Slashdot Mirror


Document Retention And E-mail

innocent_white_lamb writes "An interesting column by Jim Carroll about email within companies, document retention, how hard it is to actually get rid of an email, and how all of this can come back to bite you later on. "

174 comments

  1. Hrm. by autopr0n · · Score: 1, Insightful

    Of course, you could also just not do anything evil to begin with...

    --
    autopr0n is like, down and stuff.
    1. Re:Hrm. by ObitMan · · Score: 0, Offtopic

      no no no.
      We must not be called to account for anything we do, no matter how heinous.

      --
      Who run Barter Town?
    2. Re:Hrm. by ObitMan · · Score: 0

      once again certain moderators have shown themselve for what they truly are: Clueless.
      The Right Reverand autopr0n's comment was completely on topic.

      --
      Who run Barter Town?
  2. Resume for The_Fire_Horse by The_Fire_Horse · · Score: 0, Funny

    Hi, sorry to post this here, but I'm looking for work at the moment - hope you dont mind :)

    Personal Details
    Name - The_Fire_Horse
    Adress - Under the bridge next to the sewer outlet
    Phone - 1800-TROLL
    email - The_Fire_Horse@goatse.cx

    Career Objective
    I want to be a paid troll on various websites

    Summary of Skills
    Strong Internet skills:- I can use AOL and love MSN, I also troll at slashdot
    Personal Qualities : - unspeakable hygiene, ability to point out humorous flaws in others. e.g. 'Our boss is a complete dickhead - and did you see his toupe - jeez!'
    I religeously have a bath at least once a month, and I get on well with cleaners (we talk often about the state of the toilets)

    Special Areas of Achievement:- I once got a FIRST POST on Slashdot. Apart from that, lifes been pretty dull :(

    Employment History:
    1998-1995 Microsoft - Was soley resonsible for developing 'Clippy' in MS Office
    2000-1998 'Between Jobs' - I was a drunken bum after realising what I had done
    2001 -2000 Rehab
    2002-2001 As a new man, I entered society, and on my psychologists advice I became a Troller on Slashdot

    Education
    I went ot shcool and gto top markes in eNgesh

    Interests/Hobbies
    Wanking, trolling, and also wanking while trolling. I always read Slashdot at work^H^H^H^Hhome

    Referees
    CowboyNeal
    CmdrTaco
    Bill Gates

    Thanks very much for your time, and I hope you pay me shitloads of money to goof around

  3. Offshore email servers (not just with HavenCo) by rdl · · Score: 5, Informative

    (Disclaimer: I'm cofounder and cto of HavenCo, an offshore colo and supporting services company on Sealand)

    This is one of the main reasons people put email servers offshore now, even if they're operating onshore. This got started with HavenCo's gaming clients, but we now have general-purpose mail server customers who just want to company with their existing onshore document retention policies without the risk of someone subpoenaing their mail server and then trying to recover the disk.

    One of the features I'm working on now is some basic intelligence to detect out-of-character behavior by a mail server client -- such as attempting to download all messages, which would indicate they've been subpoenaed. If that happens, then we would attempt to contact the customer and get positive confirmation that they are *not* being investigated before allowing the transaction to continue. It's a trade-off between allowing normal function and protecting against legal attacks.

    Perhaps an extension of normal document retention policies for companies can be to keep them locally for 3-6 months, then move them to offshore "cold storage" where they will only be released when the offshore agent holding the files is certain a request is not due to legal duress. Trade a bit of latency for a lot of security, and otherwise the documents get destroyed anyway.

    1. Re:Offshore email servers (not just with HavenCo) by Anonymous Coward · · Score: 1, Insightful

      You'd still have to prevent mail from being stored on your employees' machines.

    2. Re:Offshore email servers (not just with HavenCo) by wangi · · Score: 5, Insightful

      yada, yada, yada... totally missing the point!

      There's no need for any legal request for the email - employees will dig them out to protect their own backs and to break the backs of others!

      Doesn't matter where the server is, or how many you have there's always going to be masses of duplication - local folders holding copies and such like. How do you handle this? Putting your server on a piss-forsaken rock isn't going to help!

    3. Re:Offshore email servers (not just with HavenCo) by rdl · · Score: 3, Insightful

      Employees will use them against their employers, but the much larger risk is outside discovery motions. The Microsoft trial was a good example -- none of the Microsoft employees whose email was subpoenaed benefitted from that. When the really-bad-attitude list was taken from Netscape, none of the list members really wanted that, either.

      There are threats from inside and threats from outside, and having a document retention (==destruction) policy will protect against outside threats. It will not protect against employees blackmailing their employers.

      However, if an employee keeps copies of mail in violation of a document retention policy, that employee can be sued separately. I imagine federal whistleblower laws might offer some protection, but in the case of a civil suit between companies, if an employee maintains a banned archive and then sells access to that archive to the other company's legal team, the employee is likely to suffer.

    4. Re:Offshore email servers (not just with HavenCo) by hoofie · · Score: 2, Interesting

      Check out the message from Sealand offering its services to the US in the fight against terrorism. Laugh ? I nearly fell off my chair.

    5. Re:Offshore email servers (not just with HavenCo) by Elbereth · · Score: 2

      What about using IMAP?

      I know what you're going to say to that: the users could easily save local copies of the message to their hard drive. If the company standardizes on an in-house e-mail client (or a mail client that comes with source code), then they can remove any features that they don't like, such as saving local copies.

      It doesn't stop someone from printing out an e-mail, using cut 'n' paste, etc. However, it's a lot better than using POP.

    6. Re:Offshore email servers (not just with HavenCo) by rdl · · Score: 3, Interesting

      Yes. Most of our clients for email use secure imap with mail kept on the server, or use web-based mail systems (which offer ticketing and other features as well)

      The ultimate system would involve secure laptops with no local unencrypted state -- using RAM for cache, and/or encrypted disk, but requiring connections to a non-US location to unlock the encrypted disk each time the machine is used. You could easily replicate the unlock servers for fault tolerance, and with a cell modem you can easily get a few hundred bytes exchanged from almost anywhere. Desktops and local servers could be handled the same way -- no local unencrypted state when powered off, and no way to unlock them without positive assistance from outside the jurisdiction, which would be revoked if there is evidence of an attack.

    7. Re:Offshore email servers (not just with HavenCo) by sql*kitten · · Score: 3, Informative

      This is one of the main reasons people put email servers offshore now, even if they're operating onshore. This got started with HavenCo's gaming clients, but we now have general-purpose mail server customers who just want to company with their existing onshore document retention policies without the risk of someone subpoenaing their mail server and then trying to recover the disk.

      I'm unclear about this. If they get a subpoena, it could be worded such that it's the mail they're interested in, not the physical storage device. In JWZ's account of the subpoena'ing of Really Bad Attitude, they didn't seize any of Netscape's servers, they required Netscape employees to print the whole thing out. If a court orders the company to deliver copies of their email, and they refuse, they're in contempt of court which is an offence in and of itself. And if HavenCo assist them, while it may be perfectly legal under Sealand's judicial system (assuming you have a formal set of laws there), don't forget you are surrounded on all sides by the EU who aren't above applying their own laws outside their jurisdiction. Witness pressure from the EU and US on offshore tax havens.

      What if they take out an injunction against your upstream bandwidth provider(s)? What if they send Customs and Excise agents to raid you, as the UK has done to vessels at sea suspected of smuggling? (Backed by a Navy frigate and detachment of Marines, usually). What if you personally are arrested as soon as you enter an EU country?

      I'm not saying that it's impossible to provide such a service, but that it's becoming increasingly difficult.

    8. Re:Offshore email servers (not just with HavenCo) by Anonynnous+Coward · · Score: 1
      Oh, all the email's on an offshore server outside the court's jurisdiction?

      That's fine. The court has the CEO locked up for contempt until the contents of that offshore mail server are delivered for discovery. Or the judge signs an order allowing hired stormtroopers to take every PC in the company for forensic analysis. Problem solved. Or am I missing something here? I imagine judges look dimly upon such blatant attempts to conceal evidence to protect against what you're calling "legal attacks" and that they call "justice."

    9. Re:Offshore email servers (not just with HavenCo) by Anonynnous+Coward · · Score: 1
      Alt-PrtSc, Print to FILE:, IMAP proxy, packet sniffer/logger, where do I begin (and that's after 5 seconds of thought, there are likely lots of other ways)? You can't have an enforceable Draconian email policy to cover the company's ass and have people be able to read their email from home.

      If I worked at such a place (while I was looking for another job), you can bet I'd be archiving everything that might ever be relevant. In fact, if I were ever involved in legal action against them, my lawyer might just make some hay of the lengths to which they went to try to keep me from preserving the evidence against them.

    10. Re:Offshore email servers (not just with HavenCo) by bagman · · Score: 1

      This is something I've never understood about the Havenco sales pitch. I realize you are the CFO, and not the general counsel, but are you really telling US companies that if they keep information off-shore, they are not required to turn over that information if it is subpoenaed?

      So long as a company has either (a) assets in the US that can be seized and sold or (b) people in the US who can be locked up for contempt citations, it does not matter where the data is so long as the US company controls it.

      If a grand jury or a party to a civil suit subpoenas a company's mail server's harddrive and the company is unable to get a judge to throw out the subpoena, saying that the hard drive is not in this country is not an excuse. The company must turn it over or risk sanctions including just being handed a loss in the lawsuit.

      The offshore agent not releasing files without certification that the request is not due to legal duress is a nice move, but one that isn't 100$ effective. People who have tried to hide assets in off-shore trusts with similar provisions have found out the hard way that if the government is determined enough, it can make it worth your while to bring the assets back to this country.

    11. Re:Offshore email servers (not just with HavenCo) by rdl · · Score: 3, Informative

      Yes, this is definitely an interesting legal area which hopefully will have some precedents set in the next 10 years.

      The employees of a company would first receive a subpoena in the discovery process to turn over all relevant mail. If the employees refuse to comply, they will be found in contempt and locked up indefinitely.

      However, they can only comply if they are technically capable of complying. It is not contempt to say "that document was shredded a year ago in accordance with our published retention policy", if the document was actually shredded. If recovering mail is blocked by a systems administrator located outside the jurisdiction at hand, then it would be technically impossible for users to recover the mail, and then they would be ok.

