Archiving Today
Stephanie Jordan, Messaging News
September 07, 2007 – The Federal Rules of Civil Procedure (FRCP) govern the conduct of all civil actions brought in the U.S. Federal district courts. Although they have been in place for a long time, recent FRCP amendments came into effect December 1, 2006. The new rules require companies to retain all corporate records, including email and data compilations, and make them available to the court as soon as there is a reasonable expectation that a lawsuit might occur, without the court having to specifically make a discovery request.
"While the procedures and amendments apply to Federal suits, most States are adopting the same standard," says Sundar Raghavan VP of Solutions Marketing for Postini. Companies that do not have a good email archiving policy will not be able to respond in a timely fashion." And being ignorant or unable to produce the required data is not a defense. "There have been a number of instances where the courts have found a negative inference. Meaning, if an organization is unable to produce the requested electronic data, then it is assumed that the organization is hiding something." Especially in cases were it is employee vs. employer—where more often than not, the court will side with the employee.
Given the rapid adoption of email in the last 15 years, it is not surprising that long time rules are being amended to accommodate where information lives today. "Email remains a young application. In a relatively short time it has grown from a basic tool to a mission critical one," comments Paul D'Arcy, VP of marketing for MessageOne. "Today, email is used for everything from executing contracts, to conducting business with customers. Often email is fully integrated into business processes. The result of email maturing is the need to go through all these levels of investment to become a real enterprise application."
As email security technology has evolved to protect against new threats, archiving of email now requires a more sophisticated means of records management. "Today, the archiving market is red hot. Most organizations are thinking about—for the first time ever—what their email retention policy should be, and how they will manage it," says D'Arcy. He goes on to note that one of the strongest trends in the archiving market today is the integration of archiving and disaster recovery. "They are becoming one. The reason for that is when you look at the archiving market, e-Discovery as a problem is similar to disaster recovery. A lot of companies want to solve those problems holistically, not to mention the savings to solving them separately."
Backup vs. Archiving
There is some confusion however, on exactly what archiving is. Raghavan notes that especially for SMBs, there is a learning curve to understanding the difference between backup and archiving. "The purpose of backup is to put something in storage with the confidence that data is being replicated," he explains. "The purpose of archiving is actually to be able to restore, search and retrieve. In other words, if something is in the archive it is not something to be forgotten, but to be retrieved when needed. A lot of SMB customers have not spent time thinking about archiving."
The concept of archiving is not new. Bob Spurzem, director of product marketing for Mimosa, explains that archiving for email was invented by engineers at Digital Corp to help reduce the amount of email in each mailbox. "Recall that a 10MB mailbox in the mid-1990's was common," says Spurzem. He goes on to say that the common email archiving feature to "stub" an email and attachment from the mail server and keep the email/attachment in the archive was an original email archival feature. Today it continues to be the number one feature in email archiving. "In 2002 Email archiving heated up with the SEC rules for archival. This requirement was only for SEC members. It required the email archival products to add WORM disk support and it required Microsoft Exchange to add the "journaling" feature to their product. Together, email archival solutions for Exchange could capture all incoming/ outgoing email for a given mailbox and store the data on non-erasable, non-rewriteable disk." Spurzem agrees that the latest trend for email archiving is legal discovery. "Actually, this trend has been growing steadily for the past several years. The recent FRCP amendments are another significant factor driving the need to archive email for e-Discovery."
For as long as mail systems have been in place, backing up and business continuity have been required. "Archiving started to become important at the beginning of this decade—soon after the dot-com bubble burst and Enron went bankrupt the following summer," recalls Jeff Lock, product manager of messaging storage for Mirapoint. Lock also sees the confusion people have between backup and archive. "An archive answers the question, 'What conversations did Kurt have with Fred between these two dates?' A backup answers the question, 'What did my inbox look like yesterday?' An archive captures communications between parties (messages, their header, and their envelope). It is a tool used for regulations or corporate bylaws. A backup captures messages (messages and their header) that happen to be in a production mail store when the backup took place." If organizations were under the impression that an effective backup solution could take the place of an archiving solution, they would be mistaken. "To use a backup for legal discoveries leaves you open to possibly missing critical information." At the same time, Lock believes that to use an archive to restore a production mail server would probably be overkill. Furthermore Lock says most messages have a very short shelf life. "Most readers delete the bulk of their email the same day it comes in. Some messages might never be captured in a backup."
