Most IT managers have already fielded calls from users who have lost an important e-mail. But the next call that comes in may be from the legal department with concerns about the fact that e-mail has become a litigation tool.
Creating an e-mail archive can help you answer both calls, according to IT pros who work for companies that offer secure e-mail systems.
Jeff Morris, a product line manager with Sendmail, Inc., said archiving has become a critical process because "…e-mail’s the thing that everybody is going to find." He points to e-mails from Bill Gates that were admitted as evidence in Microsoft's antitrust litigation as examples.
When you think about it, e-mail is not only key to possible litigation, it is also a vital part of an organization’s corporate record. E-mail that flows through your system may contain important and sensitive information about organizational plans and processes. For this reason, it’s important to copy, filter, and store certain types of e-mail for future reference by users or to meet a variety of legal requirements.
Storing e-mails is part of a process called archiving, a strategy that is gaining acceptance as a way to protect an organization from liability issues. Archiving copies selected e-mails flowing through an organization and stores that information in a secure location for retrieval when it is needed, either as part of a legal process or simply because a user wants to recover an e-mail that was inadvertently deleted.
Backups are the key
We all know the frustration attached to deleting an e-mail that explains a particular organizational process or contains key information.
Archiving e-mail is one way to end this frustration, but only if you back up e-mails on a regular basis. Morris said running a regularly scheduled backup is the first step IT managers should take when creating an e-mail archive.
Many organizations use software that can automatically run backups at midnight or during other off-peak times.
“It should be an automatic process, and the smart, conscientious folks are doing it regularly. But we’ve seen a number of cases where backups are not run as frequently as they arguably should be,” he said.
What should you archive?
The second step to archiving e-mail is to determine what e-mails you want to capture. Is your company more concerned with communication between in-house users or e-mails between a user and an outside party? Or is the need a mixture of both?
In other words, it’s not likely that an organization will keep e-mails between two brokers discussing where to eat lunch. But e-mails between a broker and a customer about what stocks a customer should buy or sell is something that an organization will want to keep.
The decision on which e-mails should be captured also depends on the particular needs of the organization and the industry in which it operates. For example, communication between a broker and a customer may be of interest to the U.S. Securities and Exchange Commission.
"The SEC requires organizations to archive messages that could be a potential violation of their policy,” said Joe Fisher, who manages the product line at Tumbleweed Communications, a provider of software solutions for managing secure Internet communication and collaboration.
Currently, SEC policies require brokers or their organizations to save all electronic communications they’ve had with customers. The length of time brokers must retain a record depends upon its type. For example, firms must keep securities purchase and sales information for at least six years. Copies of confirmations of these actions must be kept for three years.
Archiving methods will also vary with the enterprise. For example, an ISP might give a user a POP access account for e-mail, which is downloaded and stored locally on a user’s PC.
An ISP's e-mail archive service could be set up to archive each e-mail on the server as it was downloaded and delivered to a user’s mailbox.
In a Microsoft Exchange environment, e-mail is stored on the server. Users can retrieve mail from the server either manually or automatically, said Morris.
Identifying the e-mails to keep
In order to filter out the e-mails you want to save, you need to set an e-mail system policy. You probably don’t want to have a policy that archives all of your e-mails, Fisher said, because saving everything will only create more problems.
Many e-mail servers have programs or use third-party applications that automatically scan the subject and text of a message for certain keywords. For example, you can set a policy where the words financial, disclosure, or signature will alert a filter that the message should be archived. You can also tell a filter that a message with lunch, drinks, or racquetball should not be archived.
However, an e-mail containing the word lunch may also include important information about what was discussed at a business lunch. For this reason, Tumbleweed offers a Web-based browser feature that allows borderline e-mails to be reviewed and archived or deleted.
Tagging the content
When your filters identify a message for archiving, it’s a good idea to immediately tag that message. A tag identifies a piece of predetermined language in a text. Fisher explained that a manager set up the archiving program to automatically tag e-mails based on their content just before they are archived.
Tagging e-mails makes it easy to categorize them, which facilitates retrieval. “So later when I want to go through any type of investigation or review, I can easily pull that information up without having to go through millions of messages looking for that type of content,” he said.
Storing the content
Where to keep e-mails, especially those that you may need to store for a few years, can be a confusing process because there are many options for long-term storage.
First, don’t archive e-mails on an active server, such as an Exchange server. It’s better to place an archive on a separate storage device. Fisher suggested several methods that will work for most organizations:
- A database reserved for the archive
- A data tape
- A set of CDs
- An optical disk
The last three options are what Fisher calls offline storage solutions. These are movable pieces of data that do not have to be on the network at any one time.
It’s your corporate memory
Morris explained that the information in e-mails is your organization’s corporate memory. It should be stored for future reference and in some cases because archiving e-mails is required by law.
Morris said he would personally like to have an archive of e-mails sent by his predecessor. “There are decisions that have been made in the past that I, as a current employee, would benefit from tremendously,” Morris said.