Physical Security FAIL :-(
Notice anything wrong with this picture?
I was walking by one of the Iron Mountain Secure Shredding bins at work one day several months ago and noticed that the lock wasn’t actually locked. Being the security conscious individual that I am, I tried to latch the lock again, but the lock was so rusted that it wouldn’t close as hard as I tried. I can’t just leave it there like that so I call the number on the bin’s label and there is an automated message that tells me that they’re not taking local calls anymore and gave me a different number to try. I call that number and they ask me for my company ID number which I had no idea what it was. She informed me that without that ID number I couldn’t submit a support request. I informed the lady that this bin contained sensitive personal and financial information and that the issue couldn’t wait for some random company ID to be found. Fortunately, she gave in and created the support ticket for me saying that I should hear back from someone within four hours.
One week later, on Friday, Iron Mountain finally calls me back and says that they will come to replace the lock the following Monday before 5 PM. When the lock hadn’t been replaced yet on Monday evening, I called Iron Mountain back up. Looking at their records, they showed that a new lock had been delivered, but they had no idea where and the signature was illegible. I work on a three-building campus with 14 floors between them and almost 3,000 people. If they can’t tell me where the lock is, then there’s no way for me to track it down. They said that they would investigate and call me back.
After not hearing back from them again for a couple of days, I called them back. The woman I spoke with had no real update on the investigation. She said that she would send another message “downstairs” and escalate to her supervisor. At this point it had been almost three weeks with sensitive documents sitting in a bin with a malfunctioning lock. The next day they called me back and said they were never able to track down who the new lock was left with so they would bring us a new one at no charge. Finally, after a total of 24 days with a unlocked Secure Shredding bin, Iron Mountain was able to replace the lock. Iron Mountain……FAIL.
December 20th, 2010 at 10:23 am
Hi, I’m with Iron Mountain and wanted to acknowledge your post. This issue has been raised to senior management and is taken very seriously. Please feel free to contact me directly with more information and we’ll follow-up.
Thank you.
January 14th, 2011 at 5:43 pm
Things like this make me mad. I work for Iron Mountain as a driver. We work so hard to make sure the clients get the best service possible, and we hear horror stories, like yours, from clients that IM personnel on the phone or management not doing their jobs right or taking forever to deal with it. It’s fustrating. We are the people our clients see everyday, we are the face of Iron Mountain, so we get all the backlash of bad experiences.. Not that it happens alot, but it does happen. For your information, some clients don’t want locked bins, because they don’t want to stand there and put in a sheet at a time, they request them unlocked mostly for big shred jobs where they are emptying out cabinets or something.. But in your case, IM seams to have FAILED… Happy shredding =)
July 5th, 2011 at 7:21 pm
You’re describing having physical access to a bin with wheels. I’m not sure a padlock is the biggest problem here.
A padlock is easily circumvented and only means to keep honest people honest. While your dedication to the cause is admirable, it’s not really necessary.
Anyone with a half hour on youtube can pick a simple padlock, or with channellocks just cut the lock off, or with industrial cutters, cut the plastic hole larger.
I don’t work for Iron Mountain, and I’m glad to see they responded to your post, but let’s keep some perspective. The documentation needs only be safe when it leaves the building, not before. If your management was worried about their employees getting the info, they would shred it on-site, physically restrict the bin access, or even just use their own lock. Your management doesn’t care.
Iron Mountain: Really? It’s what? A $3 padlock? For crying out loud. I realize that getting someone out there costs a lot more in time and gas, but keep extra locks with the customer or something. Then it would be 100% on the companies’ management .