New Email Rules Effective Friday

An anonymous reader writes "As of today [Friday], certain U.S. companies will need to keep track of all the e-mails, instant messages and other electronic documents generated by their employees, in accordance with new federal rules. In April the Supreme Court began requiring companies and other entities involved in federal litigation to produce 'electronically stored information' as part of the discovery process of a trial." From the article: "Under the new rules, an information technology employee who routinely copies over a backup computer tape could be committing the equivalent of 'virtual shredding,' said Alvin F. Lindsay, a partner at Hogan & Hartson LLP and expert on technology and litigation. 'There are hundreds of "e-discovery vendors" and these businesses raked in approximately $1.6 billion in 2006, [James Wright, director of electronic discovery at Halliburton Co.] said. .'"

What's next?

[Salvance (1014001)]

What happens for companies that don't host their own e-mail, particularly smaller companies?

In order to save money, my company hosts our website and e-mail on a shared server. E-mails are downloaded via POP3 and immediately deleted from the server (each account can only hold 20MB online at one time). Most people then delete their e-mails after reading, so we have absolutely no way to retrieve this data.

This doesn't seem to impact my company, but at some point I fear regulators will start requiring more stringent data retention processes (among other IT tech processes). SOX has already hurt large companies, hopefully they don't start pushing some its fundamentals down to the little (non-public) folks.

Re:

[AltGrendel (175092)]

Even in the summary above it says "certain U.S. companies", not all U.S. companies.

Re:What's next?

[owlnation (858981)]

But TFA (I read it, sorry!) doesn't use "some"... even though logically that must be the case.

Re:What's next?

[MoralHazard (447833)]

companies that don't host their own e-mail, particularly smaller companies

This is a no-brainer, right? If you're the kind of company that is subject to these retention rules, having a shared email server that immediately deletes DL'd messages, with no user policy
at the local level, either, is illegal. You'd have to immediately move your email in-house and implement appropriate policies, or find a 3rd-party that can handle it, or some mixture.

If you're not the kind of company that is subject to these rules, who the fuck cares?

If you don't already know that your company is subject to these rules, and it turns out you do need to follow them, fire your in-house counsel because they're incompetent.

In house counsel???? WTF?

[tacokill (531275)]

He said SMALL business. Most small businesses I know don't have in-house counsel. Hell, many are lucky if they have ANY counsel, even on retainer.

Good suggestion, but way off base for small business.

I have the same problem the GP mentioned and am not sure if this affects us or not. How would you know if you are "subject to federal lawsuits"? EEOC (discrimination) lawsuits would count as federal -- so do I need to address this or not? In theory, everyone is subject to federal suits so should eve

Re:What's next?

[archen (447353)]

I'm an admin in a smaller company as you - shared hosted email. If you really want to play it safe, I would say make the responsibility of saving email the responsibility of each user.

Really this is a bunch of crap anyway. What about companies that don't even CONTROL their employee's accounts and just expect them to use personal hotmail accounts. Catalog all instant messaging traffic? How about clients that might IM that are installed aside from what the company keeps track of. Yeah, let me just start logging ALL network traffic on that 20 trillion terabyte tape I rotate every day.

Besides which how about tracking stuff that's encrypted? What if the messages are IMed through some http system? Now I have to do man in the middle attacks to sniff HTTP connections, then I have to store that information. Because we also do credit card transactions via HTTP I am storing credit card information this goes against Visa's policy for businesses allowd to do credit card transactions. I wouldn't be surprised if it were against the law either.

The Supreme Court can say whatever they want, but I can't do what they're telling me, nor can I raise the dead like Jesus if they required that either. The law is irrelevant unless you PURPOSELY shred / delete documents - and that's against the law already during litigation.

Re:

[brouski (827510)]

If you really want to play it safe, I would say make the responsibility of saving email the responsibility of each user.

And what part of that seems "safe" to you?

Re:What's next?

[Vellmont (569020)]

I'm an admin in a smaller company as you - shared hosted email. If you really want to play it safe, I would say make the responsibility of saving email the responsibility of each user.

It's a good thing you're an admin, and not head of the company. Here's how your scenario might play out it court:

Judge: Email 1 is a reply to email 0, but I don't see email 0. These are all emails to Dwayne. Dwayne, what happened to email 0?

