11. Introduction
The 2026 Research Priorities Statement (DSC-ADM-2026-001) identifies the preservation of human knowledge as one of the Department’s core responsibilities and asks the Continuity Infrastructure Administration (CIA-DSC) to provide archival infrastructure able to retain designated holdings for at least one hundred years. The Long-Duration Information Preservation Program, established this month and co-run by CIA-DSC and the Office of Long-Term Systems Research (OLSR), will carry that work forward. This report is its technical starting point.
A century is long relative to every digital storage technology in current use. Magnetic tape in its present cartridge form has existed for under three decades; the hard disk interface standards now in service are younger still. No digital medium has been observed in archival use for a hundred years, and none will be before the Department’s decisions must be made. The assessment therefore relies on inference from manufacturer ratings, accelerated-aging studies, field experience over shorter periods and physical reasoning, and it treats every lifetime estimate as uncertain.
The report informs media selection for two facilities under development by CIA-DSC: Archive Level 1 at Continuity Research Facility Bravo in the Colorado Front Range, scheduled for commissioning in June 2026, and the pilot vault at Continuity Research Facility Charlie in interior Alaska, scheduled to begin operation in July 2026.
22. Method and sources of evidence
Evidence on media life falls into three kinds, of decreasing availability and increasing relevance. Manufacturer ratings state an expected archival life under specified storage conditions; they are generally derived from accelerated aging and are not independently verified. Accelerated-aging studies expose samples to elevated temperature and humidity and extrapolate degradation rates to normal conditions, usually assuming that a single dominant chemical process follows Arrhenius-type temperature dependence. Field experience records how media behave in real archives over years to decades.
Each has weaknesses. Accelerated aging assumes that the failure mechanism observed at high temperature is the one that will dominate at storage temperature; where several mechanisms compete, extrapolation can mislead in either direction. Field experience is short for recent media and often concerns earlier product generations. And for any medium, demonstrating directly that the probability of loss over a century is acceptably small would require more media, more time and more read operations than any archive can afford, a general difficulty with long-term storage reliability that the background literature has examined.1 The Administration’s response is to rely on replication, regular verification and planned migration rather than on the longevity of any single copy.
Lifetime ranges in this report are stated as indicative ranges for media stored within recommended conditions. The lower bound reflects conservative field experience or the absence of independent evidence; the upper bound reflects manufacturer or accelerated-aging claims. Figures outside recommended conditions can be substantially lower.
33. Assessment criteria
- Expected media life
- The period over which recorded information remains recoverable from the medium itself, assuming a working reader, under recommended storage conditions.
- Environmental sensitivity
- The dependence of media life on temperature, relative humidity, airborne contaminants, magnetic fields, light and mechanical shock.
- Read-technology dependence
- The degree to which recovery requires specialized devices, interfaces and software, and the expected period over which those will remain available.
- Density
- Capacity per medium unit, and by extension per unit of vault volume.
- Cost category
- A qualitative grouping (low, moderate, high, not established) of media cost per terabyte, reader cost, and recurring effort over a century. Dollar figures are not used.
- Unpowered survivability
- Whether information remains recoverable after an extended period, measured in decades, with no power supplied to the medium or to environmental control.
44. Assessment by medium
The six media classes assessed are those available, or in late-stage development, at the date of this report. Older formats held in legacy collections are addressed only where they bear on these classes.
4.14.1 Linear magnetic tape (LTO)
Linear Tape-Open cartridges are the dominant medium for large-scale archival storage. Current generations hold 18 TB or more of uncompressed data per cartridge, and manufacturers commonly state an archival life of up to about 30 years under controlled storage. Field experience supports multi-decade life for well-stored media of earlier generations. Tape is sensitive to temperature, humidity and their fluctuation, which affect the binder and substrate; to strong magnetic fields; and to mechanical damage from handling and repeated passes.
The medium’s limitation for century-scale retention is its reader. LTO drives of recent generations read cartridges of the same generation and of only the immediately preceding one. Generations have appeared at intervals of roughly two to three years, so a cartridge typically becomes unreadable in current drives within five to eight years of its introduction. Long-retained tape therefore depends on a reserve of older drives, which have finite service lives of their own, or on migration to newer cartridges. The Administration treats tape as an actively managed medium and plans for migration on a cycle of seven to ten years.
