Ask Unclutterer: Is Google Docs safe for backing up confidential information?
Reader OB submitted the following to Ask Unclutterer:
I am in the process of scanning all of our tax returns older than seven years and am considering storing them on Google Documents. Do you consider that safe, since they contain a lot of confidential information? Thanks for your opinion.
To answer your question, I contacted Timothy B. Lee who is a computer science researcher at Princeton University. Here’s what he told me:
It really depends on the user’s tolerance for risk and what her other options are. If you place confidential information on Google Docs, the risks include: Google being compromised by hackers, Google itself using the documents for nefarious purposes, your account being compromised, governments or other third parties requesting and obtaining access to the documents, and Google losing your information. None of these outcomes are very likely, but they’re all risks to keep in mind.
Personally, I wouldn’t put confidential information on Google Docs because I keep regular backups of the data on my hard drive and I’m vigilant about the security of my machines. If you run a business or are in a profession where you regularly handle confidential data, you have an obligation to do the same in order to safeguard your customers’ confidential data. But I know that, in practice, ordinary users don’t always follow these best practices. For those users, there may be a larger risk of losing information in a personal hard-drive crash or malware infection than having something bad happen to data in Google Docs. So trusting Google Docs may be a rational, calculated risk.
If you do decide to put confidential information in Google Docs, you should strongly consider signing up for 2-step authentication. This is a free service that greatly improves the security of your Google account. It won’t protect you from all the threats I listed above, but it will at least protect you in case a malicious party gets your password.
Thank you, OB, for submitting your question for our Ask Unclutterer column. I hope Timothy’s information helps you come to a solution that is best for you.
Do you have a question relating to organizing, cleaning, home and office projects, productivity, or any problems you think the Unclutterer team could help you solve? To submit your questions to Ask Unclutterer, go to our contact page and type your question in the content field. Please list the subject of your e-mail as “Ask Unclutterer.” If you feel comfortable sharing images of the spaces that trouble you, let us know about them. The more information we have about your specific issue, the better.
21 comments posted
Posted by Neil - 05/06/2011
Encrypting the docs before uploading them would go a long way toward mitigating the risks mentioned. Then you just have to make sure not to lose your decryption key.
Posted by tim - 05/06/2011
I back up critical files like tax returns to DVD and put in my safety deposit box.
Posted by mrsean2k - 05/06/2011
The service I use, https://spideroak.com/, has a zero-knowledge policy about the data it’s backing up – and excellent backup and synch facilities.
https://spideroak.com/engineering_matters#true_privacy
Free 2Gb, paid in 100Gb increments afterwards.
I pay for two separate 100Gb accounts, one for me, one to strongarm the rest of my family into backups.
There *is* a link I can post that would get me a few gig extra for a referral, but I’d much prefer to remove any doubt I’m shilling – I just use the service and consider it excellent value.
Posted by mrsean2k - 05/06/2011
Oh and to return to the original question, I also use paid-for Google Apps for my business and don’t think twice about using it to transfer and collaborate on sensitive documents.
But I prefer not to use it as a primary backup.
Posted by rebecca_sw - 05/06/2011
And of course, if the questioner isn’t based in the US, any data entrusted to Google also becomes subject to US laws and can be easily reached through the US courts.
I pay £15 a year for a private email address and storage with a web hosting company. This company is too small to be a major target and as I am paying for the service, they answer to me rather than use my data for advertising (at best).
Posted by timgray - 05/06/2011
ONLY way safe to back up person info is in an encrypted file and place that encrypted file on dropbox if you MUST have ready access everywhere.
to encrypt the file I use http://www.truecrypt.org/
If it’s not encrypted, it’s not safe out on the “cloud”
Posted by Sinea - 05/06/2011
Great advice, Erin. I do use Docstoc.com to put URL’s on my pdf’s. Great little site. That way I can offer things like checklists, etc for my readers to print out.
Posted by consumerx - 05/06/2011
Basically, if the host can reset your password, then the employees have access to your information. Additionally, if you can view a file/document/email using a web browser, then so can the employees of your host.
Encrypting files before upload will protect the contents, as others have mentioned. However, by encrypting you will not be able to view the contents directly online if you need to, but instead will need to download and decrypt on your computer.
Posted by consumerx - 05/06/2011
Here is an example of what one Google employee was able to do unnoticed:
http://gawker.com/#!5637234/gc.....d-on-chats
Posted by Cheryl - 05/06/2011
Just wondering why you would bother to keep tax returns that are older than 7 yrs in the first place? What are the odds that you are going to refer to them ever again?
Posted by Austen - 05/06/2011
Agree with Cheryl. Think three years, basically four counting the current filing is what the IRS requires. It feels so good not carrying all that unnecessary stuff around for years.
Posted by Anne - 05/06/2011
I don’t mean this personally, but doesn’t it strike anybody how narcissistic this question is? In fact, I’m probably as guilty as anyone of this narcissism, and I think we’ve all become very narcissistic in this digital age. Why would anybody be interested in some Average Joe’s tax returns? Before the digital age did we all keep our paper tax returns under lock and key? Mine were just in a folder in the cupboard. When I, like your reader, find myself becoming slightly paranoid and hysterical regarding internet security, I just take a few deep breaths and remember that no one is out to get me, and everybody else is probably far too busy with their own lives to give a fig about my private documents. That usually puts things in perspective!