Dwayne: Umm.. I guess I must have deleted it by mistake. I do that all the time. I know we're not supposed to delete email, but this email thing is complicated and I must have hit the wrong button or something.

Judge: Ok, but companies keep backup tapes these days. What happened to them?

Archen: Oh I just decided to leave all that stuff up to the users. I couldn't be bothered with buying more tapes and modifying my backup schedule. The backup tapes get over-written every week, and that email was from 3 weeks ago.

Judge: I see. Well you've obviously in violation of the ruling. I can't hold Dwayne here responsible since these systems are complicated, and data retention should be handled by someone specially trained. But since you made the decision, I'm holding the entire company responsible and fining you 1 million dollars. I'm also recommending to the federal prosecutor you be charged with obstruction of justice Mr. Archen. Destruction of data also won't help the case against you.

Re:

[darkmeridian (119044)]

The rules only require companies to maintain their normal course of business. The exception is if a company realizes it is going to be sued, or the target of a government investigation. Under those circumstances, the company has to enter into a hold and stop destroying data even if it would have done so in the normal course of business.

Re:

[kabocox (199019)]

This doesn't seem to impact my company, but at some point I fear regulators will start requiring more stringent data retention processes (among other IT tech processes). SOX has already hurt large companies, hopefully they don't start pushing some its fundamentals down to the little (non-public) folks.

Plan for it. If the government doesn't do it, the larger companies that have to will start forcing the government to go after smaller to midsized companies that aren't following the rules that they have to. Wh

Re:

[MrNougat (927651)]

IANAL, but I have worked in IT for a company during a time when it was under subpoena.

The summary mentions companies "involved in federal litigation." If you are not involved in federal litigation (you're not being charged with a crime or sued or under subpoena), then you can do anything you like. The moment you become involved in federal litigation, you cannot destroy any electronic data, as it is discoverable by the court.

The fact that this is a new official rule shouldn't frighten anyone - this has bee

Exempt from all this of course

[hsmith (818216)]

Is congress and the white house. Much like congress is exempt from the Sarbanes/Oxley Act.

Want to see the biggest crooks and ones fudging the numbers, look at congress. Enron couldn't come close. They all would have been locked up years ago if they had to abide by the laws they pass.

Re:

[Spazntwich (208070)]

Our government fears transparency because we'd see the damage done to its lungs after years of surviving on tobacco taxes.

Re:

[hsmith (818216)]

Lets take an example:

The $61 trillion in unfunded liabilities we currently have for Medicare ALONE. Medicare which is set to go bankrupt in 2018, Social Security in 40 years. "Emergency war spending" so that we can "pretend" we get "closer" to balancing the budget. Printing out gobs of money destroying the value of our savings so they can pretend to pay for all this shit

Please, if you think they are somewhat honest in how they present any of the ways they pay for or fund anything you are kidding yours

Post office

[otacon (445694)]

That would be like making the post office open every letter then copy and store them...I guess it's not EXACTLY the same thing because it's all digital, but it's still illogical, and a waste of resources.

Re:

[Mr. Underbridge (666784)]

That would be like making the post office open every letter then copy and store them...I guess it's not EXACTLY the same thing because it's all digital, but it's still illogical, and a waste of resources.

No, it's more like saying you have to permanantly store every piece of paper you ever write on. Every memo, every piece of scrap paper. It gets ridiculous eventually.

Misleading

[calbanese (169547)]

Under the new rules, an information technology employee who routinely copies over a backup computer tape could be committing the equivalent of 'virtual shredding.

This is a bit misleading. Its only "virtual shredding" if you don't keep the records around for a reasonable period (either by statutory requirements or insutry standards) or if you have notice of litigation in which the evidence is relevant, and you continue to shred.

Thats why there is a document retention policy safe harbor in the rules themselves.

As amended, Rule 37 creates a "safe harbor," protecting a party from sanctions for failure to produce electronically stored information as long as it took reasonable steps to preserve electronically stored information when it knew or should have known such information was discoverable, or the failure results from loss of information during routine operation of such party's electronic information system.

FWIW, lawyers, even the "technology experts" don't seem to understand technology as well as someone who came through IT before becoming a lawyer.

