Storytime, since I'm no longer under NDAs for the company, over a decade ago somewhere that I worked, a disgruntled employee who decided to quit, made a point to within a week of quitting, take a whole bunch of important physical documents they had (because, FBOW, our email and other data retention was so bad, it was safer to have them as prints) and threw them all in our fancy Iron Mountain 'disposal' bin.
Apparently due to the agreement with them, short of a court order, only specific employees/titles in the company were allowed to be the persons to retrieve them.
Keeping that situation in mind, it's clear that this dance for better or worse is part of their posturing as a retention center with very strict rules to ensure compliance while also avoiding snooping.
Anything else is the sort of stuff that causes blog posts and news articles about data breaches to be written.
It’s exactly like the above but it’s presented as if the data sits neatly on two drives stored in a safe and all you have to do is mount them to see the unencrypted data.
I've dealt with them as well - they don't like being in this kind of position either.
[0] - https://ironmountain.jobs/manassas-va/armed-officer-safety-s...
[1] - https://ironmountain.jobs/boyers-pa/security-officer-armed/6...
They weren't talking about breaking into the Iron Mountain facility
That said, I would be willing to bet that doing such an act, even as a client, would be problematic on other levels.
Let's remember; part of this whole contract with a company like this, is they are guaranteeing that your organization is following document retention processes. The sort of stuff that makes it really easy to pass things like a SOX audit.
Cause, I've worked at other places. The kinds of places where you come in on a Saturday, there's a whole bunch of document bins out in the middle of the office that weren't there on a Saturday, everything is gone by Monday, and a bunch of people one to two slots under the C level resign within a week, and within the next 6-12 months all of the office gossip is either the bankruptcy proceedings impacting operations or the civil RICO lawsuit from the departed founder.
Consider this: the utility that provides the electricity and the ISP providing internet also do not have a direct relationship with Nine PBS, but will be essential in carrying out the court order. Does the judge have to expressly name every transitive party responsible for carrying out the order? Time will tell, but to me the answer seems "no."
Iron Mountain just doesn’t want to be in the middle, and I can see why. OSS went defunct, PBS files a lawsuit, guy buys OSS so PBS pauses, guy now claims he was defrauded into buying it, and somewhere in the middle nobody from OSS showed up in court so there’s a default judgement to turn those over.
I would probably also refuse to turn over the documents without a court order. The whole situation is a mess and the only way to be absolutely sure you aren’t going to get dragged into it is a court order for specific performance.
PBS probably isn’t going to sue them for releasing the docs, but who knows what OSS will do. It doesn’t sound like anyone even really knows who owns OSS at the moment.
I'm sure Iron Mountain will be happy to turn over the data, but to cover their ass in terms of their agreement with OSS, they need the cover of a court order otherwise they would likely be in breach of their contract with OSS
In fact, I'd expect you to need a seizure-warrant/distinctly-named-but-to-the-layperson-identical-court-order for my place as, among other things, I don't think I am in a position to legally have standing to challenge an order that's not mentioning me, and lack of me being an active flight risk would probably preclude you from arguing exigent circumstances to secure the dev kit without a judge ordering me to let you.
TL;DR: "complying" with a court order that's filed against a 3rd party is, IMO/AFAIK, a voluntary act, specifically because the party not mentioned in the court order AFAIK has no legal standing to challenge that very order of in court. _Precisely_ because they're not legally mandated to comply, at least not beyond perhaps taking a precautionary legal hold on the referenced information to not get accused of aiding in destruction of data in case the court-ordered party directs the non-mentioned party to delete through the regular customer relationship channels (API? Whatever else?).
Don't blame corruption for what was most likely extremely strained budgets. Local public access TV stations like KETC (Nine PBS) tend to be severely understaffed and underpaid.
Realistically, they went with OSS because the quote for a local MSP was cheaper than the cost of hiring additional headcount (a $70k salary ends up costing roughly $100k for an employer).
(Source: occasionally dealt with these kinds of accounts back when I was an SE and later PM)
Edit: I'm right - they only have 1 IT/Software employee managing the entire organization which only has a budget of $30M after losing $1.8M in federal funding.
Oof, that is a horrible position to be in with so many dicks on HN. You'd assume SWEs would have sympathy for other SWEs.
Some HNers should have been taught better manners by their parents or should have at least internalized the lessons from Arthur as a kid [0].
If that employee sees this post - I want to say THANK YOU. It's a hard job.
Only if you haven't been reading HN very long!
I hate HN and how it has gotten worse and worse as the years go by. There are a couple basic changes that the mod team could do to help alleviate the degradation but they aren't doing it.
That's making a lot of assumptions. I host some of my backups on what is effectively a reseller of S3; was that decision corrupt?
But, yes, PBS does bear some responsibility here. If you leave your car in a parking lot overnight with the door open and the key in the ignition, the thief is still wrong for taking it, but there's a limit to how much indignity you can have.
PBS is an association of local public broadcasters, most of whom are SEVERELY underfunded.
As the parent entity, the national PBS has a responsibility to guide and even mandate policies and provide best practice guidelines or even offer support and assistance in burden sharing arrangements.
PBS has long now had major structural challenges due to things like internal corruption and overbearing control by the well funded chapters without commensurate responsibility.
As with many such decentralized membership organizational structures, incentives can often be very misaligned between verticals and laterals.
You're going to have to unpack the assumption here: are you alleging that there was a kickback in the procurement process?