6 ms·

The problem is that you can't really simulate the systemic effects of a really major quake (like a scenario where Mountain View is out of power for weeks).

falcolas 11y ago
Sure you can. Just look for the keys to the main breakers to those buildings. Of course, paying for that amount of vacation for 15 days is probably not entirely feasible for any company.
- idlewords 11y ago
  By 'systemic' I mean not confined to one company.
nostrademons 11y ago
The DiRT drills include the simultaneous loss of whole offices, including the complete obliteration of the Bay Area. Participants are instructed to pretend that they've been eaten by zombies and not communicate with anyone in a remote office, and that's backed up (as described in the article) by cutting the network links to & from the Mountain View corporate office. Now, there may certainly be larger systemic effects over long time periods caused by eg. the death of the company CEO, the loss of new product development, or the complete destruction of the company's market (in, for example, a global thermonuclear apocalypse that sets us back to the stone age). But the tests absolutely do simulate the simultaneous death of 15,000+ employees, destruction of the Mountain View headquarters, and loss of all datacenters, data, and power in the Bay Area, and verify that remote teams can continue the day-to-day operations in such an event.
- Sven7 11y ago
  What happens if Google goes down for a while? Is it really that bad? Yes, Gmail and Drive may cause all kinds of chaos but I think I can survive quite a while without the search engine and YouTube.
  - pc86 11y ago
    In the grand scheme of things, not a lot of businesses use Apps for their email, but I'd hazard a guess that you're still looking at hundreds of millions of dollars in losses if that were to suddenly disappear.
    - Mtinie 11y ago
      It's the cascading service failures and related economic costs that would be the most damaging (and hardest to really quantify until a scenario really happens).
    - sneak 11y ago
      As with most people who reason about Google, you are off by at least two orders of magnitude in your estimate.
      - gaadd33 11y ago
        Wow, I had no idea that Google Apps were about 15% of Google's revenue. That is a way bigger than I would have guessed. (Hundreds of millions x 2 orders of magnitude is >= 10B, total revenue in 2014, 66B)
      - pc86 11y ago
        I'm not referring to Google revenue, I'm referring to productivity/revenue for the businesses using Apps day to day.
  - rryan 11y ago
    The data could be lost. Part of DiRT is ensuring that the result of losing N data centers is not "oops we lost 20% of GMail users data permanently". On the scale of devastation this article is describing, none of Google's servicing being obliterated really matters but I'm personally pretty glad Google is prepared for multiple, massive scale disasters to happen at once.
    - baudehlo 11y ago
- Locke1689 11y ago
  Maybe Google is distributed enough to stay up, but I'm pretty sure Microsoft and Amazon are not, and I doubt Google has the spare capacity to handle Azure load, much less Amazon load.
  - miles932 11y ago
    Try us :)
    - Locke1689 11y ago
      If Google utilization is really only 10% of capacity, that's pretty surprising and worrying for a host of other reasons.
      - deleted 11y ago
        [deleted]
      - sneak 11y ago
        Utilization and availability are not directly related. Much of their utilization is probably not super time critical and could be proportionately shed or suspended in an emergency situation like the one in question. I bet Google could absorb 100% of the emergency evacuation of AWS in a pinch. Remember also that not 100% of services will be moved, and those that are will not be running at 100% capacity - everyone would be suspending their batch/analytics/warehousing jobs that week (or month). EDIT: Also, lock in would stop all the redshift/dynamo/etc users from migrating, and would limit people to just what they could throw up on GCE/GAE.
yokohama11 11y ago
Most large companies do/have done exactly that. Arguably 9/11 was the big catalyst for DR planning. There were Wall St firms that literally had to get the military to escort them into Lower Manhattan in the days after to rescue servers, tapes, etc and cobble something together in a satellite office. No one wants a repeat of that, and you'll notice subsequent disasters like Sandy have barely been a blip for most as a result of policy changes. At this point basically any major company will/should have procedures in place for "perfect" DR, the ability for everyone to work from home indefinitely (and alternate offices/infrastructure waiting for the few people who need something special, like the special needs of a trading desk), as well as obviously having back up data centers with full replication.

