At Asellus We Know About E-Mail Archiving!

When it comes to e-mail archiving practices, there is no shortage of advice. The trouble is, the guidance often conflicts, and one white paper's best practices are another expert's anathema. Even within one organization, perspectives on e-mail management can vary widely. The legal department sees e-mail as important to formulating its discovery response strategy. The IT shop has storage and security concerns. The compliance people have preservation and control issues. And end users want better access to e-mail to improve productivity. Reconciling the needs of all these constituencies makes it clear that one size seldom fits all in the world of e-mail.

Choosing the right course of action, then, is an important part of meeting compliance requirements, coping with the e-mail tsunami and being able to rely on e-mail records for evidentiary needs while also controlling costs. The key is to find common ground on which everyone can agree. Here's what to do:

1. Define what a message archive is. An e-mail archive is a repository kept in a non-production environment to provide secure retention of messages for compliance and operational purposes. It is not good policy to treat backups made for disaster recovery as archives. Trial attorneys note that companies that use backups to restore e-mails at users' request, or that keep backups for long periods of time, are more likely to have to search tapes in response to an opponent's discovery request. On the other hand, backups used solely for business continuity and routinely overwritten at short intervals — say, 90 days or less — have a fighting chance to be excluded from legal discovery. It makes sense to establish the difference between archives and backups in everyone's mind and in day-to-day practice.

2. Define which messages constitute business records. Not all messages are record quality. Transitory items, such as "thanks" messages, spam and employees' personal mail should not be kept. Besides the storage burden, e-mails that become part of federal investigations become publicly available: witness the 1.6 million Enron e-mails, many of them personal, now on the FERC Web site. Messages that are records generally pertain to business transactions, activities, operations, obligations or rights. It is these messages and their attachments that should be maintained in the archive.

3. Determine what content can and cannot be sent by e-mail. Most companies have determined that confidential, proprietary and attorney-client privileged information should not be conveyed or received via e-mail. Personal employee data, for example, can have privacy implications, particularly for firms that have subsidiaries or work with partners that operate in the European Union, where strict privacy rules are in place. The danger with proprietary or trade-secret information is that it can become public as part of patent or copyright infringement litigation. In some cases, attorney-client privilege can be lost if it is shown that the matter was disclosed to a third party, for example, through a cc on an e-mail.

4. Agree that retention is based on content, not age, size or employee role. First, recognize that e-mail is a transmission mechanism, not a unique record type with regard to retention. Message and attachment contents determine retention time according to predetermined schedules that govern all the company's records. Mailbox manager functionality that deletes messages based on message age and size is not compliant with required retention rules. Likewise, schemes that automatically save all e-mail based on the employee's job title are not a good idea. These are tantamount to labeling a physical box, "Jon Smith, VP of marketing" and storing that box long after Smith has left. It takes up valuable space, without hope of review, retrieval or disposal.

5. Recognize that native e-mail systems have little or no retention management functionality. Most e-mail systems retain messages on centrally controlled servers. Broad-brush e-mail deletion rules and mailbox size limitations often force users to file messages in personal folders on their hard drives (for example, as .pst files in Exchange) so that the messages remain accessible. Personal folders are problematic because they actually keep both .txt and .rtf versions of messages, requiring twice the storage space. Personal folders can also be password-protected, a potential problem if the password becomes unavailable when the person leaves.

Without central management, it's unlikely that messages in personal folders will ever be disposed of by users, so folders will continue to grow. Also, search functionality does not operate across multiple personal folders; so in the event of investigation or litigation, each user's hard drive must be searched individually, a costly endeavor. Offline folders, commonly used for e-mail copies by mobile employees with laptops, will reflect changes made to server mailboxes only when the laptop is synchronized with the server. It's possible that duplicate copies of e-mails deleted from the server may still exist on the laptop.

Public folders can be set up in Exchange as a limited solution. This ad hoc approach can be achieved by establishing a hierarchy of public folders that reflects the company's retention schedule and categories. Theoretically, users drag and drop e-mail records into the appropriate public folder, and each folder has an appropriate expiration date attached to it. The problem is that users must be trained to select the proper folder and must be motivated to contemporaneously place record-quality e-mails into the proper folders — an unlikely scenario given productivity demands and e-mail volumes. Also, there is no way to handle event-based retention, such as close-of-audit-plus-six-year policies that call for retention to begin only after an event has occurred.

6. Recognize the need for technology investment. E-mail retention and storage is expensive. Some experts estimate that administrators spend as much as six hours per week recovering old messages for users. Responding to legal discovery can cost hundreds of thousands of dollars, too. In a recent gender discrimination suit, UBS Warburg reportedly spent nearly $250,000 producing e-mail for the case. This labor-intensive process entails retrieving and mounting a tape, restoring it to a search environment, searching for pertinent e-mails, printing responsive messages for legal review, then clearing the search milieu and repeating the steps for each succeeding tape. Where e-mails exist on user hard drives, the process is even more costly. Within regulated industries and those subject to investigation or audit, cost justification is relatively simple.

Any technology solution must provide a secure repository, metadata collection and granular message management from creation to final disposition - not just the ability to manage one category such as customer correspondence for a finite period of time. Equally important is the ability to capture contextual information about a message, such as routing, threads, links, embedded items and attachments. Preservation of messages for long periods, the ability to override destruction when necessary, and navigation, search and retrieval functionality are vital needs.

7. Resist the urge to either save everything or print and file. Although appealing in simplicity and possibly defensible on the basis of cost to implement, neither is good policy. While storage is cheap, the cost to review everything at discovery is not. Printing and filing paper copies not only impairs the context for understanding the message exchange, but also loses embedded items, delivery confirmations and other valuable information in the process.

E-mail archiving does not lend itself to the "just get it off my desk" school of problem solving. As with so many other compliance issues these days, e-mail archiving is less likely to be a project with a definite start, middle and end, and more likely to be part of an ongoing program aimed at realistic control. Emerging standards and influential organizations recognize that all records, including e-mail, instant messages and phone text originate as part of business processes. Monitoring, filtering, encryption, collection, management and preservation should be an automatic part of those processes. For this reason, expect e-mail management product architectures to follow the classic trajectory from independent products with their own repositories to inclusion in enterprise content management platforms.

At Asellus we deliver the Knowledge you need to keep your Mail Secure, Lean, and Operational. Contact Us! I'm sure we can be of assistance.