New and coming legislation has CIOs and IT managers across the country looking for ways to keep their companies in compliance. They could learn quite a bit from a California city that found a way to comply years ago.
Oceanside, California implemented its scalable archiving system about three years ago. Michael Sherwood, CIO for the city, told TechRepublic that he is pleased with the solution that not only keeps the city in compliance, but also saves a tremendous amount of time and money. Meanwhile, the company that provided that solution is seeing renewed interest in its product, thanks in large part to new legislation.
“Ever since Sarbanes-Oxley, companies are reevaluating how they use e-mail,” said Mary Kay Roberto, vice president and general manager of the North American Operations of KVS, which offers document and e-mail archiving solutions for Microsoft Exchange and SharePoint Portal Server.
Sarbanes-Oxley, enacted in large part as a response to U.S. corporate and accounting scandals, requires that companies become more fiscally accountable. Whistle-blowing and other provisions have made this law particularly controversial and difficult to enforce. The act, among other things, requires companies to document and certify the effectiveness of internal controls and procedures related to financial reporting.
Sarbanes-Oxley is only one reason e-mail archiving is now a frontline concern. Other legislation, such as Gramm-Leach-Bliley, the Health Insurance Portability and Accountability Act (HIPAA), and the USA Patriot Act, lay down requirements for internal and external audits and require organizations to retain certain records, including e-mail. That’s quite a surprise to companies that previously may not have considered e-mail to be a document.
A solution must be chosen
Not complying simply isn’t an option. You should consider a number of points as you evaluate e-mail archiving solutions:
- Cost of ownership
- Security and security management
- Ease of use
- Available support
In late 1999, Oceanside’s attorney informed city officials that provisions in California’s Public Records Act included e-mail requirements with which the city would have to comply. The new act made very clear that “anything you do in a city is a public record,” Sherwood said. “And you need to provide that information if anyone asks for it.”
Any e-mail exchanged within city offices, for which someone might ask, needed to be archived, just in case. At first, the city tried simply restoring backups that might hold the e-mail in question. That quickly proved impractical. “It would take, literally, hours upon hours,” Sherwood said.
In fact, some requests could take as long as three days, Sherwood said. After all, the city gets about 10,000 e-mails a day.
Not only would it take that long to locate a likely backup and restore it, there was no guarantee that the e-mail being requested would be there. An e-mail can be created and deleted before a backup tape has a chance to record it. Not only would that mean an e-mail wouldn’t be available for request; the city was not in compliance with the new act—and any other legislation coming down the pike.
Sherwood and other city officials began looking and considered a number of software packages. One of the solutions they considered was that offered by KVS, which itself has just discovered this legislation-driven market for e-mail archiving. “We do business in an extremely litigious society,” Roberto was quoted in a KVS press release. “You don’t have to be a Fortune 100 giant to have your e-mail requested for legal discovery in a lawsuit. Customers, employees, investors—a potential lawsuit can stem from any aspect of everyday business operations. To fend off bogus claims and avoid guilt by association, today’s company must be prepared to legally respond to potential litigation, especially when corporate e-mail is involved.”
KVS started offering its e-mail archiving solution, Enterprise Vault, in 1999 with its introduction into the North American Market in the winter of 2000 and in Europe, the following summer.Enterprise Vault, originally conceived by Digital Equipment Corporation, is a scalable, mission-critical platform designed to reduce storage costs, simplify business critical collaboration systems, search, and discovery.
This past May, KVS introduced Enterprise Vault Discovery Accelerator, designed to be a cost-efficient tool for companies to handle requests for e-mail as part of legal discovery in lawsuits. With Enterprise Vault Discovery Accelerator, all internal and external e-mail is archived for quick searches. Benefits, as described in a KVS press release, include:
- Centralized archiving of corporate e-mail and attachments.
- Rapid target, search, review, and discovery of all inbound/outbound messaging.
- Audit, tracking, and reporting to illustrate due diligence.
- Maintained context of e-mail content by retrieval of entire message threads.
- Authorized review by designated personnel.
- Guaranteed nonmodification of original e-mail to ensure admissibility in court.
In early 2000, what KVS had to offer was what Oceanside was looking for. Sherwood said he and his colleagues were impressed by how well KVS’s software works with Exchange. Other impressive features included:
- Customized backups.
- Ease of installation. “We wanted something that was setup and forget it,” Sherwood said.
- Easy integration with Windows software.
- Complete e-mail retention. “Every inbound e-mail and every outbound e-mail is captured and retained for long-term storage,” Sherwood said.
The city implemented KVS’s solution and has been happy with it ever since, Sherwood said. Requests for e-mail that once took days now take only an hour or so, from request to delivery. “Of that hour, only about 20 minutes would be used by a human,” he said.
And those requests don’t have to come from the public. Sherwood said he’s found internal e-mail requests also are handled quickly and efficiently. “If someone says, ‘I sent this e-mail three months ago; I need it back; it was really important,’ we can do it right away,” he said. “And we don’t have to go to their desk and set up anything special.”
The city also has realized an “immense” cost savings, Sherwood said. Time-wise, KVS’s software saves 75 percent over the old way. “And if I base it on dollars, it would be an even greater number,” he said. “I’d say in the first year, KVS more than paid us back.”
As happy as he is with KVS’s e-mail archiving software, Sherwood said there were a few gotchas that had to be worked around:
- The original implementation also backed up unified messaging, such as voice mails and faxes, which neither Oceanside nor the new legislation required. A special script was run to resolve that issue.
- Spam and other junk mail are also archived. Sherwood said this is the nature of the new requirements and legislation, and there is no way to work around it. The spam simply takes up space.
- Employees have to be educated about what e-mail archiving can mean when it comes to any e-mail they consider private. All e-mail going into and out of Oceanside is archived. No exceptions. “It’s important they remember that,” Sherwood said. “When you use an e-mail archiving product like this, this can become a privacy concern.”
Despite the latter issue, Sherwood said he doesn’t give much thought to the ongoing debate over whether the employee e-mail is somehow private. “I think the defining rule is you’re using company property and company e-mail,” he said. “Therefore, it’s the property of the company.”
- "E-mail Archiving: HOWTO"
- "E-mail Archiving: What to look for in an Exchange Active Solution" (PDF)
- "Why E-mail Archiving Works Better Than Quotas"
- "Enterprise Storage: The choices and their implications" (PDF)
- "Outlook E-mail Archiving Tips and Tricks"
- "E-mail Archiving Emerges As Critical Function"