It’s entirely possible that Iron Mountain will be happy to turnover the data but needs a court judgement to do so without incurring more legal exposure. The article says the system belongs to OSS. If this is something like a colo arrangement then probably that is the only reasonable position to take. They can’t just go crack open a customer’s server and pull data out of it for whoever asserts a claim on it.
Iron Mountain is typically very stringent on their retention/disposal policies.
Storytime, since I'm no longer under NDAs for the company, over a decade ago somewhere that I worked, a disgruntled employee who decided to quit, made a point to within a week of quitting, take a whole bunch of important physical documents they had (because, FBOW, our email and other data retention was so bad, it was safer to have them as prints) and threw them all in our fancy Iron Mountain 'disposal' bin.
Apparently due to the agreement with them, short of a court order, only specific employees/titles in the company were allowed to be the persons to retrieve them.
Keeping that situation in mind, it's clear that this dance for better or worse is part of their posturing as a retention center with very strict rules to ensure compliance while also avoiding snooping.
As a whole, I'd say it's for better. Obviously Nine PBS's situation is shitty and fuck "OSS" for putting them in that position, but they are not Iron Mountains customer. They are strangers to Iron Mountain who just demanded 50TB of customers data from Iron Mountain. The only sane response is to tell Nine PBS to come back with a court order, and (hopefully) to tell their lawyers to just make sure Nine PBS is in fact the rightful owner and if so, not to fight them on it.
Anything else is the sort of stuff that causes blog posts and news articles about data breaches to be written.
Yeah; I haven't read TFA but IMO especially if Iron Mountain is aiding the procurement of said court order through giving some (potentially redacted as required for privacy purposes) "sample" court documents that could be readily used as reference so the lawyer on the Nine PBS side (filing with the court to get a judge to order Iron Mountain to release that data to Nine PBS) doesn't need to waste their time repeating all the drafting from scratch for what I'm assuming would be a (from the legal perspective) straight-forward request (that nonetheless has to specifically account for the particular legal data possession/ownership/access-rights situation under which the data in question is stored at Iron Mountain), especially as relevant for the situation at hand allowing Nine PBS to put a temporary data retention legal hold on these 50TB giving them a fair deadline (not merely "legally 'reasonable'") either on charity (understanding the gravity of the "this Nine PBS data is a public good (at a cursory glance)"/"information wants to be free") or offering general reasonable list price of what they bill for retaining 50TB stored under the storage model at play for "just one more month" (or whatever fair deadline) paid by Nine PBS.
Indeed. That said it’s not that different from say someone backing up to someone like Druva and they ran their infra on AWS and say hypothetically Druva went out of business you would not go to AWS directly and say “hand me over my data.” It’d have to go through proceedings, etc., not to mention that without the engineers from Druva you would not get useable unencrypted data.
It’s exactly like the above but it’s presented as if the data sits neatly on two drives stored in a safe and all you have to do is mount them to see the unencrypted data.
Er... I assume a little time with a lockpick and/or an angle grinder could have recovered the documents?
Hope you have (best case) a good lawyer or (worst case) good health insurance as well if you attempt physical intrusion. Their physical asset security team is hardboiled [0][1].
I've dealt with them as well - they don't like being in this kind of position either.
[0] - https://ironmountain.jobs/manassas-va/armed-officer-safety-s...
[1] - https://ironmountain.jobs/boyers-pa/security-officer-armed/6...
I think you've misunderstood. I believe the comment you're responding to was talking about opening a secure bin that was presumably still on site.
They weren't talking about breaking into the Iron Mountain facility
Well... Again this is far out of NDA time, the documents were not on site anymore.
That said, I would be willing to bet that doing such an act, even as a client, would be problematic on other levels.
Let's remember; part of this whole contract with a company like this, is they are guaranteeing that your organization is following document retention processes. The sort of stuff that makes it really easy to pass things like a SOX audit.
