Slashdot Mirror
Deleting E-mail Could Get You In Trouble
Sterling D. Allan writes "A story in the Deseret News cautions governments and corporations from deleting legitimate email. Expensive measures are being called into place to archive the mail for future subpoena purposes. Think Enron on one hand. Think Monicagate on the other. Next they'll ask us to keep recordings of all our phone conversations? Big brother gets bigger -- with good reasons, as always. What about all those business propositions I get from Nigeria. Do I have to keep those too? "Get rich from home" (to pay for the purchase of a new hard drive to contain all your spam). One man's junk is another man's treasure. You never know what an IRS agent might find lucky."
I have no real problem with companies being subject to tighter restrictions. However, these restrictions shouldn't be too sweeping. If I send an e-mail to my friend using my Work's e-mail address the government should not be allowed to view that e-mail without a warrant.
Moreover, there should be a legal definition of what to keep and what can be tossed. I could imagine something like:
"a message that amounts to an instruction to an employee or specifying of company policy.." etc.
I don't want to store twenty thousand pieces of spam that every user might collect over two years. That makes e-mail quite an expensive tool if you have to do that.
There is one question I do have. Did the government have the power to collect so much information in the past? How many years worth of company paper memo's were stored? I suspect the ability was much reduced so in which case so why do they need so much more data?
Simon.
Seeing as their policy is "Archive, not delete", sounds like the perfect thing for Gmail.
Companies keep official correspondance.
One man's junk is another man's treasure. You never know what an IRS agent might find lucky.
Wait, what? Are you saying that IRS agents have small penises, and want to get rich from home, and want to gain a full cup size, and save Nigerian people from occupation?
Seems they consider e-mail to be somewhat akin to the paper way... everything must be documented in x y and z ways. My father's a lawyer, so I have some understanding of what it's like to document _every single thing_ that comes across your desk that's relevant...
I guess the idea is that if ever it came down to a court case, the e-mail records could be easily retrieved and used in the case. And destroying the records would be a crime, I suppose, which would also have it fall in line with what would happen if you were to destroy the paper records.
Join the Empire! http://www.empirereborn.net/
first of all this isn't a law or something, its an article discussing it. or does the poster suggest that the government being allowed to subpeona email is a violation of our civil rights?
You aren't required to keep all the dead tree spam for pizzas, kebabs, credit cards, personal loans, Readers Digest and so on, only that which relates to your business. So it should be pretty easy to make the rules the same for email.
no no. not liberals, idiots.
I use Dick Head, or Napoleon for all my correspondance. Even if they could get me in trouble, it would be so worth it.
Step forward to the stand, Dick Head.
HEY! Thats Napoleon, asshat!
The real path to male liberation
Well, when I reach my 500mb quota, I have to delete my mails. I have however, created my own mail database in Notes on my network user drive, and moved +1 year old mails to that database.
Salt Lake County is looking at a system whereby employees would decide whether the e-mail is a "non-record" (spam or personal; delete whenever you want);
So, no, we don't have to keep spam.
I'm scared of numbers that can't be written as a fraction. It's an irrational fear.
Next they'll ask us to keep recordings of all our phone conversations?
Actually trading corporations (like Bear Sterns or Bloomburg) are required to record all conversations relating to market orders. That means that some phone lines are always being recorded at all times. This is required by the SEC. You'd be suprised what restrictions are already in place to prevent things like insider trading from happening.
I submitted this story last night, and it didn't get posted.
I will forward all my work and home spam to the IRS for safekeeping.
Some companies have "document retention" policies that require employees to delete email after a certain period of time. It's not to free up space on the servers, it's to make sure the stuff can't be subpoenaed. Many respected companies have policies like this. Many even have tools that make the email deletion automatic, and require management approval to disable the tool.
So maybe this story is really just focused on banning policies like this.
Hear recorded Slashdot headlines on your phone! New service beta testing. Just call (248) 434-5508
With so many people using so many spam filters, I'd bet that a fair amount of "legitimate " email is automatically deleted by service providers and automated email filters. How can one prove to a judge that SpamCop had a given domain on its blacklist on a given date or that the sent email did not accidentally contain some filter-triggering word on that date? It seems that either spam filters create a legal risk or that the legal system has a naive view of the legal standing of email.