(disclaimer: IT guy-turned-lawyer, so I always think I know more than "pure lawyers" when it comes to tech).

Microsoft

[javilon (99157)]

If I remember correctly, Microsoft had a policy of deleting email from their servers after a short period, in order to avoid it being used in trial.

This will have to change, then.

The amendments

[jwaters (45772)]

Since the linked article is light on information, I found the actual amendments [uscourts.gov] (note: PDF)

Rising cost of business

[precogpunk (448371)]

While I'm in favor of measures to curb white collar crime these requirements seems to do more harm that good by encouraging companies to take business elsewhere.

Legislated expense

[jdray (645332)]

The company I work for has been implementing this sort of infrastructure over the past year. It's hard. With all the IM clients available, getting one system that will handle all the traffic and maintain usability in the face of changing features across the field is hard enough; couple that with long term storage requirements for corporate e-mail where the culture is to send huge attachments around willy-nilly, and add in all the other changing requirements, and the burden to adhere to this new bit of legislation becomes quite a burden.

Couple that with the fact that the company I work for is a regulated utility that has to convince the local PUC each year that costs to provide service continue to go up, and the margins just keep getting tighter. Every year around March, there's a panic call from Accounting asking everyone to contribute some of their budget back to the bottom line because of some new development that wasn't forseen the previous year. For a cash-strapped IT department wanting to provide good service, the problems just mount up, stresses are high, and the employment door keeps revolving.

Re:

[Aqua_boy17 (962670)]

You illustrate a very good point regarding the requirement for IM storage. IMO, I view IM's much as I would an informal conversation passing someone in the hallway. This as opposed to an actual mail message which is the equivalent of an old office memo and probably should be stored.

Therefore I view the IM storage requirement as a kind of unfair tax on businesses like yours. I mean take this far enough and what's next? Will the government require that digital recordings of all hallway conversations be m

Massive Pretty Good Privacy

[Doc Ruby (173196)]

Practically everyone can scramble our email, like with "Pretty Good Privacy" (PGP) [wikipedia.org]. If many of us do it, they might be able to crack it or force our password after due legal process, but private parties won't be able to snoop through all of us on any possible budgets.

Your government can probably crack any nonsymmetric crypto (with help from the US), but might not have the resources to crack everyone's all the time. You can try a tinfoil hat, YMMV.

The real problem is webmail, which can't use any installed crypto on either end (with possible rare exceptions, but the rarity and/or nonintegration makes them useless at only one end of the comms).

If GMail let me upload a PGP applet I signed myself (which I could validate in the pages when I hit them), which they embedded into their pages in Javascript the public could audit for holes, they might actually become by far the best email system for the masses. And win the webmail wars. And really piss off the government(s) that have been trying to pry into their transactions for years.

Re:Massive Pretty Good Privacy

[Beetle B. (516615)]

If GMail let me upload a PGP applet I signed myself (which I could validate in the pages when I hit them), which they embedded into their pages in Javascript the public could audit for holes, they might actually become by far the best email system for the masses.

Don't ever use "PGP" and "the masses" in the same sentence. There's a reason people don't use it unless they really need to. It's the hassle of exchanging keys and building a trust database, and getting people to use it as it should.

It's a very minor hassle for those who use it well, but getting the masses to follow protocol is next to impossible.

Re:Massive Pretty Good Privacy

[Doc Ruby (173196)]

Ah, but building demand by promoting the existing tool will encourage new developers to make it more useable.

Re:Massive Pretty Good Privacy

[NatasRevol (731260)]

Well, maybe you could use Squirrelmail.

http://www.squirrelmail.org/plugin_view.php?id=153 [squirrelmail.org]

Re:

[by Anonymous Coward]

I often wish for that too, but it's clearly a pipe dream. Google's sole interest in providing email services is to obtain access to messages themselves. They want to know what you're talking about so they can sell you crap--and they want to retain that information, so they can cross-reference it.

Providing an easy interface for you to encrypt your email undermines that goal utterly. For it to be of any value to you, they won't ever have access to your keys or plaintext.

So, it will never happen with Gmail.