Cause, I've worked at other places. The kinds of places where you come in on a Saturday, there's a whole bunch of document bins out in the middle of the office that weren't there on a Saturday, everything is gone by Monday, and a bunch of people one to two slots under the C level resign within a week, and within the next 6-12 months all of the office gossip is either the bankruptcy proceedings impacting operations or the civil RICO lawsuit from the departed founder.
Angle grinders are amazing tools, but with such amazing tools comes amazing responsibility... Yes, that's an allegory...
If Iron Mountain is shooting people for picking locks, they’re the ones who had better have good lawyers.
Right, but if they show up and try to stop you, your options for escalation are limited and you'll have to comply (stop).
I smell a Jason Statham movie
I smell a felony case with a non-trivial chance of lead poisoning or a visit to a trauma center.
I accidentally dropped something into an iron mountain bin years ago, and just pried it open with a screwdriver.
[flagged]
Oddly aggressive comment on something so mundane. Guess it's a pet peeve of yours?
They have a judgment against OSS ordering the data to be returned, and affirming ownership.
That is not the same thing as a judgement ordering Iron Mountain specifically to release the data
Maybe it isn't the same thing in the Iron Mountain Cinematic Universe.
Consider this: the utility that provides the electricity and the ISP providing internet also do not have a direct relationship with Nine PBS, but will be essential in carrying out the court order. Does the judge have to expressly name every transitive party responsible for carrying out the order? Time will tell, but to me the answer seems "no."
it sounds like Iron Mountain specifically markets itself as "we will never turn over your data without a court order", so whether contractually obligated to do that or not, choosing to do that when they have a legal choice to do so is part of what attracts and keeps customers, and not choosing to do voluntarily would harm their business and lose them customers. Perhaps they could legally choose to turn over the data, but they choosing not to. A court order would give them no legal choice, and they would then turn over the data, and it would not harm their attraction or retention of customers, because that was always the deal, only with a court order.
The electricity company doesn’t have a contract that says they’ll only give electricity to specific people.
Iron Mountain just doesn’t want to be in the middle, and I can see why. OSS went defunct, PBS files a lawsuit, guy buys OSS so PBS pauses, guy now claims he was defrauded into buying it, and somewhere in the middle nobody from OSS showed up in court so there’s a default judgement to turn those over.
I would probably also refuse to turn over the documents without a court order. The whole situation is a mess and the only way to be absolutely sure you aren’t going to get dragged into it is a court order for specific performance.
PBS probably isn’t going to sue them for releasing the docs, but who knows what OSS will do. It doesn’t sound like anyone even really knows who owns OSS at the moment.
Those two entities don't need to do something that they wouldn't normally do for that order to get carried out. It's an extraordinary act for a colocation facility to release hardware or data to someone they have no relationship with. Iron Mountain has no relationship to or with Nine PBS, only with OSS
I'm sure Iron Mountain will be happy to turn over the data, but to cover their ass in terms of their agreement with OSS, they need the cover of a court order otherwise they would likely be in breach of their contract with OSS
Pretty sure a court order to return say a "PlayStation Dev kit" a game studio employee had when he got fired during covid remote work mandates, if it's just against the employee personally, would not obligate me to let you in or carry it out to you if that employee left it on the middle shelf of my couch table having told me he'll be back after, say, taking unpaid and non-granted-despite-requested time off for his "common law wife if that was a thing in the state they're in, but legally just unrelated consenting adults (that haven't yet moved in together)" 's funeral and rounding it up to one whole week to grieve at their memorable places, after having crashed at my place (bringing his work with him, thus the dev kit on my table-shelf) as I live much closer to the hospital his "wife" was in for the past 3 weeks and he expressed some psychological worries about spending almost all of his time alone while the love of his life is dying....
In fact, I'd expect you to need a seizure-warrant/distinctly-named-but-to-the-layperson-identical-court-order for my place as, among other things, I don't think I am in a position to legally have standing to challenge an order that's not mentioning me, and lack of me being an active flight risk would probably preclude you from arguing exigent circumstances to secure the dev kit without a judge ordering me to let you.