I reality, email is no better than a slip of paper tossed an the front yard of the recipient. It has a greater chance of being thrown in the trash than read.
Two wrongs don't make a right, but three lefts do.
This might actually be a pretty good business idea for google... offer corporate (secure) e-mail---for a fee of course---possibly 10gig e-mail boxes; with SSL, and corporate administration (and logging) of e-mail accounts (all accessible via the net through google).
Sorta like Internet based Outlook outservice.
While "Deleting E-mail Could Get You In Trouble," not deleting it. will make you blind.
To avoid fishing expeditions:
Use no e-mail
100% effective spam-blocking, too.
Speak for yourself. Who do you think works for the government and corporations? Kids?
I asked about how long to save emails and any other type of documents. He said to have a policy and follow it. In other words, if your company's policy is to delete your emails after two years, then there's nothing to worry about. On the other hand, if you're getting sued, having a gov't agency investigate, or think one of those things are about to happen, and you still delete the docs (even with the policy), you will have a problem.
BTW, I asked this a year ago, so I don't think that much has changed in the last year.
Companies archiving company e-mail is okay in my opinion. But if the government wants to look through it, they better have a legit reason, such as if they have probable cause a crime has been committed.
I remember the good ol' days of the internet when it was a playtoy for scientists and computer people. Nobody knew what email was. Nobody knew what IRC was. I could send all the email I wanted and not get spam. I could even have my email address on my website!!!! I could trade files on IRC and nobody cared... it was normal.
/me thinks it's time to check out Freenet running over Internet 2 :)
Now we have the government telling me what I can and can't delete. Wonderful.
My other car is first.
The summary here seems to be implying that this has something to do with the government trying to get peopel to keep their PERSONAL emails. Read the article. That isn't the case.
This is simply talking about measures to force companys (and only them) to retain their internal emails. This way its hopefully harder for the CEO to say 'what funds? i don't know any embezzeled funds' after emailing his coherts about their plans.
Slashdot of all places should appreciate the fact that without a paper trail, corporate accountability is a pipe dream. This article is simply talking about trying to ensure that the paper trail exists.
This is hardly a surprise; the rules have applied to paper documents since forever.
If you've ever worked for company with a clue you surely encountered their "records retention policy", which is actually a "records destruction policy", since the general rule is that you are expected to delete everything as soon as the law allows you to. At places I've worked the managers made no bones about the fact that it was to keep damaging documents from coming out during lawsuits.
Sheesh, evil *and* a jerk. -- Jade
Wall Street has been recording all phone calls to trading desks for years.
With data storage costs falling, and idiots being stampeded into surrendering privacy because of "terror", it's a no-brainer that this practice will spread.
Look for clever "hacks" to undermine this to crop up in the years ahead.
Do they mandate that you use an email system that keeps track of deletions? If not, there seems to be a bit of a hole there...
My ISP filters out spam, as well as the Mail application in OS X, which automatically deletes junk mail after a specified amount of time. I never actually see the stuff. I suppose corporate email systems can do the same thing. Only real emails would normally appear in inboxes in this case, so those would be the ones that this article warns about deleting. However, if anyone wants to go through your emails and you don't want them to, flooding them with all the spam you get would be a way to hinder their efforts.
This reminds me of this recent poll. Was this some sort of trick to get Slashdotters to admit they were doing something wrong? Did /. record the IPs of everyone who said they didn't save all their e-mails and delay this story until after that poll was off the main page?
Centralization breaks the internet.
I'm a little concerned about our company policy. I work for a newspaper and our policy is that all reporters should delete their notes after a story has run. This policy was created specifically so that reporters notes cannot be subpoenaed.
At my work, we're using Microsoft Exchange standard edition (I think), which only limits your total mailbox to 16gigabytes. If you ever hit that 16gig limit you have to have everyone delete a ton of mail, then take exchange offline for a couple hours while you defrag the mail file.
We have about 150 users, so we hit that limit about twice a year which causes huge problems.
At my work, nobody can archive mail, unless they use a personal folder file (which stores the mail on their HD - meaning it doesn't get backed up).
I guess this law could become a problem for my co-workers -- oh well, screw em.
I think it's called echelon...
I am supposed to archive all the spam, viruses and other junk that gets through my filters into the company email?
