4 ms·

Judge sets framework for Nine PBS to retrieve archival data

183 points by qingcharles 2mo ago

deleted 2mo ago
[deleted]
boscillator 2mo ago
The ruling seems fair and reasonable, and I'm surprised they couldn't come to the same conclusion without a court.
- bluGill 2mo ago
  A court is needed for cover since it is possible that sometimes else's data will be seen or even corrupted in the process. This way they can say they were doing what the court asked for. That is legal cover for everyone to do what they want. Also legal limits on what they can do. That is how I interpret the article anyway
- Jtsummers 2mo ago
  Sometimes these things can go better for companies like Iron Mountain when there's a court order/decision in place to cover them. Nine PBS, in order to access their own data, could end up accessing data belonging to other people and that may not be properly covered under existing contracts and policies. It's a risk for Iron Mountain if this happens. Having a court decision and court set procedures that essentially force them to participate and also establishes third party review of the data will give them some cover if one of those other clients of the now defunct OSS discovers that Nine PBS accessed or inadvertently retained their data.
- trebligdivad 2mo ago
  They couldn't really - I doubt Iron Mountain actually objected to giving the data, but in the end it probably wasn't in a position to know what data belonged to PBS and what belonged to other clients of OSS and you'd get very worried if a data storage company gave a companies data to someone else without authorisation.
  - plorg 2mo ago
    An Iron Mountain employee is quoted in this article saying basically that.
- mikeryan 2mo ago
  It’s likely that Iron Mountain needed a court order in order to do this with legal cover. It’s just a data warehouse and OSS likely had multiple clients data and backups. Iron Mountain can’t let one third party go searching through a defunct customers stuff that has a bunch of additional third parties property intermingled with it. Too many unknowns and potentially litigious third parties.
s1artibartfast 2mo ago
Im curious why this topic has been popping up in the news. It seems like a bog standard contractor/subcontractor obligation case.
- dylan604 2mo ago
  If Iron Mountain made a deal with PBS-affiliate, they'd be breaking the terms of the contract with their customer (the fact it is defunct is just an asterisk). If you were an Iron Mountain client and one of your customers made an end run around you to go directly to Iron Mountain because they refused to pay your bill, you'd be pissed at Iron Mountain. By solving this as they have done, Iron Mountain can assure other clients they will not just let a third person circumvent their clients. They can now say they only did it by a court order even if they were more than willing to accept the asterisk and do it on principle. Everyone is happy. Everyone is whole.
  - s1artibartfast 2mo ago
    Thats my impression too. Iron mountain is doing exactly what I would want if I had data with them. If you are wharehousing data, you dont just let your customer's customer come in, look around, and take whatever they want. Even if they have a sob story. You ask for a court order with specifics.
- anigbrowl 2mo ago
  Archival/secure storage is big business with big liability headaches if you make a bad decisiion.
- Barbing 2mo ago
  A non-profit in a deeply unfair situation tugs at the heartstrings.
  - s1artibartfast 2mo ago
    What is unfair? It seems completely normal and what courts are for sorting out. Iron mountain is acting exactly how I would want them to if they were storing data for me. If you are wharehousing data, you dont just let your customer's customer come in, look around, and take whatever they want. Even if they have a sob story. You ask for a court order with specifics.
Magicrafter13 2mo ago
> These archives represent an important part of our region’s history, and we look forward to ensuring their preservation and protection through the Court-approved process. Apparently you didn't find them important enough to have backups. Hundreds of thousands of dollars a year in net income and they couldn't afford a cheap NAS with 4 disks. Incredible.
- MadnessASAP 2mo ago
  They did, they contracted with a vendor to store and backup the data. If that is insufficient then just about every customer of AWS, Azure, GCP, OCP, and every other managed storage provider is guilty of the same sin.
  - aaronmdjones 2mo ago
    I have to agree with GP here, this is pretty incredible. They contracted with a vendor to store their data, not to back it up. It's not a backup if you can lose it in the same instant you lose the data. You're right, they are. If your data can't survive a single storage host vanishing from existence, you don't have a backup. If your data can't survive one predictable or regularly occurring catastrophic act of nature, you don't have a backup. If your data can't survive a piece of malware -- with all of the credentials you have -- erasing it, you don't have a backup. EDIT: Also, if you don't regularly test that your backups actually work, you probably don't have a backup. Lots of companies learn that one the hard way.
    - jambalaya8 2mo ago
      If you do not have at least one, but usually two copies of a backup in your physical possession, you do not have a backup. |o-o|
  - stronglikedan 2mo ago
    Then that is just the 1 in 3-2-1 backups, and neglecting the 3 & 2 is a sin (wrt backup strategies).
  - 2mo ago
hn_throwaway_99 2mo ago