Re:

[fossa (212602)]

I agree with your sentiments, but I think no one cares about encryption. For what it's worth, freenigma [freenigma.com] provides GnuPG webmail through a Firefox extension and an existing webmail account supported by freenigma (includes GMail, Yahoo, Hotmail, others). I have not used freenigma, but last time I read the docs I got the impression it was not compatible with, say, mutt's PGP/MIME which I use for kicks (I have zero encryption using friends).

One thing that always bugged me about mutt's PGP is that attachments

Re:Massive Pretty Good Privacy

[0xABADC0DA (867955)]

Yeah google is really going to let you decrypt your email at the client... I can see the ads now:

413b57037 buying guide
replacement 6cf46e1dfc quote
fd8869a15cb936d8e59 Free Shipping!
bee5e2b at Amazon

Re:Massive Pretty Good Privacy

[neoform (551705)]

How hard do you think it'd be for the government to get their hands on those PGP keys if they were stored on google's servers.. ?

Google is a US company and should a court request those keys.. they'd give them.

Tape?

[Mr.NoMoniker (1034330)]

These are NEW rules? and they refer to an IT worker copying over TAPE? Does this mean I should be saving all my carbon paper too? how about punch cards?
Might all this extra data clog the system of tubes that is the internet?

Re:

[supremebob (574732)]

Last I heard, millions of people were still using tapes for backup. Up until very recently, they were a cheaper archival medium than disks, and they're still more durable and easily stored off-site.

Standard Conversation

[Silver Sloth (770927)]

Techie:- We need to keep more backups of our e-mail database
Bean Counter:- How much do the tapes cost
Techie:- Lots - we need at least one DLT per backup
Bean Counter:- We can't afford it.
Techie:- We have to afford it
Bean Counter:- Just leave the requisition in my intray


Months Pass

Bean Counter:- The courts are on to us. Where are the e-mail backups for the 1st December 2006
Techie:- I had to overwrite them so as to keep a reasonabley current backup
Judge:- Techie, you shredded evidence - now you're for it

Re:Standard Conversation

[itlurksbeneath (952654)]

I've actually had that conversation with the bean counters, but it went like this:

Techie: We need $5,000 to buy another 100 DLT tapes to comply with this no-rewrite order.
Bean Counter: Again! We don't have any money in the budget to buy any more tapes
Techie: Ok, no problem. Send me an email and CC your boss and my boss and tell them that we can not comply to this federal ruling because we don't have any money in the budget.
Bean Counter: Erm.. Uh.. Oh! Here's some money for tapes you can have.

As long as the gun is pointing at them, they are very cooperative.

invest in storage

[jwegy (775655)]

Now would be a good time to invest in companies that make storages devices

All Conversations

[giminy (94188)]

What I don't get is, why the double-standard on communication? I think congress should enact legislation recording all communication within such companies. We should have microphones in every room and every hallway, to record every word spoken in such a company, just in case people do something wrong. We should probably also have video cameras, in case the would-be lawbreakers decide to write paper notes, and every paper shredder should have a scanner with OCR in line with it, so that the letters are sto

bad blurb

[Lord Ender (156273)]

I am not a lawyer, but I highly doubt this blurb is accurate.

I can understand laws which requires retention for companies that log IMs. But they wouldn't pass a law requiring companies who do NOT log IMs to start doing so!

Legacy systems

[NetDanzr (619387)]

A company I worked at previously has been using a legacy e-mail system. We've been under the SEC rules for retaining e-mails already, and when they came to inspect our business we learned that even though it's not stated in the rules, e-mail records must not only be retained, but they must also be readable with modern software. SEC wanted us to deliver the e-mail records in either a formated text file or as an Outlook file. We ended up hiring two interns who spent the next nearly two weeks forwarding all

This is plain old FUD... heavy on the 'F'

[by Anonymous Coward]

This is a great example of FUD... programmers need to stick to programming and lawyers need to stick to lawyering. (I happen to be both, but that's beside the point).

This is not legislation.. it is part of the court rules. In a lawsuit, you have to provide all relevant documents to the other side. In the past, there had to be a *lot* of court time wasted on deciding what was subject to disclosure (i.e. a man does work for the company from home... is his home computer subject to examination? Answer: yes)

Stupid thing!