4.24.2 Hard disk drives
Hard disk drives offer immediate random access and capacities of 20 TB or more per unit, and are well suited to the active tier of an archive. They are poorly suited to long-term unattended retention. Service lives in large operational fleets are typically four to seven years, governed by mechanical wear. The magnetic recording on the platters may persist for longer, but behavior after long unpowered storage is poorly characterized: bearing lubricants, head–disk interfaces and drive electronics may not function reliably after a decade or more on a shelf. The drive’s interface, firmware and controller are integral to the unit, so its readability is tied to the continued availability of compatible host interfaces.
4.34.3 Flash storage
Solid-state storage based on NAND flash stores data as trapped charge, which leaks over time. Unpowered retention depends on cell technology, on how heavily the device has been written, and strongly on temperature; industry specifications for enterprise and client devices require retention of only months to about a year without power at the end of rated endurance. Fresh devices stored cool retain data considerably longer, but not reliably for decades. Flash is appropriate for working storage and caching but is excluded as an archival medium in this assessment.
4.44.4 Inorganic recordable optical disc (M-DISC class)
Recordable optical discs of the M-DISC class use an inorganic recording layer intended to resist the dye degradation that limits conventional recordable discs. Capacities follow the Blu-ray formats, from 25 GB to 100 GB per disc. Manufacturer claims of several hundred years or more rest on accelerated aging; independent evidence is more limited and some published comparisons have been less favorable. The Administration adopts a planning assumption of several decades, with the possibility of considerably longer.
The read technology is widely manufactured, standardized and comparatively simple, but optical drives are disappearing from general-purpose computers and the installed base is shrinking. Because data are recorded as physical marks along a spiral track, a reader could in principle be reconstructed from documentation with precision optics and signal processing, which is not practical for magnetic media. Low density makes optical media unsuitable for bulk holdings but suitable for selected collections and for bootstrap material.
4.54.5 Archival microfilm
Silver-gelatin microfilm on a polyester base is the most thoroughly characterized long-life medium in this assessment. Life-expectancy ratings of several centuries are published for properly processed film stored in cool, dry, stable conditions, and archives hold film that has remained legible for many decades. Degradation risks include oxidation of the silver image in polluted atmospheres, and mold and image damage at high humidity; polyester base is chemically stable compared with the older acetate bases that caused widespread losses in twentieth-century collections.
Film can hold information in two forms. Images of documents are recovered with magnification and a light source, with no dependence on any digital system. Digital data can be written as dense two-dimensional codes and recovered by scanning and decoding, which reintroduces dependence on equipment and software but only on general-purpose imaging and well-documented algorithms. Density for digital data is low, on the order of tens to around a hundred gigabytes per reel depending on encoding, and write and read throughput are modest.
4.64.6 Silica-glass optical storage
Laser-written storage in fused silica records data as nanoscale structural modifications within the volume of a glass platter, using ultrashort laser pulses. Information is encoded in the position, orientation and strength of each modification across many layers and is read by polarization-sensitive microscopy followed by computational decoding. Prototype platters hold several terabytes. Fused silica is inert to water, resistant to heat and electromagnetic fields, and not subject to the chemical degradation of organic binders or emulsions. Accelerated-aging results have been extrapolated to lifetimes of thousands of years or more.
Those extrapolations rest on the stability of the written structures and are unverified at the timescales claimed; the Administration treats them as indicating very long potential life rather than as a planning figure. The technology is pre-commercial. Write throughput is low, reading equipment is specialized and not widely available, and no long-term supply of either can be assumed. The reader, however, is built from optical microscopy and computation, both general technologies whose operating principles can be fully documented. CIA-DSC will evaluate glass storage on a pilot basis at Facility Charlie.
