Email Management for the Organization Jesse Wilkins May 1, 2009 Bellevue/Eastside Greater Seattle Puget Sound

EMAIL MANAGEMENT DRIVERS

Email – defining the issue First email was sent in 1971 Today more email is sent every day than the USPS delivers in a year 11 billion emails a day in the US alone More than 57 billion a day world-wide NOT including spam 60% or more of business-critical information is stored within messaging systems

First email was sent in 1971

Today more email is sent every day than the USPS delivers in a year

11 billion emails a day in the US alone

More than 57 billion a day world-wide

NOT including spam

60% or more of business-critical information is stored within messaging systems

Email – the 50,000 ft. view Why are we sending so much email? It’s easy It’s nearly instantaneous It’s less formal It’s asynchronous It’s convenient

Why are we sending so much email?

It’s easy

It’s nearly instantaneous

It’s less formal

It’s asynchronous

It’s convenient

Role of email in the organization Email is a mission-critical application Used to communicate and collaborate But 34% of email is unnecessary chatter 99% of organizations conduct business by email 75% of civil discovery is for email

Email is a mission-critical application

Used to communicate and collaborate

But 34% of email is unnecessary chatter

99% of organizations conduct business by email

75% of civil discovery is for email

Business issues Email storage costs 300+GB email per month for 1,000-user company Costs to add and manage storage Costs to back up to tape Costs to restore Productivity costs

Email storage costs

300+GB email per month for 1,000-user company

Costs to add and manage storage

Costs to back up to tape

Costs to restore

Productivity costs

Legal drivers Every organization uses email for business Everyone in every organization uses email Email content is generally less formal Email is almost impossible to get rid of Email is the proverbial smoking gun

Every organization uses email for business

Everyone in every organization uses email

Email content is generally less formal

Email is almost impossible

to get rid of

Email is the proverbial

smoking gun

Legal issues 75%+ of demands for discovery are for email Cost to produce messages is high $2 per message $2,000 - $18,000+ per GB Pales in comparison to the cost of NOT producing

75%+ of demands for discovery are for email

Cost to produce messages is high

$2 per message

$2,000 - $18,000+ per GB

Pales in comparison to the cost

of NOT producing

Email and the FRCP Email is ESI and must be produced Litigation holds need to include email systems, clients, backups, and archives Organizations need to know what they have and where it is located Time to locate email is before litigation begins

Email is ESI and must be produced

Litigation holds need to include email systems, clients, backups, and archives

Organizations need to know what they have and where it is located

Time to locate email is before litigation begins

Legal considerations for messages Messages are discoverable – whether they are records or not Message archives are discoverable, regardless of the format or storage medium The “deleted messages box” is discoverable Personal copies are discoverable

Messages are discoverable – whether they are records or not

Message archives are discoverable, regardless of the format or storage medium

The “deleted messages box” is discoverable

Personal copies are discoverable

When is an email a record? When statutorily defined When it documents a business transaction When it memorializes a business decision When the attachment is a record When it is the only written record of something

When statutorily defined

When it documents a business transaction

When it memorializes a business decision

When the attachment

is a record

When it is the only written

record of something

Regulatory and recordkeeping issues Email messages might be records – but email is NOT a series! Email has to be accessible today…and tomorrow Email systems and formats Attachments and their formats Media and hardware issues

Email messages might be records – but email is NOT a series!

Email has to be accessible today…and tomorrow

Email systems and formats

Attachments and their formats

Media and hardware issues

APPROACHES TO EMAIL MANAGEMENT

Email management through quotas Used to limit the storage space in each user’s mailbox Example: Users limited to 125 MB total storage Or used to delete email automatically after certain period of time Example: All messages in the inbox deleted after 90 days

Used to limit the storage space in each user’s mailbox

Example: Users limited to 125 MB total storage

Or used to delete email automatically after certain period of time

Example: All messages in the inbox deleted after 90 days

Mailbox quota issues Users often try to circumvent quotas Save messages to .PST, .NSF files Move messages out of mailbox Forward messages to personal accounts Delete messages by size rather than importance All users may not be subject to quotas

Users often try to circumvent quotas

Save messages to .PST, .NSF files

Move messages out of mailbox

Forward messages to personal accounts

Delete messages by size rather than importance

All users may not be subject to quotas

Other email mgmt approaches Do nothing Let users do what they want Keep everything forever

Do nothing

Let users do what they want

Keep everything forever

Email management is NOT: Saving all email messages forever Saving all email messages in the messaging application Setting mailbox time limits Setting mailbox size limits Declaring “email” as a record series Or as simply “correspondence” Doing nothing

Saving all email messages forever

Saving all email messages in the messaging application

Setting mailbox time limits

Setting mailbox size limits

Declaring “email” as a record

series

Or as simply “correspondence”

Doing nothing

CAPTURING AND CLASSIFYING MESSAGES

Capturing everything Many organizations choose to capture everything Trending and knowledge reuse Easy access to messages and attachments Keeps everything in one place and in an application everyone has and uses But there are significant drawbacks to this approach

Many organizations choose to capture everything

Trending and knowledge reuse

Easy access to messages and attachments

Keeps everything in one place and in an application everyone has and uses

But there are significant drawbacks to this approach

Cost of capturing everything Cost of storage Cost to find messages when needed Cost to manage storage and backups Cost to restore messages Cost of discovery later Risk of inadvertent disclosure