If anything, this is a good reason to have a policy of ALWAYS deleting email after a short amount of time.
Not to mention, I want to see, what kind of standards are applied by the courts to verify the validity of email -- most of it is not cryptographically signed, and mail storage is almost never handled in a tamper-proof way even if it is somehow possible to verify the origin of the message.
Contrary to the popular belief, there indeed is no God.
...and nobody used it to conduct business, especially financial matters.
Now we have the government telling me what I can and can't delete.
The government has always told certain categories of businesses that certain things must be saved. My friend who is a private, fee-based financial planner/advisor, has to keep all emails and a call log (don't remember with notes or not) when it concerns a client.
Please help metamoderate.
I think that this is fine for company e-mail, but it shouldn't be an option for personal e-mail.
If you are at work, you shouldn't use your work e-mail address for sending or receiving personal e-mails. Quite hard to enforce though. Instant Messaging has taken a reasonable amount of the small e-mail market though, and it does have a lot less spam issues to contend with as well.
Important e-mails like "sell those shares in XYZZY tomorrow, I've heard that they're doing badly, on the grapevine, like" should not be deletable though, so that illegal insider trading type scenarios cannot occur. OTOH why not a phone call with the same information?
Basically, you have to consider that anything that goes through a computer system can and will be recorded for a long time.
I knew someone would point this out.. what I meant to say was "who let the REGULATORS in".
My other car is first.
like real MAIL(equivalent), then it's a no brainer that the same restrictions/rules apply...
of course, there's these people that seem to think that just because something is 'electronic' none of the earlier made laws or rules apply..
some institutions just have to keep records of what they communicated with others or what was submitted to them, it being a formal phone call inquiry, a fax(which is not that far from email anyways), email or an email printed on a piece of paper and mailed through ups courier having little to do with it being an official paper needing to be logged.
you don't like bureaucracy with certain rules at all? make your own nation that can act without it and be effective at anything.. then you can really have 419's fraud-stories that are actually real.
world was created 5 seconds before this post as it is.
I'm not really opposed to this, and it does seem to be in direct opposition to a lot of "company e-mail policies" as it's written too.
I dont think that companies should get a pass on these types of written correspondences. These days, it's just too easy to hatch a "dominate the globe" policy at the corp. level and then eliminate the evidence through a "document destruction policy" like those at Arthur Anderson/Enron/MS/etc.... I've seen a clear policy of "destroy everything" with regard to e-mail and written transactions at almost every company I've been at. Seems more like the policy is geared towards eliminating any incriminating evidence rather than simply keeping space on the server to a manageable level. That's too bad, because I've seen some smoking guns that SHOULD be loosed on the world.
On the other hand, these types of policies are instituted because it's just too easy for lawyers to get ahold of those records for the purposes of "fishing expeditions," think SCO and their associated scum. Lawyers can just come in with the vague outline of some scheme and get all of a company's e-mails to help create a real case where none existed before. The cost of handing off an entire archive isn't trivial, and discovery is just too easy to do.
Whatever the outcome, it just seems like you and I (read the little guys) will have ALL of their e-mails "go down on our permanent records" while the big guys will always seem to have a good excuse why the mail server suddenly destroyed all the records for that pending lawsuit. I can just hear the lawyers now...."..yeah, it's funny how only the VP's e-mails dissapeared, and only for a 3 month period, but we've got him on a special server that's set to explode in flames every 90 days."
I think that this type of national policy will ultimately hurt the little guys/companies more than the real targets of such legislation. The big guys will just start having oral meetings without taking notes or some such method of non-trackable information sharing.
As with all government intervention, the "quick-fix" is never really that quick, and the problem is almost never fixed.
Seems apropos. My company, who I can't name for reprisal purposes, is a fortune 10 company. We have a policy that any email must be deleted after 30 days. No backup of any electronic means. However, *paper* archive is fine, and is the only approved method of maintaining email over 30 days. It's insane. What my colleages do is zip up our outlook folders, encript, rename, and save to "safe" backup folder to let our system save it on tape/dlt. If I ever need an important "pearl harbor" file, then I can request an old renamed, zipped backup, and then pull it. I've done it once.
The main reason for this is that the lawyers waaaay up there in the chain got really afraid of the Enron type email digging, and released the policy of "destroy, good or bad"
It sux.
