Data and E-mail Archiving 1

Data and E-mail Archiving: Legal Concerns Joel Zart Capella University TS5536-Ethics in Technology

Data and E-mail Archiving 2

Table of Contents Abstract……………………………………………………………………………………Page 3 Introduction to the world of Archiving……………………………………………………Page 4 Laws and penalties associated with archiving……………………………………………..Page 5 My ethical and legal dilemma……………………………………………………………...Page 6 Ethical dilemmas in archiving……………………………………………………………...Page 6 Process of identifying archiving liability…………………………………………………...Page 7 The solution based on law…………………………………………………………………..Page 8 The affects…………………………………………………………………………………..Page 9 The solution………………………………………………………………………………...Page 10 Conclusion………………………………………………………………………………….Page 11 References………………………………………………………………………………….Page 12

Data and E-mail Archiving 3

Abstract The purpose of this is to analyze the importance of data and e-mail archiving within an enterprise organization. At my organization I am currently in the planning stages of having a fully fledged data and e-mail archiving solution in place by the end of 2009. Archiving data and e-mail within an enterprise is important for legal litigation. According to industry experts 90% of communication in business takes place through e-mail and electronic documentation such as instant messaging and word documents (2009 para.1). Companies are now required to archive all communication to not only protect the company but also their employees. In this paper I will outline the process I am going through to choose the right solution to fill our company’s requirements for this solution. I will present my approach in order to give future IT professionals a reference for when they do it.

Data and E-mail Archiving 4

Introduction to the world of archiving According to searchstorage.com the term e-mail archiving refers to “a systemic approach to saving and protecting data contained in e-mail messages so it can be accessed quickly at a later date” (2008 para .1). This is what all companies are moving to today. Gone are the days of tape backup and personal folders. To truly be compliant within a digital enterprise, companies need to keep all communications that take place between their users, business and others. Besides e-mail, this includes text messaging, instant communications, Word, Excel and all electronic documents and any other communication that is considered digital. You may need to keep this data for up to seven years depending on your company’s business practice. Seven years? It would seem like a large number. In reality if you look at the IRS and that they can go back ten years during an audit, seven doesn’t seem so long. The reason for all of this archiving is that we no longer do deals with written proposals and letters. Most contracts are done through electronic distribution. Almost all communication that I do with a company is done through my e-mail. This includes renewal of maintenance contracts, to purchasing new software contracts. The plain fact is that we don’t realize how much of our communication is done electronically. Since 2006 there are federal rules on e-discovery. These rules govern what is considered to be easily accessible to a litigation team. Companies need to know where there data is kept and how to get access to it if requested. Since our company does not have a solution in place it is up to me to get us compliant with federal standards.

Data and E-mail Archiving 5

Laws and penalties associated with archiving There are certain US Federal and regulations as well as rules that require a broad range of companies to retain certain records. There are also stiff penalties that follow for noncompliance. The following are examples of legislature that was put in place to govern the retention of communication within certain companies. The Securities and Exchange Act of 1934 requires every national securities exchange member, broker and dealer who transact business in securities through the medium of any such member are required to retain records for up to six years. Failure to produce such documents in a timely manner to the SEC can result in fines (GFI, 2008). In 2002 the SEC fined five firms $1.65 million each for violation of their retention policies Even though this law was enacted in 1934 it still governs electronic medium such as instant messaging and e-mail (SEC). The Commodity Futures Trading Commission (CFTC) requires each futures commission merchant, introducing brokers and members of a contract market to keep full records of all transactions relating to commodities for a term of 5 years. These companies should be able to produce these documents for inspection at the request of the CTFC (GFI, 2008). In 2003 the CTFC fined $20 million in fines against a single company for failure to produce truthful and accurate documents. In 1999 the CFTC amended the rules to include electronic media (CFTC). The final one is the Sarbanes-Oxley Act. This states that when accountants conduct an audit or review of a public reporting company under the act of 1934 Act, accountants must keep all records for a period of five fiscal years. Failure to do so can lead to fines and imprisonment for up to 20 years(GFI,2008).

