3 ms·

Any reason you can’t dump an air gapped archive and put it on a physical device in a deposit box? Best of both worlds should you truly need to access it. Or ar

by tmpz22 2y ago

Any reason you can’t dump an air gapped archive and put it on a physical device in a deposit box? Best of both worlds should you truly need to access it. Or are depositions also a concern? Funny enough I just did a business law presentation on Comcast Corp v FCC (2010). Thanks for doing what you could for Net Neutrality

holmesworcester 2y ago
It was a pleasure! We lost nominally in the end (except in California and outside the US) but we built enough awareness to give the ISPs a fear that blatant violations would rock the boat and lead to worse outcomes for them, like more state laws or tougher agency rules when Democrats regained power. I do regret not pushing harder for federal legislation though! On airgapped email archives, yes, the subpoena threat model is real too. That also happened to us because of some other dirty tricks by ISPs in the same campaign! Fake FCC submissions opposing net neutrality were being created with blatantly stolen user data; like, not people being tricked into singing a petition but just straight up identity theft. We documented all of this and pitched some state AGs on looking into it. New York did, which was awesome, but they ended up subpoenaing everyone including us! We were psyched about this overall of course since it was our idea, and they did end up finding out who did it which was awesome (Broadband for America, the umbrella lobbying group for the telcos) but it was a huge amount of work to comply with the subpoena. The retention limits reduced that burden. Another reason to have them! I would also say that, if you do create an airgapped archive and store it in an appropriately paranoid way, you are likely to never ever bother to dig it out of storage before the SSD melts into uselessness. You'll miss the ocassional old email but not enough to go digging for it.
- lukan 2y ago
  If you really don't need old email, then don't bother, but for the chance that you do need them sometimes, but don't want to store everything in an internet connected place - it would be an option setting up a old laptop for this(maybe with Thunderbird), where you can remove the wifi chip for this air gapped use case. (In most older laptops they are easy to remove and not soldered on.) Then regulary exporting all the needed files, either just copy them with a USB stick and more secure would be burning CD-R's for each data transfer. And it likely helps having an exotic linux system on the laptop, so a windows USB worm won't replicate there if you use the pragmatic USB data transfer variant.
michaelt 2y ago
Nah, the value of having access to 3-month-old e-mails is that they're indexed in gmail, so if someone asks how much we paid for that widget 18 months ago you can get the original quotes in an instant. Whereas if the data is in a bank vault, you ask the same question and the reply is "IDK, I think it was about $50-100?"
- holmesworcester 2y ago
  Exactly.
- Teever 2y ago
  Surely there's a middle ground for these things. The value in old data isn't just in pulling up a single piece of information like a magician pulls a rabbit out of their hat, it's tremendously useful for looking back and seeing how an organization and its methodology has changed and how that information can be applied to future project.
  - michaelt 2y ago
    I see it as less about pulling up a single piece of information and more that a tool that every employee uses a dozen times a day produces much more value than the same tool if it's used only by the big boss, and only once or twice a year as it's so inconvenient to use

by tmpz22 2y ago

holmesworcester 2y ago

It was a pleasure! We lost nominally in the end (except in California and outside the US) but we built enough awareness to give the ISPs a fear that blatant violations would rock the boat and lead to worse outcomes for them, like more state laws or tougher agency rules when Democrats regained power. I do regret not pushing harder for federal legislation though! On airgapped email archives, yes, the subpoena threat model is real too. That also happened to us because of some other dirty tricks by ISPs in the same campaign! Fake FCC submissions opposing net neutrality were being created with blatantly stolen user data; like, not people being tricked into singing a petition but just straight up identity theft. We documented all of this and pitched some state AGs on looking into it. New York did, which was awesome, but they ended up subpoenaing everyone including us! We were psyched about this overall of course since it was our idea, and they did end up finding out who did it which was awesome (Broadband for America, the umbrella lobbying group for the telcos) but it was a huge amount of work to comply with the subpoena. The retention limits reduced that burden. Another reason to have them! I would also say that, if you do create an airgapped archive and store it in an appropriately paranoid way, you are likely to never ever bother to dig it out of storage before the SSD melts into uselessness. You'll miss the ocassional old email but not enough to go digging for it.

lukan 2y ago
If you really don't need old email, then don't bother, but for the chance that you do need them sometimes, but don't want to store everything in an internet connected place - it would be an option setting up a old laptop for this(maybe with Thunderbird), where you can remove the wifi chip for this air gapped use case. (In most older laptops they are easy to remove and not soldered on.) Then regulary exporting all the needed files, either just copy them with a USB stick and more secure would be burning CD-R's for each data transfer. And it likely helps having an exotic linux system on the laptop, so a windows USB worm won't replicate there if you use the pragmatic USB data transfer variant.

michaelt 2y ago

Nah, the value of having access to 3-month-old e-mails is that they're indexed in gmail, so if someone asks how much we paid for that widget 18 months ago you can get the original quotes in an instant. Whereas if the data is in a bank vault, you ask the same question and the reply is "IDK, I think it was about $50-100?"

holmesworcester 2y ago
Exactly.
Teever 2y ago
Surely there's a middle ground for these things. The value in old data isn't just in pulling up a single piece of information like a magician pulls a rabbit out of their hat, it's tremendously useful for looking back and seeing how an organization and its methodology has changed and how that information can be applied to future project.
- michaelt 2y ago
  I see it as less about pulling up a single piece of information and more that a tool that every employee uses a dozen times a day produces much more value than the same tool if it's used only by the big boss, and only once or twice a year as it's so inconvenient to use