      It would not be acceptable for someone who receives a subpoena to delete his own key locally and thus lose access; that would be considered a willful obstruction of the legal process. But it is perfectly acceptable for an overseas party not named on the subpoena (or not served) to take arbitrary actions, and it's acceptable for a company to contract with an offshore agent to undertake security monitoring of a site and lock off access in the event of any suspicious activity.

      (I would be amused if these slashdot postings themselves ended up in testimony when we finally have a test case on the email servers)

    12. Re:Offshore email servers (not just with HavenCo) by rdl · · Score: 2

      It is certainly within a judge's powers to approve a discovery motion bringing in all PCs in a company to scan for files, but if the company has a policy (regardless of what it is), and then convinces the judge that it follows that policy, the judge will then only approve discovery motions which are likely to produce decent results based on the interpretation of that policy (weighed against business costs in complying with that motion).

      If an offshore party refused to assist the subpoenaed party in taking an action, the onshore party would NOT be in contempt of court, provided he could not take the action alone anyway, and provided he had not instructed the offshore party to destroy documents or whatever after the subpoena was received (but rather, the offshore party continued to operate under a pre-existing contract presented to the court), the CEO would not be in jail.

      (Certainly this was true some time ago. The RIP Act in the UK may complicate things for those in the UK, and there might be civil lawsuits against the company for contracting with a non-cooperative offshore party in the first place, but this is far less than the original case)

      As for liability on the part of HavenCo for continuing to respect a lawful contract even once our counterparty has legal difficulty in another country -- perhaps. As far as I can tell there is not a lot of precedent here. The Sealand Government would presumably receive legal requests from overseas governments; it would be a violation of Sealand Law to comply with them. The analogy is offshore trusts, where if a doctor for instance is sued for malpractice in the US, the offshore trust will not turn over assets, which has been tested repeatedly. The US specifically has engaged in "trust busting" with respect to fraudulent forms of trusts used for tax evasion, but the general concept of trust is respected greatly in most other common law countries, and aside from tax issues and criminal investigations, in the US as well.

    13. Re:Offshore email servers (not just with HavenCo) by rdl · · Score: 2

      The analogy with trusts is a good one; basically, the onshore party is *unable*, not *unwilling* to comply with the request, having ceded authority to an outside party. When you enter into a trust you no longer have ownership or control of the assets, which is why they are legally distinct from your own in the case of subsequent legal action.

      The US's trust-busting is primarily focused on tax and criminal investigations, and requires the cooperation of the offshore jurisdictions in which the trusts are domiciled. Sealand Law would make it illegal for the Sealand Government or HavenCo to comply with any requests for the data.

    14. Re:Offshore email servers (not just with HavenCo) by ariels · · Score: 2, Insightful

      I still don't get it. If I'm a disgruntled employee (say the company just collapsed and I've just been laid off and feel cheated), what's to stop me making a copy of any email to which I have access?

      Saying "secure server" and "secure client" doesn't cut it. As long as I have reasonable access to my computer, I can make a copy. If the computer can display it for me to read, I can copy it.

      Surely SeaLand protects against something else completely!

      --
      2 dashes and a space, or just 2 dashes?
    15. Re:Offshore email servers (not just with HavenCo) by sql*kitten · · Score: 2

      If recovering mail is blocked by a systems administrator located outside the jurisdiction at hand, then it would be technically impossible for users to recover the mail, and then they would be ok.

      How would you deal with the case that you mentioned, if you detect suspicious activity, call up the customer and ask if they really meant to be downloading their entire archive? They would have no choice but to say yes, they really did want to. If they did say no, they're busted.

      And signing a contract that stated that you would be blocked from accessing your own email if a subpoena was served puts the customer on uncertain legal ground. Basically, I'm saying that the court would find contempt at the very minimum.

    16. Re:Offshore email servers (not just with HavenCo) by bagman · · Score: 1

      Although I agree that in the past trust-busting has typically been initiated by a government agency (FTC, SEC, IRS), there is no reason that it will not spread to plain-vanilla civil suits. Furthermore, there is no reason that it requires the cooperation of the foreign country.

      In FTC v. Affordable Media [179 F.3d 1228], the Andersons, a husband and wife, had a trust on the Cook Islands. An "event of duress" occurred, removing the Andersons as trustees and preventing the foreign trustee from moving the funds back to the US. The Andersons spent six months in jail for contempt. The US court did not rely on any cooperation from the foreign agent/country.

      This was a case where the court's simply did not believe the Andersons when they said that there was no way for them to get at their millions of dollars they had sent overseas. The trust owner has the burden of proof in this case. The court left open the question of whether the trust owners could be held in contempt even if they established that they had no control.

      So, companies are stuck between creating an ironclad agreement where they cede total control over their servers to a third party (and still risk contempt/default judgment sanctions) or a not-so-ironclad agreement where they maintain some control but the courts ignore the agreement. Neither seems all that appealing.

    17. Re:Offshore email servers (not just with HavenCo) by Anonynnous+Coward · · Score: 1
      I'll admit to an unfamiliarity with the law associated with trusts, but I have always thought of these as financial arrangements. But even provided that the trust argument holds up for Sealand, and that force isn't ultimately used to compel HavenCo to produce the contents of the mail servers, wouldn't having made such an arrangement itself be damning against any company who did so that becomes involved in legal action?

      An analogy would be an individual suspected of trafficking in contraband (kiddie porn seems to be popular these days, I imagine copy control circumvention programs would be next), and when the cops busted down his door, they found nothing. However, the guy had a copy of "Evidence Eliminator" installed, and with that, plus logs from his ISP with "suspicious" filenames in he headers, the prosecution would probably be able to secure a conviction, or at least get him to cop a plea to a lesser charge.

    18. Re:Offshore email servers (not just with HavenCo) by Anonymous Coward · · Score: 0

      One of the best ways to protect against email and other documents getting out of hand is to enforce access controls which travel with the document. For example, by making all documents active with access control from a remote server under control of the sender. Probix purports to have such a system.

    19. Re:Offshore email servers (not just with HavenCo) by Znork · · Score: 2

      External threats are minor compared with the everyday risks of not being able to cover your back.

      It's just that Joe Programmer being fired because he couldnt prove the customer asked for what he provided and then the customer changed his mind later doesnt exactly make the news headlines the same way.

    20. Re:Offshore email servers (not just with HavenCo) by Wanker · · Score: 2
      On a truly secure client there is no screen. Instead, you need to run a USB connection into your modified artificial retina to generate text for you to read.

      Sure, you can "copy" it by hand, but then it's just your word against theirs.

      :-)

      Note for the humor impaired: Yes, I'm kidding. At least I hope I am.

    21. Re:Offshore email servers (not just with HavenCo) by Eppie · · Score: 3, Informative

      Legally, offshore servers are of limited value. If you are subject to jurisdiction in the US and a court orders you to cough up the email, you must cough it up. It does not matter where you store it, especially if you have electronic access to those servers in the US.

      I represented an American investment bank that was stiffed on a deal with a foreign company. The fact that many of the relevant documents were scattered throughout Asian offices of various companies made little difference in our ability to force our opposition to produce many boxes of documents, including email stored on off-shore servers.

      I'm not sure why you would try to detect if your customers are being subpoenaed. Why would you disallow your own customers to download their own documents? If you think you're helping them by refusing to allow them to comply with a subpoena, you're mistaken. Companies that intentionally put themselves in the position of losing control of their own documents to avoid legal process will not be treated kindly by courts. I can think of little better news than opposing counsel coming to me with a sob story about how his client's agent refuses to turn over the documents. In the case of third-party subpoenas, such tactics would quickly result in mounting sanctions.

      I can see reasons for getting documents offshore. From a legal perspective, though, this does not do much good. I hope your service wins a lot of customers. I can't wait to litigate against somebody dumb enough to hide his documents in this manner.

    22. Re:Offshore email servers (not just with HavenCo) by gnovos · · Score: 2

      One of the features I'm working on now is some basic intelligence to detect out-of-character behavior by a mail server client -- such as attempting to download all messages, which would indicate they've been subpoenaed. If that happens, then we would attempt to contact the customer and get positive confirmation that they are *not* being investigated before allowing the transaction to continue. It's a trade-off between allowing normal function and protecting against legal attacks.

      Why not give them two passwords. One for "normal" use, and one that automatically flags your alarm system. They can ostensibly be "complying" with the court order while at the same time having your system automagically alter or destroy all the "good stuff".

      --
      "Your superior intellect is no match for our puny weapons!"
    23. Re:Offshore email servers (not just with HavenCo) by sdowney · · Score: 1

      Great, so I use your services, get hit with a subpoena to produce old email, then go to jail for contempt of court.

    24. Re:Offshore email servers (not just with HavenCo) by jafac · · Score: 2

      I hope you don't have an Al Qaeda mail server.

      Because if they "win", you can be sure that SeaLand won't be allowed under Sharia.

      --

      These are my friends, See how they glisten. See this one shine, how he smiles in the light.
    25. Re:Offshore email servers (not just with HavenCo) by Anonynnous+Coward · · Score: 1
      This is the concept of a "duress" password. I used to think banks should issue two ATM PIN: a normal PIN, which gives full access to the account, and a duress PIN, which only gives access to a small amount of cash, to be used when the customer is withdrawing money at gunpoint. If the duress PIN is used, the small amount of cash is dispensed (to keep the customer alive), and armed security or police dispatched.

      However, experience with alarm systems shows that accidental use of duress passwords is much too common among civlians!

      But a duress password for a mail server, as you suggest, would be a good idea whether it's hosted at HavenCo or not. The problem is that if it were part of a well-known commercial product, once the adversary was aware that such a product was in use, there wouldn't be time to use the duress password--armed men would storm into the server room, copy the disk bit-for-bit, and the guy with the keys would be in jail for contempt until the prosecution's (or other adversary's) forensic analyst could verify he had both passwords. Same idea goes for personal encryption systems.

      A file system encryption program that implements this idea deniably is Rubberhose. Unfortunately, I think the name is apt, because if nothing substantially incriminating were found on a machine running it, law enforcement (or other adversary's) assumption would be that there's another layer that a little more pressure (or pain) would cause the user to give up the next password.

      The key would be to find a product that can be used without leaving a sign that the user is using anything but innocent (and perhaps appropriately backdoored) commercial products. I have yet to run across anything like this.

    26. Re:Offshore email servers (not just with HavenCo) by Anonymous Coward · · Score: 0

      How would you deal with the case that you mentioned, if you detect suspicious activity, call up the customer and ask if they really meant to be downloading their entire archive? They would have no choice but to say yes, they really did want to. If they did say no, they're busted.