Data and E-mail Archiving 6

My ethical and legal dilemma Since my company is publicly held I am responsible under the Sarbanes Oxley Act to make sure that our company is completely protected in case of an audit. This includes all communication branching out in instant and e-mail correspondence as well as data retrieval. Since our inception in 1991 as a company we have not archived any documentation let alone electronic medium. To be compliant I have to achieve the standards that the law requires. This includes archiving all data from human resources, accounting, management, as well as the 480 McDonald’s stores that we host e-mail for. My biggest fear is that we will be sued or audited and without the proper response to a request for documentation our company could be held liable for failure to produce and subsequently lose the case based on that merit alone. I do not want to be solely responsible for the repercussions if this should happen. Ethical dilemmas in archiving In February 2009 a top republican named Mr. Issa questioned Washington on the use of personal e-mail programs to conduct government business. According to Mr. Issa “ The use of personal e-mail accounts, such as Gmail, to conduct official business raises the prospect that presidential records will not captured by the e-mail archiving system(CFE, P 3).” In the reading it states that the staff members were told to forward all e-mails that they received to their work addresses however no one was there to track it to make sure that it was done. Is this a way to circumvent the laws set forth from those agencies above? I believe that this would be a failure to produce if someone requested the documents and would put our government in an unusual predicament of ethics and law. Do the same rules apply if our government breaks these laws or are they immune to the consequences?

Data and E-mail Archiving 7

Process of identifying archiving liability In my company the subject of electronic discovery was brought up during a meeting about overall shared services responsibility. E-mail is an essential part of our business and it has become the primary way we communicate with our customers. A main issue with litigation is that in the event of a lawsuit, the new regulations stipulate that discovery happens at the front end of the process and things discovered afterwards may not be admissible. This puts a lot of pressure on IT (me!) to do a thorough search. Of course, what you find can either help or hurt you. During this meeting I was tasked to research the implications of an E-Discovery in a litigation case against us. E-Discovery is the process of locating, securing and using documentation from a company's archives in a legal setting (GFI2). So the process was to do a mock audit of our system using four of our executives as an example. I chose a keyword of buns and did a search of their e-mail. The results were not what I had hoped for. I only returned 42 emails across four mailboxes and all of the e-mail collected was from the past six months. I then asked the four executives if they found themselves deleting e-mail or keeping it. The answer was deleting it. With this information I knew that I had to come up with a solution that would accomplish the task of keeping e-mail for a minimum of two years and it needed to be invisible to the user. I knew I had some evaluation ahead of me to find the right solution.

Data and E-mail Archiving 8

The Solution based on Law There was a need to satisfy Federal compliance regulations such as SarbanesOxley, SEC Rule 17a & HIPPA. Failure to meet compliance requirements can result in significant fines, shareholder lawsuits, and harm to corporate image. Meeting electronic "discovery" requests to produce email messages related to a lawsuit or legal action. Retrieving specific emails based on the subject, content, sender, etc from backup tapes is extremely time consuming and expensive. Virtually every local, state and federal agency needs to be able to produce email messages in order to meet Freedom of Information Act (FOIA) guidelines in the case of federal agencies. With archive email an administrator can search, retrieve and deliver required emails in just minutes instead of weeks. There was a landmark ruling occurred in 2004 by a US District Court that demanded historical mail records "in native mode". The amendments to the Federal Rules of Civil Procedure (FRCP) came into effect December 1, 2006. Rule 26: General Provisions Governing Discovery; Duty of Disclosure. This rule states that companies must retain all corporate records, including email and data compilations, and make them available to the court. $50,000 dollar a day fine was imposed in the case of Serra Chevrolet vs. GM. Rule 16b says that you have 99 days to produce the results/records. Rule 37F says that "bad faith" efforts to remove records (smoking guns) or to avoid proper archiving will result in fines (GFI2). Private companies will need to comply with SarbanesOxley requirements if they anticipate becoming a public company in the future or being acquired by a public company. SarbanesOxley requirements will also raise the bar for corporate controls and governance among stakeholders of private companies. Private companies will be motivated to invest in

Data and E-mail Archiving 9

infrastructure for compliance, to reduce risk and increase stakeholder confidence and to increase their valuation in the event of acquisition or IPO (GFI2). The Affects The affects are great and the stakes are high when you don’t adhere to archiving laws. As stated before you can be fined and serve prison sentences, in some cases, if you fail to produce documentation when requested by law. IT managers and directors are the hardest hit because they are responsible for having this information at the ready. Even though most colleagues and peers tell me that they have enough protection because they backup to tape are mistaken. Archiving requires instant access to the information, without it you could be fined up to 50,000 a day as was imposed on the case of Serra Chevrolet vs. GM. Tape backup leaves a lot to be desired with the compression ratios and time it takes to decompress the data and then search it.

