Hopeless? Records Management for Email -

Is it ever going to be possible to manage emails as records? I’m beginning to wonder. There are at least five viewpoints regarding the purpose, value, threat and burden of email, each with its own set of concerns, parameters and possible solutions. With new, cheap SaaS email offerings available from Cisco, IBM, Microsoft and Google, and with ever more mobile users, it may be time to face some hard facts about email management.

Law departments see email as a potential nightmare for e-discovery and litigation. The cost to search email archives and pay outside counsel to sift through them for relevance and attorney-client privilege is scary. Lawyers tend to see the management of email as the management of particular mailboxes. But as Daniel Garrie and Yoav Griver pointed out in their AIIM presentation, “Mobile Devices and E-Discovery,” third-party service providers like Google, AOL and Verizon have their own retention rules for messages which may be entirely different from yours. Attempting to put a litigation hold on third party files because of your litigation may not be possible.

Compliance departments want to make sure that email communications covered by regulations are kept as proscribed. The classic example is financial services, where client communications are retained according to SEC rules. What gives the compliance department dyspepsia is the idea of email as a separate silo, instant messaging as another silo, voice communications as another silo, etc. Faced with a regulatory audit, it is hard enough to show that one system is in compliance with regulations, let alone three. Compliance officers are among those who push for integrated messaging systems, with good reason.

Records managers will tell you that what determines retention is message content. True enough, but this concept assumes that there is a standard classification scheme in use by the entire enterprise; that all employees willingly classify their email messages according to it (or there is an automatic classification tool that works with more than 10 categories); and that there is actually some way to retain messages according to their assigned retention periods rather than copying them sequentially to storage media. Given the volume of email, the potential numbers of categories, and the enforcement of complex, event-driven retention periods, this solution may not be viable as a practical reality.

IT, of course, is where the buck stops. Headaches are the ongoing cost of operating email systems, backing them up and administering the storage needed for archiving. That’s why there are still plenty of organizations that assign email a single retention period in policies that stipulate “we keep all emails for 4 years, then delete them.” It’s just easier.

Meanwhile, consider the users, most of whom use email as a personal file cabinet. For many of them, email is a combination of knowledge, CYA, project history, and source information. In short, it is a productivity tool that lets them get their work done. Because email doesn’t easily integrate with their line-of-business systems, they face hybrid environments where one system contains process documents and another contains emails. In some cases, they actually print emails and scan them back in to the business system.

According to the April 26^th issue of Information Week, entities as large and diverse as GlaxoSmithKline, Panasonic, and Coca-Cola are going to cloud-based email solutions and others may follow suit when the time comes to upgrade existing email systems. It remains to be seen whether a third party provider will be willing or able to provide much more than bulk retention and disposition of messages based on date.

Comments

Submitted by Dennis Kiker May 11, 2010 - 4:46 PM

Very nice article. As a lawyer dealing with e-discovery, I very much appreciate your recognition of the different, and often competing, perspectives on e-mail management. I wonder only about the last sentence. It seems that there are enterprise technologies that enable management of e-mail as business records. True, as you point out, they require user categorization of the e-mails (I am not convinced there are any viable auto-classification technologies out there yet, but I would love to be proved wrong), but they can work. As an admitted non-technologist, I have to wonder whether the technology is not available to make the same functionality available in the cloud, if the vendors are willing to implement it. So, the question perhaps should not be "whether a third party provider will be willing or able," but simply whether they are willing. (And, are enterprises willing to pay for that functionality, offsetting one of the benefits of moving to the cloud.)

Report

Was this helpful? Yes No

Submitted by Gordon Hoke May 11, 2010 - 5:56 PM

Let's not confuse emails that are documents and needed for legal reasons with emails that meet the definition of a record. Organizational policy can require the sender or the receiver to declare an email as a record, just like, for example, a text file might be declared a record. Of course, it's not quite as simple as that (what about attachments?), but the basic concept is helpful. Records declaration can be manual or automated, but discrimination of emails is valuable.