TL;DR: "complying" with a court order that's filed against a 3rd party is, IMO/AFAIK, a voluntary act, specifically because the party not mentioned in the court order AFAIK has no legal standing to challenge that very order of in court. _Precisely_ because they're not legally mandated to comply, at least not beyond perhaps taking a precautionary legal hold on the referenced information to not get accused of aiding in destruction of data in case the court-ordered party directs the non-mentioned party to delete through the regular customer relationship channels (API? Whatever else?).
You are overthinking this. In your scenario, you will offer to pay a lawyer to write your reply who who will say, "no just comply with the order who cares." You cannot make analogies. People just hold these frou frou promises from Iron Mountain in some higher regard than other meaningless marketing, so they mook for it - a company nobody cares about - on Hacker News.
It still sucks for all involved, and it's a shame there's not a better solution here. It's gotta be so frustrating for the folks at PBS to keep getting hit like this.
Actually it is PBS that bears responsibility here. Very likely the decision by PBS to hire OSS was corrupt (OSS are just a reseller of Iron Mountain) and they made no other provision to backup the files a second way, like AWS Glacier.
> is PBS that bears responsibility here. Very likely the decision by PBS to hire OSS was corrupt
Don't blame corruption for what was most likely extremely strained budgets. Local public access TV stations like KETC (Nine PBS) tend to be severely understaffed and underpaid.
Realistically, they went with OSS because the quote for a local MSP was cheaper than the cost of hiring additional headcount (a $70k salary ends up costing roughly $100k for an employer).
(Source: occasionally dealt with these kinds of accounts back when I was an SE and later PM)
Edit: I'm right - they only have 1 IT/Software employee managing the entire organization which only has a budget of $30M after losing $1.8M in federal funding.
Oof, that is a horrible position to be in with so many dicks on HN. You'd assume SWEs would have sympathy for other SWEs.
Some HNers should have been taught better manners by their parents or should have at least internalized the lessons from Arthur as a kid [0].
If that employee sees this post - I want to say THANK YOU. It's a hard job.
[0] - https://arthurwiki.com/wiki/Go_to_Your_Room,_D.W.
> You'd assume SWEs would have sympathy for other SWEs.
Only if you haven't been reading HN very long!
I have - this is my throwaway account, and my primary account has been alive since a little after YC moved from Boston.
I hate HN and how it has gotten worse and worse as the years go by. There are a couple basic changes that the mod team could do to help alleviate the degradation but they aren't doing it.
So you would probably not in fact assume SWEs would have sympathey for other SWEs then, I'd guess!
> Very likely the decision by PBS to hire OSS was corrupt (OSS are just a reseller of Iron Mountain)
That's making a lot of assumptions. I host some of my backups on what is effectively a reseller of S3; was that decision corrupt?
But, yes, PBS does bear some responsibility here. If you leave your car in a parking lot overnight with the door open and the key in the ignition, the thief is still wrong for taking it, but there's a limit to how much indignity you can have.
> PBS does bear some responsibility here
PBS is an association of local public broadcasters, most of whom are SEVERELY underfunded.
Although you are correct, the statement is still arguably correct.l, even if only accidentally.
As the parent entity, the national PBS has a responsibility to guide and even mandate policies and provide best practice guidelines or even offer support and assistance in burden sharing arrangements.
PBS has long now had major structural challenges due to things like internal corruption and overbearing control by the well funded chapters without commensurate responsibility.
As with many such decentralized membership organizational structures, incentives can often be very misaligned between verticals and laterals.
Note, this wouldn't be PBS the national organization, this would be the local PBS affiliate who would have made this decision. The affiliates are extremely independent.
> PBS to hire OSS was corrupt (OSS are just a reseller of Iron Mountain)
You're going to have to unpack the assumption here: are you alleging that there was a kickback in the procurement process?