[VincenzoRomano (881055)]

So all the email traffic done in the US will be stored somewhere at least once, often twice (sender+reciever) and in some cases several times.
And storing them is not enough: you'l need to browse them for searches!
This is a very very smart move!
And when litigations will go with browsed web pages, we'll need to store all the web we browse!

Re:Nice; tell you about new rules, just not the ru

[stry_cat (558859)]

RTFA:

The rules, approved by the Supreme Court in April, require companies and other entities involved in federal litigation to produce "electronically stored information" as part of the discovery process, when evidence is shared by both sides before a trial.

so if you are or might be involved in federal litigation, you better follow the rules.

Re:

[nm42 (310685)]

Keep in mind that many states adopt the federal rules with little or no modification for use in state courts. Within the next few years, these changes will be incorporated into local rules for just about every jurisdiction.

The scariest parts of the new federal rules are:

• 26(b)(2) which says that a party can designate information as "not reasonably accessible". It's supposed to protect companies from having to spend huge amounts of money to restore backup tapes from ancient systems, but it's going to lead

Re:

[magarity (164372)]

Most impressive! Not only did you not read the article, you didn't even read the summary that clearly states this is for "companies and other entities involved in federal litigation."

Re:Nice; tell you about new rules, just not the ru

[calbanese (169547)]

It applies to all companies. The length of time you are required to retain documents before destroying can be different for different companies. Like a poster noted, Sarbanes-Oxley defines a time period for publically listed companies. But other than that (and other industries where regulations prescribe time periods for record retention), the courts have used a "reasonable time period" requirement in the past and most commentators expect that to continue under the new rules, which are, in many ways, a f

Re:Nice; tell you about new rules, just not the ru

[DerGeist (956018)]

Welcome to the wonderful world of scare-mongering!

This only applies to compaies [myway.com] under federal litigation, but I'm sure it'll get a lot more pageclicks if you make it sound terrifying and scream things like WE'RE ALL GONNA DIE!

Truth time, kiddies! You absolutely must hold on to email and IM data... IF it is part of a subpoena or a discvoery process, and so on. But there's nothing requiring companies to hold on to such data for any specified period of time.

Re:Nice; tell you about new rules, just not the ru

[DerGeist (956018)]

Nice try, but you are sadly wrong thanks to your slippery-slope fallacy. As long as you have a data collection policy and follow it, you're fine. Documents/data that have been shredded prior to discovery or litigation aren't your problem. If your policy is "shred every 60 days" and you follow it, and the court requests something 120 days old, your policy will stand up in court. This rule applies only to those who are currently under federal litigation or think they soon might be.

As the summary says...

[jpellino (202698)]

"companies and other entities involved in federal litigation"

Odds are you already know if you're one of these.

(Use your best Jeff Foxworthy voice for this next part)

"If your CFO has been escorted out of the building on the national news by people with big yellow letters on their backs..."
"If the new guy in the office spends all his spare time chatting up his sleeve instead of the secretary..."
"If your office phone system now says Press 1 for Customer Service, Press 2 for Public Defenders..."
"If they show Dennis Kozlowski on Biography and your boss snorts "Huh. Pikers..."
"if you check your email and a cheery voice announces "You've got bail!"

Links to the rules

[davidwr (791652)]

This link [fulcruminquiry.com] goes into a bit more detail than the article in the main /. story.

The pertinent rules appear to be the Federal Rules of Civil Procedure, specifically Rule 16 dealing with pretrial scheduling and Rule 26(f) relating to discovery and disclosure.

Cornell University has these rules online. They might be outdated already.
Rule 16 [cornell.edu]
Rule 26 [cornell.edu]

Wikipedia also has a writeup on the Federal Rules of Civil Procedure [wikipedia.org].

Do a search for rules on electronic discovery [google.com] for more commentary.

Re:

[Your Pal Dave (33229)]

NPR did a report [npr.org] on this today as well.

Re:

[KiahZero (610862)]

Which brings me to my next point..... ERASE YOUR EXPIRED TAPES!!!!!! This is how Morgan Stanley lost the 1.45 BILLION dollar case. During Discovery, it was found that the data that was needed to LOSE the case was on tapes that had expired data on them. Welllllll... guess what? It's still there, still viable, and cost them a shiteload of cash.

Maybe avoiding tortious conduct might be a better idea?