Posted by Jay - 05/07/2011
Anne, people are concerned about identity theft. I don’t think that such a concern makes someone narcissistic.
Posted by katrina - 05/07/2011
Check the website of the tax agency in your country to see if they expect you to keep the original documents or if photocopies or scans are OK. Some countries have 7 years retention for financial and tax records.
Personally, I’d rather have the clutter of a few documents than risk someone stealing my identity off a website
Posted by Mrs Angry - 05/07/2011
@Anne – Wow. Just wow. When you pull your head out of the sand you’ll discover that it’s not narcissistic at all…there are thousands of people who would be very interested to take the information in those, and your documents, and ‘steal’ your identity. If you think this isn’t a problem, try it out for yourself – let me know how it works out for you.
For me, it wasn’t much fun at all. I had some one steal papers from my bin that were accidentally thrown out. Using the information, in my name they were able to set up credit cards, buy expensive and luxury items, take out a loan and they tried to buy a car. More than a year later we are still trying to untangle the mess.
The people concerned have never been caught, They weren’t out to get me personally. They would have been just as happy to take your documents and your identity and to be honest, with your attitude, I would say you’re probably next on their list!
Try googling ‘identity theft’. Does that puts things into perspective for you or do you still believe no one will give a fig about your private documents and information?!
Posted by Laetitia in Australia - 05/07/2011
I’m scanning old uni notes and uploading them to Google Docs, then I’m getting rid of the originals. That way, if I end up in a job where info from the early 1990s would be useful they’ll be much more readily available and pleasant than having to go home and poke about in boxes for notes that now smell of naphthalene. If anyone were to hack my account, well, good luck to them trying to become a civil engineer by reading my notes!
I wouldn’t put something of high importance like my tax records on there. And fortunately the Australian Tax Office only requires records be kept for 5 years for personal tax and, I think, 7 years for business tax.
Posted by stormy - 05/08/2011
One of the best recommendations I’ve heard for when potentially-hazardous information needs to be backed up online is to email it to yourself in a password-protected archive file.
If you email it from a different account, and give it a subject line that makes sense to you, but no-one else would think to search under, it would take more trouble than it would be worth to find it (assuming they even know it’s there and consider it worth searching…).
For an example, I’ve scanned copies of my passport, driver’s license, front and back of my credit cards, insurance docs,etc. Now in case of disaster, I will at least have copies of these crucial docs if my home burns down, gets hit by an earthquake, washed away by a flood… I will be able to at least make a start on proving who I am, and accessing the credit accounts to get under a roof, or out of town.
But tax records and the like? I’ll never need to access them in an emergency situation, those are backed up to a USB hard-drive, that is in the safe-deposit box at my local bank.
Posted by Elaine - 05/09/2011
I’ve been using Livedrive (http://www.livedrive.com) which is like Mozilla with an online Briefcase that allows you to store files online with unlimited space. It’s encrypted, and while it does cost an annual subscription, it’s a small cost to know that it has lower risk of getting hacked, contains industry standard encryption and has unlimited storage and less downtime.
Posted by Sarah - 05/09/2011
Thanks so much for this post – I had no idea Google offered the authentication service, and am so glad I’ve now learned!
Posted by Nick - 05/10/2011
Be careful with DVD/CDs – the plastic degrades, causing the metal film to move and crack, and you lose random bits of your data after a few years, so it’s good for medium-term storage (tax returns etc), but for stuff that needs to stay there forever (30-40 years) it actually fails.
I personally invested in a NAS – its a box with 3 hard disks in it, and it connects to my network. I put all my stuff on it, and the hard disks are in what’s called a RAID array, which means the data is copied across multiple disks, so if one of them fails, you buy another 2Tb drive from Western Digital for $100, replace the burnt out on, and your data remains safe. I can also access it from anywhere in the world over the internet.
Nothing’s perfect – remaining risks are
- It gets damaged badly enough to compromise 2 of the disks at once (i.e. it gets knocked off the table, but that would take one hell of a knock).
- I get robbed and the thieves take off with the drive and all the data.
- Someone hacks into it over the internet and plays “rearrange the 1s and 0s” with my data.
But I get to keep my data, I dodge all that untested legal hullabaloo about who my data belongs to and what they can do with it when someone else stores it under contract (possession versus ownership legal issues), and I don’t have to worry about whether I trust a third party with my photos, documents, bank statements, tax returns, contracts and business plans. Althoguh truth be told, I kind of do trust Google not to illegally take advantage of my data.
Posted by Jenna - 05/11/2011
I use Google Docs for most of my home document needs because I like to be able to access them from work sometimes, and it’s also less expensive than having to purchase Microsoft software to use at home. However, I don’t keep anything on there that has account information or any other sensitive data, so I’m still searching for the best way to back up my other documents. I appreciate all the suggestions in the comments!
Comments are closed for this entry.