Backup tapes: friend or foe?

By David McGrath.

Key Points:
Failing to implement and follow formal policies for information management and data retention could be costly.

In many organisations there is an Information Technology ("IT") Department with a safe or cupboard containing a host of backup tapes: backups created during the routine daily/weekly/monthly cycle, primarily for disaster recovery purposes; backups taken pre-migration, or pre-system upgrade; snapshots of financial or other business critical systems taken at various points in time, and for various reasons, legal or otherwise. Some of these tapes are eventually stored securely off-site, often for indefinite periods of time.

While seemingly innocuous, and often proving a life-saver, the humble backup tape has the potential to cause serious issues for an organisation if formal policies for information management and data retention are not implemented and complied with. In particular, a failure to adhere to such policies can cost an organisation dearly in the event of a dispute resulting in litigation.

The prospect of litigation is often far from the minds of those charged with running an organisation's IT system and infrastructure: that is, until they are faced with the enormous task of recalling and restoring all the company's backup tapes for discovery. In legal proceedings, parties may be required to give discovery, which, in essence, means they must disclose all documents which are or have been in the possession, custody or power of the party providing discovery. Since the landmark decision in Sony Music Entertainment (Australia) Ltd v University of Tasmania (2003) 198 ALR 367 the term "documents" is interpreted very widely giving the court power to order disclosure of any electronic files and the physical media they reside on such as hard drives, CD-ROMs and tapes.

Back up tapes are prima facie discoverable. In an increasing number of cases, the courts have ordered parties to discover material held on backup tapes. When this happens, those same tapes, once a source of some comfort to an organisation, suddenly become a millstone around the organisation's neck. As the discovery process begins, the organisation is required to retrieve, restore and process enormous volumes of data, often within a very short time. The irony is that much of this data either duplicates information that is already available or is completely irrelevant to the dispute. Retrieving this data can be a time-consuming and costly process. It is not uncommon for organisations to spend upwards of hundreds of thousands of dollars on discovery of electronic data in large cases.

What makes the discovery process, particularly involving data contained on backup tapes, such an onerous task?

First, where tapes are retained indefinitely, the sheer volume of data to be restored can amount to literally terabytes (one terabyte is equivalent to around 33 million pages). The first question is, where do you put this data? Will you have to acquire additional hardware to accommodate it? If the tapes are quite old, chances are there's no easily accessible catalogue. Re-cataloguing the tapes and reviewing them for relevance is the next step, and a major investment of time. Then the tapes have to be physically restored, presenting another very time consuming exercise.

Secondly, as litigation often takes place many years after the events in question, technologies are quite likely to have changed, especially considering the 3-5 year lifecycle for hardware and software adopted by many organisations. This means that an organisation may no longer have the original tape drives or backup software required to retrieve information created many years before. This often results in the need to retain external experts who specialise in data recovery, again at considerable expense. In some cases, once the data has been retrieved, applications will need to be rebuilt in order to view the data in its native format. This is particularly true in the case of accounting systems and database applications, and can often mean rebuilding entire systems using obsolete operating systems and applications that were in use when the data was originally created and backed up.

Thirdly, an external expert with experience providing evidence in court is often required to assist the court with its enquiries. In Derby & Co Ltd v Weldon (No 9) [1991] 2 All ER 901, one of the earliest cases to consider electronic discovery, the court found that in such cases expert evidence was required to determine issues such as availability of information, recoverability of the data, risks of damage to data and disruption to the business producing the data.

Finally, a physical review of the recovered data for the purposes of assessing relevance, privilege and confidentiality would be conducted. As a result of the sheer volume of data to be reviewed and the required expertise of those making these assessments, this can be an extremely costly process.

All this work needs to be carried out by either the party, the party's lawyers, if they have an in-house litigation support department capable of recovering and properly handling electronic materials, or by a third party provider. Either way, the expense to the party will be considerable.

While the expense of this exercise may be a relevant factor in the exercise of the court's discretion as to whether to order discovery of electronic material from backup tapes, the primary concern is to ensure justice is done between the parties. A quick review of the cases in this area demonstrates that the courts are reluctant to relieve a party of its obligations to restore tapes simply because to do so would prove to be a burden.

For example, in NT Power Generation Pty Ltd v Power and Water Authority [1999] FCA 1623, the Power and Water Authority, which had already provided discovery of printed email in the action, sought relief from the court in relation to discovering electronically stored email. It argued that email archiving was achieved by individuals printing out emails they considered significant. After 30 days (from creation or receipt), emails were deleted from the system. As a result, the only emails stored electronically long-term were those saved by an individual to his or her PC, or to a backup tape for disaster recovery purposes. While the court accepted that emails stored on backup tape were for disaster recovery purposes and that retrieving them would be "burdensome", it was not persuaded that the exercise was pointless and so did not grant the relief requested.

In BT Australasia v State of New South Wales [1998] FCA 363, selective discovery of e-mail and other material from up to 970 tapes was ordered where some of the tapes "may have contained relevant information". A submission by Telstra that the burden of additional discovery was too great and its value to the action too uncertain was rejected by the court which ordered the discovery, despite finding that the "purpose of making and retaining the backup [tapes] was essentially disaster recovery and not archival".

In the Sony case, Sony sought discovery of information from the university's computers to help it identify individuals who had downloaded music files in breach of copyright. The university offered to conduct a total of 140 targeted searches over the data using specific keywords such as ".mp3". Sony argued the approach was neither forensically sound nor sufficient and would result in relevant materials being missed[1]. It proposed that its own forensic expert take physical possession of the CD-ROMs and backup tapes in order to conduct a more rigorous and exhaustive retrieval. The university contended that this method would lead to retrieval of large amounts of irrelevant data and had the potential to infringe the privacy of innocent third parties.

Despite agreeing with the university that the Sony approach would lead to recovery of a "great deal of extraneous and irrelevant materials, some of which may be privileged or confidential" the court adopted it, as it thought the university's method was likely to result in insufficient discovery.

It therefore ordered the university to hand over its backup tapes and CD-ROMs to Sony's expert to carry out the data retrieval. It ordered that the retrieved data be handed back to the university for relevance and privilege review before making discovery, reasoning that the university would have an opportunity to canvass any privilege or confidentiality issues with third parties before actually discovering materials to Sony.

Today, 92 percent of new information is stored on magnetic media[2] making it a tempting target for a lawyer to pursue in discovery. It is imperative that organisations review backup tape strategies carefully in line with the organisation's overall archival or records management policies and its legal obligations.It is important thatorganisations have in place a records management policy which determines what business information the organisation needs to keep, how long it needs to be kept and procedures governing its eventual disposal.

Backup tapes that are made by an organisation must be properly managed. Keeping an accurate catalogue of tapes and their contents is an obvious starting point. Countless hours retrieving and reviewing tapes can be eliminated if the party can exclude a particular tape's contents by knowing what dates, persons or activities it relates to. This may require the party to examine how its backup data is organised and structured at the point of capture. The better the data is managed, the greater the savings will be in retrieval costs. Also, if the court is left in any doubt about the nature of information saved on particular tapes, it is less likely to be persuaded that those tapes should be excluded from the discovery process.

So don't forget the backup tapes… out of sight does not necessarily mean out of mind!

[1] The forensic expert in the case criticised the university's approach on a number of grounds including (a) not all music digital file extensions were specified, (b) the file extension was not checked against the header, (c) other keyword searches did not take account of slang, (d) base 64 encoded information would be missed, (e) there were difficulties identifying compressed files, and (f) the university's preparatory processes, in some cases, could interfere with subsequent analysis.

[2]"How Much Information?" University of California, Berkeley, 2000