Microsoft Exchange 2010

By Heather Minx

E-discovery has taken over from DNA as the most popular form of evidence in trials. The prevalence, and importance of email is our personal and professional lives is well known. That makes it fertile ground for litigation and the gathering of evidence. Email archiving makes the gathering of evidence in this way possible.

E-discovery is the method by which lawyers can request email information from companies to aid an investigation. Email archiving is mandated by law for just this reason. There are several things any business needs to know about e-discovery, and we’re going to discuss them here.

E-discovery applies to any electronically stored information (ESI). That includes social media, Instant Messaging, chat, and email. An email archive solution should include all ESI to fully comply. As new electronic communication methods evolve, the solution will have to include those too.

Alongside email data, instant messages and social media, ESI can also include databases, email attachments, email headers, and even metadata within an electronic document. A solid email archive should be able to store data in its original format, without destroying any of this data.

The main piece of legislation for civil cases is the Federal Rules of Civil Procedure (FRCP). It outlines obligations under the rules to assist in bringing cases to court. The rules are numerous, but there are three main rules that are useful to know.

They are:

• Rule 26 General Provisions Governing Discovery; Duty of Disclosure. This rule outlines the process for discovery including exemptions to the discovery process and a meeting between parties to discuss the organization of the process.
• Rule 34 – Production of Documents, Electronically Stored Information, and Things and Entry Upon Land for Inspection and Other Purposes. The main rule relating to e-discovery.
• Rule 37 – Failure to Make Disclosures or Cooperate in Discovery; Sanctions. This rule states the court cannot sanction the responding party for failing to provide ESI that was lost as a result of routine computer operations.

It would be useful for any business operating in the US to know each of these three rules. They form an important part of e-discovery, and will probably make their presence known at one point or another.

Another aspect of e-discovery is preserving the stored data from destruction while a case is being prepared. There is a mechanism called a Litigation Hold, which is designed to stop companies destroying incriminating data before it’s brought to court.

When a company is informed of an impending civil litigation, a Litigation Hold may be requested to enforce the preservation of all email archives to ensure the data is available for evidence. All data overwrites, destruction or other removal has to be stopped until the case is finished.

E-discovery and email archiving is a huge, contentious subject. It takes a trained lawyer to know the vagaries of such things, so it’s essential to seek professional legal advice if you receive an e-discovery request and you aren’t sure what to do.

Email archiving is extremely important to business as well as personal users. Email backups are another method of saving emails beyond and above saving them in an inbox. Users do not need to keep an email in their inbox once they have saved it in email archiving. They simply need to hit the archive button or send it to the archive folder. Once the file is sent to that area, they do not need to worry about it.

That is, until they need it. There may be a question about an older order or someone may be confused about a detail of a meeting. They can consult the older email archiving feature. That way they will be ready to go and not have to contact the other person again. Email archiving increase productivity by over 50% among individuals who use it within their web mail or desktop email clients. Email archiving is quite similar to search through your email. A user is typically able to pull up an email by entering the email address, subject line or keywords that they are looking for. The more details they know, the better luck they will typically have with accessing the email.

Email archiving is a relatively new feature to be added to many web mail programs as well as desktop clients. Google Mail commonly known as Gmail is infamous for its archive button. Google is also the king of search and their email archiving product is extremely good. Businesses who are interested in using it can sign up under the Google Apps for Business program. This program gives each business user an email address under the corporate domain name as well as access to Google Docs and Calendar. Email archiving on Google Apps for Business can save a business time from having to contact customers to ask for clarification as well as time searching for an old email conversation.

Email archiving also makes it easy for bad people to access your email. You need to ensure that you have a strong password. Criminals who are smart can search for “credit card password” or “bank statement” and find which bank you bank with. They also can reset these passwords and delete these emails from your account. This takes a matter of minutes, thanks to the email archiving software. However, with a secure password this will never become a problem for you.

Have a to do list that needs to be updated? Well, check your recent client requests with client archiving. Need to see which unread messages have been sent to the archive? No problem! Email archiving software does not have to be difficult to use either. Even older users or younger users who have never used it before understand the basics of how to use the software. Best of all, users are able to quickly consult emails and then get back to the task at hand. Secretaries for email at some major companies have already been eliminated. Interns are able to search for keywords through email archiving software, solving the problem of an onslaught of email.