I think stories like these highlight the need for clearer (not necessarily more) regulations around contractor/subcontractor/client relationships and what happens when one of them goes tits up. There were rampant issues in the fintech world that exploded when Synapse, a banking as a service provider, went bankrupt and their ledger didn't match what partner banks had in their accounts. End users were told "your deposits are FDIC insured", but in bankruptcy court the judge was sort of at a loss over how to rectify things - the banks weren't insolvent, and the FDIC (rightfully) said "hey, this isn't our problem, our regulated entities are in compliance". Looks like a similar situation happened here, where the contractors are both doing the "not it" thing. I feel like a lot of tech innovation and "business process innovation" over the past 15 years was just ignoring regulations that were built up over decades, only discovering the reasons for those regulations when the tide went out and seeing that lots of companies had been pantsless the whole time.
- ww520 2mo ago
  Whoever claims "your deposits are FDIC insured" needs to be prosecuted as fraud and scam artists. “Your” the company’s deposits in the bank is FDIC insured. My deposit with you the company is not. When the bank goes belly up, your deposit is FDIC secured up to the account limit which is tiny in the scale of things. When your company goes belly up, my deposit is gone.
  - recursivecaveat 2mo ago
    My understanding is that they split the accounts to keep up with the limit. Otherwise though yeah, FDIC will only step in for the extreme minority scenario of failure by the underlying bank. You absolutely should not be allowed to advertise FDIC insurance unless it goes all the way to the consumer.
    - vel0city 2mo ago
      > they split the accounts to keep up with the limit You're right about that, they (and other fintechs) have tons of accounts split across a ton of tiny little banks. All of those accounts and banks are FDIC insured. But, those aren't the end client's accounts. They're shared pools of money from all the clients. When Alice and Bob both give the fintech $100, the fintech may split up that total $200 across dozens of different accounts. When Alice wants $20 back, it might not even come from accounts where her initial $100 landed, that money probably got sent to Charlie when he wanted his $1,000 back. The fintech's money was FDIC insured. If any of those banks failed, all the fintech's deposits would be guaranteed. But if the fintech mismanaged their client funds and suddenly their outstanding balances in their client databases are larger than the sum of all the balances of all their hundreds of FDIC bank accounts, their clients are SOL.
alexthedigger 2mo ago
[flagged]
- pavel_lishin 2mo ago
  How exactly is the judge an activist judge in this case? Did you just find a random HN article that had "judge" in the name, and register an account to air an unrelated grievance?
  - alexthedigger 2mo ago
    Nope
js2 2mo ago
Open Source Storage (OSS), the vendor in question, was around for two decades before going out of business last year. The first and last archived versions of its web site: https://web.archive.org/web/20040628023451/https://www.osstorage.com/ https://web.archive.org/web/20040628023451/https://www.ossto... https://web.archive.org/web/20250329140721/https://www.osstorage.com/ https://web.archive.org/web/20250329140721/https://www.ossto... (The first version isn't too exciting. It's a broken Flash site.)
dredmorbius 2mo ago
Earlier coverage (St. Louis KETC / Nine PBS sues Iron Mountain for data access): "Nine PBS sues Iron Mountain over blocked access to archival data" <https://news.ycombinator.com/item?id=49285418 https://news.ycombinator.com/item?id=49285418> This is working out largely as I'd suggested it should, albeit with a court's intervention. See: <https://news.ycombinator.com/item?id=49293058 https://news.ycombinator.com/item?id=49293058>. I'd still argue that I.M. should have anticipated this situation, and have some process in place to address it. "See a court" might well be part of that process.
walrus01 2mo ago
I previously commented on this when a different, earlier news article and it wasn't clear at the time if the storage company was a colocation customer, or a dedicated server customer of Iron Mountain: ============================================= (from 4 days ago) https://news.ycombinator.com/item?id=49293326 https://news.ycombinator.com/item?id=49293326 The news article is really not clear about whether this was, relative to the company "OSS": a) OSS is a colocation customer with its own hardware colocating it inside an Iron Mountain datacenter. In which OSS owned the bare metal and paid iron mountain for rack space and power. or b) OSS is a dedicated hardware customer of Iron Mountain running a service on bare metal owned by Iron Mountain, and has gone defunct, leaving behind a bunch of servers/storage arrays that would in normal circumstances get wiped/reprovisioned. From the point of view of a customer of OSS (PBS), that's two extremely different things. If it's scenario A, I don't see how PBS has any claim against Iron Mountain. Your typical datacenter colo host for bare metal hardware owned by a customer has no involvement whatsoever in the condition or operation of the data, operating system, filesystems, RAID arrays, ZFS, etc of how the customer has set up their environment. Nor any ability to do anything with it. A colocation host that hasn't been paid for its rack space and power will typically have clauses in its colo contracts allowing for seizure and sale of abandoned hardware after a certain period of