Schneier on Security

Clive Robinson • January 19, 2014 1:25 PM

@ CallMeLateForSupper,

I trust paper much, much more than any digital device

You are not the only one.

Aside from the fact paper is actualy harder than wood to burn (try comparing lighting a book and bit of 2×4 with an oxy torch/cutter if you don’t beleive me 😉

It can with the adition of certain chemicals be made sufficiently fire retardant that it’s used as a light weight sprayed on coating to protect structural steel in buildings and industrial facilities from fire damage.

One major advantage with “printed data” is “you see what you are giving away”. To many file formats these days have hidden metadata and error histories that enable you to “undo” back to the first charecter in the file.

Thus giving a potential enemy (as you have to do with disclosure) information hidden in the meta and history data that you may not be aware of.

It’s why I advise clients “Paper, Paper NEVER data”

And if a judge gets “cute” at the request of the other party and insists on “electronic discovery” being in “electronic format” then print out and scan back in and give them “image files” disguised as PDF’s, and make sure the scaning in is a little wonky to make OCR difficult at best (if you hunt around on the internet there is “anti-watermark” software that does this).

In these days of electronic discovery and rapidly aging file formats it is very unwise to have documents stored in either complex or propriatary file formats. It is better to set up a database or repository into which documents are put.

If you are going down the “roll your own” way you could use something like GIT as the repository of “print to file in Postscript” files, and run these through a Postscript to text filter which then goes to be converted to an “inverted text” format to store in either a conventional flat file or relational database for fast searching.

Oh and build in the destruction of any other files on a six month at most life time into your company data retention policy.

The simple fact is as we are now waking upto with the likes of the NSA disclosures “privacy” is only for the prepared. But worse current “electronic tools” make possible overnight what would have less than a life time ago taken thousands of “man hours” such as searching a million documents for certain key phrases…

Clive Robinson • January 20, 2014 2:42 AM

@ Jason T. Miller,

Business records covers the entire gamut of documentation produced within a business as far as electronic discovery is concernend.

However those that legaly need to be kept are little different from those that were required to be kept in a business back in the 1960’s and 70’s, when most businesses did not have any kind of electronic records. Thus they did not have hidden meta-data nor did they tend to have attached extranious or irelevant information.

Further the legal time requirments for keeping such documents is often relativly modest and can be as little as 18months. For others the time falls to the reasonableness test “of the man on the Clapham Omnibus”.

In general it’s not these legaly required documents that cause problems by electronic discovery but the documents where there is no legal reason to keep them, and thus those making them excercised no caution in making them. As they had no reason to beleive they would be anything other than as equivalently ephemeral as a chat round the coffee machine or quick “PostIt note”.

Provided there is a clearly identified business policy in place for the destruction of such documents that is adheared to then the potential question of hiding information in civil or criminal cases is usually negated.

Clive Robinson • January 21, 2014 3:34 AM

@ Tom,

If you want real long times there are some records that need to be kept for what seems like forever.

Property leases can be 999years in duration and some land is constrained for ever by having a Church tax upon it, which is realy quite nasty (in the UK a couple inherited a paddok and shortly there after the Church commissioners hit them with a charge for repairing the church that was many times what the land was worth… basicaly the commisioners had been negligent in maintaining the church and had alowed it to fall into disrepair but went to court to make the couple pay…).

The point of my original comment was not about how long you are required to keep some records but the problems that electronic records make for individuals, companies and other organisations if they are not carefull.

When it comes to paper records most people think it’s reasonable to do a bit of housekeeping and throw out what is in effect “dead wood”, courts recognise that “you can not keep evrything” with paper records. However since “electronic records” have started a myth has arisen “that you can keep everything” as the storage media is so inexpensive and easily obtainable and you can “data warehouse” it etc etc.

Then as others have already found some smart mouth legal type will use it to argue that not keeping it was a deliberate attempt to “destroy evidence”, which can only be negated by a well designed policy that can be clearly seen is enforced. If that does not work the next gambit will be to get a judge to order you to produce all electronic records in some format that benifits them not you, knowing full well thatl the cost will if it does not bankrupt you certainly cost you a kings ransom, again there are ways to defend against this with an enforced policy.

The sad part about the electronic record myth is the “zero cost storage” aspect, people have seen the cost of home storage effectivly half every year and because they don’t look after their data properly they think the actual costs involve are halved every year. In fact as a number of organisations can confirm it’s usually more expensive and less secure to store electronic records than it is to store paper records, not because of the storage media costs but the on going maintanence costs in doing the job to a level a court finds acceptable…

There is the old “Keep it Shipshape” saw which people should practice, which in effect is shortened to “keep it clean and tidy”. But those who have spent time on boats know it also includes keep it well ordered and prioritized against use and risk in limited space, which also means you have to be ruthlessly about culling that which is infrequently used and has low risk value.