      And even if you were to ask the client if they under a subpoena, subpoenas can be worded so that it would be a contempt of court to reveal this fact? Or am I confusing this with proposed laws that were mentioned on slashdot?

      I suppose you could have prearranged code words that if mentioned or not mentioned would enable communication of the fact that the client was being compelled... But still if the client was found it there would be hell to pay.

  4. From the article.... by RobertTaylor · · Score: 3, Funny

    Some estimates suggest that once it is all added up, American's send some 1.5 billion messages a day.

    1.4 Billion SirCam "I send you this file for advice". Probably.

    1. Re:From the article.... by Anonymous Coward · · Score: 0

      Don't forget the "This is a new game I wrote" notifications.

  5. The answer is easy by Anonymous Coward · · Score: 0

    Central servers, dumb clients. If you have to control things, that's the only way to do it.

  6. Easy and secure delete by tom_newton · · Score: 3, Funny

    Simply include some extremely useful or important information in every email you send, and voila, you will find that it disappears every time, resisting even the most sophisticated attempts at retrieval :)

    NB. This method works best if this is also the only copy of said information.

    --
    Tom Newton
  7. What about the benefits by Anonymous Coward · · Score: 4, Interesting

    So what is the lesson here? If you are planning on committing fraud, illegally maintaining a monopoly, or postponing a defective product recall to maximize profit, you should first make sure you have a document 'retention' policy? And then everything will be OK? What is wrong with this picture?

    What about a story on the benefits of keeping old emails? I'm tired of hearing about the costs.

    Fucking lawyers. Oh, my mistake. It isn't the lawyers, it is the legislators. Fucking legislators. Oh, my mistake. It isn't the legislators, it's the voters. Fucking voters. There, that's better.

    jkljkl

  8. HERF gun by Lord+Puppet · · Score: 2, Funny

    When there's a lot of email, and your in a REAL hurry...

  9. It gets out of control very easily by Anonymous Coward · · Score: 1, Interesting

    One of my company's senior managers started keeping a copy of every e-mail he sent or received because he got burned in the usual "you said this..., no that is'nt what I said..." that goes on in any office. After 2 years he had 6Gb in his Outlook .pst file.

    1. Re:It gets out of control very easily by Anonymous Coward · · Score: 0

      See, that's what mailing Word documents converted to html does to your harddisk.

    2. Re:It gets out of control very easily by Heem · · Score: 2

      Hey, as long as he had it in a .pst on a client machine and not on a server.. good for him. It's when that 6gb is sucking up server space when that starts to suck.

      --
      Don't Tread on Me
    3. Re:It gets out of control very easily by baptiste · · Score: 3, Interesting
      It's when that 6gb is sucking up server space when that starts to suck.

      Oh I don't know - GB sized .pst files anywhere seem to give Outlook fits. I'm alwasy amazed at people who have all their email in ONE folder and complain about sluggishness. They're amazed when we tell them they can file stuff in folders both on and off the server.

      As for storage of email - I've never really figured this out. Yes, some companies log email, etc, etc. Stuff gets caught on backup tapes, etc. But even then stuff drops out after a while. As an IT manager, I'd almost WANT to ditch email serve rbackup tapes after 6 months to a year, less legal hassles :)

      Besides - if its not on the server or the defendants machine (IANAL) - its tough to use as evidence - I mean you can spoof an email easily if you're the plaintiff to make it LOOK like someone sent something. Now do courts understand that? I doubt it :)

    4. Re:It gets out of control very easily by Tri0de · · Score: 1


      6 GIG? Gee, that's about, what, $12 USD? (yeah, I just bought a 20 gig for $60.)

      --
      "Everyone is entitled to their own opinion, but not their own facts."
    5. Re:It gets out of control very easily by afidel · · Score: 2

      This story is impossible, there is a very hard limit to pst's at 2GB. It is due to the fact that pst's are just an implementation of the archaic microsoft JET database, a system that dates back to the late 80's. This is one of the most glaring bugs (other than the security problems) left in Outlook. I can't count the number of people that have lost email because their .pst went over 2GB. Until recently there wasn't even a way to recover the file, but there is now a tool that will allow you to shave off some of the end of the .pst file so that you can at least recover most of your old email.

      --
      There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
    6. Re:It gets out of control very easily by ethereal · · Score: 2, Insightful

      I keep everything too:

      du -k ~/.netscape/nsmail
      ...
      296495 /home/ethereal/.netscape/nsmail

      This is for almost four years at this particular company. I'm not up to boss-like standards (of course, the fact that I can communicate without using .doc and .ppt files probably helps) but it's still a hefty archive.

      Is it useful? Often it is - I have exact records of all my correspondence for the last four years, sorted by date, topic, etc. as I want it. And when all else fails, I can grep for the text in the message that I want. Of course, it helps that I religiously file mail into folders so that my inbox only contains email about tasks I haven't completed yet.

      Frankly, I don't see how I could live with the example quoted in the article of deleting everything over 30 days old. I would be unable to function without reference to technical discussions, product release information, and the latest management diktats from 30 days, 3 months, or even three years ago (OK, maybe I could live without the mgmt stuff :). Do these companies with such a destruction policy just convert all their important email into other documents so that they can maintain state past 30 days? I honestly don't understand how you could just throw all that information away and hope to keep your business rolling forward. Maybe someone can enlighten me...

      --

      Your right to not believe: Americans United for Separation of Church and

    7. Re:It gets out of control very easily by Znork · · Score: 2

      $12 USD? No, that's what storage costs on your PC at home. $300/month would be more in line for 6 GB storage, internal corporate no-profit charges.

    8. Re:It gets out of control very easily by netringer · · Score: 1
      Besides - if its not on the server or the defendants machine (IANAL) - its tough to use as evidence
      Actually the courts have held that the legal discovery process is concerned with data that is on servers, not desktops. We were told by the lawyers that the courts have held that servers ARE controlled by the company but desktops are not.

      What the lawyers are concerned about is when they get a court order for discovery that says "present every document regarding issue Y or company X." They are required to come up with EVERYTHING and report back that there's nothing else in places the company controls that the company can put it's hands on. They are not expected to search every desktop, but they are expected to seach common controlled resources like file servers.

      My place has suggested that everyone store their .pst files on their home directory so that could make things interesting.

      --
      Ever dream you could fly? Get up from the Flight Sim. I Fly
    9. Re:It gets out of control very easily by netringer · · Score: 1

      ..and there's the deep. dark secret of Outlook .pst files that space is never reclaimed until you manually run the well-hidden compress utility.

      Even if you delete items from the folder from within Outlook the space the deleted items used is still gone until you compress to reclaim it. Nobody compresses, so the file grows and grows.

      --
      Ever dream you could fly? Get up from the Flight Sim. I Fly
    10. Re:It gets out of control very easily by Anonymous Coward · · Score: 0

      from technet:

      Each .pst file can contain 16,384 items. An item is either a folder, message, task, etc. Each folder can contain a maximum of 16,384 items. If you select the option to "Allow upgrade to large tables," each folder can contain up to 65,536 items. The total file size of a .pst cannot exceed 2 Gigabytes (GB).

  10. Lotus Notes by marcushnk · · Score: 2, Insightful

    Is the only enterprise (and home use) e-mail client worth using if you handle that many e-mails.
    And as to it comming back to bite you... Don't do anything bad.. Be open honest and totally transparent in all your business dealings.. then nothing can come back and bite you.
    :-)

    --
    "Consider how lucky you are that life has been good to you so far. Alternatively, if life hasn't been good to you so far
  11. Interesting moral position by Ami+Ganguli · · Score: 5, Interesting

    I find it fascinating that people openly discuss ways of destroying evidence in case of possible legal action. Is this going to be a standard MBA course from now on: "How to cover your tracks" or "Case Studies: Failures in Shredding Policy from Watergate to Enron"?

    It makes you wonder why nobody looks at it from the opposite side. If you don't do anything illegal then your e-mail archive could prove valuable for your own defense. Trading companies, for example, keep all records of customer interaction, including phone calls, for use in the event of a dispute. You can never claim that your broker did something without authorisation because they archive everything.

    --
    It is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail. - Abraham Maslow
    1. Re:Interesting moral position by Scutter · · Score: 4, Interesting

      "Legal" is an ambiguous term at best, the definition of which is determined in the courts, not the boardroom. The U.S. legal system is so convoluted, it's virtually impossible to get through the day without breaking some law. Even if you just stayed in bed all day, you'd probably be guilty of loitering.

      --

      "Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
    2. Re:Interesting moral position by SuperCal · · Score: 1

      I believe the problem is that, especially in highly competitive fields, one company can use the legal system to basically steal corporate secrets. Once you get the documents out of the company they become much easier to get a hold of. It comes down to the fact that the more people who see secret files the more chances there are for a leak. Of cource this is just my view, and I have trust issues so...

      --
      Business News and Resources: www.usasource.net
    3. Re:Interesting moral position by Anonynnous+Coward · · Score: 3, Informative
      Although that is the cynical, (and usually valid, IMHO) interpretation, here's another one:

      It's not just about destroying evidence that could be used against you, maybe. I'm not in Records Management, but I bet complying with a subpoena is a lot easier when there's simply less email hanging around--if you have a good, enforced retention policy, you can honestly say "Here is what we have. We don't have anything older than n days, according to policy," and save thousands of dollars in staff time that would have been spent mounting old backup tapes and cruising employees hard disks trying to honestly comply with a court order.

    4. Re:Interesting moral position by bdoliver · · Score: 1

      Its not really that there is anything illegal going on. For instance destroying documents that are not the final copy is a very typical practice. If there are many versions of a document floating around (various pre-releases) it later becomes difficult to get everyone on the same page. I can only imagine during a legal investigation someone having a document that contained some mis-wordings, or a few typo's and that being chosen as evidence over the final document. It is very common (and a good practice) for people to get rid of extra stuff for the above reasons (read in less confusion).

      I am not advocating the destruction of documents to hide things, however for the general case, once a new revision of some document is out, everyone needs to trash their local copy. Formal document control programs are great for handling these kinds of things and helping to enforce protocols like this. Not to say a user can work around them, just any little bit helps.
      I am sure this will turn out to be an intresting legal discussion for some time to come.

