Iron Mountain's transport methods disturb some users

Iron Mountain is moving backup tapes between its customers' remote locations, often via UPS and FedEx, a detail some users say they were not aware of.

Iron Mountain Inc.'s trucking routes for picking up and delivering backup tapes over long distances are sometimes filled in by common transportation companies including United Parcel Service (UPS) and FedEx, much to the alarm of some of its customers.

"We assumed when we gave them our tapes, that they kept hold of them," said a senior technical specialist at a large mortgage company. He requested anonymity due to the sensitivity of the topic. "The security implications are really disturbing … FedEx misplaces stuff all the time," in his experience.

This particular company is sending several hundred tapes to Iron Mountain daily and approximately 10 tapes per month across the country to its other locations. For the long distance transportation part, Iron Mountain offloads the tapes to FedEx in this case. The main reason this company is sending tapes across the country is for data center consolidation. "When we move several hundred servers, we use backup tapes to do that … services are being migrated from old to new servers, and it's terabytes of information," the user said.

More offsite storage info
Xiotech the lowest bidder in records management deal  

Iron Mountain offers Exchange email services  

Laptop backup spurs software consolidation  

The many faces of e-vaulting can confuse IT efforts
He concedes that it's possible his contract with Iron Mountain states that it uses third-party transportation, but he wasn't aware of it until some tapes went missing recently. "They told us FedEx had it somewhere," he said. "We've even got backup tapes that weren't ours before." To mitigate any further risk, the company is investigating encrypting all tapes that go off site.

Melissa Mahoney, director of corporate communications at Iron Mountain, said in an email that third-party shipping services are used, per a customer's request.

"We strongly believe that the tightest chain of custody for media is Iron Mountain end to end. However, that is not always possible and may not be economically attractive for very long distances. In cases where customers elect to use a shipping service, we recommend using a high-end service like FedEx Custom Critical or Panther that offer environmental controls for media, and stronger chain of custody and oversight than a typical hub-and-spoke delivery service," Mahoney said.

An Iron Mountain user in the healthcare sector said he uses the company to move tapes out of the area to avoid regional disasters like hurricanes. He didn't know whether the service entailed a third-party contractor or not. "As long as my tapes get there … so far we've had no trouble, knock on wood," he said, preferring to remain anonymous as he is not authorized to speak on behalf of his company.

James Callahan, operations security executive at Verizon Business, also an Iron Mountain customer, asks how much an Iron Mountain service would cost if the company had its own proprietary trucks for cross-country transportation. "It would probably raise the costs tremendously, and are you willing to pay such a lot of extra money for such a small amount of risk?" He added: "Customer demand will drive this, … don't expect Iron Mountain to do it because it's the right thing to do."

Callahan said that when he chose Iron Mountain as a vendor, he toured the facility where his tapes would be stored. He refused to sign a standard contract, specifying his own service level agreements (SLA) and standards. "It's your data … protect it to your standards," he said.

Other users said they feel that part of the problem is that Iron Mountain is really the only game in town. "They've bought up most of the companies in this space," said a storage architect at Qualcomm Inc.

Iron Mountain performs upwards of five million pickups and deliveries of backup tapes a year, with about a dozen or so losses in that time frame, according to public statements by the company.

In the past couple of years, Iron Mountain (or one of its third-party contractors) has lost tapes belonging to many high-profile firms, including Time Warner Inc., City National Bank in Los Angeles and Long Island Railroad Co., and these are just the ones announced publicly. Eventually, the company was forced to issue a statement advising its customers to encrypt their backups to prevent potential breaches of privacy.

Analysts said the real issue for users is getting a verifiable chain of command, once tapes leave the loading dock at their IT site. "You should know where your data is every step of the way … with Iron Mountain, apparently, no one knows if the tapes ever even got there," said Mike Karp, senior analyst with Enterprise Management Associates.

Contacted for comment, FedEx and UPS were unable to respond to this story by press time.

Dig Deeper on Long-term archiving

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.