> How do they justify this when the keys may be locking doors that for example protect extremely sensitive personal information?

The locks for rooms that had extremely sensitive information, personal or otherwise, did not use the same master as was available to students, and used a different brand of lock that was more resistant to lockpicking. And, perhaps more important in practice than the actual resistance to lockpicking, the brand was widely understood as a signal that picking the lock was not acceptable. Presumably, they also had electronic security.

Personal observation - assuming everyone is out to get everyone else is a cultural thing that wasnt such a concern until quite recently. It's a bit like looking at certain phrases in common use 70 years ago and wondering why anyone would use them.

You don’t have to assume everyone is out to get everyone, just that someone might possibly be out to get someone.

Also, whatever you assume, there are legal and moral obligations to protect information in any case.

Because once upon a time you could trust and at the same time people didn't feel like that they had that much to hide. In modern society secrecy is the only new 'experience'.

I don’t know how it is handled now, but when I was there things that needed higher security like that were in rooms that had locks not on the master system.

You had most older buildings on one brand of ordinary locks with a master system, and the newer buildings with better ordinary locks on a different master system, and then a few rooms with Medico high security locks.

As sibling commenters have commented, yeah, the higher-security rooms used Medecos instead -- they had not only up * down for the pins but also directional slant (don't really know how to describe this, but pretty and much harder to copy or pick). But also, think through student motivations: I used my master to get into the steam tunnels, to find cool things, to gain access to the old wind tunnel, to find space to make art, to win at capture the flag. Who wants personal info or allegations of misconduct? And moreover, isn't the computer a much lazier vehicle for finding such info?

Presumably they multiplied the probability of this occurring with the damage caused and decided that it was lower than the benefit of the high-trust society.

I don’t understand - don’t they have legal obligations to protect? Saying ‘but we trusted’ won’t work in a court.

Sure, but the court won't make them pay unbounded damages.