This week backups relying on the services have hit the headlines: earlier in the week, some were horrified to discover Apple’s policy for deleting old iCloud backups of its devices, and in the last couple of days, users of WD’s My Book Live devices have found their local backups have been completely removed. These might appear unrelated, but bear a common lesson.

iCloud backups

One of the most convenient ways for those with iOS or iPadOS devices to back them up is iCloud. One of the strangest policies that Apple has, though, is that old iCloud backups can be automatically deleted. This isn’t exactly made clear either: most of Apple’s documentation on these iCloud backups doesn’t mention this limitation, and the only reference I can find is here, where Apple writes: “iCloud backups are available for 180 days after you disable or stop using iCloud Backup.” That seems out of place in a paragraph headed “Delete backups and turn off iCloud Backup for your device”.

The meaning is that, if you had backed up your iPhone or iPad to iCloud before last Christmas, but not since, your old backup should now have vanished automatically even though you may have ample free space in iCloud. However, if you had made that previous backup and one earlier this month, both should still be there ready to be accessed.

This happens nowhere else in iCloud: you can leave all manner of files in your iCloud Drive or document folders, and those will be left there as long as you have sufficient free space.

I can’t for the life of me comprehend why Apple has this policy, but it’s another reflection on the fact that cloud services only rent you the storage, and can impose what policies they like, including the removal of files such as backups. I hope Apple reviews that policy and either provides a cogent reason for doing this, or rectifies its behaviour.

NAS backups

The other backup problem is even worse: if you still use Western Digital My Book Live networked storage (NAS), the chances are that over the last few days, all your backups on that storage system will have been erased. What happened here is more complicated, doesn’t involve cloud storage, and may well be even more disastrous.

One of the features of My Book Live storage is that its users can remotely access files stored there, through Western Digital’s cloud service. Although these models lost support six years ago, it appears that many are still in active use, and storing Time Machine and other backups as well as shared folders.

At some time in the last few days, My Book Live users started noticing that their devices underwent a factory reset and loss of all the stored files, which was apparently initiated by a remote connection. This was first reported by Bleeping Computer, and by Ars Technica. Western Digital attributes this to attack of the devices by malicious software, and continues to investigate. It appears that, when WD dropped distributing further software updates for My Book Live products in 2015, they were left with a vulnerability (CVE-2018-18472) which was published three years later, in 2018, but nothing has been done to mitigate that.

Lesson learned

In both cases, those worst affected by the loss of backups are those who have entrusted those backups to just one destination: iOS/iPadOS devices to iCloud, and local backups to ageing My Book Live storage. While neither should have resulted in such data loss, and both Apple and Western Digital need to investigate and act in their users’ best interests, no one should ever rely on a single backup set, nor a single method of making backups.

Maybe I’ve gone a little over the top, but I use four different tools to maintain my backups here: Time Machine (to local APFS), Carbon Copy Cloner 6 (to local APFS), ChronoSync (to local APFS), and manual copying to iCloud. If I had the bandwidth, I’d also like to use another cloud service to keep more backups off-site. I also keep fallback Macs at the ready.

If you put all your eggs in one basket, don’t be surprised when something happens to that basket and you’re left with no eggs. Please reconsider your backup strategy and ensure that your risks are wisely spread.