Click on ad below to get FREE music downloads of all your favorite music!

Computer Times

Return to Computer Times home page

By: Nick Mehta

Senior Director, Product Management

Symantec Corp.

E-mail has not only evolved into a primary form of business communication, but has also become a primary weapon in a prosecutor's arsenal.  A 2004 survey of 840 U.S. companies co-sponsored by the ePolicy Institute found 21% of respondents had their employee e-mail and instant messaging subpoenaed in the course of lawsuit or regulatory investigation, up from 14% in a 2003 survey. This trend of using e-mails as evidence in court is expanding outside of the U.S. The Singapore High Court in June 2005 allowed e-mails presented as evidence in a dispute over negotiations for a lease of a warehouse. Searching through volumes of backup tapes for requested e-mails is extremely costly and time-consuming, with no guarantee all requested records are recoverable. Not being able to produce all subpoenaed records can result in multi-million dollar fines and long-term damage to a company's reputation. Organizations should therefore use e-mail archiving and discovery software technologies to ensure all e-mail records are retained in a secure repository and are readily available for everyday business use and to quickly and completely respond to the likelihood of an e-discovery request.

Traditionally companies save e-mails to backup tapes at regular intervals, such as the end of every business day, week or month. This means thousands of e-mails and attachments are kept on volumes of un-indexed tapes, usually stored off-site. These backup tapes are excellent for disaster recovery where an entire mailbox, system or even data center needs to be quickly re-created. But backup systems are not designed for information discovery, where responding to a request means finding specific e-mails and attachments based upon the context (e.g., date, sender, recipient) and content (e.g., keywords, subject line, attachments) of the information requested.

Another source of unstructured e-mail is employee laptops. These local e-mail caches, known as .PST files in the Microsoft Outlook/Exchange world, pose a tremendous challenge during the legal discovery process. These files are highly susceptible to corruption and/or accidental loss (e.g., if the laptop is stolen) or destruction (e.g., if the laptop crashes). Retrieving these .PST files means laboriously coping all business records off each laptop and then searching through them to find specific documents. Often this information is on the laptops of highly paid business executives, causing inconvenience and lost productivity of key company employees as laptops are taken away and imaged.

Once the data is restored, it must then be extracted for presentation in court. Depending on the size and scope of the discovery request, this entire process can take days, weeks or even months, especially as attachments in formats that cannot be searched electronically, such as pdf, have to be converted to text-searchable files. The cost of this process usually falls on the company being forced to produce its own records.

Fortunately, preparing for the e-discovery request goes hand-in-hand with meeting requirements for secure e-mail retention and supervision that an ever-increasing number of organizations must meet. Many companies must retain records mandated by industry regulations. SEC Rule 17(a)-4 requires retention of all communication involving broker-dealer employees. Companies can also be forced to retain communications that have been placed on a litigation hold related to open or pending litigation.

An e-mail archiving system relieves employees of the responsibility of deciding what e-mail messages and attachments to retain and for how long. Deleted e-mails are rarely backed up and won't appear on imaged laptops. Litigation hold requests are frequently enforced by asking employees to preserve specific e-mails. Employees are often expected to read and comply with long-documented retention policies, which is an extremely time-consuming process that today's busy worker just doesn't have the time to devote to. Therefore, the likelihood that important records are accidentally deleted or lost significantly increases.

Not being able to produce requested e-mail records - or worse, having the plaintiff or opponent produce them - opens the door to significant penalties. Even non-regulated businesses should retain records in a consistent manner. Case law has shown that companies that have haphazard or inconsistent approaches to records management place themselves at serious risk.

To ensure compliance with laws and regulations governing e-mail retention, avoid the high costs of electronic data recovery and restoration, and eliminate the risk of heavy fines for not producing all requested information, a company must develop a proactive e-mail retention and discovery policy. There are three steps that all organizations, regardless of their business or industry, should accomplish:

1. Determine which e-mails should be retained and for how long. This could be based on a specific segment of employees, such as C-level executives, or based on the nature of the e-mail (for example, which e-mails are truly business records, or which are on a stated litigation hold). This varies depending on the relevant industry regulations and laws, and each organization should consult its legal counsel when developing its records retention and deletion policies.
2. Implement an e-mail archiving system that immediately archives and indexes all messages passing through the e-mail system (e.g. Microsoft Exchange, Lotus Domino/Notes), stores them in their original form (e-mails and attachments) to a centralized repository with specified retention periods, and ensures the e-mails are not altered or deleted inappropriately.
3. Implement a software-based system that allows authorized reviewers to quickly pinpoint specific e-mails required as part of litigation support. This reduces the time spent searching for and recovering requested e-mail records from weeks to just a few days. This significantly cuts the costs of meeting the e-discovery request and ensures all requested records can be produced. The support of global marking schemes eliminates unnecessary duplication of a review effort when discovery requests overlap, as they frequently do.

If all information is captured and retained, it is possible to prove that an action occurred or did not occur. One example would be a harassment case where the plaintiff accused a defendant of inappropriate e-mails - if all e-mails were retained then it is possible to prove whether or not such e-mail activity took place. The worst case scenario is when the plaintiff can produce e-mails the defendant cannot. In some cases, courts have ruled "adverse inference" instructing the jury to assume that the data was intentionally deleted.

So e-mail archiving and discovery technology can play two important roles in helping an organization achieve regulatory compliance and better manage its response to the e-discovery request. The first is ensuring the secure retention of electronic records in a manner compliant with laws and such as the Sarbanes-Oxley Act, and industry regulations such as HIPAA, SEC 17a-4 and NASD 3010 and 3110. Second, these technologies significantly reduce the time and costs associated with searching for and retrieving e-mail records relevant to an e-discovery request. Once companies have established proactive policies for data retention and e-discovery, the next step should be to look more holistically at how they manage information availability and security to prevent future policy violations. Examining information security with an eye towards preventing issues like data leakage can safeguard critical company intellectual property and customer information from loss or theft. 

Go to top of page

Return to Computer Times home page