and walk out of your office and, again, that's something that you couldn't have happen in the past, where they could get everything that is in your office rather than just one file.
PB: And there's a couple of things that flow from that. One is that, who is the caretaker of your information within the office or outside the office? And I know people do different kinds of backups. Maybe they only back up the new information they have accumulated throughout that day or throughout that week, the so-called incremental backup or maybe it's a systemwide backup at the end of every week, but it's still important to know what happens to that information once it's backed up and who is responsible for taking care of it.
DW: I'm a big fan of, especially in small environments where you might not have IT staff or enough time to look at the technology and manage it yourself, to consider using backup that is out on the web or out on a cloud as they say, so that when you're doing a backup you're backing up in a secure manner, perhaps in an encrypted manner but you're backing up out onto the Internet so that if, for whatever reason, you have a failure in your office, that data is not located and that backup isn't located inside the office where the disaster happened.
PB: And again if we're talking about the cloud, one of the things we need to be concerned about is client confidentiality and you should know first of all who owns that data if it's stored in the cloud because certain user agreements might suggest that the company who is storing your data owns it and they don't and they shouldn't and you shouldn't sign an agreement like that. But the other thing is, is your information encrypted or do other people readily have access to that information?
DW: I think that's a good point and some of the sites like Mozy.com or Carbonite.com, that provide this sort of online backup may back it up in a way that it's essentially one big blob of information, so you only are really going to be accessing it when you have to restore your computer. Another way to think about doing backup is to use a site like Dropbox.com or SugarSync.com where you are actually backing up all the files in the same file or folder structure as you have on your computer. That can make it easier to access one by one and it also might allow you to provide an extra layer of encryption where you are sending all those files up in an encrypted format, so even if someone can get access to it, even if they are unauthorised to do so, at least you know that the files out there are encrypted.
PB: The four companies you named, I think, are all American and have American servers and there are probably equivalent Canadian companies as well that would have servers resident in Canada and the only reason I mention that is because I know there is a concern to potential vulnerability because of the Homeland Security Act in the US and whether or not someone else might have access to your information which you might not be able to control.
DW: Absolutely and I think that whenever you're dealing with information going out on the Internet you're better off encrypting it if you’re leaving it anywhere, because even if you're using a service that's very well known and is Canadian based, you may or may not actually be leaving it on a Canadian server or it may be passing through other servers, so it's always good to use encryption so that it diminishes your concerns about possible invasions by government agents or other folks.
PB: Whether here in Canada or the US.
PB: I guess the other question is, how long is this information going to last? We all backup stuff on our hard drives or on DVDs or wherever and then we sort of forget about them forever and we may need to access them in 10 or 20 years. Will we still have access?
DW: I think that it's going to be a huge challenge and I'm not sure that we will have access. We've already seen difficulties when a lot of lawyers moved from Word Perfect to Microsoft Word and Word Perfect is still out there but it's no longer anywhere near as popular among lawyers as it was. I think we're going to have format problems going forward in the future. I think one of the things we may be able to dodge a little bit is that the hardware that we relied on in the past, which was local where you had to buy essentially a spare tape drive or a spare CD drive in order to read the media, I think that issue may be going away, but we're still going to have to be very wary about any data that we store and if you've got one of the first PCs you probably have more than 20 years’ worth of data stored from your practice. How are you going to get access to all of those files going forward?
PB: And I guess just to build on that, if you are using a third party company to do information storage for you, you need to know what happens if that company is not around later and how much it would cost to recover your information if you needed to recover it.
DW: That's right. You don't want to be found without access to your backup just because a company that you were relying on has gone out of business or for whatever reason is unavailable.
PB: Great! Okay, thanks very much.
DW: Thanks a lot Phil.