    5. Re:Interesting moral position by Anonymous Coward · · Score: 0

      You know they did that not because they hate blacks but because their professional experience tells them that blacks in predominantly white neighborhood means trouble.
      Sometimes it ends up like in this case but most of the time they are right ( just check crime statistics.)

  12. all this seems strange to me.... by phunhippy · · Score: 4, Funny

    Back when I worked at a .com years ago it seemed the exchange server crashed so much we could'nt keep our email longer then a few weeks if we did'nt back it up!!

    Then the CEO told us to auto delete mail older then 90 days... well the exchange server crashes took care of that too :)

  13. So what? by hcdejong · · Score: 4, Insightful

    I'm having a hard time figuring out what his point is. He's saying "we need a policy for archiving e-mail" and then he talks about Enron, where any policy regarding e-mail would have resulted in evidence being destroyed. Is he saying we need to start pre-emptively destroying email in case there's something incriminating in it?

    "Digging up the dirt" isn't a new problem. Back when everything was done on paper, you could make copies and stash them somewhere, so shredding the original was never enough to ensure the document didn't exist anymore.

    And as for saying "e-mail will play a role in many other unfolding corporate stories", well, duh!

  14. Well we already know... by danny256 · · Score: 2, Funny

    ... how hard it was for Bill Gates to keep all of those "leaked e-mails" from the public.

  15. Keeping what you need... by Xamdam_us · · Score: 2, Interesting
    My company has an e-mail retention policy of 45 days. Every Monday morning you get a message in your inbox telling you how many massages have been deleted and that they are not recoverable. The funny thing is at least for me, all it dose it put them in my deleted mail folder. It dose not actually delete them.

    It's also annoying because I get a lot of informational mail that I "need" to keep. So it's either print them out or lose them. Well it would be if it worked right.

    1. Re:Keeping what you need... by base3 · · Score: 2
      How does the company stop a technically knowledgeable user from circumventing the policy by keeping a personal, offsite archive (say, by printing the emails to a LaserWriter on FILE: on a Windows machine, then copying them to removable media or emailing the resulting .PS files to a drop), besides the threat of termination.

      Bonus points: if the hammer is threat of termination, how does the company catch the employee, save for pervasive, big brother type monitoring?

      --
      One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
    2. Re:Keeping what you need... by gorilla · · Score: 2

      How does the company stop a technically knowledgeable user from circumventing the policy They can't. Next question.

  16. lack of regulation & lack of understanding by buzban · · Score: 1
    personally, i think one of the most interesting aspects of this topic, in addition to the lack of document retention regulations for email, is the lack of understanding on the part of many in power to make such regulations or implement such regulations.

    for example, my boss, God love him, has no idea how email works from the server end. frankly, we would-be administrators don't have the best understanding of it either.

    with this in mind, i think one of the most interesting things to see is how any document retention scheme would be implemented by many smallish and medium sized businesses. of course, i'm thinking that we may not have the appropriate skills or facilities to carry out a doc reten policy that the government might impose. the other possibility -- more likey in an Enron case, is that employees might purposefully botch such a policy.

  17. MS communications by Anonymous Coward · · Score: 3, Funny

    Top level MS officials no longer communicate with email.
    All communications happen in closed door sessions.
    Verbal communications are also discouraged.
    Most of these meetings are like a game of charades.

  18. Netscape history by the+gnat · · Score: 5, Interesting

    Jamie Zawinski has a rather unpleasant story about this on his site:

    http://www.jwz.org/gruntle/rbarip.html

    A very good example of how essentially harmless email can be seriously misinterpreted.

  19. Slow decay is easy... by gweihir · · Score: 2

    just use a proprietary format (like Word's .doc) and store the emails on magnetic tape. 20 years later all is gone and what can be recoverd cannot be read. Some versions of what many people today think are html-documents also decay pretty fast, especially if they only display with a specific browser running on a specific OS. If this OS only runs on specific hardware, as soon as that hardware becomes unavailable the documents become unreadable.

    On a related note, I find people that put things in email they would not put on ordinary paper quite unaware of reality. Don't they know there are devices called "printers", that can put emails on paper? Don't they know that email obviously is "written text"? Except for being far more convenient, I assume that an email is a written document, that will be stored by whoever I send it to.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted and ignored otherwise.
    1. Re:Slow decay is easy... by tom_newton · · Score: 1

      > I find people that put things in email they would
      > not put on ordinary paper quite unaware of
      > reality.

      Perhaps, however it's more the fact that to post someone a letter or fax someone you have to get out of your chair, and usually have to pay. This gives you more incentive to think "is this crap worth sending?" Compare: slashdot postings, emails where sending crap is the norm, rather than the exception ;)

      --
      Tom Newton
  20. Don't Use Email for Everything by pryan · · Score: 3, Informative

    When I worked at a Fortune 500 company, I noticed that people use email for almost everything internally. Most of the stuff that large companies are liable for get thrown about in email when there are many other, often better communication methods. Unfortunately, there are a lot of middle-aged administrative assistants and managers that seem to think everything goes in email.

    The lesson? Don't use email to distribute that 10 MBib presentation. If you have a memo, then email everyone a link to it and set the web server to spit out a no-cache HTTP header with the page. If you have a file to share with some people, put it on a file server and give people the link via an email, but don't just attach the little bastard file, which probably isn't so little anyway.

    1. Re:Don't Use Email for Everything by DrSpin · · Score: 1
      If you can tell whether an attachment is large or not, you are computer litterate.

      A millon lemmings cant be wrong.

  21. What is the legal status of email? by mir · · Score: 5, Interesting

    Emails can be forged so easily, how is their authenticity established?
    I guess any decent sysadmin in the world could show the court a whole bunch of threatening emails from the CEO of his company, what would a court do in such a case?

    --
    Look, that's why there's rules, understand? So that you think before you break 'em. (Terry Pratchett)
    1. Re:What is the legal status of email? by Eppie · · Score: 3, Informative

      Email is incredibly useful as evidence. In much large litigation, perhaps half of the documents submitted as evidence are email.

      Courts aren't like the movies. In real litigation, the parties don't have many fights about whether a document is what it purports to be. They have fights on how to interpret the document, but not about whether it really came from the CEO or not.

      The reason for this is that email is largely self-authenticating. Most litigation involves at least one party that is a company. All but the smallest companies keep track of their email automatically. When the request for documents comes in, IT does a keyword search, dumps a bunch of emails to a CD-ROM and hands it to the lawyers. The lawyers filter the emails and hand over the relevant ones to the other side. The lawyers keep their clients reasonably honest.

      If a plaintiff comes up with an email that the other side doesn't have a record of sending, they'll have a battle over whether it is real. Both sides present evidence and the jury or the judge makes a decision as to whether it's an authentic document or not.

      In a company of any decent size, the person keeping track of emails and other documents is not important enough to have his or her ass on the line. If they are asked to forge or destroy documents, they'll either refuse or else they'll be extremely willing to talk about it. If there is ever a trial over Enron, we'll see a parade of paralegals, secretaries and mailroom clerks testifying about shredding documents until 3am every night. These things have a way of getting out.

      So: If a sysadmin forged a bunch of emails from the CEO, the court would either let the jury decide if the emails were real or, if it their authenticity were very clear, rule on the issue before trial. It would be up to the CEO and his attorney to show the court why these aren't real. If the sysadmin gets caught forging, he probably goes to jail for a little bit.

    2. Re:What is the legal status of email? by 4of12 · · Score: 2

      I was going to say that most of the email sent and received in my corporation is not digitally signed.

      I used to get laughs from coworkers by sending them messages with the name of the CEO in the From: field.

      I can see the legal battles of Bill Clinton continuing as his sexual misbehavior is further detailed by all those Usenet postings to the alt.sex sites...

      However, it's a good point. I think in the future that important emails will get my digital signature, even if puzzled recipients don't know WTF GPG is.

      --
      "Provided by the management for your protection."
  22. The inhumanity! by Anonymous Coward · · Score: 0

    Slashdot hosts must not believe in document retention, especially when it comes to past topics...

  23. I suppose... by Richard_at_work · · Score: 2, Funny

    ... this could be one use for USAs nuclear plans. Just EMP everyone to get rid of any potential damaging emails :)

    1. Re:I suppose... by Technician · · Score: 2

      Shielding goes a long way to protecting against EMP. Your typical fire rated safe has a double metal layer case and a door that has metal rods that extend into the case on 2 or 4 sides of the opening. The attenuation of a pulse by the magnetic shunt is quite high providing a high degree of protection from EMP to the contents. Our military has lots of redundant stuff sealed in farady shielding containers to be deployed to replace online stuff damaged from a EMP attack. You can do the same thing at home. Take your spare computer and remove all external cords (cords act as antennas to pipe EMP into a box). Put it into a metal container with a metal lid with full RFI contacts all the way around the edge of the lid. The container shunts the EMP with counter EMF protecting the contents. That computer will be ready to put online after a nearby lightning strike takes out your old one.

      --
      The truth shall set you free!
    2. Re:I suppose... by Anonymous Coward · · Score: 0

      If they can make an EMP strong enough to erase my CD-R archives, I have bigger problems.

  24. Encryption? by ksw2 · · Score: 2
    I didn't see encryption mentioned anywhere to offset the persist nature of email. If all the mail is encrypted, at least you won't have to worry about copies of the message remaining on servers in between. Match that with a client that never caches the plaintext to disk, and autodeletes messages of a certain age, and I think you've got a winner.

    Of course, I'm sure some will say this is beside the point. Nothing stops employees from printing/saving email, especially if they WANT to incriminate the company. I don't think email makes this more of an issue than non-email incrimination does, however... just don't talk dirt in your email, duh?

    1. Re:Encryption? by ibennetch · · Score: 1

      Part of the point of deleting the emails rather than simply encrypting them (as I understand it) is if you are ever under a subpoena from a court to retrieve the documents. If they are there but encrypted, you could be held in contempt for not decrypting them; but if the company policy is to delete anything after (say) 90 days, you *can't* retrieve them. (On the other hand, Eric Damron pointed out elsewhere in these comments that there must be a policy for it or you could end up having to recover the data :-O)
      of course, IANAL

  25. Email security by fruey · · Score: 1

    Remember... electronic transactions are always going to haunt you.

    Don't say anything, anywhere, that you don't want repeated.

    Don't do anything, anywhere, that you don't want to be held up for.

    Be aware of your email.

    Oh, and use a decent email client/server solution. Use IMAP so that you only have one mail store. Delete old files.

    And beware... Big Brother IS already watching a LOT of people.

