The Law Requires Email Archiving

By Edward Alexi, Vice President, IT Solutions, Tangent Inc., Tangent Inc. |  Security, email archiving 4 comments

According to industry experts, approximately 90% of the day's business communications are performed via email or by way of unsecured instant messages. Communications including unstructured data can clog up an organizations network bandwidth and take up great amounts of storage space. The volume of emails and similar data forms in most businesses double every 12 to 18 months.

It begs the questions: What do I do with all of that data? For most organizations, the data has been backed-up to tapes or in the worst case scenario deleted from centralized repositories within email and database servers. After the amended Federal Rules of Civil Procedures were passed in December of 2006, all emails, communications, files, directives and requests that may be relevant to a current or future litigation cannot simply be deleted or overwritten. The data must be produced and thus it must be archived, because that's the law.

Remarkably, most business operators don't realize they must comply with the Federal Regulations on Civil Procedures, or FRCP. In this instance, ignorance is far from bliss. It could put you and your organization in serious legal trouble, if the requested electronically stored information (ESI) is not produced when requested by courts. In fairness, those that are aware of the need to archive fail to make the investment to put a proper archival process in place because of the perception that it's too complicated or too costly or too much trouble. The reality is if you can be sued in federal court, and that includes just about every individual and organization, you must archive and then be able to quickly and completely retrieve requested email communications. Another reality is your existing data storage systems, NAS and SAN solutions are not intended as a solution for archival, litigation holds, and eDiscovery

Here's another tough question:

If your organization is sued, are you prepared to provide records of all communications and transactions conducted by certain individuals with the company during certain dates relating to a certain set of issues?

Remember, it's the law that any of your electronic records can be requested and must be provided by a court order under the newly updated Federal Rules of Civil Procedure.

What are the FRCP standards?

The Federal Rules of Civil Procedure govern the production of evidence in Federal cases. The FRCP is designed for the civil federal court system, with input from the US Supreme Court, and approval by the US Congress. Seventeen states have adopted the new rules for electronic stored information (ESI) discovery and eighteen additional states are considering adopting the new rules for state civil litigation. Companies that find themselves subjected to lawsuits within the federal and state courts system need to be prepared to meet the requirements as written and supply information immediately as it pertains to individual cases.

Amended Rule 26:
As of December 2006, all institutions must meet the eDiscovery requirements as stated in the FRCP. This amended rule was created to assist specifically at helping courts and litigators navigate the new world of ESI. The eDiscovery requirements recognize all electronic communication, especially email and IMs as now legal to request at the court's convenience. Organizations now have a clear responsibility to produce ESI or face the penalty of the law.

Penalties of not following FRCP eDiscovery Requirements:
As outlined in Section V, Rule 37 "Failure to Make or Cooperate in Discovery; Sanctions," penalties include paying for the expenses of the opposing party, contempt of court, imposing of sanctions against your case, heavy fines, or even an automatic guilty verdict.

How Your Organization can comply with FRCP Standards:
Organizations need to know exactly where data is stored, what data storage technology is used to backup and archive records, how the retention schedule applies, how and when they are recycled, how long it will take to produce them, and in what formats they can be produced.

Another important shift brought about by the new Rule 26 is the courts' increased emphasis on identifying and preserving relevant ESI. Organizations not only must know the terrain of their records management landscape" including email and instant messages "they must also be able to traverse it quickly and efficiently to control retention and disposal. If you can't explain where you put your data, or if you can't act quickly to prevent the destruction of potential evidence, you face sanctions or worse. Your IT team must be aware of this

Email Archiving that Works Best for You:
There are a lot of options on the market that can full fill your network and legal/regulatory requirements. You can use hosted solutions which provide the search capability that you need along with storage, without taking up resources and space within your IT infrastructure and adding another device for your IT staff to manage and maintain.

The appliance-based solution can be an excellent option that's still affordable and can be controlled onsite. It's also more suitable if your organization has or more employees as well as an advanced storage system in place .

What's most important is that when requested, you can search and retrieve email and IMs quickly and easily. An affordable solution that meets legal standards and your institution's IT policies and practices will result in a more efficient workplace.

Email archiving is not something you can put off into the future. Beyond the legal implications, implementing an archival system allows you to better manage the large volumes of existing emails and file attachments, which continue to grow exponentially.