55. Comparative assessment
Table 1 summarizes the assessment. It should be read row by row as a profile of each medium rather than column by column as a ranking: the media serve different roles, and the archive’s design depends on combining them.
| Medium | Indicative media life, controlled storage (years) | Basis of estimate | Environmental sensitivity | Read-technology dependence | Indicative capacity per unit | Media cost per TB | Reader cost | Unpowered survivability (decades) |
|---|---|---|---|---|---|---|---|---|
| LTO tape | 15 – 30 | Manufacturer rating; field experience | Moderate–high (temperature, RH, fluctuation, fields) | High: drives read own and prior generation only | 18 – 30 TB per cartridge | Low | Moderate | Media likely; readers unlikely beyond 1–2 |
| Hard disk drive | 4 – 7 (powered service); unpowered poorly characterized | Fleet experience | Moderate (shock, temperature) | High: integral electronics and interface | 20 – 30 TB per drive | Moderate | Low (integral) | Uncertain; not relied on |
| Flash (NAND) | Months – a few years unpowered | Industry retention specifications | High (temperature, wear) | High: integral controller and interface | 8 – 60+ TB per device | High | Low (integral) | No |
| M-DISC-class optical | 30 – several hundred | Accelerated aging; limited independent tests | Low–moderate (scratches, light, heat) | Moderate: standard drives, declining availability | 25 – 100 GB per disc | Moderate–high | Low | Likely for media; reader reconstructible |
| Archival microfilm (silver-gelatin, polyester) | 100 – 500 | Long field record; published life-expectancy ratings | Moderate (RH, oxidizing pollutants) | Very low (analog); low (digital codes) | ≈ 10 – 100 GB per reel (digital encoding) | High | Low (analog) / moderate (scanner) | Yes, if cool and dry |
| Silica glass (pilot) | > 1,000 (extrapolated, unverified) | Accelerated aging; physical stability | Very low | High at present (specialized reader); reconstructible in principle | Several TB per platter (prototype) | Not established | High | Yes |
Three conclusions follow. First, the media with the highest density and lowest cost per terabyte are those with the strongest dependence on short-lived readers. Second, the media most likely to survive a century unattended carry little data per unit and are expensive per terabyte. Third, for every digital medium except possibly glass, reader availability rather than media life sets the interval between migrations.
Bar chart of planning estimates for the number of times holdings on each medium would need to be copied to new media over a century. Hard disk drives require about 20 migrations, flash about 17, LTO tape about 12, M-DISC-class optical about 4, and archival microfilm and silica glass about 1 each.
Midpoints of the ranges in Table 3. Microfilm and glass values are precautionary allowances for reformatting or reader changes rather than expected media failure.
View chart data as a table
| Category | Planning estimate (midpoint) |
|---|---|
| Hard disk | 20 |
| Flash | 17 |
| LTO tape | 12 |
| Optical (M-DISC class) | 4 |
| Microfilm | 1 |
| Silica glass | 1 |
66. Bit-level degradation and fixity
Digital media do not usually fail all at once. Errors accumulate: individual bits or blocks become unreadable or, more rarely, are read back incorrectly without detection. Error-correcting codes within each medium correct most raw errors, and published unrecoverable error rates are low, on the order of one error in 10¹⁹ to 10²⁰ bits read for current LTO tape and one in 10¹⁴ to 10¹⁵ for hard drives. At the scale of a 120 PB archive, which holds roughly 10¹⁸ bits, such rates are not negligible over repeated full reads, and they do not account for failures of whole units, firmware defects, handling errors or software faults, which in practice dominate.
The Administration manages these risks through fixity: the systematic verification that stored content is unchanged. Each object is registered with cryptographic digests at ingest, recorded in a manifest held separately from the content. Copies are audited on a schedule by reading them back and recomputing digests. A failed audit triggers repair from another copy, which is possible only if independent copies exist and are themselves verified.
| Element | Policy |
|---|---|
| Digests | Two independent cryptographic hash functions per object, recorded at ingest |
| Manifests | Held in at least three locations, including a human-readable printed or film copy |
| Copies | Minimum three, at geographically separated sites, on at least two media classes |
| Tape audit | ≈ 2% random sample read annually; full read-back at least every 5 years and at each migration |
| Optical, film and glass audit | Sample read every 5 years; full verification at any relocation |
| Repair | From a verified copy; repair events logged and reviewed quarterly for patterns |
| Independence | Copies differ in at least one of: medium, vendor, reader, software stack, site |
Independence is as important as the number of copies. Copies written by the same software to the same media type from the same batch can share defects that defeat replication. Requiring diversity across media, readers and software stacks reduces the probability that a single fault affects every copy.