    --
    Conversion Rate Optimisation French / English consultant
    1. Re:Email security by goldid · · Score: 1

      I disagree. Of course, with e-mail there are multiple copies, archives, records of it being sent, etc. Personally, however, you can make decisions to keep yourself safe: DO NOT BE STUPID.

      Besides, that, though, I delete my e-mail that's over 6 months old every month, and assume that if any info were that important it would've been copied.

      I would also argue that e-mail is not *more* dangerous. Who was to say that an employee didn't make a secret photocopy of a paper memo and sneak it out of HQ?

      Same old problem... same answers

  26. Government email by Eric+Damron · · Score: 4, Informative

    The email for my State government is covered under the freedom of information act.

    What this means is that anyone can walk into any State agency and under this act require that the agency provide copies of it's email.

    There is a charge to cover costs and a waiting period to allow the information to be gathered.

    This can cause real problems for agencies that delete email without a policy covering the removal of this information. Basically, if the agency deletes email without such a policy they can be required to "recover" their email. If they don't have the expertise to do so they can be required to contract out to a company who does have the ability. This could cost them tens of thousands of dollars.

    Better to have a policy and to stay within the guidelines!

    --
    The race isn't always to the swift... but that's the way to bet!
    1. Re:Government email by kspencer · · Score: 1

      Actually, no.

      First, the Freedom of Information act applies solely to US Federal government, not state government. Now, most if not all states have some sort of "open public records" law, but the specifics vary from state to state. That said, there are some commonalities that bring us to...

      Second, nobody can just walk into any State agency (or Federal for that matter) and demand to see copies of the email. In most cases what must be requested is material regarding a subject, which includes email. Some of that material is potentially going to be denied - a specific example is where (in the state of Georgia) the email is part of a discussion between two law enforcement agents regarding an ongoing investigation. Your state's laws will vary in what is denied and whether you are to be told it's been denied.

      Finally, most states already have policies (mandated by law) in place regarding document retention and destruction.

    2. Re:Government email by Eric+Damron · · Score: 1

      I work in a building full of lawyers and judges. After reading your post I asked one of the judges if the law applied only to the federal government. He told me that you are mistaken. This law definitely applies to state government as well. He also mentioned that in addition the Freedom of Information act, there are state laws.

      As far a just walking in to a State agency and requesting copies of email I may have been unclear although I did say that there was a charge and waiting period.

      Finally, I don't know about most states and mandated policies but in my state each agency is responsible for its own policies.

      --
      The race isn't always to the swift... but that's the way to bet!
  27. New product for business email by jamwyd · · Score: 1

    My company, BitDaemons Ltd, has just released the Technology Preview of a product which we believe solves many of the problems outlined in this article. It's based around ebXML and so eradicates spam and any non-business specific mail. We are developing the full product for release in Q3 2002. And its cross-platform, including Linux, aimed at the desktop. There are a huge amount of articles at the moment about problems with emails in business like this one - we think our product, Octimal, will solve them.

  28. Bad news by Technician · · Score: 2

    If you used to get things in snail mail in a plain brown wrapper, don't consider getting it via e-mail. It gets xeroxed and copies archived before it reaches your in-box. It's not a secret anymore for anyone who wants to know what you got last year. ;-)

    --
    The truth shall set you free!
  29. This morning on the radio... by PHAEDRU5 · · Score: 2

    As I was driving in to work, I heard a PSA from CPAs of America, or somesuch. Part of the announcement talked about deleting un-needed e-mail "to save on disk space."

    Now there's a ready-made excuse for Enron...

    --
    668: Neighbour of the Beast
  30. Forgot the URL! by jamwyd · · Score: 1

    Sorry, so interested in the article, I forgot to post the url for the product:http://www.bitdaemons.com

    1. Re:Forgot the URL! by Anonymous Coward · · Score: 0

      Fuck off, you whore.

  31. illegal by cascadingstylesheet · · Score: 1

    Have you ever, um, looked at legal statues? Just law, mind you, not "case law", i.e. every case ever litigated.

    I have, in support of a project I work on. Just one narrow area of law, in one U.S. state. I tried to limit it to just the statutes, but I also had to look at some regulations and "policy", i.e. how the agencies involved chose to interpret the law.

    It's insane. Maybe, with an army of lawyers, you could sorta comply with everything. Except the parts that are contradictory, impossible, or just too vague.

    I doubt if anyone avoids "illegal" activity even in their personal lives, and it is actually impossible for business or even government, any complex entity. The problem with email and other electronic retrieval is that the normal wiggle room of life shrinks and shrinks. Aha, they did something illegal! This is done to make Joe Blow think the accused has done something actually immoral, when it could just be some absurd technicality, or just the sheer weight of things to comply with.

    By the way, big business, the bugaboo of /., doesn't really mind this situation much. Makes it so hard for some upstart competitor to emerge and compete.

  32. It's not just about destroying evidence by RatFink100 · · Score: 5, Insightful

    I've read a few comments already implying this is all about companies covering their tracks after commiting fraud or other criminal acts. These comments rightly ask why should we be concerned about policies and technological solutions to aid this.

    However destroying evidence is only a small part of what this debate is about - it just makes for the flashiest headlines.

    The issue is about the way email is used - many people write emails with an informality similar to speech, forgetting that email often has a 'lifespan' equivalent to many physical documents. When you also consider that emails are being used as documentary evidence in legal cases this begins to be a cause for concern. Why? Because people don't always express themselves precisely and may give a misleading impression - especially if the email is taken in isolation.

    And it's not just the informality it's the 'working document' status of email. Let's say a particular business decision is the subject of scrutiny in a legal case, and let's say it was a decision reached after some discussion. If that discussion took place in a meeting then the documentary evidence would be the minutes - which would express the decision reached. If that discussion took place over email - would you be able to discern later that an email saying "We should do X" was expressing the final decision or merely a point of view in an on-going discussion? What if you had to prove than Y not X was the final decision?

    So the policies that need to be implemented are not necessarily about covering up wrong-doing, they are about making sure that documents (emails) which may be treated as written communcation, have the clarity and riguor that they need. If they are informal working documents then they may need to be either clearly marked or destroyed at an appropriate time.

    In my view the heart of any sensible policy should be education about how to write emails appropriately. The guideline I always use is "am I still happy to send this knowing that my customer/competitor/a.n.other could potentially see it one day?" If the answer is no then the email either needs re-writing or possibly a different form of communication is needed.

  33. Not so simple by Anonymous Coward · · Score: 2, Interesting
    There are a lot of comments here, mostly from people with no real world experience in large organizations, I suspect, saying, "well just don't do anything bad in e-mail and you're safe." How I wish it were that simple. The fact is that things get taken out of context, sometimes willfully by other people with a hostile agenda, or the rules determining what's good and bad change over time, and something that's perfectly innocent when you write it could turn into a major problem years down the road.

    Another aspect to this that seldom gets mentioned is the notion of one-sided archiving: Two people in negotiations have a dispute about how the e-mail-based conversations went, and only one can produce the prior e-mails (and often selectively at that, leaving out the ones that don't support his/her side of the argument).

    About the only solution is to be as careful as you can about what you put into e-mail (in all iffy situations make explicit references to all pertinent correspondence and other docs), and make sure you can retrieve everything from your past e-mail when needed.

  34. Two points on this by Boss,+Pointy+Haired · · Score: 2, Interesting

    Firstly, users ability to deal with an increasing volume of business email varies enormously.

    Some people are super efficient - their inbox is virtually always empty, anything they need to keep is moved more or less straight away to a permanent folder related to the subject, and anything they don't want to keep is deleted.

    If I look over my shoulder at some of my more senior (chronologically speaking) colleagues, their inboxes are a mess. They can't recall email on a particular topic, they don't process incoming email into sensible subjects, they just let it pile up. Then I hear them complaining that they get too much email.

    Secondly (and perhaps more ontopic) is the matter of physical document retention.

    Many companies simply retain everything, and the cost of storing these documents mounts up and mounts up. People have the attitude that "we might need it some day". Yes, you might.

    But you might not.

    Cost of storage of every document ad infinitum = $x.

    Cost of impact of not having a document at some arbitrary time in the future = $y.

    If $y is less than $x then why are you keeping every document by default?

    Or don't you know what x and y are?

    I think.

  35. Server kept emails by Anonymous Coward · · Score: 0
    An interesting side point we had happen with us. We run Novell Groupwise at work, and just implemented a 3 million dollar project. However, the project had a lot of issues, and upper management had been notified via email several times that the project may not make it out on time, resulting in the possible job loss of a lot of people.


    Magically about two weeks before the go live day, key emails started 'disappearing' from mailboxes. They seemed to only be emails relating to the deadline and what had been passed on to management. Then two critical computers came up missing.


    Being a government agency, everything is supposed to be recorded and kept public record. But it was fascinating to us to watch these just disappear. Luckily we had found a tool before hand that allowed us to connect to the Novell message store using Outlook (yech) and export all the emails of two key people as PST files, which were stored off site.


    So while I am all for the tracking of emails, etc, etc, I am NOT all for behavior like that.


    (Sorry for posting AC, but I still have my job there and would like to keep it that way)

  36. On public "radar" since 1987 by catfood · · Score: 3, Informative

    I'm a little surprised the article didn't mention the greatest email bust of all. In 1987, the questionable para-military funding activities of USMC"Lt.Col.OliverNorth were uncovered partly by an investigation of messages that he thought he'd deleted from the White House's internal email system.

    North hadn't counted on the "deleted" messages showing on backup tapes.

    Partly because of this smoking-gun evidence, North was convicted in 1989 of aiding in the obstruction of Congress, accepting illegal gratuities, and destroying documents.

    North's conviction was later overturned (with great irony considering his status as a law-and-order conservative icon) on a legal technicality.

    1. Re:On public "radar" since 1987 by Anonymous Coward · · Score: 0

      God, I wish I'd seen the look on that smarmy bastard's face when he found out that his tracks weren't covered as well as he had thought. Serves him right, that stinking traitor.

  37. crap by Anonymous Coward · · Score: 0

    bahh..it it would be better for large corporations to be ignorant of this. After all, large corporations are eeveel.

  38. Document Shredding by rf600r · · Score: 1

    Our company is considering a mandatory policy that states that no email is to be kept beyond 90 days. This policy is based on the very premise in the article: it can come back and bite you later.

    Can't say I agree with the policy entirely, but I'm just a worker bee.