Define Electronic Data
When the FRCP amendments refer to electronic data, it is not just about email. While email may be the most frequent form of electronic communications, the definition encompasses blogs, instant messaging, online chats, webcams, and broadband voice services, just to name a few. "The definitions are sufficiently broad that customers that are unprepared need to pay attention to what their data retention policies are and what their data deletion policies are," warns Raghavan.
Spurzem says, "The FRCP amendments are careful to specify 'electronically stored information'. So IM for instance applies the same as email. But the ease at which certain data can be found and searched is also one of the factors to consider. Many companies let employees use public IM services (AOL, Yahoo, MSN) and the trend is for organizations to bring IM in-house and archive the IM records. Spurzem also notes that digital telephone is another form of electronic information that will also become part of the messaging archive.
Where to Begin
According to Raghavan actual fines for not being able to produce data have ranged from US$15 million to US$1.45 billion. Clearly, it is time for organizations to have an archiving policy. "When customers come to us we typically find that they are in one or two places," reveals Raghavan. "Some are well prepared. They have gone to a law firm, and have a policy ready to go. At that point, we can show them how our product can enable those policies. The other set of customer comes to us and says 'what should we do?' We then recommend a number of organizations that we partner with, including system integrators, law firms and solution providers that can help them to define their policy."
Most experts agree that it takes a number of functional areas within an organization to develop archive policies. "Organizations need to quickly form a cross department team tasked to define a company wide policy for electronic information," suggests Spurzem. "They need to inventory existing data, its location, its age, the amount, etc. They need to inform IT of the need to preserve data that is involved in litigation. They need to investigate the retention rules for their industry. And the list goes on and on, but those are some basic beginning steps." Spurzem adds that firms like Contoural (www.contoural.com) specialize in helping organizations define policies.
Asked if an organization should attempt to populate an archive with old backups and imports of PST files, Lock says, "No, unless you are mandated to keep communications and have been remiss. You might be required to go find old stuff due to some litigation, in which case moving all that stuff into an archive will get it indexed and make it easier to find."
A service called Message Consolidation is expected to launch soon from Postini to address this very question. "With Message Consolidation customers will be able to provide us with older legacy disc and tape and we will be able to consolidate it into one place," reveals Raghavan. For now, his recommendation is to start the electronic archiving in one centralized place today, so going forward organizations have the information available. Once Message Consolidation becomes available, organizations could then add historical data to new archives, allowing for the data to all be located in one place. While archiving is important for e- Discovery, D'Arcy contends that it can be much more.
"Archive is really a tool to eliminate a bunch of risks around managing email. When organizations make the archive investment, there is a list of problems they should ensure the archive solution solves." D'Arcy's suggested list includes being able to manage retention and deletion and storage management. "Email volumes are increasing at an extremely rapid rate and the size of email data stores are increasing along with it. In particular with Exchange, there is a fixed amount of time that you can get messages in and out of the system. As a result, when you look at the amount of time to do maintenance, backup and recovery, you have a very large amount of data, which could take days." D'Arcy sees this as an example of email disaster recovery and archiving coming together. For many companies, it would take a week to rebuild their system and it would take equally as long to load it back into the environment. To combat this, organizations have put email quotas into place. "What storage management solutions do is essentially make the archive and the primary environment work more seamlessly together. After a certain amount of time, messages can migrate over to the archive and a stub is left behind. This is especially useful for emails with attachments. You can cut the size of your storage by 80 percent," says D'Arcy. "When a user browses through their mail, they can still see all the messages, but there will be a link to where the attachment is. They can click on the link and it will open, but instead of coming from the primary, it will be coming from the archive. This extends the user mailbox to make it infinitely larger."