time. ==================================== New commentary: The new news article seems to shed a bit more light on it, it sounds like it's scenario B, in which OSS never owned the hardware (they just set up the operating system/software config on it), and was renting it from Iron Mountain. In this scenario it's much more realistic to expect to be able to get some data back. And as the new news article says, PBS is paying all of the overdue bills in order to be able to do so. Ordinarily a dedicated server provider that is renting rackmount bare metal hardware to people has a very automated and fast re-provisioning process, if you don't pay your bill, the terms of the contract let them wipe the servers within a fairly short amount of time and reallocat them to new customers. Now if it had been scenario A, I think that there would have been very little opportunity for judicial remedy in an order requiring Iron Mountain to do anything, because Iron Mountain would have had no control over what a failing/bankrupt/dead colocation customer did with the data on their servers. PBS might have had a claim against the principals of the OSS company, but then you get into the "blood from a stone" problem of trying to enforce a judgment against people who have no assets or ability to pay.
johnnyApplePRNG 2mo ago
https://archive.is/OBGDn https://archive.is/OBGDn
Animats 2mo ago
The court got this right. This is when you need a special master to help with cleanup after a bankruptcy. We saw something like this when TechShop went bankrupt, with member property in storage on the premises. The bankruptcy trustee set up a procedure where former members could make an appointment to retrieve their property, escorted by a representative of the trustee. Huge pain, but necessary.
vondur 2mo ago
I'm a bit confused from Iron Mountain's response about how they are worried that data could be co-mingled with other data? That would be an interesting way to back up data.
- wolrah 2mo ago
  No idea how OSS and Iron Mountain were doing things so this is pure speculation, but if for example Iron Mountain were providing an object storage platform on which OSS then ran some secondary platform that stored all the data in one place with separate metadata to figure out what's what then it's entirely reasonable that they might not be able to easily separate it out. Not saying that'd be a good way to do it, but it's easily plausible I do something similar with my clients backups, each individual client gets their own bucket on B2 for many obvious reasons but to sort out anything beyond what's obvious from the bucket name you need the backup software and appropriate encryption keys.
- cyphar 2mo ago
  Iron Mountain probably only knows what data was owned by Open Source Storage, but not on the level of which data belongs to which Open Source Storage customer. If so, it would be incredibly reckless for Iron Mountain to provide all of the data stored by Open Source Storage to one of Open Source Storage's former customers (PBS). Presumably that is why they wanted to go through the legal process so that someone else would be vested with the legal authority to determine what data PBS can legally access.
scosman 2mo ago
> William Cravens, the attorney representing Iron Mountain, told the judge his client doesn’t know the format of Nine PBS’ materials that were stored by OSS. He expressed concern about whether Nine PBS’ archival material is lumped together with data from other OSS clients. Iron Mountain wants to avoid potentially corrupting the other data, Cravens added. > Elliff ordered the immediate return of any physical devices that hold Nine PBS’ data once access to OSS’ storage system is granted… > Once Nine PBS retrieves its data, the station must work with a third party to ensure that no data from other OSS customers is among those materials. I don’t love this call. Handing over any disk has several problems. It could easily contain very sensitive data from another client. It’s inherently one-sided (another client can’t make the same request if the disk is already gone). And it’s being handed over to a PBS station that doesn’t seem to have the technical chops to manage data backups/security. I want them to get their data back, but this needs a technical intermediary that handles all client data equally.
- harshreality 2mo ago
  Is that statement by Iron Mountain's attorney believable, though? If cage or server access was shared between Iron Mountain customers, how can Iron Mountain not have a record of what's in what cage or what's on what server? If Iron Mountain customers like OSS were free to add or remove things without Iron Mountain's knowledge, then their (OSS's) access would've been limited to cages or servers dedicated to their (OSS's) own clients' data. Allowing an OSS ex-employee the same access they previously would've had should be a non-issue, from Iron Mountain's perspective.
  - msandford 2mo ago
    What iron mountain does know is which drives are owned by oss. What they don't know is which drives owned by oss have the station's data on them. Hopefully nothing is comingled and drives are dedicated to a customer. Seemingly only oss knows and they went bankrupt so who knows what shape the records are in.
    - scosman 2mo ago
ikidd 2mo ago
This station was clearing over a million dollars after expenses, and they couldn't be arsed to take a backup of their data on this cloud service. I have a hard time feeling much sympathy for them. And now Iron Mountain has to referee the data being recovered without handing over others data in the process. The utter cluelessness all around from start to finish is impressive.