falcolas 11y ago

Sure you can. Just look for the keys to the main breakers to those buildings. Of course, paying for that amount of vacation for 15 days is probably not entirely feasible for any company.

idlewords 11y ago
By 'systemic' I mean not confined to one company.

nostrademons 11y ago

The DiRT drills include the simultaneous loss of whole offices, including the complete obliteration of the Bay Area. Participants are instructed to pretend that they've been eaten by zombies and not communicate with anyone in a remote office, and that's backed up (as described in the article) by cutting the network links to & from the Mountain View corporate office. Now, there may certainly be larger systemic effects over long time periods caused by eg. the death of the company CEO, the loss of new product development, or the complete destruction of the company's market (in, for example, a global thermonuclear apocalypse that sets us back to the stone age). But the tests absolutely do simulate the simultaneous death of 15,000+ employees, destruction of the Mountain View headquarters, and loss of all datacenters, data, and power in the Bay Area, and verify that remote teams can continue the day-to-day operations in such an event.

Sven7 11y ago
What happens if Google goes down for a while? Is it really that bad? Yes, Gmail and Drive may cause all kinds of chaos but I think I can survive quite a while without the search engine and YouTube.
- pc86 11y ago
  In the grand scheme of things, not a lot of businesses use Apps for their email, but I'd hazard a guess that you're still looking at hundreds of millions of dollars in losses if that were to suddenly disappear.
  - Mtinie 11y ago
    It's the cascading service failures and related economic costs that would be the most damaging (and hardest to really quantify until a scenario really happens).
  - sneak 11y ago
    As with most people who reason about Google, you are off by at least two orders of magnitude in your estimate.
    - gaadd33 11y ago
      Wow, I had no idea that Google Apps were about 15% of Google's revenue. That is a way bigger than I would have guessed. (Hundreds of millions x 2 orders of magnitude is >= 10B, total revenue in 2014, 66B)
    - pc86 11y ago
      I'm not referring to Google revenue, I'm referring to productivity/revenue for the businesses using Apps day to day.
- rryan 11y ago
  The data could be lost. Part of DiRT is ensuring that the result of losing N data centers is not "oops we lost 20% of GMail users data permanently". On the scale of devastation this article is describing, none of Google's servicing being obliterated really matters but I'm personally pretty glad Google is prepared for multiple, massive scale disasters to happen at once.
  - baudehlo 11y ago
Locke1689 11y ago
Maybe Google is distributed enough to stay up, but I'm pretty sure Microsoft and Amazon are not, and I doubt Google has the spare capacity to handle Azure load, much less Amazon load.
- miles932 11y ago
  Try us :)
  - Locke1689 11y ago
    If Google utilization is really only 10% of capacity, that's pretty surprising and worrying for a host of other reasons.
    - deleted 11y ago
      [deleted]
    - sneak 11y ago
      Utilization and availability are not directly related. Much of their utilization is probably not super time critical and could be proportionately shed or suspended in an emergency situation like the one in question. I bet Google could absorb 100% of the emergency evacuation of AWS in a pinch. Remember also that not 100% of services will be moved, and those that are will not be running at 100% capacity - everyone would be suspending their batch/analytics/warehousing jobs that week (or month). EDIT: Also, lock in would stop all the redshift/dynamo/etc users from migrating, and would limit people to just what they could throw up on GCE/GAE.

yokohama11 11y ago

Most large companies do/have done exactly that. Arguably 9/11 was the big catalyst for DR planning. There were Wall St firms that literally had to get the military to escort them into Lower Manhattan in the days after to rescue servers, tapes, etc and cobble something together in a satellite office. No one wants a repeat of that, and you'll notice subsequent disasters like Sandy have barely been a blip for most as a result of policy changes. At this point basically any major company will/should have procedures in place for "perfect" DR, the ability for everyone to work from home indefinitely (and alternate offices/infrastructure waiting for the few people who need something special, like the special needs of a trading desk), as well as obviously having back up data centers with full replication.