  39. I like the Poll by Monsieur_F · · Score: 1

    On the specified page

    Tech News Poll
    Should websites stop running online polls
    because they are unscientific?
    [] Yes
    [] No
    [] Don't Care

    No CowBoyNeal option, but funny question !

    --
    McCartney fans pay bus tickets. [...] Lennon fans too, with discretion.
  40. overall validity of email evidence? by Anonymous Coward · · Score: 0

    all this discussion of the discoverability of email (and the article's seeming implication of email policy as ass-covering) misses a very important point i've always wondered about...

    how does one determine the actual age or origin point of a given file? what is to prevent an unscrupulous individual from forging (or quickly deleting) email that would be used as discovered evidence?

    why is it discoverable in the first place? this stuff is infinitely more forgable than paper documents.

    ---

    and to answer the author (and others') comments about why email is treated so casually: the level of effort required to create an email (or usenet or webforum post such as this :) is less than that required to send a snailmail or memo. less of an inertial-laziness barrier, so more impulses to write make it to execution. applying the rules of written correspondance to email is reasonable, i guess, but it muddles the fact that they are different forms of communication. i would posit that email has more in common with postcards than letters.

    (and by extension, an attachment is like a package. sizeable, expensive to deliver, and annoying if it's just a brick. :)

    ---
    mike, passwordless

  41. Outsourced Email/Better Internal Solutions by pinkUZI · · Score: 2

    This might be a factor: the other day I got a call from a gal with Lotus/IBM asking if I think a per user/per month external email would be marketable. This is the second time I've heard of a company starting to offer such a product, the first being Cisco. Since then I've come across a few companies marketing to the same tune.

    Along the same idea as Microsoft's software subscriptions, this could be the email model of the future. Now we throw in the factor that companies may not even be in control of where/how their documents are being destroyed? Assuming, of course, that it is possible to destroy all evidence of an email. (Due to the nature this could be quite difficult)

    I know that even with on-site, 100% controlled email it has proven difficult to find a good way to enforce a document retention policy. Users (and I'm no different) have tendency to want to horde their past emails, text index them, and search them from time to time, as you never know just what pieces of the past, from two weeks to two years, might prove useful. You can restrict the size of a user's mail-file size, but this only restricts how much the save and not how far back they can save. As of right now, mail servers don't seem to take into account an enforced document retention policy. Will a "Delete Documents Older Than:" field appear as an option on newer versions of Exchange or Domino?

    --
    You are receiving this message because your browser supports Slashdot Sigs and you have Slashdot Sigs enabled.
  42. Plead the 5th by pryan · · Score: 5, Interesting

    A corporation is a legal construct designed to give a business the same rights as a person, right? If so, in the face of a subpoena duces tecum, why can't a corporation plead the fifth amendment? I assume there's a clear legal answer, but IANAL.

    Amendment V

    No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a grand jury, except in cases arising in the land or naval forces, or in the militia, when in actual service in time of war or public danger; nor shall any person be subject for the same offense to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.

    1. Re:Plead the 5th by Anonymous Coward · · Score: 0

      I believe the difference here is that a person cannot be compelled to testify against themselves, but they can be forced to hand over material evidence.

    2. Re:Plead the 5th by pryan · · Score: 2

      What if the material was encrypted and the passphrase was known by the CIO of the corporation?

    3. Re:Plead the 5th by foobar104 · · Score: 2

      What if the material was encrypted and the passphrase was known by the CIO of the corporation?

      That's no different than saying the evidence in question is in a closet and only the CIO has the key.

      The court can legally compel you to hand over the key. If you don't do it, you go to jail for contempt, and they'll break the door down anyway.

      In the case of encryption, it's possible that officers of the court may be unable to break down the door. Fine. But then you're still in jail, which is what you were presumably trying to avoid with encryption in the first place.

    4. Re:Plead the 5th by jafiwam · · Score: 1

      YANAL IANAL but...

      The 5th amendment appears to only apply to criminal law, such as fraud and so on. Also, in that case well duh, you should know better not to plot crimes in email.

      The part where you can really get burned is in civil law, in which case 5th amendment will not give you a way not to provide all your email. Even if you were doing nothing wrong and innocently doing business, some person with an aggressive lawyer can cost you thousands of dollars of time and expense to comply with some bogus lawsuit.

      That is a pretty good reason to have aggressive removal policies and to know how not to keep the stuff around.

    5. Re:Plead the 5th by pryan · · Score: 2

      I was making a distinction between providing materials and bearing witness. Under the 5th, the court can't compell someone to bear witness against themselves if it may be incriminating. Since the key can only be obtained via testimony, short of breaking the encryption, the 5th should cover it under the 'bear no witness' clause.

    6. Re:Plead the 5th by foobar104 · · Score: 2

      Since the key can only be obtained via testimony, short of breaking the encryption, the 5th should cover it under the 'bear no witness' clause.

      Turning over an encryption key would not qualify as testimony, for several reasons. The most important one is the fact that, under those circumstances, you wouldn't be placed under oath.

      The fifth amendment's primary purpose is to give an individual an "out" when faced with the choice of confession versus perjury. When you're placed under oath and asked questions by the court, you can opt not to answer those questions on the grounds that you'll either be incriminating yourself, or lying under oath.

      Turning over your encryption key, on the other hand, doesn't involve being placed under oath. A summons will show up at your door, carried by your friendly neighborhood police officer, and you can either cough it up or go to jail. At the least, you'll be in contempt of court. At worst, you can be charged with obstruction of justice.

    7. Re:Plead the 5th by Anonymous Coward · · Score: 0

      Then just make your encryption key an incremenating statement. Then tell the friendly officer to talk to your lawyer, because by giving them the key you would be directly incremenating yourself.

    8. Re:Plead the 5th by ethereal · · Score: 1

      Well, if you're not under oath when asked for the key, can't you just lie and say that you forgot? Although I suppose that's still contempt of court if they don't believe you.

      If it's perjury versus confession, then it seems like you're in a "damned if you do, damned if you don't" situation, and the 5th amendment is providing you a way out of that position. If you are subpoenad for your encryption keys, you are likely also in a "damned if you do, damned if you don't" situation, except that here the choices are confession versus contempt of court. I don't see that much difference between the two situations in terms of the immediate consequences for the subpoenaee. One is under oath, and the other isn't, but both are a situation where you can either incriminate yourself, or else go to prison if the courts think that you are not sufficiently helpful in the self-incrimination process. It seems to me that the discovery process should be limited to physical evidence - anything that I must be forced to say feels like self-incrimination.

      In reality I suppose it comes down to whether the penalty for the crime is worse than the contempt of court sentence.

      --

      Your right to not believe: Americans United for Separation of Church and

    9. Re:Plead the 5th by foobar104 · · Score: 2

      Then just make your encryption key an incremenating statement. Then tell the friendly officer to talk to your lawyer, because by giving them the key you would be directly incremenating yourself.

      You don't get it. Protection from increminating statements only applies during testimony. It doesn't protect you from having to comply to a subpoena.

      An encryption key is a piece of material evidence, insofar as it relates to the unlocking of other pieces of material evidence. Providing it is not testimony, and it's not covered by the fifth amendment.

    10. Re:Plead the 5th by HiThere · · Score: 2

      The 5th amendment appears to only apply to criminal law, such as fraud and so on. ...The part where you can really get burned is in civil law, in whi

      This is clearly wrong. If corporations are to be treated as people, then they should also be subject to the penalties of criminal law.

      Mind you, I'm not saying that you aren't speaking accurately, merely that what you are reporting is a moral, ethical, and legal wrong.

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    11. Re:Plead the 5th by foobar104 · · Score: 2

      It seems to me that the discovery process should be limited to physical evidence - anything that I must be forced to say feels like self-incrimination.

      That's just the thing. The fact that a password exists only in your head doesn't suddenly make revealing it a statement. It's not testimony. It's evidence. There's a really important distinction between the two.

      The thing is this: if I (the State or Feds or whatever) subpoena your laptop as part of a civil investigation, then you are legally obligated to turn it over. If you fail to do so, you are in contempt of court for failure to turn over the laptop. This is true even if the laptop, or the files contained therein, is ultimately incriminating to you.

      If you turned over just the laptop's keyboard, you would not be in compliance with the subpoena. You'd be in contempt.

      If you turned over the laptop, but not the hard drive, you'd be in contempt.

      If you turned over the laptop, and the hard drive, but not the password to acces it, you'd be in contempt.

      See? A password is not testimony. It's part of the laptop, from a legal point of view. So you can't be protected from turning it over by the fifth amendment.

    12. Re:Plead the 5th by ethereal · · Score: 1

      If protection from incriminating statements only applies during testimony under oath, then what is stopping the police from beating a confession out of you during the discovery phase of the trial, and then using that confession in court?

      --

      Your right to not believe: Americans United for Separation of Church and

    13. Re:Plead the 5th by foobar104 · · Score: 2

      If protection from incriminating statements only applies during testimony under oath, then what is stopping the police from beating a confession out of you during the discovery phase of the trial, and then using that confession in court?

      Miranda v. Arizona, 1966. Miranda married the concepts of protection from self incrimination (5th amendment) and the right to counsel (6th amendment).

      But Miranda also has a scope. The Miranda doctrine only applies if the subject is in custody and under interrogation.

      The objective test for "custody" is whether, under those circumstances, a reasonable person would believe, based on an officer's actions or statements, that he or she is not free to leave.

      Being under "interrogation" requires that the subject be asked questions that imply involvement with a crime. "What did you see?" isn't an interrogative question. "Where were you on the night of January 21st?" is.

      So to protect you from being compelled to answer a question under oath that incriminates you, you have the protection of the 5th amendment. To protect you from being treated similarly in a custodial or arrest situation, outside the context of a legal proceeding, you have Miranda.

    14. Re:Plead the 5th by ethereal · · Score: 1

      According to my reading of Miranda, it only guarantees that you will be informed of your rights, etc., in the interests of securing your 5th Amendment right against self-incrimination. For example, this synopsis seems to hit the important points.

      There wouldn't be a need to preserve the 5th Amendment rights during situation where you are not on the witness stand, unless the 5th Amendment also applies to statements that you make while not under oath. So it appears that the courts think that the 5th Amendment does not just apply to testimony under oath, but in fact applies to many situations in which your statements may later be used against you. Which was the loophole in your original statement that I was trying to point out.