183 points by qingcharles 2mo ago

deleted 2mo ago

[deleted]

boscillator 2mo ago

The ruling seems fair and reasonable, and I'm surprised they couldn't come to the same conclusion without a court.

bluGill 2mo ago
A court is needed for cover since it is possible that sometimes else's data will be seen or even corrupted in the process. This way they can say they were doing what the court asked for. That is legal cover for everyone to do what they want. Also legal limits on what they can do. That is how I interpret the article anyway
Jtsummers 2mo ago
Sometimes these things can go better for companies like Iron Mountain when there's a court order/decision in place to cover them. Nine PBS, in order to access their own data, could end up accessing data belonging to other people and that may not be properly covered under existing contracts and policies. It's a risk for Iron Mountain if this happens. Having a court decision and court set procedures that essentially force them to participate and also establishes third party review of the data will give them some cover if one of those other clients of the now defunct OSS discovers that Nine PBS accessed or inadvertently retained their data.
trebligdivad 2mo ago
They couldn't really - I doubt Iron Mountain actually objected to giving the data, but in the end it probably wasn't in a position to know what data belonged to PBS and what belonged to other clients of OSS and you'd get very worried if a data storage company gave a companies data to someone else without authorisation.
- plorg 2mo ago
  An Iron Mountain employee is quoted in this article saying basically that.
mikeryan 2mo ago
It’s likely that Iron Mountain needed a court order in order to do this with legal cover. It’s just a data warehouse and OSS likely had multiple clients data and backups. Iron Mountain can’t let one third party go searching through a defunct customers stuff that has a bunch of additional third parties property intermingled with it. Too many unknowns and potentially litigious third parties.

s1artibartfast 2mo ago

Im curious why this topic has been popping up in the news. It seems like a bog standard contractor/subcontractor obligation case.