The impending launch of Microsoft Exchange 2010 got quite a few SaaS vendors worried when they first heard about it. The new built-in archiving features of the platform were one of the main reasons they were in business.

I don’t think it is the end of SaaS email archiving services, not by a long shot. Firstly the email archiving is basic, and requires the clients to use Outlook 2010, which isn’t out yet except in beta as part of the Office 2010 suite.

Secondly using Exchange 2010 involves a significant investment in hardware, software and support. Something which many organizations just can’t afford right now. Considering many vendors offer the equivalent benefits already for a much lower cost, take up of Exchange and Outlook 2010 is expected to be limited for a year or so. Or at least until the economies of the world pick up.

The Exchange archival model also depends on the storage capabilities of the company. Unless many companies drastically improve their storage solutions, mailboxes will be limited, or restricted and the archive facility will lay idle. While hard drives are relatively inexpensive, they are still an added expense.

Many organization don’t allow full-text indexing on their Exchange servers. We all know this puts quite an overhead on the Exchange server, and will only work efficiently on low scale or low use platforms. Larger scale organizations simply can’t afford the slowdown in performance full indexing involves. The multi-mailbox search in Exchange 2010 depends on full-text indexing to work, therefore is largely useless.

Email archiving is based on three requirements. Storage, discovery and compliance. Exchange 2010 only addresses two of these concerns and those only on a basic level. The storage needs a hardware solution to make it work. Exchange has done much to improve how it handles storage by allowing multiple copies of databases, mailboxes and data. E-discovery is only addressed on a basic level, and as we see indexing involves compromises. Also emails can only be copied to another mailbox, not extracted from the system and provided immediately.

Compliance isn’t even touched by the new platform, so many organizations, especially those regulated by the SEC will still need a third party solution.

Exchange a made great strides in increasing management, usability, scalability and seems to be trying to drive down the cost of ownership. There are compromises though, the initial installation will cost a lot, both in time, resources and money. A new infrastructure will most likely be needed, involving the hardware, software and network. Then training for the support staff, as the new platform has many new features, and ways of doing things.

So SaaS email archiving vendors don’t have too much to worry about just yet. It’s going to be a year or three before Exchange 2010 is rolled out across the globe.

A recent study by technology company, CMSWire, found that many companies in the United States get email archives and backups mixed up.  As unbelievable as it sounds, the confusion is still rife, even years after the legislation came into force, and organizations are being caught out all the time.

For those who still don’t know the difference, a backup is when a copy is taken of a given media and stored elsewhere.  This is to provide disaster recovery should any disaster befall the building, the company or its infrastructure.  Every business should have a comprehensive backup process that is followed to the letter, but it is different to archiving.

An archive is designed to copy, store and manage data for the longer term.  It is designed to be a permanently separate, accessible silo where the data can be safely kept.  Ideally it would be sited somewhere other than the premises, in a purpose built facility where it is protected from all forms of harm such as flood and fire.

In the case of an email archive, for compliance, the email data is siphoned off the corporate email platform and formatted into a particular state.  It is then indexed, compressed and then stored safely somewhere else.  That storage should be secure, safe and resilient, so the client can access their data should the need arise.

A backup can run in conjunction with an archive, but are completely separate entities.  They should not be confused.  The only driver for a backup procedure is disaster recovery and damage limitation.  Archiving is necessary to satisfy a range of legal obligations that are enforced aggressively, as well as the retention of important information.

It isn’t only for E-discovery that archiving is a good idea.  Business depends a lot of email using it as the main means of communication both internal and external.  Often corporate communications, policy changes and even external contracts are communicated this way, and they are important for any business to retain for a period of time.

On paper it is an easy mistake to make.  Both processes make copies of stuff for retrieval later but only one will protect an organization from litigation if an E-discovery request comes their way.

While emails can be retrieved from a backup, it is a time-consuming and laborious task.  With no real indexing facility, finding emails may take a significant amount of time, especially in larger, communication heavy organizations.

An email archive makes it easier to follow email trails and the branches that can occur when mail is copied and forwarded to multiple recipients.  A thorough implementation should also comply with the relevant legislation and prevent any action being taken against the company for non-compliance.