      It's good that you brought up Miranda, actually, because the language of it seems to be pretty clear in terms of what you can and cannot be compelled to say:

      • The privilege against self-incrimination, which has had a long and expansive historical development, is the essential mainstay of our adversary system, and guarantees to the individual the "right to remain silent unless he chooses to speak in the unfettered exercise of his own will," during a period of custodial interrogation [p*437] as well as in the courts or during the course of other official investigations.
      • In the absence of other effective measures, the following procedures to safeguard the Fifth Amendment privilege must be observed: the person in custody must, prior to interrogation, be clearly informed that he has the right to remain silent, and that anything he says will be used against him in court; ...

      So imagine that the police violate your Miranda rights, and you tell them where you hid the bodies before you get to talk to a lawyer. The judge will throw out that evidence in court, since the evidence was procured through a violation of the user's rights (unless the prosecution can demonstrate that they would have inevitably discovered the evidence anyway (you can see that I watch a lot of Law & Order :)). Evidence attained through a result of the violation of the suspect's rights is "tainted", and cannot be used against you in court.

      So, working back closer to the original tack of this thread, it appears that the 5th Amendment applies to many things that you say, whether under oath or not. Evidence retrieved as a violation of your 5th Amendment/Miranda rights can't be used against you to incriminate you. If the only way to get the password from you is for you to say it, and the 5th Amendment applies to anything that you are compelled to say, then I don't see how this doesn't fall under the 5th Amendment protections. Just because it unlocks other existing evidence isn't sufficient - telling the officers where you hid the bodies also unlocks other existing evidence, but we have protections against that. Heck, even if you could somehow say where you hid the bodies without admitting to the murders, compelling such a statement would still violate the 5th Amendment.

      --

      Your right to not believe: Americans United for Separation of Church and

    15. Re:Plead the 5th by pryan · · Score: 2

      Okay, I'll go along with that. This seems very unfortunate. Some people who use encryption use it to help protect their data from the government accessing it. There's a common phrase that goes something like "you can pry my keys from my cold, dead, hands."

      Are there any cases where people have gone to jail for not revealing their passphrase or turning over a private or symmetric key? I am a huge fan of cryptography, but if keys kept in my head can be attacked by putting me in jail, then I'm not so sure it's the best solution.

  43. Use MS Exchange Server by krusaderx · · Score: 1

    Hell, I can't keep the e-mail! I'm trying to retain documents! Repair teh database - there went attachements since June! Use the IS/DS Consistency aAdjuster - whoops - restore a backup - Oh, that one
    s no good, go find one that works. ""Sorry everyone, the e-mail server's been rolled-back to last Wed night at 6:00 PM. Sorry for the trouble.""

    I can't believe MS got in trouble for having e-mail retained too long, they must be using AS/400's or *nix + Domino for e-mail.

    -Krus

  44. SEC Rules and Reality by Anonymous Coward · · Score: 0

    The SEC (Securities and Exchange folks) have big rules on what sorts of things you have to retain, and for how long. All email and electronic documents are covered, including transcripts of electronic chat programs (which is why you have to use an approved chat program that allows chat logging).

    The whole key to this is to not allow POP or IMAP mail access, and that makes it much easier to apply retention rules.

  45. Not a solution by Czarnian · · Score: 1

    Aha. So if your client is being investigated and they tell you not to allow the "transaction" [transfer] to continue, you won't. In which case they'll face criminal charges for willful obstruction. Not much help to them and not really a valid option to the legal automatic deletion of emails.

    1. Re:Not a solution by Czarnian · · Score: 1

      ...to the legal automatic deletion of emails... after a set time period.

    2. Re:Not a solution by rdl · · Score: 2

      There are procedures which have withstood legal challenges for offshore trusts and their records which we follow with the systems administration of the mail servers.

      The overarching principle is that the party having received the subpoena is not capable of taking the action, and does not contribute to the action being prevented.

  46. how can you prove it. by azagthoth · · Score: 2, Informative

    The biggest question I have about this is how can they prove that the person whose name is on the From: actually sent the e-mail?

    We all know just how insecure e-mail really is and how easy it is to forge an e-mail, so how can these e-mails stand up as evidence. I can see some justification in if the headers show the e-mail coming from that person's workstation's IP connecting to ${CORPORATE_MAIL_SERVER}, but even this is not 100% proof that it came from ${PERSON}.

  47. Re:No, remember "Very Hot Deal" by Anonymous Coward · · Score: 0

    All of a sudden, I feel the urge to become an investigator with expertise in email analysis.

  48. The next version of Exchange Server by alen · · Score: 2

    I can see a feature in the next version of Exchange where the admin can select an email and have it deleted from all mailboxes that it resides in. With Single Instance Storage it's not that big of a deal. The problem comes when people archive email to personal folders. I can see "solutions" from Veritas and some other companies for smart email archival software.

    1. Re:The next version of Exchange Server by Anonymous Coward · · Score: 0

      There already are, actually...http://www.otg.com/solutions/messaging/ .

  49. So much for KM by michaelmalak · · Score: 2

    All this destruction of e-mail for liability reasons thwarts mining e-mail for the purposes of knowledge management, such as can be done by products like Lotus Knowledge Discovery System. With today's high turnover rates, KM is needed to maintain long-term productivity, but evidently legal issues are dwarfing anything like actually earning money by being productive. (Hmm, has a ring of revenue generation by old large companies through patent portfolios rather than innovation, doesn't it?)

  50. Off shore ? by Martin+S. · · Score: 3, Interesting

    This post is completely miss-leading, even assuming 'HavenCo' have a legit claim to be off-shore.

    Placing/using an email Server 'off-shore' offers not more protection than refusing to hand over the messages in the first place, you will be in contempt of court and go to jail until you agree to turn them over. FACT!

    Causing the destruction of evidence is a crime, in most countries, even if it is carried out by an agent. So in most cases, all 'HavenCo' will achieve is to further incriminate.

    BTW: How does a mindless commercial plug warrent +5 Interesting ?

    1. Re:Off shore ? by tgibbs · · Score: 1

      I think this is an extremely interesting legal issue. Destruction of evidence is a crime. But routine destruction of documents that might or might not be considered evidence at some time in the future is not. So if you can destroy them, why can't you transfer them to an offshore depository with highly restrictive rules about when/whether they can be retrieved?

    2. Re:Off shore ? by bungo · · Score: 2

      Ok, refusing to hand over the messages can be contempt of court....

      .. BUT, this assumes that the mail is known to exist.

      What if I deleted everything which I didn't want seen, then supplied the rest.

      How would you know if I handed over everything or not?

      If you can't see any advantages, you're not thinking evil enough - you'd never make a CEO of Enron!

      --
      "The best part? I became an ordained minister while not wearing pants." -- CleverNickName
  51. CYA by Ratbert42 · · Score: 1, Flamebait
    I had a boss that would never e-mail me about anything important. Anything that could come back to bite him in the ass was done in person or over the phone, never in writing. Learned a lot from that jackass.

    I also have always kept replicated copies of all my work e-mail. Want to see my boss from 4 years ago telling me to forge timesheets to bill more hours to a certain customer? It's in there. Want to see a pornographic joke from half my coworkers? I've got them.

    Cover your own ass. I assure you that your bosses are covering theirs.

    1. Re:CYA by alen · · Score: 2

      I learned to do that too while in the government. I never delete an email except for notifications from anti virus software. Every so often I archive to .pst and burn it to CD and take it home.

  52. HavenCo will destroy Sealand by micromoog · · Score: 2
    Let me get this straight:

    I am the CEO of a UK-based company. I send documents to you, with the instructions "Give me access to these documents on demand, unless you think I'm being subpoenaed". Then, when the subpoena comes, I'm supposed to tell the court "I can't give you those documents; I'm paying HavenCo not to give them to me"?!

    I effectively made a contract with you designed to obstruct justice. They'll just lock me up for contempt until you hand them over. In that case, are you still planning to keep them locked up forever while your customer rots in jail?

    You must have gotten Prince Roy pretty wasted before he signed the contract to allow you to do business in Sealand. He must be regretting jumping on the Internet bandwagon about now. This behaviour will eventually prompt Britain or the EU to take action and dissolve Sealand, and you won't care because it's not your little-recognized sovereign nation you destroyed with your shady business practices.

  53. Disappearing eMail is EZ by didando · · Score: 1

    As I recall the Clintons had huge amounts of eMail disappear. The Justice Department under Janet Reno, would not agree with this article. The stuff just plain disappeared.

  54. I'd like to fuck some voters... by Anonymous Coward · · Score: 0

    As long as they are blond with big boobs.

  55. Ask the RIAA by Anonymous Coward · · Score: 0

    Weren't they pushing for self destructing single-use CDs?

  56. Attitude is the problem, not evidence by redelm · · Score: 2
    Why are people worried about email retention? Do they say things that aren't true at the time? Why should people be allowed/encouraged to distroy evidence?

    "Things will be misconstrued" is a cop-out. How do you misconstrue a direct warning that the recipient is too pre-occupied to do anything about? If there is an explanation, give it. I don't think juries are that stupid. If they are, then we're in alot more trouble and need to work more at educating them, or at least not putting them to sleep in court.

    Sure, anything can be taken the wrong way. But the solution isn't to give nothing, but rather to assist people in seeing the right way. Unless there isn't one! In which case, you're guilty, and I don't see why anyone should help you hide your guilt.

    1. Re:Attitude is the problem, not evidence by tweek · · Score: 2

      Easy.

      Redhat (or insert your favorite company here) sales person sends an email to all sales people as follows:

      "Do whatever it takes to bring in those customers."

      5 years later, unhappy former employee or disgruntled competitor sues the company. All email is subpoened. FavCompany hasn't done anything wrong but the email from sales manager to sales staff is used as "proof/smoking gun" that the company was engaging in anti-competitive business practices.

      People can and WILL interpret something in thier favor. I can tell another coworker that I think a particular employee is very fetching in that new dress and the next thing you know, I can be sued for sexual harrasment by someone who overheard the conversation. This isn't from personal experience mind you but it makes the point clear.

      You shouldn't need encryption, right? You don't have anything to hide!

      These companies don't need to delete email, right? They don't have anything to hide!

      --
      "Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
    2. Re:Attitude is the problem, not evidence by redelm · · Score: 2
      I thought about this before posting. The problem is not with what was said, but how it's interpreted. Of course some people will read it in their favor. That's called bias, and they're excluded from Juries.