I really wish that PGP signing/encryption of email would become a lot more commonplace... do you want to be prosecuted for an email that you didn't send? Email is, obviously, very insecure... on the other hand, you can't deny that it you sent if it's convenient :-D
Another question: What if the government wanted to read an encrypted email? Would they demand you turn over your private key?
that its not that big brother is recording our emails - they realize they can't.. so they make it law that we have to spy on ourselves by saving emails. So, If I delete my own emails - can I plead the 5th amendment? But, forcing my employer to spy on me, now that is an interesting work-around to the 5th. Not one I like, just interesting.
meh
Next they'll ask us to keep recordings of all our phone conversations?
Including metadata. Anyone still want VOIP?
you should be sacked for not following this policy. it's not your place to override something like that, potentially creating all kinds of liability and not just in terms of "catching" teh company trying to do something bad to you
The Government can keep all email from and to headers without a subpoena. I am not sure if they can keep the contents and only look at it years later when they get the subpoena, i.e. you are connected with someone who does something interesting, or maybe connected to someone who is connected to someone interesting.
It is only a matter of time.
[Is refering to 6 degrees of separation redundant. Well I am Irish, to be sure, to be sure.]
Be Free: Free Software Tuition
The Slashdot sysadmins (Slashmins?) are keeping records of our posts (including metadata?)
As a now private, more or less un-employed and semi-retired person, most of my mailing list activitys are recorded in the various folders my email agent maintains. But, part of that maintainance in most cases is an expire date. I keep mailng list messages only for a couple of months, then they are automaticly gone as basicly their contents are no longer valid anyway.
Not only that, but what the hell has happened to our basic 1st amendment rights. Or the rest of the Bill of Rights for that matter.
I think its way past time we found an honest man for the white house, one who would uphold the constitution instead of figure out ways to feed his buddies ever more government contract monies without actually putting it out to bid.
Unforch, politics and religion have this commonality. As the devil said when God threatened to sue to get an engineer back that was sent down by accident, "And just where are *you* going to get a lawyer?"
Seriously, we need a "D" option on the ballot, for none of the above, thereby forceing a fresh start at finding a suitable candidate, one crazy enough to want the job, and still honest enough to try to fix the congressional excesses of the last 30 years.
You don't like my message? Then don't post, but get off your ass and be a part of a democracy, register and VOTE dammit! Then send a message to the winner saying that you expect him to do the job he was elected to do.
Cheers, Gene
When I worked as a Unix guy at Computer Associates, who fired me for reporting them to the BSA, I fondly remember being told that CA policy was to delete all email off the servers after a period of 90 days, and that no email server was to *EVER* participate in the enterprise backups. In other words, if any email server had a failure which resulted in data loss, that data was gone, and the hundres of affected users were down shit creak with no paddle. I was informed that this policy was enacted several years previous when the SEC busted down the doors and seized the emails servers looking for some evidence against the company. So CA simply made it so no email is ever kept on any archive, less it be the users own personal archive on their computer terminals. Even then, most users would have to delete emails in their own archives to cope with space issues. So enacting laws that requires companies to retain an archive si a bit silly in my experience. Also, what would happen if a company retained an archive of email, but encrypted the mail data-base, and keyed it on the users password? Would that violate the letter of the law, or the spirt, to retain the emails in a cipher-text format. Certainly you could get a court order to force somebody to provide the password, right?
Just thinking outloud here...
Thanks.
It isn't a lie if you belive it.
I can't imagine a business that has to deal with lawsuits, legislation, and government regulations not already having some sort of periodic file review in conjuction with document retention policies. Business-related documents should kept for a period. At the time of periodic file review the company should provide a list of document retention orders so that relevent documents are not destroyed if associated with legal actions, financial records, etc. I don't see it as Big Brother. I see it as keeping shiznit wired tight so companies can CYA -- assuming everyone is doing their job right. If there is neglegence/cover-up/criminal actions, get it dealt with. If not, provide evidence that proper procedures are being followed.
Speak truth to power.
...and follow it.
For emails, ours is "relevent life". Upon becoming irrlevent, it gets whacked.