What to Archive?
There are no hard and fast rules on what to archive. "This is an old debate: save nothing vs. save everything," says Spurzem. "The argument against save nothing is that it does not work, because you may delete email on your server, but it may also exist on a home email account, or a local PST file. Because you cannot guarantee the email is totally deleted, you may as well keep a copy, just in case you end up in court. The argument against save everything is based on the cost of storage. Storage costs are dropping, but it is still expensive to manage large disk storage systems." Spurzem believes the likely best choice is to compromise and save intelligently. He says to apply retention periods to employees depending on their position and other factors. "With a firm policy in place and the evidence that it is being adhered to with best practices, no court is going to penalize you. A sound policy combined with a sound email archival solution is the best solution," recommends Spurzem.
But the compromise can be difficult to reach. As Lock asks, "How do you not choose save everything?" Because email is extremely high volume, Lock recommends the decision be automated. "If not, the least of your worries are going to be storage costs. There are easy and clear decisions like all communications for specific employees and groups that can limit the amount archived. The important point this brings to light is just how critical good antispam technologies are, along with the mechanisms that do not accept unsolicited bulk email." Retention policies will vary by functional area. "Human Resources require longer terms of retention, sometimes upward of 10 years," notes D'Arcy. "Finance and executive management might also require a specific set of policies. The philosophy varies wildly. Some organizations think that every email is a potential smoking gun and prefer to make their email retention policy as short as possible. Some feel that the defense values of the email is much more important than running the risk of not being able to produce an email. Both of these approaches would be correct."
For How Long?
The FRCP does not state a specific period of time for retaining information. But each regulated industry has its own requirements. "FRCP itself only states that organizations must have a policy around electronically stored information, and that you must tell the other party in the lawsuit what that policy is," says Raghavan. It can get complicated. He points out that if an employee takes an email and prints it out and places it in a file folder, the organization is obligated to likewise keep a record. "Companies need to make a risk assessment on how long a duration to store information and how quickly do they want to respond," adds Raghavan.
Patient records, customer invoices, boardroom minutes, etc. are all examples of business records that have specific retention requirements. It might be useful to gather a team together to determine retention length, for which groups within an organization. "Consult with a compliance expert for your industry to determine the time period," recommends Spurzem.
But many companies do not fall into a mandated time frame. "There are no best practices or mathematical rules to state how long to keep stuff," states Lock. "In general, it comes down to cost and ethics. Most archives are priced on a per mailbox basis. They are quite expensive to set up for a user, but once set up, extending the archive period is an incremental cost. Other solutions, like Mirapoint's, are capacity-based pricing.
Get Going
Many organizations do not have clearly defined archiving policies, as the survey conducted by Osterman Research reveals on page 15. Some companies are aware they should, but have not taken steps to define a policy or select an archive solution. "A rule of thumb for email archival sales is the cost of one court case can pay for the email archival system," says Spurzem. "Better to invest in an email archival system, than to pay court penalties, auditor fines and regulatory fines. In the process you can protect important company business records and intellectual property." Spurzem also points out that less company information is lost with employee turnover when email is archived. "Plus users enjoy a boost in productivity with better access to archived email and the stubbing feature allows them to keep more email without exceeding mailbox limits. The bottom line is that email is the number one form of business communication. It is worth the cost and effort to manage it more efficiently."
There is no denying the December FRCP amendments brought added attention to the need for archiving. "It is definitely the match that ignited this market," says D'Arcy. "While some organizations prepared in the months before it, most organizations are still figuring out their strategy for how to comply with those rules, so they can be well prepared for litigation. The number of organizations that are looking at archiving as a result is growing every single day.