Report

Was this helpful? Yes No

Submitted by J. Sprehe May 11, 2010 - 7:36 PM

Julie:
No, email records management is not impossible. It is not only possible but it is actually happening in the Office of the Chief Information Officer at the U.S. Air Force, Under a department-wide information policy, AF has created an information management strategy known as Information Asset Management (IAM). An important feature of IAM is that "all information assets will be managed so as to minimize the effort required by personnel and applications to conduct information management activities and enterprise services. IAM explicitly entails a high degree of automation occurring in the background and transparent to the desktop user." That quotation marks refer to an article just published in the May/June online edition of ARMA's Information Management magazine titled "Cleaning Up Your Information Wasteland," by Michael Corrigan and myself.
AF has created the Metadata Environment (MDE) that operates as a web service at the server level. Any Information Asset -- email, document, multimedia file, web content file, case file, etc. -- that is save to or passes through the server is grabbed by MDE and its metadata is automatically extracted; in the AF case, that's about 70 metadata elements. Among other things, MDE uses the Automated Metadata Population Service (AMPS), which is publicly available shareware, to extract the metadata from each Information Asset. AMPS uses keywording, key phrasing and automated metadata extraction software (which have now been around for a number of years), among other tools, to extract the metadata.
AF has devised a Rules Engine for assigning retention and disposition and determining what an Information Asset (IA) is a record. Simply put, the Rules Engine finds a probability match between the metadata of a given IA and the metadata of all AF records schedules, finds a best match and assigns retention and disposition to the IA accordingly. If the match is close enough according to predetermined criteria, MDE declares the IA a record and associates the IA with the appropriate schedule.
This is not rocket science; it uses off-the-shelf software tools widely available. Making it happen requires intensive organizational work in developing metadata vocabularies and ontologies.
BUT at the end of the day IAM not only solves the email records management problem, it also solves the e-discovery problem because every IA has a complete, searchable set of metadata.

Report

Was this helpful? Yes No

Submitted by Daniel O'Leary May 13, 2010 - 10:32 AM

I've heard good things from some of our customers and resellers about another product they carry called FileTek- good for exchange users. Personally we are looking at migrating to Google and using all cloud services, solving this problem is going to be super challenging.

Report

Was this helpful? Yes No

Submitted by Randy Moeller May 14, 2010 - 2:13 PM

I agree that email became the 3-drawer file cabinet that was in your cube. It’s stuffed with mostly copies, project work, CYA (a lot of that) and junk. The level of solution to email only needs to equal the ‘problems’ in relationship to your business. I doubt that we will ever have an extra system for email managing as the problems have not justified it and problems equal cost. Litigation exists by the bunches. We search the emails with an e-discovery tool. The tool would exist regardless of email. Retention? As so much is project driven, folks work on cleaning out their archive. Not the best way but we don’t find any 14 yr old CCMail messages either. Loss of business critical records? Haven’t seen that either. Important records are in the critical systems. For many, the amount of email has lessened with the rise of using Wiki’s etc. where you don’t have to email the attachment for editing.

Report

Was this helpful? Yes No

Submitted by Carl Weise May 21, 2010 - 2:31 PM

I attended an excellent presentation this week by Gary Steele, CEO of Proofpoint Inc., on the “Best Practices for Controlling Tomorrow’s Email Risks Today”. He asked all attendees if they had retention policies in place. Clearly, he was expressing the need for them by all organizations.

In reading about the sponsors of Osterman research white paper on “Convincing Decision Makers of The Critical Need for Archiving”, all vendors address retention policies in regards to their solutions for email archiving, including Google’s Google Message Discovery, Iron Mountain’s Mimosa Systems and Mimecast Unified Email Management.

I think it is clear that these vendors recognize that emails’ retention must be managed to support the needs of their clients related to ediscovery costs and controls. These vendors, and others, recognize that emails, like other electronic records must be managed, more importantly, they can be managed and they are providing the solutions to do just that.

Report

Was this helpful? Yes No

This post and comment(s) reflect the personal perspectives of community members, and not necessarily those of their employers or of AIIM International

The Global Community of Information Professionals

Community

Hopeless? Records Management for Email

Rate Post

Add a Comment

Comments

Blog Search

ERM Automation with SharePoint

Records Management Best Practices

ERM Training

Latest Comments

AIIM's Executive Leadership Council

Get The Research

Grow Your Expertise

Expand Your Network