77. Migration cycles
Migration is the copying of holdings to new media, and where necessary to new formats, before the old media or their readers become unreliable. It is the principal means by which digital holdings survive beyond the life of any one technology, and it is also a principal source of risk: each migration reads and rewrites the entire collection and exercises software that may contain defects.
| Medium | Planning interval (years) | Principal driver | Migration events per 100 years |
|---|---|---|---|
| Hard disk drive | 4 – 6 | Mechanical service life | 17 – 25 |
| Flash (working tier only) | 5 – 7 | Endurance; interface change | 14 – 20 |
| LTO tape | 7 – 10 | Drive generation compatibility | 10 – 14 |
| M-DISC-class optical | 20 – 30 | Drive availability | 3 – 5 |
| Archival microfilm | > 100 (analog) | Media condition; reformatting only if degraded | 0 – 1 |
| Silica glass | Not established | Reader availability | 0 – 2 (provisional) |
Every migration is verified end to end against the original digests and preceded by a dry run on a sample. The Administration’s planning horizon assumes that the institution itself must remain capable of carrying out migrations at regular intervals for a century. That is an organizational requirement as much as a technical one, and it is addressed in OLSR’s work on institutional design for long-lived organizations.
88. The readability problem
Recovering digital information requires an unbroken chain: the medium, a device that can read it, an interface to connect that device to a computer, software to control the device and interpret its file system, and software to interpret the file formats. Each link has its own obsolescence cycle, and the chain fails at its weakest link. Media that survive a century are of little use if the last compatible reader failed decades earlier.
Reader reserve
For each medium and generation in use, CIA-DSC will maintain a reserve of reading devices and spare parts sufficient for at least one full read of the holdings on that medium, plus a margin. Reserve devices are exercised on a schedule, since equipment that sits unused can fail when first needed. A reserve extends the readable life of a generation by years, not decades, and is a bridge to migration rather than an alternative to it.
Emulation of reading hardware
For media recorded as physical marks that can be imaged, including optical discs, microfilm codes and glass, the Administration will pursue reader independence through emulation: the capture of the medium’s physical signal with general-purpose imaging equipment and the reproduction of the original reader’s signal processing and decoding in documented software. A reader built this way can be reconstructed from its documentation using whatever imaging and computing technology is available in the future. The approach is not practical for magnetic tape, whose signal cannot be recovered without a matched read head and transport, and tape therefore remains on a migration path.
Software emulation of the host environment, meaning the operating system, drivers and applications needed to interpret file systems and formats, is applied to all holdings. Preference is given to open, fully documented formats so that interpreting software can be rewritten if emulation fails.
Human-readable bootstrap layers
The last line of defense is documentation that a future reader could understand without any surviving software. Each long-duration collection will carry a bootstrap sequence of layers, each of which explains how to read the next. The outermost layers are readable by eye, and each subsequent layer requires only what the previous one has explained.
| Layer | Content | Form | Required to read |
|---|---|---|---|
| 0 | Statement of what the collection is; pictorial and multilingual introduction | Large text and diagrams on film or etched glass leader | Unaided eye |
| 1 | Character sets, numerals, units; description of the encoding of later layers | Microtext on film or glass | Magnification (≈ 10× – 50×) |
| 2 | Physical recording format, error-correction scheme and decoding procedure | Microtext and diagrams | Magnification; imaging equipment |
| 3 | Reference decoder expressed in a minimal, fully specified notation; file formats | Microtext; encoded data with plain-text copy | Imaging; general-purpose computation |
| 4 | Manifests, digests and the holdings | Encoded data | Decoder from Layer 3 |
Bootstrap layers are written on the most durable media in the collection, microfilm and on a pilot basis glass, and placed with every copy. Their content is tested by asking staff unfamiliar with the encoding to recover sample data using only the documentation.
99. Facility environmental basis
The two archival facilities serve different roles. Bravo holds actively managed copies at scale, with continuous environmental control and regular access. Charlie holds long-duration copies designed to remain recoverable if all active management ceases.
