Evan Schuman's StorefrontBacktalk

Iron Mountain, however, issued a statement saying, “these storage devices were being sent to us via third-party shipping company, as per the state agency’s defined disaster recovery protocol.” So Iron Mountain is saying that California insisted on FedEx, not Iron Mountain. California’s Lally said using FedEx “was not our directive,” adding, “the state was agreeable to using FedEx.”

As for how the disks got lost, Lally said the fault for that is shared by IBM, whose people did not properly secure the containers, which enabled four disks to fall out of the container. “We believe that the containers were not properly secured at the IBM facility,” she said.

Regardless of who brought in FedEx and who packaged the crate, who was making sure that quality control was maintained? Did California, IBM or Iron Mountain make special arrangements with FedEx to handle sensitive data or was this thrown in a truck along with 50 fruit baskets?

A bit late to the party, California has apparently learned that shipping sensitive disks in 2012 is perhaps not the most secure—or cost-effective—way to move data. “The California Office of Technology Services (oTech) is working with their contractors to strengthen their information security practices. oTech is also in the process of establishing new systems and processes that will eliminate the need for shipping storage devices in the future,” said a California statement.

Lally clarified that the new system—which will electronically transfer the data to offsite locations—is very near term. “We anticipate that this service will be up and running by the end of this year,” she said.

To be fair, this all likely seemed entirely reasonable at the time to all of the players. If it went well, FedEx is likely the cheapest and fastest alternative. But sensitive data transports need to be handled with extra care.

Maybe California will run into some luck finding the cartridges. In a terrible irony, the most recent news release from Iron Mountain—dated March 6, six days before the California incident—is a new service “aimed at helping customers to find and retrieve files stored on magnetic tape cartridges.” That’s convenient. It can start by finding these cartridges, which Iron Mountain—with help from IBM and FedEx—lost.