About the author:
Edward Alexei, Tangent's Vice President of IT Solutions, has extensive experience in the technology industry and is an expert on FRCP, SOX and HIPPA compliant solutions for SMB and enterprise clients. Tangent is the provider of DataCove.

4 comments

    Anonymous 2 years ago
    Without being to harsh; all readers of this article need to know that there are many incorrect statement, assumptions, and sited laws.This article is vastly errored and should be immediately deleted!It's dangerous commentary.
    Anonymous 3 years ago
    The attention grabbing headline can be debated, the article however is correct."Remember, it's the law that any of your electronic records can be requested and must be provided by a court order under the newly updated Federal Rules of Civil Procedure."Rule 26, 33 and 34.Archiving is NOT manadatory by law, but you WILL face additional cost and a real possibility of sanctions and even loosing your case (as numerous case law will attest to), if you can not produce relevant ESI when requested by the opposing side and even more so when mandated by court.30 day retention is fine, if you can institute it for your ENTIRE network. Most IT departments can NOT guarantee that the data which may be relevant to a case is completely gone from their network once it is deleted from the mail server. Rule 37 (Safe Harbor), states that you have to prove in court that the data requested is innaccesible and too cost prohibitive. Of the hundreds of IT Directors, CIO's, and Network Administrators, not a single one was willing to testify in court that they know for a fact that everything that was relevant to a case was completely deleted from the entire network after 30 days. By law, (Rule 26 again) a company does have to disclose where the relevant data may and does reside.Unfortunately once an email is delivered or sent, it can reside in multiple locations such as, PST files, Various network drives, Desktops, Non email servers, Back Up tapes, USB's, Etc. That is why archiving email, the most prevelant form of ESI in a centralized archival solution, is practiced by most of Fortune 500, Federal and State government agencies.
    Anonymous 3 years ago
    The article vastly overstates the legal requirements. Archiving is NOT required by the federal rules. Yes, there are definitely circumstances under which preservation of relevant email is required because of pending litigation. Yes, archiving may be a prudent policy to comply with all kinds of record retention requirements and business practices. No, archiving is not the law.
    Anonymous 3 years ago
    This article is full of misrepresentation and innuendo calculated to push a sales agenda. Any general counsel would throw this author out of his/her office."The data must be produced and thus it must be archived, because that's the law." Try reading all of the Federal Rules. What about safe harbour. What about a 30 day deletion policy. If I get rid of it, I don't have to do squat. What tripe!

      Add a comment

      Post a comment using one of these accounts
      Or join now
      At least 6 characters

      Note: Comment will appear soon after you have activated your account.
      Obscene/spam comments will be removed and accounts suspended.
      The information you submit is subject to our Privacy Policy and Terms of Service.

      ITworld LIVE

      SecurityWhite Papers & Webcasts

      White Paper

      Overcome Top 7 Admin Challenges of Active Directory

      As Active Directory's role in the enterprise has drastically increased, so has the need to secure the data. Gain insight on creating repeatable, enforceable processes that reduces administrative overhead and enables robust, customizable reporting and auditing capabilities. Brought to you by NetIQ.

      White Paper

      Insiders Can Ruin Your Company. Take Action.

      Did you know that 80 percent of threats to an organization come from the inside? The threat from insiders is often overlooked in organizations worldwide. This white paper from NetIQ, discusses key technology solutions that help to prevent and detect insider threats.

      White Paper

      Top Solutions and Tools to Prevent Devastating Malware

      Custom malware frequently goes undetected. According to Forrester Research, the best way to reduce risk of breach is to deploy file integrity monitoring (FIM) tools that provide immediate alerts. This white paper has been brought to you by NetIQ, the leader in solving complex IT challenges.

      White Paper

      Streamline Compliance and Increase ROI

      Streamline, simplify, and automate compliance related activities; especially those that impact multiple business units. This white paper from NetIQ, outlines solutions that will help your business gain the maximum return on investment possible while aligning your compliance programs.

      White Paper

      X-Ray of the PCI Process-4 Proactive Steps

      This white paper from Forrester Research Inc., helps break PCI into understandable components. Security and risk professionals will gain knowledge and insight into creating a compliant and secure IT environment. Follow these four proactive steps now before your next audit. Brought to you by NetIQ.

      See more White Papers | Webcasts

      Ask a question

      Ask a Question