9.19.1 Facility Bravo, Archive Level 1
Facility Bravo is constructed in a repurposed former hard-rock mine. Archive Level 1 lies within working levels at 140–190 m of rock overburden, which provides large thermal mass, protection from surface weather and a stable baseline environment. The environmental setpoint was chosen as a compromise across the media to be held there: cooler conditions slow chemical degradation in film and in tape binders, while the operating ranges of the robotic tape library and drives and the long-term storage ranges published by tape manufacturers argue against going much colder. Relative humidity of 35% lies within published ranges for both tape and polyester-base film.
| Parameter | Value |
|---|---|
| Temperature setpoint | 15 °C ±1 °C |
| Relative humidity | 35% RH |
| Overburden | 140 – 190 m rock |
| Tape capacity (design) | ≈ 120 PB |
| Other vaults | Optical disc vault; microfilm vault |
| Power | Dual independent utility feeds; 72 h on-site generation |
| Heat rejection | Geothermal-assisted |
| Commissioning | Scheduled June 2026 |
If environmental control fails, the surrounding rock limits the rate of temperature change, so that conditions within Level 1 drift over days rather than hours. This allows the 72-hour generation reserve to cover most interruptions and gives time for orderly response to longer ones. Bravo is not, however, designed for unpowered operation over years; that role belongs to Charlie.
9.29.2 Facility Charlie, unpowered survivability design
Facility Charlie’s design requirement is that its long-duration holdings remain recoverable for at least 100 years without power, environmental control or staff. The interior Alaska site was selected for its cold climate, low seismic hazard at the specific site, and isolation. Low mean annual temperatures reduce the rates of the chemical processes that limit film and other media, and allow a passively stable vault environment.
The design does not rely on permafrost. Ground conditions in the region are expected to change over the facility’s design life, and a structure whose stability depends on frozen ground would carry a risk that grows with time. The vault is founded on an engineered foundation and monitored for thaw. Its passive envelope combines thermal mass, insulation and vapor control; media are held in sealed enclosures with humidity buffering so that the micro-environment of each item, rather than the room, is the primary line of protection.
| Medium | Role | Relied on for unpowered survivability |
|---|---|---|
| Silica glass | Long-duration copy (pilot) | Yes, subject to pilot evaluation |
| Archival microfilm | Long-duration copy; bootstrap layers | Yes |
| M-DISC-class optical | Long-duration copy of selected collections | Yes, with reader reconstruction |
| LTO tape | Active copy | No |
The pilot vault, scheduled to begin operation in July 2026, will hold approximately 1.5 PB of active holdings and will be used to validate handling, sealing and monitoring procedures. The main vault, with a target of 60 PB of long-duration holdings and an offline glass library, is planned for completion in 2028.
1010. Conclusions and recommendations
Recommendations
- No single medium is relied on for century-scale retention. Designated holdings are held in at least three independent copies across at least two media classes and at geographically separated sites.
- LTO tape is the primary medium for actively managed copies, on a migration cycle of seven to ten years, with fixity auditing as set out in Table 2.
- Archival microfilm is used for bootstrap documentation and for selected collections where long unattended life outweighs low density.
- M-DISC-class optical media are used for selected collections at Charlie, with reader emulation developed in parallel.
- Silica-glass storage is evaluated at Charlie on a pilot basis and is not relied on as a sole copy until pilot results and independent evidence support it.
- Hard disk and flash storage are used only for working and access tiers.
- A reader reserve is maintained for every medium and generation in use, and exercised on a schedule.
This assessment will be revised at intervals of no more than three years, and earlier if pilot results at Charlie or developments in media technology warrant it.
1111. Limitations
The lifetime ranges in this report cannot be validated within any period relevant to the decisions they inform. They depend on the assumption that media are manufactured to their specifications, stored within recommended conditions and handled correctly, and they exclude risks such as fire, flood, deliberate damage and institutional failure, which are addressed through replication and site selection rather than media choice. The assessment of silica-glass storage rests on a small body of evidence about a pre-commercial technology. Cost categories are qualitative and may change materially as markets for older media contract.
Notes
- 1.See the background literature listed below (Rosenthal et al., 2005), which discusses why very high reliability of long-term digital storage cannot be confirmed by direct testing and why replication and auditing are central to it. Cited for general context only. ↩
Background literature (real-world works)
The following published works are real. They are cited for general scientific and historical context only. They do not support the fictional findings of this document, and their authors are not associated with this project.
- Rosenthal, D. S. H., et al. (2005). A Fresh Look at the Reliability of Long-term Digital Storage. Proceedings of EuroSys 2006 (arXiv:cs/0508130).