Iron Mountain uses UPS and FedEx to transport backup tapes
Iron Mountain is using UPS and FedEx in some of it's routes when delivering and picking up backup tapes over long distances. This news is disturbing to some of it's customers. The security risks are alarming since FedEx and UPS has been known to misplace and lose packages. The main reason that companies use Iron Mountain is to secure their data during transport.
In a case involving an particular company, they are sending several hundred tapes to Iron Mountain daily and about 10 tapes per month across the country to its other locations. For the long distance transportation, Iron Mountain is offloading the tapes to FedEx. The main reason this company is sending tapes across the country is for data center consolidation. "When we move several hundred servers, we use backup tapes to do that … services are being migrated from old to new servers, and it's terabytes of information," the user said. The user concedes that it is possible that their contract with Iron Mountain stated that it uses third-party transportation, but wasn't aware of it until some tapes went missing recently. They have even received backup tapes that weren't theirs. To mitigate any further risk, the company is investigating encrypting all tapes that go off site.
Melissa Mahoney, director of corporate communications at Iron Mountain, stated that it was done at their customers' request. She also stated that "We strongly believe that the tightest chain of custody for media is Iron Mountain end to end. However, that is not always possible and may not be economically attractive for very long distances. In cases where customers elect to use a shipping service, we recommend using a high-end service like FedEx Custom Critical or Panther that offer environmental controls for media, and stronger chain of custody and oversight than a typical hub-and-spoke delivery service,"
James Callahan, operations security executive at Verizon Business, also an Iron Mountain customer, stated that it would most likely raise the costs tremendously if Iron Mountain would use it's own truck for cross-country transportation. He added that customers may not be willing to pay that premium for a small amount of risk. He concluded by stating that customer demand will drive this and doesn't expect Iron Mountain to do it because it's the right thing to do.
One of the reasons that customers feel powerless is that Iron Mountain is really the only game in town. "They've bought up most of the companies in this space," said a storage architect at Qualcomm Inc. Iron Mountain does almost five million pickups and deliveries of backup tapes a year, with about a dozen or so losses in that time frame, according to public statements by the company. In the past couple of years, Iron Mountain lost tapes belonging to many high-profile firms, including Time Warner Inc., City National Bank in Los Angeles and Long Island Railroad Co., and these are just the ones that have been announced. Following these high profile announcements, the company issue a statement advising its customers to encrypt their backups to prevent potential breaches of privacy.