dylan604 2mo ago
If Iron Mountain made a deal with PBS-affiliate, they'd be breaking the terms of the contract with their customer (the fact it is defunct is just an asterisk). If you were an Iron Mountain client and one of your customers made an end run around you to go directly to Iron Mountain because they refused to pay your bill, you'd be pissed at Iron Mountain. By solving this as they have done, Iron Mountain can assure other clients they will not just let a third person circumvent their clients. They can now say they only did it by a court order even if they were more than willing to accept the asterisk and do it on principle. Everyone is happy. Everyone is whole.
- s1artibartfast 2mo ago
  Thats my impression too. Iron mountain is doing exactly what I would want if I had data with them. If you are wharehousing data, you dont just let your customer's customer come in, look around, and take whatever they want. Even if they have a sob story. You ask for a court order with specifics.
anigbrowl 2mo ago
Archival/secure storage is big business with big liability headaches if you make a bad decisiion.
Barbing 2mo ago
A non-profit in a deeply unfair situation tugs at the heartstrings.
- s1artibartfast 2mo ago
  What is unfair? It seems completely normal and what courts are for sorting out. Iron mountain is acting exactly how I would want them to if they were storing data for me. If you are wharehousing data, you dont just let your customer's customer come in, look around, and take whatever they want. Even if they have a sob story. You ask for a court order with specifics.

Magicrafter13 2mo ago

> These archives represent an important part of our region’s history, and we look forward to ensuring their preservation and protection through the Court-approved process. Apparently you didn't find them important enough to have backups. Hundreds of thousands of dollars a year in net income and they couldn't afford a cheap NAS with 4 disks. Incredible.

MadnessASAP 2mo ago
They did, they contracted with a vendor to store and backup the data. If that is insufficient then just about every customer of AWS, Azure, GCP, OCP, and every other managed storage provider is guilty of the same sin.
- aaronmdjones 2mo ago
  I have to agree with GP here, this is pretty incredible. They contracted with a vendor to store their data, not to back it up. It's not a backup if you can lose it in the same instant you lose the data. You're right, they are. If your data can't survive a single storage host vanishing from existence, you don't have a backup. If your data can't survive one predictable or regularly occurring catastrophic act of nature, you don't have a backup. If your data can't survive a piece of malware -- with all of the credentials you have -- erasing it, you don't have a backup. EDIT: Also, if you don't regularly test that your backups actually work, you probably don't have a backup. Lots of companies learn that one the hard way.
  - jambalaya8 2mo ago
    If you do not have at least one, but usually two copies of a backup in your physical possession, you do not have a backup. |o-o|
- stronglikedan 2mo ago
  Then that is just the 1 in 3-2-1 backups, and neglecting the 3 & 2 is a sin (wrt backup strategies).
- 2mo ago

hn_throwaway_99 2mo ago

I think stories like these highlight the need for clearer (not necessarily more) regulations around contractor/subcontractor/client relationships and what happens when one of them goes tits up. There were rampant issues in the fintech world that exploded when Synapse, a banking as a service provider, went bankrupt and their ledger didn't match what partner banks had in their accounts. End users were told "your deposits are FDIC insured", but in bankruptcy court the judge was sort of at a loss over how to rectify things - the banks weren't insolvent, and the FDIC (rightfully) said "hey, this isn't our problem, our regulated entities are in compliance". Looks like a similar situation happened here, where the contractors are both doing the "not it" thing. I feel like a lot of tech innovation and "business process innovation" over the past 15 years was just ignoring regulations that were built up over decades, only discovering the reasons for those regulations when the tide went out and seeing that lots of companies had been pantsless the whole time.

