A Risk Assessment of Piql Services by FFI

1 Introduction

It was Aristotle who said ―It is likely that unlikely things should happen‖ [1 p.357]. In other words, we must accept the probability of the improbable occurring, because only when we accept it can we begin to plan for it. That is the purpose of risk assessment: to identify and evaluate the risks surrounding us to be able to mitigate the effects of those risks. It is true of all risk assessments and future studies that the unknown and the uncertainty of what the future might bring is a defining factor, but in the risk assessment presented in this report this aspect is multiplied a hundredfold. It will make an assessment of the risks faced in long-term preservation of digital data for 500 years to come. Considering the exponential change rate our society is experiencing, it is simply impossible to predict from a scientific point of view what our world and our reality will look like in 500 years from now and hence the risks we then have to face. Additionally, we have to take into account the limitations of human perception and imagination, where we are unable to even imagine, and thus foresee, events which may occur. This state of non-imagination is magnified in our assessment because of the vast time perspective. Artificial intelligence, dinosaurs roaming the earth once more due to genetic manipulation of frozen DNA, the extermination of the human race due to plague, meteor showers, and many other events which lie outside the scope of our imagination – these are all events which may happen within the next 500 years, and if they do, they could to great harm to the Piql Preservation Services, the object of study in this report. However, though it is important to allow room for such fantastical thinking in the assessment, as this is a scientific report we must mainly deal with trends and events we can perceive. In this study FFI is performing a risk assessment of the Piql Preservation Services, which represents a new and innovative solution to long-term preservation of digital data. As an alternative to the traditional storage media – hard disks, optical disks and magnetic tapes – the information is stored instead on a proven technology for audio-visual preservation – photosensitive film. This film is taken in use within the Piql Preservation Services as a newly developed ―nanofilm‖, with the same proven properties as the more traditional microfilm. This new film, the piqlFilm, has a documented longevity of at least 500 years, eliminating the need for data migration. The report is a deliverable in one of many Research & Development projects Piql AS is currently running simultaneously in order to continuously improve the technical quality of the components of the Piql system, as well as advance its security properties. The project is called ―Preservation: Immune and Authentic‖ (PreservIA), and its goal is to further develop future versions of key components of the Piql system to improve functionality and thus better ensure the security, immunity and authenticity of the information stored on the piqlFilm. The risk assessment in this study entails identifying vulnerabilities and security challenges the Piql Preservation Services may face now and in the next 500 years throughout the Piql Preservation Services Journey. Which steps this service journey include and how the scope of the assessment is defined, is clarified in chapter 2 and 3 of the report. The vulnerabilities and security challenges identified will be analysed according to their effect on the three main security properties of information security: confidentiality, integrity and availability. The

11

FFI-RAPPORT 16/00707