Iron Mountain Inc.'s trucking routes for picking up and delivering backup tapes over long distances are sometimes filled in by common transportation companies including United Parcel Service
"We assumed when we gave them our tapes, that they kept hold of them," said a senior technical specialist at a large mortgage company. He requested anonymity due to the sensitivity of the topic. "The security implications are really disturbing … FedEx misplaces stuff all the time," in his experience.
This particular company is sending several hundred tapes to Iron Mountain daily and approximately 10 tapes per month across the country to its other locations. For the long distance transportation part, Iron Mountain offloads the tapes to FedEx in this case. The main reason this company is sending tapes across the country is for data center consolidation. "When we move several hundred servers, we use backup tapes to do that … services are being migrated from old to new servers, and it's terabytes of information," the user said.
Melissa Mahoney, director of corporate communications at Iron Mountain, said in an email that third-party shipping services are used, per a customer's request.
"We strongly believe that the tightest chain of custody for media is Iron Mountain end to end. However, that is not always possible and may not be economically attractive for very long distances. In cases where customers elect to use a shipping service, we recommend using a high-end service like FedEx Custom Critical or Panther that offer environmental controls for media, and stronger chain of custody and oversight than a typical hub-and-spoke delivery service," Mahoney said.
An Iron Mountain user in the healthcare sector said he uses the company to move tapes out of the area to avoid regional disasters like hurricanes. He didn't know whether the service entailed a third-party contractor or not. "As long as my tapes get there … so far we've had no trouble, knock on wood," he said, preferring to remain anonymous as he is not authorized to speak on behalf of his company.
James Callahan, operations security executive at Verizon Business, also an Iron Mountain customer, asks how much an Iron Mountain service would cost if the company had its own proprietary trucks for cross-country transportation. "It would probably raise the costs tremendously, and are you willing to pay such a lot of extra money for such a small amount of risk?" He added: "Customer demand will drive this, … don't expect Iron Mountain to do it because it's the right thing to do."
Callahan said that when he chose Iron Mountain as a vendor, he toured the facility where his tapes would be stored. He refused to sign a standard contract, specifying his own service level agreements (SLA) and standards. "It's your data … protect it to your standards," he said.
Other users said they feel that part of the problem is that Iron Mountain is really the only game in town. "They've bought up most of the companies in this space," said a storage architect at Qualcomm Inc.
Iron Mountain performs upwards of five million pickups and deliveries of backup tapes a year, with about a dozen or so losses in that time frame, according to public statements by the company.
In the past couple of years, Iron Mountain (or one of its third-party contractors) has lost tapes belonging to many high-profile firms, including Time Warner Inc., City National Bank in Los Angeles and Long Island Railroad Co., and these are just the ones announced publicly. Eventually, the company was forced to issue a statement advising its customers to encrypt their backups to prevent potential breaches of privacy.
Analysts said the real issue for users is getting a verifiable chain of command, once tapes leave the loading dock at their IT site. "You should know where your data is every step of the way … with Iron Mountain, apparently, no one knows if the tapes ever even got there," said Mike Karp, senior analyst with Enterprise Management Associates.
Contacted for comment, FedEx and UPS were unable to respond to this story by press time.