If someone later orders you to produce email, you'll probably not have it. If you can show that you didn't delete it as a result of the order, or in an effort to destroy evidence, you cannot be prosecuted for not having it. A retention policy is key to this, because it eliminates any arbitration regarding when (or why) something was whacked.
help me i've cloned myself and can't remember which one I am
You should probably delete them, so that when they turn out to be true, you can't be sued for corporate malfeasance for not having responded appropriatly. :)
Seriously. He thought he was deleting his e-mails but when they disapeared only from his machine and not the central server it became obvious what had happened. And which ones were the "good stuff." So if your company backs up data- you're boned.
I've already run into situations where I couldn't get documentation or software for devices only 4 or 5 years old because it had all been trashed according to the vendor's records retention policy.
Its why plants in adverse areas grow thorns... cause the animals eat those who didn't protect themselves from the predators.
I speak from experience.
Trust me.
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
I complain when people delete emails anyway... :)
I have every email I received over the past 5 years in my mailbox (with the exception of some spam, though I have a lot of that too since it's automaticly put in my Spam folder)
My maildir only uses 650 MB (150 MB compressed), so it's not like space is a reason to delete email... People just need to make folders and use them.
Luke-Jr
Let's say you receive an OpenPGP (PGP, GPG) encrypted email which requires your public key to decrypt. Once your key expires you're going to switch to a new key. Even if you're good at keeping old legacy expired keys around, eventually the message will become unreadable (forgot passphrase etc.) I don't know where I'm going with this mind you
pass all corporate email through a proxy. the proxy could easily store every email in sub folders by employee>yyyy>mm>dd> (let the IRS sort through it if they want it). this could be made cheaper if its stored on a compressed file system (reiser4 with a bzip plugin when its ready, because there wouldn't be that taxing on a cpu dedicated to bzipping mail).
this would also save money if all mails were passed through a virus scanner and all viral attatchments removed before reaching the network proper.
i would have thought companies would want a log of all emails anyway to find out who's wasting resources on emails such as "john, pub at lunch?" and such.
There's enough backstabbing and blame-shifting in modern business that it makes sense to keep emails around anyway. I frequently delete the ones that say "ok, thanks" or something equally as insignificant, but I also keep a "CYA" folder for things I may need to throw back in a customer's face later on when they claim they asked for something different, and I also never empty my "Sent" folder so when the boss comes storming in with a "Why didn't you..." rant, I can pull up the relevant email and say "See, I did."
This should be pretty obvious to anyone who's had a job with email for more than a couple of months. I used to be a good server citizen, keeping my mail store usage nice and tidy, but not anymore.
Tired of FB/Google censorship? Visit UNCENSORED!
There's better ways to do records retention - this thread abounds with examples.
Besides, if I forward an email to myself on day 29, does the clock start over?
What if I print it out and scan it back in, does that stop the clock?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Land of the Free (How much longer
are you guys and gals gonna put up
with this Kafkaesk silliness?
Everbody's a suspect unless
proven unguilty.
The truly guilty -- their heads
should roll, their mouths not smirk.
Yet hope there is --
again be free,
be brave, American!
Crush those sinister powers
that be), Home of the Brave.
A big part of a lawsuit is discovery. FRCP 26(b)(1) provides that:
Parties may obtain discovery regarding any matter, not privileged, that is relevant to the claim or defense of any party, including the existence, description, nature, custody, condition, and location of any books, documents, or other tangible things and the identity and location of persons having knowledge of any discoverable matter.
In other words, lots of stuff in emails is considered fair game for discovery. Failure to produce it, or destroying it, subjects the party to severe sanctions, up to and including "rendering a judgment by default against the disobedient party." So, what they're saying is, deleting emails could constitute willful failure to disclose in the event of a lawsuit and could result in those sanctions.
I would like to point out that it is not only "big brother" (aka the government) who is driving the data retention policies... it's the litigation brought on against private industries, in order to determine fault for civil cases.
When it comes to Enron or Big Tobacco, we'll embarrass them, put their statistics in commercials, their phone coversations on the evening news, just so another group can turn around and start civil suits against them. Our society seems to have this drive to find out exactly who was in the drivers seat when decisions were made, down to Who sent what email When to Whom... yet we still allow our governement representatives to take "voice votes" so we don't know who voted on what laws? You would think that that's something we want to hold people accountable for...
They make trading systems and information systems. But unlike Bear Stearns, I don't think they actually are involved in trading and thus aren't subject to SEC requirements.
