Slashdot Log In
New Email Rules Effective Friday
Posted by
Zonk
on Fri Dec 01, 2006 10:56 AM
from the kiss-your-conversations-goodbye dept.
from the kiss-your-conversations-goodbye dept.
An anonymous reader writes "As of today [Friday], certain U.S. companies will need to keep track of all the e-mails, instant messages and other electronic documents generated by their employees, in accordance with new federal rules. In April the Supreme Court began requiring companies and other entities involved in federal litigation to produce 'electronically stored information' as part of the discovery process of a trial." From the article: "Under the new rules, an information technology employee who routinely copies over a backup computer tape could be committing the equivalent of 'virtual shredding,' said Alvin F. Lindsay, a partner at Hogan & Hartson LLP and expert on technology and litigation. 'There are hundreds of "e-discovery vendors" and these businesses raked in approximately $1.6 billion in 2006, [James Wright, director of electronic discovery at Halliburton Co.] said. .'"
Related Stories
[+]
News: New E-Discovery Rules Benefit Some Firms 35 comments
The new E-discovery rules that came into effect last Friday — clarifying federal requirements about producing electronic documents as evidence in lawsuits — may make life harder for some companies, but they will benefit others. mikesd81 writes to mention an AP article profiling companies that help businesses track and search their e-mails and other electronic data. From the article: "There are hundreds of 'e-discovery vendors' and these businesses raked in approximately $1.6 billion in 2006... That figure could double in 2007."
[+]
Businesses Generally Ignoring E-Discovery Rules 109 comments
eweekhickins writes "A full year after the institution of new federal e-discovery court rules, only a minority of companies are paying attention. Keeping track of every IM, email, and document for a court order that may never come must seem like a tall order. Researcher Michael Osterman said that only 47 percent of companies have some kind of e-mail retention policy in place. 'I don't think it's difficult to understand the rules,' Osterman told eWEEK. 'I just think that it sometimes takes headline shock to make people move on some things.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
What's next? (Score:5, Informative)
In order to save money, my company hosts our website and e-mail on a shared server. E-mails are downloaded via POP3 and immediately deleted from the server (each account can only hold 20MB online at one time). Most people then delete their e-mails after reading, so we have absolutely no way to retrieve this data.
This doesn't seem to impact my company, but at some point I fear regulators will start requiring more stringent data retention processes (among other IT tech processes). SOX has already hurt large companies, hopefully they don't start pushing some its fundamentals down to the little (non-public) folks.
Re:What's next? (Score:5, Informative)
This is a no-brainer, right? If you're the kind of company that is subject to these retention rules, having a shared email server that immediately deletes DL'd messages, with no user policy
at the local level, either, is illegal. You'd have to immediately move your email in-house and implement appropriate policies, or find a 3rd-party that can handle it, or some mixture.
If you're not the kind of company that is subject to these rules, who the fuck cares?
If you don't already know that your company is subject to these rules, and it turns out you do need to follow them, fire your in-house counsel because they're incompetent.
Parent
Re:What's next? (Score:5, Insightful)
Really this is a bunch of crap anyway. What about companies that don't even CONTROL their employee's accounts and just expect them to use personal hotmail accounts. Catalog all instant messaging traffic? How about clients that might IM that are installed aside from what the company keeps track of. Yeah, let me just start logging ALL network traffic on that 20 trillion terabyte tape I rotate every day.
Besides which how about tracking stuff that's encrypted? What if the messages are IMed through some http system? Now I have to do man in the middle attacks to sniff HTTP connections, then I have to store that information. Because we also do credit card transactions via HTTP I am storing credit card information this goes against Visa's policy for businesses allowd to do credit card transactions. I wouldn't be surprised if it were against the law either.
The Supreme Court can say whatever they want, but I can't do what they're telling me, nor can I raise the dead like Jesus if they required that either. The law is irrelevant unless you PURPOSELY shred / delete documents - and that's against the law already during litigation.
Parent
Re:What's next? (Score:4, Interesting)
I'm an admin in a smaller company as you - shared hosted email. If you really want to play it safe, I would say make the responsibility of saving email the responsibility of each user.
It's a good thing you're an admin, and not head of the company. Here's how your scenario might play out it court:
Judge: Email 1 is a reply to email 0, but I don't see email 0. These are all emails to Dwayne. Dwayne, what happened to email 0?
Dwayne: Umm.. I guess I must have deleted it by mistake. I do that all the time. I know we're not supposed to delete email, but this email thing is complicated and I must have hit the wrong button or something.
Judge: Ok, but companies keep backup tapes these days. What happened to them?
Archen: Oh I just decided to leave all that stuff up to the users. I couldn't be bothered with buying more tapes and modifying my backup schedule. The backup tapes get over-written every week, and that email was from 3 weeks ago.
Judge: I see. Well you've obviously in violation of the ruling. I can't hold Dwayne here responsible since these systems are complicated, and data retention should be handled by someone specially trained. But since you made the decision, I'm holding the entire company responsible and fining you 1 million dollars. I'm also recommending to the federal prosecutor you be charged with obstruction of justice Mr. Archen. Destruction of data also won't help the case against you.
Parent
Re:What's next? (Score:4, Informative)
Parent
Exempt from all this of course (Score:4, Insightful)
Want to see the biggest crooks and ones fudging the numbers, look at congress. Enron couldn't come close. They all would have been locked up years ago if they had to abide by the laws they pass.