Data and E-mail Archiving 10

The Solution I chose a solution called Mimosa. Mimosa gives me instant e-mail archiving to my existing architecture as well as the archiving of .PST files and data. From one management console I can access anyone’s archives and restore e-mail with a right click and a restore. This solution allows for data compression and e-mail cleanup by storing one copy of an e-mail and all related attachments. The users see an icon within Outlook that allows them to search the archive and recall any e-mail that is stored there. This solution also helped with the issue of “no pain to the user” by allowing the mail to be archived by the use of transport logs from Exchange. This way the system is not taxed in any way during the day. If for any reason I should get a discovery notice I will be completely compliant from this point forward without having to worry about information retrieval or data de-duplication.

The Mimosa archive solution supports all government laws including Sarbanes-Oxley, HIPPA and other retention policies set forth by companies of any size or makeup. This product makes it possible to retain the data and make it available and accessible for regulatory audits and legal discovery when needed (Mimosa).

The need for my company to have a solution to comply with a mid size companies demands for retention was fulfilled by this program. The greatest thing about this program is the way that it works. It eliminates the bottleneck common with traditional archiving programs by using the journaling features inherent to Exchange. This allows for the solution to be behind the scenes with no noticeable difference to the user or server performance. This was especially important as one of the objectives that were set forth in my original meeting.

Data and E-mail Archiving 11

Conclusion This paper was a synopsis of what I did and the research that I had to do in order to be compliant with the laws that are out there. It was amazing that there are so many laws that cover a wide variety of information. The penalties that companies face are astronomical and can put many companies out of business. What shocked me was the amount of information that is available about this subject. It is just a shame that many companies out there probably ignore the inevitable and leave themselves open to prosecution. There are many other solutions out there that are just as good as the one that I chose. The bottom line is, if you are archiving, good for you. If you aren’t yet it is high time that you evaluate a solution to protect your company against data de-duplication and e-discovery requests. The risks are high and the penalties are even higher. What are you waiting for?

Data and E-mail Archiving 12

References Alexei, Edward IT solutions, Tangent. (2009 Para.1) The Law Requires Email Archiving. Retrieved April 23rd, 2009 from http://www.itworld.com/security/55954/law-requires-emailarchiving Whatis.com. (2008 para.1) Definition of e-mail archiving. Retrieved April 23rd, 2009 from http://searchstorage.techtarget.com/sDefinition/0,,sid5_gci1123554,00.html GFI email archiving in the US. (2008) (GFI, 2008) Retrieved May 7, 2009 fromhttp://whitepapers.pcmag.com/index.php Wikipedia.com (2009) Securities Exchange Act of 1934. (SEC) Retrieved May 7, 2009 from http://en.wikipedia.org/wiki/Securities_Exchange_Act_of_1934 CFTC Press release. (2003) (CFTC) Retrieved May 7, 2009 from http://www.cftc.gov/opa/enf03/opa4765-03.htm Wikipedia.com (2009) Sarbanes Oxley Act (SOA) Retrieved May 7, 2009 from http://en.wikipedia.org/wiki/Sarbanes-Oxley_Act Citizens for Ethics.com (2009) Issa seeks clarity on archiving e-mails. (CFE,P 3) retrieved May 7, 2009 from http://www.citizensforethics.org/node/37346 GFI what are the legal requirements for archiving in the US. (2008) (GFI2) Retrieved May 25, 2009 from http://kbase.gfi.com/showarticle.asp?id=KBID002205 Legal and Regulatory Compliance for File and Email Management (2008) (Mimosa) Retrieved June 4th, 2009 from http://www.mimosasystems.com/html/sol_regulate.htm