I think Mr. Ellis needs to go get an independent consultant to double-check the software contractor's results. If users are just filing e-mail, then saving meta-data should be automatic. All the e-mail programs I use commonly that let me file messages in folders (Pine, Evolution, Mozilla Mail, Thunderbird) save the complete SMTP headers with the meta-data in question automatically. If the company Mr. Ellis is getting his "solution" from charges extra for saving what's commonly saved automatically, they're probably gouging him on more than just that.
When will it be illegal to not have a valid email address?
No, there is a clear legal standard on document retention. You do not need to keep documents if they are not needed for a business purpose unless you have been notified of an existing legal investigation. So you can destroy drafts of any work and clean out old work at your descretion. However you cannot go back and catch up on your cleaning up if you become the subject of a legal investigation.
I own a small company that among other things helps implement e-mail archiving systems for compliance. Some information:
1. The archiving of e-mail applies only to company e-mail. ALL e-mail inside a company is considered to be owned by the company and is NOT private! (If you check your AOL account at work and it's not blocked this isn't company mail.) If you're using your work e-mail you have no privacy. As to spam, not spam etc. If it's caught by a spam filter at the firewall and the user doesn't see it it's spam and doesn't need to be kept. IF it makes it to the user, it isn't spam, (even if it really is;)
2. There are specific regulations applying to trading firms, (such as SEC 17a-4 and NASD blah,) but more general legislation such as Sarbanes Oxley can also be interpreted to apply to archiving and making searchable electronic records such as e-mail. This really isn't any different than keeping memos or other paper records that have been generated in companies and kept in archives for years.
3. Having a policy for what to keep for how long as far as electronic records is good, but it's not the whole battle. You need to document why you choose a given amount of time to keep a record, how you kept it, (can it be altered? Can it be eraseed without anyone knowing it?) How you're auditing those records. (E-mail was deleted after 7 years, prove it!) And how you can prove nothing was lost. It's just doing your homework.
4. This is all actually an opportunity for companies to save money, right now, most companies keep everything the employee doesn't delete until they leave and the account is deleted. Why keep potentially damaging information that's taking up space and costing money for storage if you don't have to? Also if a company is sued and an employee is for instance accused of sexual harassment through e-mail, it's an easy matter to check isn't it? It'll stand up in court, something e-mail wouldn't do if it isn't really being turned into a record.
"Expensive measures are being called into place to archive the mail for future subpoena purposes."
I work for the State of Washington. In this state's government there is no problem deleting email as long as your department has a written policy defining the retention time for email.
Email is covered by the freedom of information act which means that it is not hard for an average citizen to request copies of email sent and received by the department. There is a procedure, fee and waiting period that discourages someone from coming in and requesting all mail during the retention period. It could be done but it would be very expensive. Not really worth it for someone on a wild fishing expedition but doable for a citizen that wants specific information..
If we receive a subpoena for email that was sent or received within out written email retention policy we had better be able to produce it. If we can't the requesting party could conceivably compel us to hire a very expensive data retrieval company to come in and reconstruct our data in order to comply. And of course if the courts believe that we deleted email prior to the retention date in an attempt to destroy evidence there is a chance that someone could be spending some quality time as Bubba's new love toy. If you know what I mean...
The race isn't always to the swift... but that's the way to bet!
Expensive measures are being called into place to archive the mail for future subpoena purposes. Think Enron on one hand. Think Monicagate on the other.
The Lewinsky thing centered on a soild dress; that was the smoking gun, so to speak. The presidential scandal in which archived email played an important part was Iran-Contra (think of Ollie North shredding all those files, only to have his email correspondence with Poindexter used against him).
...I'm glad of this. After having just worked for several years for a company with a "document retention policy," (corporate jargon for "we delete your email for you after two weeks"), it's clear that companies are out there running the equivalent of digital paper shredders night and day to prevent any chance that any of their illegal activities might ever be discovered.
I think it won't be longer passwords but a unique key assigned to you or generated from you such as a thumb print or retina image coupled with a 8-12 character password -or- two short passwords which change at different times.
-illumina+us "I put on my robe and wizard hat..."
