>You immediately arrest have any employee interfering with emergency response and throw them in jail.
Imagine that you work for a 3 letter US agency and is storing confidential data on AWS. Would you allow random individuals (yes even for emergency personnel) to have unfetter access to your computation and storage systems? What about health data? What about data belonging to other countries? Do you do a sweep for unauthorized remote access device after the incident?
Then they need to have staff on site that is fully qualified to handle any type of emergency any time there is anyone at all in the facility, which they don't.
I've never experienced it but I've been told that if an emergency responder needs to enter an area where classified information is stored you let them in, escort them, and security will debrief them and have them sign an NDA after the fact if they saw any classified information.
My understanding is that the fire department has pretty broad legal authority to tell you where to shove your policies your if your building is on fire. They can legally smash down your doors, haul you out kicking and screaming, and detain you outside of the building while they put the fire out.
This is largely correct. However, staff also need to be trained and drilled on security policies and procedures. That's often lacking, especially if security is outsourced to third party contractors.
Because there are federal agents with rifles guarding the data center, and they're allowed to use deadly force if the local FD ignores their instructions.
Reading between the lines: yes, certainly. Amazon wouldn't stop firefighters from getting into a normal datacenter, nor would they have the authority to stop them if they wanted to. A private corporation can't demand background checks from emergency responders; a letter agency can.
Imagine that you work for a 3 letter US agency and is storing confidential data on AWS. Would you allow random individuals (yes even for emergency personnel) to have unfetter access to your computation and storage systems? What about health data? What about data belonging to other countries? Do you do a sweep for unauthorized remote access device after the incident?