Re: (Score:3, Interesting)
Misleading (Score:5, Informative)
This is a bit misleading. Its only "virtual shredding" if you don't keep the records around for a reasonable period (either by statutory requirements or insutry standards) or if you have notice of litigation in which the evidence is relevant, and you continue to shred.
Thats why there is a document retention policy safe harbor in the rules themselves.
FWIW, lawyers, even the "technology experts" don't seem to understand technology as well as someone who came through IT before becoming a lawyer.
(disclaimer: IT guy-turned-lawyer, so I always think I know more than "pure lawyers" when it comes to tech).
The amendments (Score:5, Informative)
Rising cost of business (Score:3, Insightful)
Legislated expense (Score:3, Interesting)
Couple that with the fact that the company I work for is a regulated utility that has to convince the local PUC each year that costs to provide service continue to go up, and the margins just keep getting tighter. Every year around March, there's a panic call from Accounting asking everyone to contribute some of their budget back to the bottom line because of some new development that wasn't forseen the previous year. For a cash-strapped IT department wanting to provide good service, the problems just mount up, stresses are high, and the employment door keeps revolving.
Massive Pretty Good Privacy (Score:5, Insightful)
Your government can probably crack any nonsymmetric crypto (with help from the US), but might not have the resources to crack everyone's all the time. You can try a tinfoil hat, YMMV.
The real problem is webmail, which can't use any installed crypto on either end (with possible rare exceptions, but the rarity and/or nonintegration makes them useless at only one end of the comms).
If GMail let me upload a PGP applet I signed myself (which I could validate in the pages when I hit them), which they embedded into their pages in Javascript the public could audit for holes, they might actually become by far the best email system for the masses. And win the webmail wars. And really piss off the government(s) that have been trying to pry into their transactions for years.
Re:Massive Pretty Good Privacy (Score:4, Insightful)
Don't ever use "PGP" and "the masses" in the same sentence. There's a reason people don't use it unless they really need to. It's the hassle of exchanging keys and building a trust database, and getting people to use it as it should.
It's a very minor hassle for those who use it well, but getting the masses to follow protocol is next to impossible.
Parent
Re:Massive Pretty Good Privacy (Score:5, Insightful)
Parent
Re:Massive Pretty Good Privacy (Score:4, Informative)
http://www.squirrelmail.org/plugin_view.php?id=15
Parent
Re:Massive Pretty Good Privacy (Score:4, Funny)
413b57037 buying guide
replacement 6cf46e1dfc quote
fd8869a15cb936d8e59 Free Shipping!
bee5e2b at Amazon
Parent
Re:Massive Pretty Good Privacy (Score:4, Interesting)
Google is a US company and should a court request those keys.. they'd give them.
Parent
Standard Conversation (Score:5, Insightful)
Bean Counter:- How much do the tapes cost
Techie:- Lots - we need at least one DLT per backup
Bean Counter:- We can't afford it.
Techie:- We have to afford it
Bean Counter:- Just leave the requisition in my intray
Months Pass
Bean Counter:- The courts are on to us. Where are the e-mail backups for the 1st December 2006
Techie:- I had to overwrite them so as to keep a reasonabley current backup
Judge:- Techie, you shredded evidence - now you're for it
Re:Standard Conversation (Score:4, Insightful)
I've actually had that conversation with the bean counters, but it went like this:
Techie: We need $5,000 to buy another 100 DLT tapes to comply with this no-rewrite order.
Bean Counter: Again! We don't have any money in the budget to buy any more tapes
Techie: Ok, no problem. Send me an email and CC your boss and my boss and tell them that we can not comply to this federal ruling because we don't have any money in the budget.
Bean Counter: Erm.. Uh.. Oh! Here's some money for tapes you can have.
As long as the gun is pointing at them, they are very cooperative.
Parent
Stupid thing! (Score:4, Insightful)
And storing them is not enough: you'l need to browse them for searches!
This is a very very smart move!
And when litigations will go with browsed web pages, we'll need to store all the web we browse!
Re: (Score:3, Insightful)
That would be like making the post office open every letter then copy and store them...I guess it's not EXACTLY the same thing because it's all digital, but it's still illogical, and a waste of resources.
No, it's more like saying you have to permanantly store every piece of paper you ever write on. Every memo, every piece of scrap paper. It gets ridiculous eventually.
Re:Nice; tell you about new rules, just not the ru (Score:3, Informative)
As the summary says... (Score:5, Funny)
Odds are you already know if you're one of these.
(Use your best Jeff Foxworthy voice for this next part)
"If your CFO has been escorted out of the building on the national news by people with big yellow letters on their backs..."
"If the new guy in the office spends all his spare time chatting up his sleeve instead of the secretary..."
"If your office phone system now says Press 1 for Customer Service, Press 2 for Public Defenders..."
"If they show Dennis Kozlowski on Biography and your boss snorts "Huh. Pikers..."
"if you check your email and a cheery voice announces "You've got bail!"
Parent
Re:Nice; tell you about new rules, just not the ru (Score:4, Informative)
Parent
Links to the rules (Score:4, Informative)
The pertinent rules appear to be the Federal Rules of Civil Procedure, specifically Rule 16 dealing with pretrial scheduling and Rule 26(f) relating to discovery and disclosure.
Cornell University has these rules online. They might be outdated already.
Rule 16 [cornell.edu]
Rule 26 [cornell.edu]
Wikipedia also has a writeup on the Federal Rules of Civil Procedure [wikipedia.org].
Do a search for rules on electronic discovery [google.com] for more commentary.
Parent