Backup Encryption Contents Introduction Hardly a week goes by where you don't hear the stories in the news about companies leaking important data through losing their backup tapes. Whether it is through malicious theft, opportunistic snatching, or accidental misplacement there is a huge cost to business when data is lost. When the data contains sensitive information about members of the public, possibly including bank account and credit card numbers, the cost can be severe indeed. Simply the stigma of having to notify clients that you've lost their data is extremely damaging. For example, in June 2005 Citigroup was forced to issue a media statement admitting that tapes containing personal information on 3.9 million customers had been lost while they were being carried to another site. In July 2006 Chase staff accidentally discarded five computer tapes containing personal information and financial records of 2.6 million Circuit City credit card account holders. Even though the tapes were in a locked box, the company was forced to release a public statement and was forced to notify and compensate all of those customers. And this threat isn't new at all. In 1977 a disgruntled system administrator at Imperial Chemical Industries (ICI) in the UK stole a set of backup tapes and attempted to extort a large amount of money from the company for their return. He was eventually captured. Despite the obvious and well-known risks, I've found that few companies actually use encryption to protect their backups. And this is quite surprising considering how