Because by doing so, law enforcement can manipulate the image from the source by:
Unless, of course, the BIOS stores the checksum of the untainted image. (Which adds its own can of worms, because that would make legitimate image upgrades require writing the new proper checksum on each server)
I’m aware of PXE, but in order to do so you need either of:
Since the first mode is probably too unsafe, that leaves us with the second mode. Either the operator memorizes a specific IP address and types it into the BIOS each time the server is rebooted, or the IP address (and possibly the checksum of the image) are stored in a single-use pendrive that the operator carries. I wonder which of these two methods is used in this case.
Something tells me that they have a stack of single-use drives so that each time a server needs to reboot for some reason, they write a boot loader in one from their central headquarters, walk back to the server room, use the device to boot the server, and finally hammer the everliving bejeezus out of the thumb drive juuuuust in case. Hopefully they don’t have to reboot that often!
From what I read in the article, there is still one part of the boot sequence that does require some sort of storage: the part where the bootloader fetches the network boot image and verifies it against the checksum signature. But I think that can be performed by booting from a pendrive and then removing it. The problem will come if law enforcement gets a hold of said pendrive…
While online I have most of my items under lock and key, my personal computer at home is set to boot automatically with my password (since the attack vector of “having the feds raid my home” is fortunately not an issue for me). So in the rare case that I’m no longer available, my family can just get my user names and passwords from my computer