Your Backup Has a Lawyer Now!

Pillar 02 · Legal

Bias Declaration: I founded a data custody company. A story like this one is worth more to me than a booth at a trade show.

Nine PBS in St. Louis is suing to get back 70 years of its own archive. Fifty-plus terabytes of documentaries, local history, and institutional memory going back to the mid-1950s.

The fun part is that the data is fine. Every byte of it is sitting safe and climate-controlled in an Iron Mountain data centre in Denver. No drive died. No bit rotted. No ransomware crew ever got near it. The storage layer performed flawlessly for a customer who is now paying litigators by the hour to look at it.

How you lose data that still exists

Nine PBS contracted a vendor called Open Source Storage. OSS parked the physical servers inside an Iron Mountain facility under its own agreement. Two hops. Nine PBS could see one of them.

When renewal came due in March, OSS stopped answering the phone. Then the website disappeared. Then the station found the company listed as delinquent with the Colorado Secretary of State, which is the corporate equivalent of learning your surgeon's licence lapsed mid-procedure. Iron Mountain, whose paying customer was OSS and not the station, declined to hand anything over. The servers holding a public broadcaster's entire history belonged to a ghost, and the ghost owned the hardware.

It gets better. Mid-lawsuit, a gentleman surfaced claiming to be managing partner of a group that had acquired OSS. He corresponded for about a month, then went quiet, then announced he had been defrauded into buying the company and that it had reverted to its previous owners. This is the supply chain your archive was riding on. You just didn't know it, because the brochure had a padlock icon on it.

The contract, naturally, had a 30-day retrieval window after termination. Lovely clause. A retrieval window is a promise, and a promise requires a counterparty who reads email. Nine PBS needed a preservation order from a judge to attempt what a functioning vendor would have called Tuesday.

Eleven nines of durability, zero nines of access

The storage industry sells durability and buyers hear resilience. These are different properties, measured at different layers, and the gap between them is where Nine PBS currently lives.

Durability asks whether the bits will exist next year. Iron Mountain nailed it. The bits exist. They are pristine, redundant, professionally maintained bits that nobody who owns them is permitted to touch.

Resilience asks whether you get your data back when something in the chain fails. And "something" includes components that never appear on an architecture diagram: a vendor's solvency, a vendor's willingness to answer the phone, a vendor's mysterious acquisition by a man who later claims the acquisition was a fraud. Show me the Visio stencil for that.

Your risk register has drive failure, site failure, ransomware. Where is the line item for "our vendor's continued corporate existence"? That was the component that failed here, and there is no RAID level for it.

Litigation is a restore procedure

A single vendor holding your only accessible copy is a bet that a company you cannot audit stays solvent, responsive, and honest for the entire useful life of your data. Nine PBS wagered seven decades of archive on the going-concern status of a firm that ended up delinquent in Colorado. The house won.

And when the bet goes bad, note what your recovery mechanism actually is: discovery motions, demand letters, a judge deciding whether you may access your own history. Legal process is a restore procedure with billable hours, a docket number, and an RTO measured in fiscal quarters. It ships by default with every single-custodian architecture, and nobody mentions it in the sales call.

The fix is arithmetic, not vendor selection

The reflex response is to pick a bigger vendor. Bigger vendors get acquired, sunset product lines, and rewrite terms too. They just send nicer emails about it.

The mechanical answer has two parts.

Shard across independent custodians. Erasure-code the archive across five independent providers such that any two can vanish without data loss, and a vendor bankruptcy stops being a crisis. It becomes a rebuild event. You re-shard onto a replacement and file an incident report. Nobody phones a lawyer, because no single company ever held enough of your data to be worth suing.

Hold your own keys. When the customer holds the key hierarchy and custodians hold only ciphertext shards, access is a cryptographic operation. There is no counterparty whose cooperation is required, no favour to be withheld, no clause to enforce. Retrieval is math. Nine PBS is finding out what retrieval looks like when it's jurisprudence.

The fine print was a confession all along

Every single-vendor storage contract contains the same quiet admission: your continued access depends on us. On our solvency. On our responsiveness. On our willingness to honour the off-boarding clause after we've stopped having any commercial reason to care about you.

Nine PBS will probably recover its archive. A court has ordered preservation and a supervised transfer is underway. Take a moment with that sentence. "Probably," "court," and "supervised transfer" are now load-bearing words in a public broadcaster's backup strategy.

Seventy years of history, and the disaster recovery plan turned out to be a courtroom in Colorado. The architecture worked exactly as designed. That's the problem with it.

Ross Norrie is the founder of SkyeConnex, a Canadian data custody company. Yes, that's the bias declared at the top. It hasn't moved.