Cost of storage

Cost to find messages when needed

Cost to manage storage and backups

Cost to restore messages

Cost of discovery later

Risk of inadvertent disclosure

Capturing email records Not everything needs to be captured Capture messages that have value Keep them according to records program

Not everything needs to be captured

Capture messages that have value

Keep them according to

records program

When is an email a record? When defined by statute or regulation When it documents a business transaction When it supports a business decision When it is the only evidence of something When the attachment is a record

When defined by statute or regulation

When it documents a business transaction

When it supports a business decision

When it is the only evidence of something

When the attachment

is a record

Email capture decision flow Source: AIIM Email Certificate Program

Who captures the message? YOU have to capture an email: You receive from outside the organization You send, either internally or to someone outside the organization Designate someone to capture messages sent to groups/lists

YOU have to capture an email:

You receive from outside the organization

You send, either internally or to someone outside the organization

Designate someone to

capture messages sent to groups/lists

Emails that are not captured Transitory messages that are not timely Personal messages unrelated to business “ Me-too” messages Messages already captured by someone else “ Bacn”

Transitory messages that are not timely

Personal messages unrelated to business

“ Me-too” messages

Messages already

captured by someone else

“ Bacn”

Why classify messages? So we can find all messages related to a particular subject, thread, or topic Because nobody wants to look at an inbox with 10,000 messages in it Because it is easier to manage messages in groups Because it is in our nature

So we can find all messages related to a particular subject, thread, or topic

Because nobody wants to look at an inbox with 10,000 messages in it

Because it is easier to manage messages in groups

Because it is in our nature

An approach to classification 3-zone approach: Inbox or transitory zone Working zone Records zone Inbox zone Working zone Records zone

3-zone approach:

Inbox or transitory zone

Working zone

Records zone

Inbox zone Messages that have just been received And perhaps not read yet Transitory messages Personal or non-business-related messages “ Bacn” Keep these messages for short periods, e.g. 30 days

Messages that have just been received

And perhaps not read yet

Transitory messages

Personal or non-business-related messages

“ Bacn”

Keep these messages for

short periods, e.g. 30 days

Working zone Messages that have been read but require more time to respond effectively Messages related to ongoing projects or initiatives Reference-type messages Keep these messages longer but still defined, e.g. 180 days or 1 year

Messages that have been read but require more time to respond effectively

Messages related to ongoing projects or initiatives

Reference-type messages

Keep these messages

longer but still defined,

e.g. 180 days or 1 year

Records zone Messages that rise to the level of records Ideally these are not stored in the messaging application or folders – they are moved into an ERM system Retention is defined by the content of the message and its value to the organization

Messages that rise to the level of records

Ideally these are not stored in the messaging application or folders – they are moved into an ERM system

Retention is defined by the

content of the message and

its value to the organization

EMAIL MANAGEMENT TECHNOLOGIES

Messaging system Not built to store massive amounts of messages And attachments And manage as records Difficult to search across inboxes Discovery, auditing

Not built to store massive amounts of messages

And attachments

And manage as records

Difficult to search across

inboxes

Discovery, auditing

Print & file Common approach Challenges: Loss of metadata Attachments Volume to print and to file Authenticity (phishing)

Common approach

Challenges:

Loss of metadata

Attachments

Volume to print and to file

Authenticity (phishing)

Backup tapes Backups store data, not files or messages Designed for “smoke & rubble scenario Multiple copies of data Readability of older tapes Format, media, hardware

Backups store data, not files or messages

Designed for “smoke & rubble scenario

Multiple copies of data

Readability of older tapes

Format, media, hardware

Email management applications Move messages out of the messaging application Typically use a rules engine May provide simple retention management Single instance storage Many different capabilities available

Move messages out of the messaging application

Typically use a rules engine

May provide simple retention management

Single instance storage

Many different capabilities

available

Email management technologies Email archiving Personal archive file management Email encryption and digital signatures Email compliance Email discovery Email security Policy management ECRM solutions

Email archiving

Personal archive file management

Email encryption and digital signatures

Email compliance

Email discovery

Email security

Policy management

ECRM solutions

ELEMENTS OF AN EMAIL POLICY

Email policy principles Email belongs to the organization, not the individual Email is not a records series unto itself Email management program must comply with appropriate regulatory requirements Policy has to be followed and enforced!

Email belongs to the organization, not the individual

Email is not a records series unto itself

Email management program must comply with appropriate regulatory requirements

Policy has to be followed and enforced!

Elements of an email policy Acceptable/appropriate usage Personal usage Access to external messaging systems Effective email usage Ownership of email Retention and disposition Legal issues Holds Discovery and production

Acceptable/appropriate usage

Personal usage

Access to external messaging systems

Effective email usage

Ownership of email

Retention and disposition

Legal issues

Holds

Discovery and production

Elements of an email policy Mobile and web-based email Backups Archival Privacy Security Retention and disposition Training Audit and compliance

Mobile and web-based email

Backups

Archival

Privacy

Security

Retention and disposition

Training

Audit and compliance

Summary We have to manage messaging technologies better Start with policies and procedures Technology can help Communicate, communicate, communicate Enforce the program

We have to manage messaging technologies better

Start with policies and procedures

Technology can help

Communicate, communicate, communicate

Enforce the program

Questions?