My company presently does not have a policy regarding the retention of e-mail. With only 75-100 mailboxes on our Exchange server, reasonable mailbox size limits in place and plenty of HD space – we really never gave it much consideration. We do have a practice of running AutoArchive in Outlook to keep the power users from amassing monster-size mailboxes to keep the load on the server down, and to keep the “mailbox is full” warnings from populating their mailboxes – and the archive files are saved on the file server. Everything gets back up to tape every night and archived monthly. So far so good.
This is where things get dicey. It was just handed down to the IT dept from the top of the mountain that we must delete _everything_ off the Exchange server and keep only those e-mails which are less than 30 days old – and to make this an ongoing policy. This also includes destroying 4 years worth of archived backup tape that we have secured in our records room. Red flags are waving and alarms are ringing. From an IT perspective, we have enough disk space on our Exchange box for at least another 20 years of e-mail – and the hardware we run it on barely breaks a sweat. My boss told me to make this happen starting next week. He’s just as perplexed about it as I am, but said we need to follow orders.
The twist is that we’re a government agency that falls under a number of state and federal regulations, requirements and obligations. For all intents and purposes, e-mails are business documents. From an operational standpoint, most of my users rely heavily on e-mail and often need to go back several months or longer to retrieve information regarding any particular project they’re working on.
Now, I’m sure by doing this, I’m probably not breaking any laws – however, there are guidelines and requirements in place by the state/federal government that pertain to record retention, in addition to the legal implications of destoying records — especially if they can save your company in the event of a sizeable lawsuit. But what if all those records are subpoenaed in court and we can’t produce them because they were destroyed? If we’re in compliance in what we’re supposed to do, then we shouldn’t have to worry about any damaging documents floating around our mail server – so no need to destroy them.
I’m sure you remember the Ollie North Iran-Contra scandal with the all of the document shredding, and the hot water he got in for obstructing justice. Do I really want to be implicated in this when I have mouths to feed and a mortgage to pay? Do I want my name and reputation tarnished – even though I was following orders?
But if you were put in this situation, what would you do? The IT job market has yet to recover from it’s heyday (and likely never will).