      In your example, this smoking gun doesn't prove a thing _unless_ there was some anti-competitive activity that resulted. If FavCo had a corporate values statement saything they would obey all laws and act ethically [any company large enough to sue would], then that would be a strong defense. But it would ultimately boil down to what people say that the alleged smoking gun meant to them.

      If you don't presuppose some level of reasonableness in juries, then you're living under an oppression much more serious than the government can even impose. The prior-restraint and self-censorship is intolerable. Don't live in fear. Sometimes not even if the fears are real!

  57. Re:Anal Retention and Email by Anonymous Coward · · Score: 0

    Wow, it only took 4 minutes for the "Anal Retention" post...

  58. Re:Slow decay is not mag tape by DrSpin · · Score: 1
    Personally, I have little difficulty reading my 1/2" tapes from 1974. They are mostly card images, or tar format.

    The real problem is my 1/4" tapes written with proprietry OS/2 backup software.

    Moral: Open sauce is better than tomato sauce - except on burgers

  59. Email is public speech by eer · · Score: 2, Interesting

    Back in the days when I first began using email on UNIX, I realized that

    1) far too many people had root access to the email servers;
    2) far too many people could put sniffers/tcpdump on the ethernet; and
    3) far too much mail transited through university campuses (Rutgers Univ comes to mind)

    We came to realize, and to advise our management, that email was public speech.

    Anything you said was subject to being overheard and repeated. That applies to recipients who forward mail, too.

    The same eventually was realized about voice mail.

    Encryption (usually) doesn't control recipients storing and forwarding your messages.

  60. Exchange 2K by DeMorganLaw · · Score: 1

    I have been running an Exchange 2K server in a small enterprise enviorment for about 4 months now. We origionally migrated from Lotus Notes, and I am currently much happier with Exchange 2K than Lotus Domino. The server has been running for that entire time without requiring a single reboot.

    We perform backups of the entire server on a 20gb Travan drive daily. Every monday I run exmerge and extract every mailbox into its own PST file. I can then usually compress the PSTs down from 900mb to less than 400mb, at which point I burn it to CD and file it on a shelf.

    1. Re:Exchange 2K by afidel · · Score: 2

      Don't use Traven for god's sake, have you ever done a real test to see how much you can recover? In one test on an older traven we were only able to recover about 25% of the tapes! There is a reason Traven is cheap, it's built cheap. For the sake of your users get DLT, LTO or some other real tape solution.

      --
      There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
  61. Been there.. by Anonymous Coward · · Score: 0

    Sorry for the Anonymous..

    Saving email is a double edged sword. It could save your can one day and get you fired the next.

    I work in a large DC law firm. We are occasionally tasked to scan a clients supplied HD, zip disks, and other various media to pull and collect email files to be sent off and printed to be presented in court. I've seen some jobs produce over 100 full CASES of printed output from just one person. I have no idea who or how someone has the ability to go through all that crap. It seems to me that submitting the information electronically (like a .pst file in the case of Outlook) would be a better choice.

  62. slightly different environment... by Archfeld · · Score: 2

    at my work, a major corporation, it is nearly impossible to KEEP a bloody email for more than 90 days. We use exchange (yes I know) and the system will purge anything in a .pst folder format older than 90 days. It patrols your offline archives, it will even find a .pst or archive folder that has its' filetype changed. The only successful way I have found it to back it up on physical media and restore to an offline computer. If you put it back on a connected computer the damn thing will find it and purge it overnight. Only certain users with legal requirements are able to exceed this bloody purge.

    --
    errr....umm...*whooosh* *whoosh* Is this thing on ?
    1. Re:slightly different environment... by blibbleblobble · · Score: 1

      So use a text file. Or am I misunderstanding something? Most email clients allow you to cut and paste text.

      Text files are best anyway for archiving emails: they can be arbtary size, they can be searched, and they can be read using whichever os you decide to boot that day.

      And of course, text files can be encrypted, or put onto an encrypted disk. I suppose that email folders could too, but it's not so convenient

    2. Re:slightly different environment... by Archfeld · · Score: 2

      that is a decent work-around but then you lose your index and pointers. I remember when email WAS just text...things were simpler then :)

      --
      errr....umm...*whooosh* *whoosh* Is this thing on ?
  63. Just have your law firm host your email by egarland · · Score: 1
    I remember back when the cigarette manufacturers were in big trouble for knowingly engineering their product to be addictive the research couldn't be subpoenaed because they had their law firms do the research and therefor the results were protected by lawyer client privilege. Could the same thing be applied to email?

    If your law firm received all your email communication and you had to call your lawyer on the phone and ask to have your email read to you would it be protected by lawyer client privilege?

    If you have your law firm host your email could the imap connection be considered communication between you and your law firm and therefor protected?

    It seems to me if lawyer client privilege is broad enough to cover chemical and biological research it could also be used for something like email.

    --
    set softtabstop=4 shiftwidth=4 expandtab nocp worlddomination
  64. backups? what backups? by pbegley · · Score: 1

    As someone who has done more than my share of e-mail server disaster recovery work, I actually *admire* anyone who can extract specific messages from random backup tapes.

    Most of the calls I got involved blood on the floor, unmarked backup tapes (in several different formats) and hours (and hours and hours) of inventory, catalog, restore to get a server back in production.

    Also, very few companies are keeping more than two weeks of e-mail backups. Have you done the math recently? My old dot-bomb employer (may the accountant have nettles in his testicles), had 100 Gig of messages for 800-900 staff on 5-6 servers scattered around the US. Our original legal guy wanted us to keep mail for six years. After I did the math, the cost ($$ and manpower) was prohibitive (plus we started imploding at that point - anyone interested in a seven year lease of prime Boston real estate?).

    Another issue is how do you prove a message is real or forged? Digital sigs? Hard copy? It would require 'expert witness' testimony to verify the authenticity and lineage (source, route, etc) of the message.

  65. What is so funny. by Anonymous Coward · · Score: 0

    Doesn't seem laughable to me, nor is the offer of assistance from one person or any small group or country.

    SeaLand is trying to act legitmately, and their intent is honorable (if clouded with the obscure hope that the US and other nations will recognize them officially by taking up their extended offer).

    1. Re:What is so funny. by Gaijin42 · · Score: 2

      Sealand is already recognized officially, as well as that little island off the US that was bought by some other right guy.

      The one off the US coast even has a mutual protection pact with the US.

  66. Re:Slow decay is not mag tape by gweihir · · Score: 2

    Personally, I have little difficulty reading my 1/2" tapes from 1974. They are mostly card images, or tar format.

    Very high quality tape? I have to admit I don't have personal experience with old tapes, but I heard in several places that the oxide layer is flaking off on some of them and the read signal gets very weak with time.
    The copy-trough-effect also degrades ordinary tapes when they are unwound and rewound (as in "playing" them). I also have several 5-8 year old 3.5" floppies that have become unreadable because of weak read signal.

    Anyway, I will accept that my time-frame is wrong if you say your old tapes are still good.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted and ignored otherwise.
  67. OT: I love the online poll at the bottom by stand · · Score: 1

    This has nothing to do with the article, but the online poll at the bottom of the article is hilarious:

    Should websites stop running online polls because they are unscientific? Options: Yes, No, Don't Care

    --
    Four fifths of all our troubles in this life would disappear if we would just sit down and keep still. -C. Coolidge
  68. It may be an interesting article... by Charlie+Bill · · Score: 1

    > An interesting column by Jim Carroll

    But its no "People Who Died".

  69. C programmers have known the risk for years... by Anonymous Coward · · Score: 0

    ...hence:

    #include

  70. there is also value in email by dwsauder · · Score: 1

    In my small company, our need is not destroying email, but archiving it. Much of our email is with customers, and there's much value in preserving it as part of our corporate memory. For example, the sales team needs corporate memory because the saleperson dealing with a customer this year may not be the same salesperson dealing with the same customer next year. The previous email correspondence with that customer is very useful to a new salesperson. I'm sure there are other examples of the need for preserving email. How about engineering discussions about the design of a product that eventually changes the world. I'm sure that kind of information is gold to historians.

  71. Re:CUNT FUCK PISS SHIT CUM QUIM PUSSY FUCKER ASSHO by The_Fire_Horse · · Score: 0

    *he* is racist ??

    HA - that's funny! At least he doesnt go around blowing up innocent people in the name of some loser like the titiban (or is that taliho, or tali - something)

    It's one thing to troll on a website - its completely different when you losers bomb innocent people - THAT is the difference.

    Losers

  72. Re:CUNT FUCK PISS SHIT CUM QUIM PUSSY FUCKER ASSHO by Tyreth · · Score: 1
    How can you be so stupid?

    Just because there are more racist people in the world than this guy you presume that he is not racist? That's not logical.

    >HA - that's funny! At least he doesnt go around
    >blowing up innocent people in the name of some
    >loser like the titiban (or is that taliho, or
    >tali - something)

    Are you talking about the Taliban? They don't murder innocent people in the name of the Taliban you twonk. They claim to do it for Allah, which is the arabic translation of the Hebrew word Eli - Elohim, which is who we westerners call God.

    >It's one thing to troll on a website - its
    >completely different when you losers bomb
    >innocent people - THAT is the difference.

    That's like a thief saying "I don't have to stop stealing $50 from the local newsagent when there are people stealing millions of dollars from corporations". That's just stupid. They both have to stop. Don't remove his responsibility because of another's actions. He should take responsibility for his own actions.

    While he may not bomb innocent people America certainly has had it's fair share of racist killings, and that's the same feelings, the same hatred (in fact it is much less rational than the Taliban/Al-Qaeda's hatred of America).

    And don't talk about them as if I am one. Do you have a talent for ignorance that you choose to put people into categories so you don't have to understand them? I don't bomb Americans, nor do I bomb Afghanistan people, nor do I prohibit people from necessary food/medical supplies resulting in needless death.

    The world's not as simple as you think. Attitudes shape the world, even if you don't act on them.

  73. IM by sckeener · · Score: 1

    I wonder if instant messaging is helping reduce the silly email messages sent around the office that could come back to bite someone.

    Unless you remember to save the conversation, you'd have nothing and I doubt a saved copy without any timestamps is going to hold up in court.....I think I can make up a conversation as good as anyone else....

    --
    "Only one thing, is impossible for god: to find any sense in any copyright law on the planet." Mark Twain
  74. Segway? by Anonymous Coward · · Score: 0

    Dean Kamen's island?