You've got to be kidding me. Are we all supposed to live under the threat of legal action? I don't give a shit about some lawyer or overpaid legal advisor telling me that it's to protect myself from liability... My business practices should not be centered around litigation. What the hell has this country become, and when is it going to change back? I better be careful, this message expressing subversive opinions may someday be used against me.
A simple workaround: Encrypt all e-mail archives. Delete the key pair. Now, they didn't ban deleting key pairs, just e-mails. OR, store the mails, then repartition the hdd on which they were stored. Easier to get them back, but still nothing illegal and a good way to hide it.
Not a sentence!
I have to agree with you,
s /issue2 8/saved.html
Still.
I did a quick google search to see what I would find. The University of Washington seems to think this topic is important enough to have a set of web pages devoted to guidelineing eMail destruction.
It seems that if you keep it too long you're hanging your self when a public records request comes along. Excerpt below:
"One person at the UW whose email was recently requested had 45,000 messages; another had the equivalent of 1.4 million pieces of paper. With this kind of volume, responding to a request is time-consuming and expensive."
They go on to advise:
"The key is to organize your email so you can delete it in a timely manner. Keeping all your email has costs, as does deleting email too soon. It is worth learning which messages should be kept and taking the trouble to save and delete them systematically."
The fact that a university has a "Records Retention Schedule" should be of no surprise. But it still gets a bit of a chuckle out of me.
It's an amuseing read:
http://www.washington.edu/computing/window
Cheers,
--The Dude
Give me 10 gig of space, and I may consider keeping all my mails in some kind of archive. Heck, give me 50 rooms, and I may print out all the emails, together with whatever attachments that come out, file them, and store the files somewhere. Of course, we'll probably kill many many trees somewhere along the way, but it's all for the sake of keeping our records properly.
There are 10 kinds of people in the world - those that know binary, and those that don't.
ohh, really tricky, this. Let us keep forever in bound (electronic or leather) pertfolios all that which we do. Better yet! Let u srespond with 'narf' to all penis enlargement or viagra offers. let us dutifully file all the robot responses in an auditable manner. hooo-fckn-rah... BB can choke on the overload and let us let the Fort meade just keep chewing terabytes. Innocuity will always win over purpose, as the anarchists and socialists of europe realized over 100 years ago.
Well, it's easy for me. The only password I really have for my server is the root password, the only way I log into the root account is via SSH. So I basically set my password to 96 digits (IIRC) of line noise, and use a 4096 bit RSA key for authentication.
ND
... in my very own personal Privacy Policy page.
Tag lost or not installed.
"When I worked as a Unix guy at Computer Associates, who fired me for reporting them to the BSA"
1) Aren't there whistleblower statutes to stop such things?
2) Isn't CA a *member* of the BSA, or am I seriously confused here?
*boggles quietly*
You never know what an IRS agent might find lucky
Someone who fills out their income tax return perfectly?
Frink: Nice try floyd, but you were designed for scrubbing, and scrubbing is what you shall do.
we went through this at the company I worked with where we sought legal opinions from several sources.
If you routinely delete emails rather than archiving them and cycle your backup media on some regular basis you can certainly legally erase your emails without worry.
Think of the parallels with other things in your office - do you keep duplicates of all things you photocopy? Do you store copies of all regular mail you receive? Do you stash away everthing in your waste baskets each night? - of course not.
So, get your policies written - regularly cycle your backup tapes, and if you want to delete emails then delete your emails - the only difference is that you may specify that particular people - those who have direct contact with clients and suppliers - make arrangements to store emails for potential litigation purposes - but put it all in a well written policy book and do it soon.
So if we save all our e-mails for future legal purposes, the e-mail probably would not be valid evidence anyways. I mean think about it. I get dozens of e-mails per day that come from a phony or 'borrowed' e-mail source address. How would the e-mail be verified as ligitimitate, and not a fake? Come on, If you can't track down all the spammers (or virii) from the hundreds of messages per day in everyone's inbox how can you expect to tell me that CompanyX actually set me that message in my inbox offering me money for free? - James.
- James
...protection against compelled self-incrimination only applies to persons.
Corporations are not entitled to that 5th Amendment protection and if a corporation posesses any incriminating information in paper or digital form, it can be compelled to produce that information into evidence before the court.
Looks like the guys who need this more did all ;-)
the clean up before coming up with this
What the hell has this country become, and when is it going to change back?
