I have been consulting with a wide variety of organizations over the last 10 years and one of the most common topics brought up is eDiscovery/eRetention. Most leadership teams are unfamiliar with how these policies impact their business and I thought it could be both a helpful and interesting discussion.
Let’s start with defining the meaning of legal discovery: http://en.wikipedia.org/wiki/Legal_discovery
And now eDiscovery:http://en.wikipedia.org/wiki/EDiscovery
WHAT DOES THIS REALLY MEAN?
Now that we have that straight we can end our discussion, right? Not so fast. The confusing part of the eDiscovery definition, as described in Wikipedia, is how the legal system holds organizations responsible for electronic evidence. How much information do we have to keep? What policies and procedures should we follow? Most importantly, how can we automate these processes so we don’t have to hire more people? Unfortunately, there are no specific guidelines given by the courts for when you become involved in a an eDiscovery request. What the courts seem to be doing is providing guidance through decision. And, the decisions seem to point to following “best efforts” to preserve and protect prospective digital evidence.
So let’s apply this newly found eDiscovery knowledge to our problem of retaining eMail. How many of you work for organizations that restrict the size of your mailboxes? How many of you work for organizations that allow you to delete email? How many of you work for organizations that allow you Archive (PST, TAR, ZIP) your local mailboxes yourselves? If you answered “YES” to any of these questions then the organization you work for is probably in violation of the interpreted eDiscovery rules of Civil Procedure. The impact of this can be extremely costly and even put you out of business if your organization is ever involved in a legal dispute where eDiscovery is initiated. Let me give you an example from March of 2004:
In March 2004, Bank of
America was fined $10 million by the Securities and Exchange Commission (SEC) for failing to retain email records for the time stipulated by the regulation and for failing to submit the information requested by SEC in a timely manner.
This may be an extreme example, and although public companies are now required to follow specific regulatory guidelines around eMail retention, the impact on small to medium size business can be even more severe. Think about how costly an eDiscovery request might be for a 20 person organization that has been storing volumes of unstructured files for a decade or more. Having 4 to 5 people in this company spend time and energy to dig up such files could potentially put the company out of business. Here is another example in recent history:
In January 2008, U.S. District Court Judge Barbara L. Major hit Qualcomm with an $8.5 million penalty for failing to produce e-mail relevant to a patent lawsuit against Broadcom.
Public entities have not been excluded from these fines by the courts:
In June 2007, the city of Dallas settled a wrongful termination suit for $1.55 million after the city failed to turn over records, including e-mail, relevant to the case.
One simple way to considerably reduce this risk is to archive your email. eMail archiving systems are now considered main stream applications and are fairly simple to implement. Before implementing a system, you need to either formally complete an eDiscovery audit and develop comprehensive retention policies for both physical and digital assets, or you can attack the most pressing concerns of your organization first, such as unstructured files and eMail. Most organizations attack eMail first. Here are the reasons why:
It is estimated that over 10,000 compliance regulations have been enacted around the world. Think about the Bank of America reference above.
(SOX, GLBA, SEC, NASD, HIPAA, FDA, FOIA, NARA)
Although many regulations exist and each seems to have its own requirements, compliance is based on three main concepts:
1. Data permanence – The notion that data must be retained in its original state
without being altered or deleted.
2. Data security – Information that is retained must be safeguarded against all
security threats which include access by unauthorized persons as well as anything
which could physically damage or endanger the availability of the information.
3. Audit Readiness – The concept of having information duly protected but easily
accessible in a timely manner by authorized personnel whenever required.
Nearly all companies in the course of regular business activities become implicated in lawsuits. The cost of producing the information for litigation can be colossal and can often outweigh the damages sought in the suit. This is most common in organizations that do not have an adequate email archiving solution in place. For example, the cost for restoring 77 tape backups in the case Zubulake vs. Warbung (USB Bank) amounted to $165,954 and the relative review costs totaled to $107,694.
It is estimated that one in every four organizations increases its storage needs by more than 25% a year. This escalation is attributed to the increase in use of email in general plus mounting surge of attachments that increased the size of the average email from 22 KB to 350 KB. In fact, it is estimated that nearly 50% of organizations are providing more than 150 MB of storage per user. Organizations often make use of email storage quotas to prevent message stores from growing and degrading server performance.
An organization’s email system is a corporate knowledge repository. It contains a wealth of critical information that is vital to a business. Providing access to this corporate asset makes users more productive. An email archiving system provides appropriate knowledge management tools (e.g. email records sorting, advanced search and retrieval functions) that enable IT and end users to intelligently manage the knowledge base contained in the company’s email archive.
Here is an overview of the business impact of eMail Archiving (Information Week, October, 2008):

Here is another interesting chart showing reasons to deploy eMail Achiving (Compliance is not the only reason):

In conclusion, it would benefit each of our respective organizations to begin to develop our own eDiscovery policies. Our highest exposures are most likely with the applications we frequent. These provide internal and external evidence of communication and are easily circumvented by our organizational users especially when there are no proper polices in place. An eMail archiving system along with retention policy controls will dramatically reduce our eDiscovery risk. The additional benefits include knowledge management, storage management and compliancy.
Feel free to comment or contact me directly with your questions or thoughts.
-Rick Erickson
Agosto CIO Consultant and Founder