ww520 2mo ago
Whoever claims "your deposits are FDIC insured" needs to be prosecuted as fraud and scam artists. “Your” the company’s deposits in the bank is FDIC insured. My deposit with you the company is not. When the bank goes belly up, your deposit is FDIC secured up to the account limit which is tiny in the scale of things. When your company goes belly up, my deposit is gone.
- recursivecaveat 2mo ago
  My understanding is that they split the accounts to keep up with the limit. Otherwise though yeah, FDIC will only step in for the extreme minority scenario of failure by the underlying bank. You absolutely should not be allowed to advertise FDIC insurance unless it goes all the way to the consumer.
  - vel0city 2mo ago
    > they split the accounts to keep up with the limit You're right about that, they (and other fintechs) have tons of accounts split across a ton of tiny little banks. All of those accounts and banks are FDIC insured. But, those aren't the end client's accounts. They're shared pools of money from all the clients. When Alice and Bob both give the fintech $100, the fintech may split up that total $200 across dozens of different accounts. When Alice wants $20 back, it might not even come from accounts where her initial $100 landed, that money probably got sent to Charlie when he wanted his $1,000 back. The fintech's money was FDIC insured. If any of those banks failed, all the fintech's deposits would be guaranteed. But if the fintech mismanaged their client funds and suddenly their outstanding balances in their client databases are larger than the sum of all the balances of all their hundreds of FDIC bank accounts, their clients are SOL.

alexthedigger 2mo ago

[flagged]

pavel_lishin 2mo ago
How exactly is the judge an activist judge in this case? Did you just find a random HN article that had "judge" in the name, and register an account to air an unrelated grievance?
- alexthedigger 2mo ago
  Nope

js2 2mo ago

Open Source Storage (OSS), the vendor in question, was around for two decades before going out of business last year. The first and last archived versions of its web site: https://web.archive.org/web/20040628023451/https://www.osstorage.com/ https://web.archive.org/web/20040628023451/https://www.ossto... https://web.archive.org/web/20250329140721/https://www.osstorage.com/ https://web.archive.org/web/20250329140721/https://www.ossto... (The first version isn't too exciting. It's a broken Flash site.)

dredmorbius 2mo ago

Earlier coverage (St. Louis KETC / Nine PBS sues Iron Mountain for data access): "Nine PBS sues Iron Mountain over blocked access to archival data" <https://news.ycombinator.com/item?id=49285418 https://news.ycombinator.com/item?id=49285418> This is working out largely as I'd suggested it should, albeit with a court's intervention. See: <https://news.ycombinator.com/item?id=49293058 https://news.ycombinator.com/item?id=49293058>. I'd still argue that I.M. should have anticipated this situation, and have some process in place to address it. "See a court" might well be part of that process.

walrus01 2mo ago

I previously commented on this when a different, earlier news article and it wasn't clear at the time if the storage company was a colocation customer, or a dedicated server customer of Iron Mountain: ============================================= (from 4 days ago) https://news.ycombinator.com/item?id=49293326 https://news.ycombinator.com/item?id=49293326 The news article is really not clear about whether this was, relative to the company "OSS": a) OSS is a colocation customer with its own hardware colocating it inside an Iron Mountain datacenter. In which OSS owned the bare metal and paid iron mountain for rack space and power. or b) OSS is a dedicated hardware customer of Iron Mountain running a service on bare metal owned by Iron Mountain, and has gone defunct, leaving behind a bunch of servers/storage arrays that would in normal circumstances get wiped/reprovisioned. From the point of view of a customer of OSS (PBS), that's two extremely different things. If it's scenario A, I don't see how PBS has any claim against Iron Mountain. Your typical datacenter colo host for bare metal hardware owned by a customer has no involvement whatsoever in the condition or operation of the data, operating system, filesystems, RAID arrays, ZFS, etc of how the customer has set up their environment. Nor any ability to do anything with it. A colocation host that hasn't been paid for its rack space and power will typically have clauses in its colo contracts allowing for seizure and sale of abandoned hardware after a certain period of time. ==================================== New commentary: The new news article seems to shed a bit more light on it, it sounds like it's scenario B, in which OSS never owned the hardware (they just set up the operating system/software config on it), and was renting it from Iron Mountain. In this scenario it's much more realistic to expect to be able to get some data back. And as the new news article says, PBS is paying all of the overdue bills in order to be able to do so. Ordinarily a dedicated server provider that is renting rackmount bare metal hardware to people has a very automated and fast re-provisioning process, if you don't pay your bill, the terms of the contract let them wipe the servers within a fairly short amount of time and reallocat them to new customers. Now if it had been scenario A, I think that there would have been very little opportunity for judicial remedy in an order requiring Iron Mountain to do anything, because Iron Mountain would have had no control over what a failing/bankrupt/dead colocation customer did with the data on their servers. PBS might have had a claim against the principals of the OSS company, but then you get into the "blood from a stone" problem of trying to enforce a judgment against people who have no assets or ability to pay.

