Business dilemma: email retention policy; new SEC regulations to address storing and restoring

Computer Technology Review,  Jan, 2003  by Christine Taylor Chudnow

• E-mail
• Print
• Link

Messaging applications are crucial for modem business, but managing them is a never-ending headache. Messaging data generates huge volumes of storage: Microsoft Exchange alone processes more than 3 million email messages every day through corporate email servers, and analysts estimate that email and attachments are growing at a rate of 35% per year. Email archives are massive and unwieldy, resist classification schemes, ignore structured searches and frustrate policy-driven archiving. But managing email archives is vital to protect companies from serious management, storage, litigation and regulatory liabilities.

Management Support Costs

Without effective email archiving in place it is time-consuming and expensive to search and restore email databases from backup media. Lacking email management tools makes email applications such as Exchange especially challenging. When Exchange crashes (as it frequently does), administrators must undergo an ugly and labor-intensive restore operation. If they must search archived databases they are forced to dedicate a separate server to the task, and individually search and restore each separate backup tape that might hold a relevant message.

Storage is also a huge issue. Many companies try to stay on the side of the angels by retaining all their emails. But the huge and growing volume of email seriously impacts storage budgets and resources. The great expense is not so much buying it, since relatively cheap storage brings in the initial purchase price at just 20% of storage-related expenditures. But managing it is another story: Email administration tasks, like backups and restores, gobbles up 43% of IT support costs. Companies are adopting and growing their storage area networks to manage their email glut as much as their critical database storage.

Corporate email systems are even harder to manage because of the weight of "personal" emails. Users send overwhelming numbers of personal emails from work, but job hunters and moonlighters beware--court cases surrounding personal emails sent from work have favored the corporations, essentially ruling that when an employee uses the company email system to send an email it is no longer personal and First Amendment rights do not apply. (Tell that to Arapahoe County's Clerk & Recorder. The Colorado man is facing tax misappropriation charges for using the county's email system to send some 600 raunchy messages to his mistress--who is also his assistant. The electorate returned him to office anyway, but his own embarrassed party is trying to kick him out.)

Because email is so hard to manage, corporations largely ignore personal email floods. But not only do personal emails strain storage resources, ignoring emails with sexual or hate-filled content is an invitation to serious lawsuits.

Storage

Yet this is hardly unusual for companies and their email. This leads to the ironic conclusion that--like not shredding paper documents--companies must retain their emails, even if they're keeping a smoking gun on their hands. Legalities aside, IT departments struggle with storing huge volumes of messaging data. Microsoft Exchange alone processes more than 3 million email messages every day, most of it through corporate email servers, and analysts estimate that email and attachments are growing at a rate of 35% per year. Since corporations are reluctant to delete messages, this type of volume greatly impacts storage purchases and management. This cost can sneak up on a business: Storage hardware is relatively cheap, so initial purchases account for only 20% of storage-related expenditures. But managing all these volumes is another story: Email administration tasks gobble up 43% of IT support costs. These days, companies are adopting and growing storage area networks to manage their email glut as much as their critical database storage.

Litigation

Companies have lost lawsuits by keeping too much information. Robert F. Williams, president of consulting company Cohasset reported, "Not having any email retention policies inevitably will result in amassing vast volumes of communications that are costly to retain, even more expensive to search through in response to discovery requests, and may unwittingly supply information that is harmful to the organization if disclosed in response to discovery requests."

The opposite tack, deleting most messages, is also risky. This used to be a popular accounting and legal strategy (the idea was that they can't use evidence that doesn't exist). But as the government frowns on that concept now, large accounting and legal firms are aggressively pursuing email retention strategies and software tools to keep their clients (and themselves) off regulatory hit lists. Taufer commented, "These large law firms want to address the issue from both a storage and a policy and methodology standpoint: how do you do it, what do you do, and how do you cover yourself from a legal standpoint?"

In one lawsuit an IT professional divulged that he was storing hundreds of backup tapes in a closet. He had not told his lawyers. Regardless of whether the backups had anything to do with the lawsuit, the opposing lawyers had the right to order that the backups be read. Of course they did that, and the cost ran into the millions of dollars for the company. In another case, Prudential Life Insurance was involved in a class action suit and the court had ordered that it destroy no records during the proceedings. Unfortunately no one told the IT department, who happily went on deleting electronic records on its own retention schedule. A judge issued a $1 million penalty against Prudential for destroying data that supported its opponent's case, and required them to deploy a records management program with a multimillion dollar price tag. Although Prudential had not deliberately destroyed relevant data, it still lost huge sums of money over its inability to enforce a reasonable and consistent retention policy.