Let’s set the record straight once and for all.  A backup policy is good methodology, but entirely optional.  Email archiving is not.  It is mandatory and specified in more than a few laws.  Ever since those very high profile corporate scandal cases, every business has had to comply with a set of stringent compliance laws that demands an effective trail be left with any documentation of any kind.

Legalities aside, email archiving should be used by businesses large and small, no matter what their line of business. It was once thought to be the preserve of public companies until the changes in legislation made sure every company in the country had to comply.

Email archiving is also useful for internal purposes such as employee monitoring. While not very popular with staff, emails can be stored, retrieved and used for disciplinary or investigative purposes as well as compliance with internal guidelines. This kind of monitoring can not only warn the company about breaches in security, potential risks and insider dealing.

With an effective email archiving solution, alerts can be set up for keywords or key phrases in an email that can flag up potential risks as they happen. If this traffic is monitored regularly then action can be taken at the earliest signs, and potentially prevent it getting out of hand. The keywords can be anything pertinent to the business from resume, career, swear words, to client file, secrets, medication and anything company specific.

While this activity may not seem ethically sound, it is another tool in the ongoing mission to protect companies from damage from without, and within. Employees are often unaware of the problems they cause by sharing information they shouldn’t or gossiping about subjects that are better off left alone. If an effective email monitoring and archive system is in place then these kinds of incidents can be stopped in their tracks by early intervention or discipline.

Most smaller to medium companies don’t have a legal department so the burden falls to IT. In an in-house email archiving setup they will be the ones who control and maintain the system anyway so it’s logical for them to monitor. However, in an outsourced situation that burden can be passed to the vendor to take care of.

There is inevitably an expense to setting up an archiving solution, but in this country it is one that businesses cannot avoid. Since those high profile corporate fraud cases, it has been legally mandated that every company large or small who communicates via email has to have some kind of storage and archive facility for them.

If an E-discovery request is presented to a company without a coherent archive strategy, they may have trouble finding the data requested, or even worse, may not be able to find it at all. This not only causes problems for the litigation for which the data is bound, but also for the company itself. The government and judiciary don’t look kindly on those who don’t comply with these new laws as it hampers them when they are trying to investigate companies.

The whole idea of the new legislation was to improve public confidence in American business by ensuring there was always a paper trail for everything they did. Anything that gets in the way of that is viewed dimly indeed.

Company email has become a vital source of evidence in legal proceedings over recent years. As it became more important to the way businesses operated and communicated, both internally and externally, the more useful email became in litigation.

Email compliance soon became an important part of an IT department’s life, and plans were hurriedly drawn up so organizations could meet their obligations. While archiving email has been a part of the IT schedule for many companies, it was often on an unofficial or ad-hoc basis. Then along came a raft of legislation compelling businesses to create and maintain an effective, and compliant archive and retrieval system.

Fortunately, even during its infancy, there were two methods of email compliance. The first was to control everything in-house, on the organizations own servers. Then build in a secure storage function, efficient retrieval and processes to answer E-discovery requests.

The second was to outsource the operation to third party providers and let them take the strain. They would take the email information off Exchange servers or other email platforms, format it, compress it and then store it securely. They would then service any E-discovery requests made by the client or their legal team.

Both have pros and cons.

Keeping it in-house involved a hefty investment in time and money. Extra hardware, networking, staff and processes would be needed in order to build a coherent, and compliant process that would satisfy the needs of the legislation. The benefit was that the organization retained full control of the data, the systems and the process.

Having the email compliance hosted offloaded just about all of the initial outlay, the need for the hardware, extra staff and the infrastructure to support a compliant system. That would be in the hands of the vendor. The size of the solution could also be scaled according to seats. If the client company grew, bought other entities or got purchased itself, the outsourced service could be scaled to meet the new needs.

The downside was that it is a recurring expense that the business has to pay, but doesn’t own. The organization also has to rely on the professionalism of the vendor in order to ensure the data is safe and that they are completely covered in the event of litigation or E-discovery requests.

There is no right answer to the question of what method is right for which business. That comes down to the individuals involved. Both solutions lend themselves to different scenarios, and different situations. The decision whether to go in-house or outsource depends entirely on where the organization is now, and where they plan to be in a few years time.