johnnyApplePRNG 2mo ago

https://archive.is/OBGDn https://archive.is/OBGDn

Animats 2mo ago

The court got this right. This is when you need a special master to help with cleanup after a bankruptcy. We saw something like this when TechShop went bankrupt, with member property in storage on the premises. The bankruptcy trustee set up a procedure where former members could make an appointment to retrieve their property, escorted by a representative of the trustee. Huge pain, but necessary.

vondur 2mo ago

I'm a bit confused from Iron Mountain's response about how they are worried that data could be co-mingled with other data? That would be an interesting way to back up data.

wolrah 2mo ago
No idea how OSS and Iron Mountain were doing things so this is pure speculation, but if for example Iron Mountain were providing an object storage platform on which OSS then ran some secondary platform that stored all the data in one place with separate metadata to figure out what's what then it's entirely reasonable that they might not be able to easily separate it out. Not saying that'd be a good way to do it, but it's easily plausible I do something similar with my clients backups, each individual client gets their own bucket on B2 for many obvious reasons but to sort out anything beyond what's obvious from the bucket name you need the backup software and appropriate encryption keys.
cyphar 2mo ago
Iron Mountain probably only knows what data was owned by Open Source Storage, but not on the level of which data belongs to which Open Source Storage customer. If so, it would be incredibly reckless for Iron Mountain to provide all of the data stored by Open Source Storage to one of Open Source Storage's former customers (PBS). Presumably that is why they wanted to go through the legal process so that someone else would be vested with the legal authority to determine what data PBS can legally access.

scosman 2mo ago

> William Cravens, the attorney representing Iron Mountain, told the judge his client doesn’t know the format of Nine PBS’ materials that were stored by OSS. He expressed concern about whether Nine PBS’ archival material is lumped together with data from other OSS clients. Iron Mountain wants to avoid potentially corrupting the other data, Cravens added. > Elliff ordered the immediate return of any physical devices that hold Nine PBS’ data once access to OSS’ storage system is granted… > Once Nine PBS retrieves its data, the station must work with a third party to ensure that no data from other OSS customers is among those materials. I don’t love this call. Handing over any disk has several problems. It could easily contain very sensitive data from another client. It’s inherently one-sided (another client can’t make the same request if the disk is already gone). And it’s being handed over to a PBS station that doesn’t seem to have the technical chops to manage data backups/security. I want them to get their data back, but this needs a technical intermediary that handles all client data equally.

harshreality 2mo ago
Is that statement by Iron Mountain's attorney believable, though? If cage or server access was shared between Iron Mountain customers, how can Iron Mountain not have a record of what's in what cage or what's on what server? If Iron Mountain customers like OSS were free to add or remove things without Iron Mountain's knowledge, then their (OSS's) access would've been limited to cages or servers dedicated to their (OSS's) own clients' data. Allowing an OSS ex-employee the same access they previously would've had should be a non-issue, from Iron Mountain's perspective.
- msandford 2mo ago
  What iron mountain does know is which drives are owned by oss. What they don't know is which drives owned by oss have the station's data on them. Hopefully nothing is comingled and drives are dedicated to a customer. Seemingly only oss knows and they went bankrupt so who knows what shape the records are in.
  - scosman 2mo ago

ikidd 2mo ago

This station was clearing over a million dollars after expenses, and they couldn't be arsed to take a backup of their data on this cloud service. I have a hard time feeling much sympathy for them. And now Iron Mountain has to referee the data being recovered without handing over others data in the process. The utter cluelessness all around from start to finish is impressive.