Earlier this year, the Dallas office of the FBI raided a web hosting facility (co-lo) and carted off more than a million dollars worth of computer equipment, including 220 servers, routers, switches and even power strips (I guess the agents were concerned that the power strips may yield valuable information). Additionally armed FBI agents raided the house of the owner of the co-lo, where they reportedly seized "eight iPods, some belonging to his three children, five XBoxes, a PlayStation3 system and a Wii gaming console, among other equipment. Agents also seized about $200,000 from the owner's business accounts, $1,000 from his teenage daughter's account and more than $10,000 in a personal bank account belonging to the elderly mother of his former comptroller."
This is obviously very bad news for the owner of that co-lo and bad news also for the more than 320 businesses who simply had the bad luck of running their web servers at that business location. At the time this article was written, none of those sites have returned to the web. Pity the business owner who relies on that website for income. Worse still is the information I got from an FBI insider who told me that Branch Offices typically have a 9-12 month backlog of computer forensic work. So I guess sites like Catholic Media Group, Intelmate, Crydontech, a credit card processing service, and a video gaming company among many others will be dark while they scramble to rebuild their sites and get them hosted at another facility. Incidentally, the credit card processor (who was not involved in or associated with the reason for the raid) physically lost $35,000 worth of computer equipment. And what, you may ask, exactly was the FBI's reason for such heavy-handed tactics? Well, I can tell you that it had absolutely nothing to do with the reason they gave to the press: "alleged fraud." The reasons for the vast seizure involved a VoIP company and where the clients were calling. 'Nuff said!
What lessons can we learn from this escapade? I would suggest the following seven recommendations for anyone who earns a living from a website:
- Never, ever leave your data (content, customer lists, consent forms, site statistics, etc.) on your server for more than a day. Once you perform a full backup, you can perform daily, incremental ones that take up much less time and consume far less bandwidth.
- Have a DVD ready that can be used to recreate your website on any server you choose.
- If your budget allows, consider having a "warm backup" — a second web server that duplicates all transactions from the main site and can be used as the primary site in the case the primary becomes unavailable — located at another hosting facility at least two states away (more on this in a bit).
- The 'two state rule' is a good rule for surviving natural disasters, power outages, etc.
- The FBI is a federal agency and its search and seizure warrants are valid in all 50 states. However, unless they are specifically targeting you, the chances that both data centers will be raided simultaneously are extremely small. If you feel that the FBI may be targeting you, however, locate your servers where they can't get them. Servers located outside the country obviously cannot be raided by the FBI.
- Keep a copy of your web hosting contract handy and see what provisions exist in case the co-lo suffers a similar kind of loss.
- Minimize downtime, even if this means hosting your site in your garage. It can take days for a change in your site's IP address to propagate across the web and you need to make sure to do everything possible to get back online as soon as possible.
We'll watch and see if little drops of truth dribble out of this Dallas case.