The problem is that the US has punitive damages, and generally no caps on said damages. It also has class action lawsuits with no caps on attorney fees (there should be *flat caps*). The initial point of this was to rein in out-of-control companies, but it has horrendously backfired. Now, a huge amount of our business overhead results from attempts to compensate for ridiculous legal concerns. My disposable coffee cup each day has a molded plastic top with a huge blurb of text right in front of my eyes when I'm drinking that reads "WARNING! SIP WITH CAUTION! CONTENTS MAY BE HOT!"
In general, I do not believe that this has been a net win for society. We spend a huge amount of time in businesses doing stupid things to avoid legal problems. Many useful things that a company *might* do to help someone (like offer advice from their helpdesk with solutions that aren't on the "script" when the "script" has been exhausted and can't help anyone) are now avoided for fear of litigation. We see class-action lawyers (such as for the tobacco lawsuits) sucking down *huge* fees, on the order of hundreds of millions of dollars. The result has been flat bans on litigation (which, in my opinion, should never, ever be done and should be unconstitutional -- the lawsuit is the way our legal system allows a citizen to demand reparations). Now, a citizen cannot file suit against a food company for food "making them fat", and came close to not being able to file a lawsuit against tobacco companies (thanks to John McCain and Clinton for shooting that down). I'm not saying that either of these lawsuits would have merit, but the idea of banning lawsuits is appalling, and the idea of taking control of whether a lawsuit is reasonable or not from the judicial branch is particularly egregious.
May we never see th
nice guy - reporting the company... did it profit you any?
Actually, I'd say he is. If you define "nice" as "willing to take personal cost to benefit others (in this case society)", I'd say that he pretty much falls exactly into that category.
If "nobody likes a snitch" then perhaps everybody should stop breaking the law at their company. Frankly, I think it's too bad that we can't reward whistleblowers even more.
May we never see th
This puts IT in a very interesting position. They are in a position of extreme trust. A ranking IT person that "goes rogue" could probably get all of the email of the company, as well as other files. This means that it may be worthwhile to pay the IT people that you grant full control over your systems well to minimize the risk of them turning on you. The same thing happens for CEOs -- lots of pay, since the damage they can do is phenomenal.
May we never see th
I do not only archive my important emails but I record my converstaions with other people as well.
I have an MP3 recorder running in a loop all the time in my pocket. Whenever I have gone through a particularly important conversation I save it on my laptop, and then finally on CDROM for future reference. In future, if the technology becomes affordable, I would also like to record whatever I see too (video)... meanwhile I take pictures with my digital camera. In order not to piss people off I don't give it away that i'm recording everything.
Such recordings can be very useful when assholes 'twist' what they have said in order to save their ass and put yours on the stake.
- "They misunderestimated me."
..but then again, I like to live dangerously..
"It's too bad that stupidity isn't painful." - Anton LaVey
Have you hugged your penguin today?
Check out http://www.educomts.com for an email archiving solution. It's pricey, only works with MS exchange, but its likely quite worth it for large corps.
Oh, that's okay. It doesn't matter if I delete a message-my friendly BOFH keeps our entire employment history's worth of E-mail messages on backup tape...whether we all want him to or not.
Suffice it to say, it's more for his own reasons than reasons of secur...oh my god, here he comes! I have to go, right &NO CARRIER
Help protect civil rights from abuse by the TSA - visit TSA News Blog.
http://www.tsanewsblog.com
Nobody follows the official retention policy. Not with PHBs constantly denying that they authorized a project or made a decision or whatever...
My manager has a great policy for dealing with people who don't ever respond to e-mail requesting decisions - send them an e-mail saying "This is what we're doing, reply if it's not okay". And keeps a copy of it, knowing full well they never reply. Instant paper trail. Great for CYA.
Potentially stupid question, but what's the BSA? I keep thinking "Boy Scouts of America."
Ok so we all know that government entities now can no longer delete what they consider spam, so my open is can we use this to help congess / lawmakers see the spam problem for what it is? My proposition is to have a large segment of the IT community batch and send their Washington representitves their daily bulk mail with a polite note explaining a want / need for change in legislation reguarding opt-in versus opt-out as we have currently. Something like this could be used as a tool to even influence the spammers themselves if anyone could actually gain access to their addresses.