New Email Rules Effective Friday 193
An anonymous reader writes "As of today [Friday], certain U.S. companies will need to keep track of all the e-mails, instant messages and other electronic documents generated by their employees, in accordance with new federal rules. In April the Supreme Court began requiring companies and other entities involved in federal litigation to produce 'electronically stored information' as part of the discovery process of a trial." From the article: "Under the new rules, an information technology employee who routinely copies over a backup computer tape could be committing the equivalent of 'virtual shredding,' said Alvin F. Lindsay, a partner at Hogan & Hartson LLP and expert on technology and litigation. 'There are hundreds of "e-discovery vendors" and these businesses raked in approximately $1.6 billion in 2006, [James Wright, director of electronic discovery at Halliburton Co.] said. .'"
What's next? (Score:5, Informative)
In order to save money, my company hosts our website and e-mail on a shared server. E-mails are downloaded via POP3 and immediately deleted from the server (each account can only hold 20MB online at one time). Most people then delete their e-mails after reading, so we have absolutely no way to retrieve this data.
This doesn't seem to impact my company, but at some point I fear regulators will start requiring more stringent data retention processes (among other IT tech processes). SOX has already hurt large companies, hopefully they don't start pushing some its fundamentals down to the little (non-public) folks.
Re: (Score:2)
Re:What's next? (Score:4, Informative)
Re:What's next? (Score:5, Informative)
This is a no-brainer, right? If you're the kind of company that is subject to these retention rules, having a shared email server that immediately deletes DL'd messages, with no user policy
at the local level, either, is illegal. You'd have to immediately move your email in-house and implement appropriate policies, or find a 3rd-party that can handle it, or some mixture.
If you're not the kind of company that is subject to these rules, who the fuck cares?
If you don't already know that your company is subject to these rules, and it turns out you do need to follow them, fire your in-house counsel because they're incompetent.
In house counsel???? WTF? (Score:3, Interesting)
Good suggestion, but way off base for small business.
I have the same problem the GP mentioned and am not sure if this affects us or not. How would you know if you are "subject to federal lawsuits"? EEOC (discrimination) lawsuits would count as federal -- so do I need to address this or not? In theory, everyone is subject to federal suits so should eve
Re: (Score:2)
FTA
It apears that once your informed of the suite, you cannot delete the stuff. Sadly, It will probably take a team of lawers to figure out to what extent you need to save
Coincidentally... (Score:2)
Hmmmmmmmmmmmmmmmmmmm...
Re: (Score:2)
Re: (Score:2)
Which U.S. companies would not be subject to these retention rules? Those who know for a fact that they will never be involved in federal litigation?
Re: (Score:2)
So at minimum, it would be prudent to at least have an what if stratigy. It would suck to claim you didn't need to keep these things just to find out every user who deleted thier junkmail for the day is now guilty of destroying evidence because your company was sued in federal court this moring.
Re: (Score:2)
Re:What's next? (Score:5, Insightful)
Really this is a bunch of crap anyway. What about companies that don't even CONTROL their employee's accounts and just expect them to use personal hotmail accounts. Catalog all instant messaging traffic? How about clients that might IM that are installed aside from what the company keeps track of. Yeah, let me just start logging ALL network traffic on that 20 trillion terabyte tape I rotate every day.
Besides which how about tracking stuff that's encrypted? What if the messages are IMed through some http system? Now I have to do man in the middle attacks to sniff HTTP connections, then I have to store that information. Because we also do credit card transactions via HTTP I am storing credit card information this goes against Visa's policy for businesses allowd to do credit card transactions. I wouldn't be surprised if it were against the law either.
The Supreme Court can say whatever they want, but I can't do what they're telling me, nor can I raise the dead like Jesus if they required that either. The law is irrelevant unless you PURPOSELY shred / delete documents - and that's against the law already during litigation.
Re: (Score:3, Insightful)
And what part of that seems "safe" to you?
Re: (Score:2)
Any (legal) activities they do in the course of their work, under the instruction of their management is considered to the fault of Management, and the company as a whole.
This does have limits of course, for example if I told you to rob a bank, and you actually did it, I expect that BOTH of us would end up in jail.
In this case, where the employee is not properly retaining documents, any auditor would be asking for the corp retention policy. And if that policy states that the employees are
Re: (Score:2)
I don't see how I could give them the resources to save all email (which I'm sure will include all spam and viruses) as I work for a small company that has a hard time supplying ME with those resources.
Maybe you couldn't do that, but in this case it's more about covering your ass, since if your company is under federal lawsuit things can get messy fast. Let someone else make the decision to not spend the money on proper data retention. Document that decision and your recommendations that they do it proper
Re:What's next? (Score:4, Interesting)
I'm an admin in a smaller company as you - shared hosted email. If you really want to play it safe, I would say make the responsibility of saving email the responsibility of each user.
It's a good thing you're an admin, and not head of the company. Here's how your scenario might play out it court:
Judge: Email 1 is a reply to email 0, but I don't see email 0. These are all emails to Dwayne. Dwayne, what happened to email 0?
Dwayne: Umm.. I guess I must have deleted it by mistake. I do that all the time. I know we're not supposed to delete email, but this email thing is complicated and I must have hit the wrong button or something.
Judge: Ok, but companies keep backup tapes these days. What happened to them?
Archen: Oh I just decided to leave all that stuff up to the users. I couldn't be bothered with buying more tapes and modifying my backup schedule. The backup tapes get over-written every week, and that email was from 3 weeks ago.
Judge: I see. Well you've obviously in violation of the ruling. I can't hold Dwayne here responsible since these systems are complicated, and data retention should be handled by someone specially trained. But since you made the decision, I'm holding the entire company responsible and fining you 1 million dollars. I'm also recommending to the federal prosecutor you be charged with obstruction of justice Mr. Archen. Destruction of data also won't help the case against you.
Re: (Score:2, Informative)
Re: (Score:2)
I'd print out and retain that message from the boys upstairs saying 'we can't afford this solution' or 'it doesn't apply to us.'
Oh absolutely. Print out that email, and send it to yourself registered mail. Then don't open it and keep it in your safe. It could quite literally be a "get out of jail free" card. My only point is an admin deciding that users should be in charge of retaining data is just foolish, short sighted, and could lead to a nice firing or worse.
Re: (Score:3, Interesting)
Re: (Score:2)
Aurthur Andersen got in trouble because they thought they were going to be subject to a good old Federal probing and someone said to go ahead and follow their document retention policy anyway even though they were asked about the possibility of an investigation, which conveniently enough was to start shredding anything older than a couple months or something like that.
I had thought that it was already
Re: (Score:2)
Think about that. Large companies are always going to be hit by this. Microsoft, Apple, Sun, IBM, General Motors, Ford, State Farm, Allstate... you name it, once they get large enough, there is always going to be a lawsuit or investigation either pending, or in progress. Some of these things can drag out for decades.
Re: (Score:3, Insightful)
Plan for it. If the government doesn't do it, the larger companies that have to will start forcing the government to go after smaller to midsized companies that aren't following the rules that they have to. Wh
Re: (Score:3, Informative)
The summary mentions companies "involved in federal litigation." If you are not involved in federal litigation (you're not being charged with a crime or sued or under subpoena), then you can do anything you like. The moment you become involved in federal litigation, you cannot destroy any electronic data, as it is discoverable by the court.
The fact that this is a new official rule shouldn't frighten anyone - this has bee
Re: (Score:2)
Scale that to the level of a company which probably exchange 5 times the same amount of e-mails, you face a real IT issue.
Re: (Score:2)
Not high volume lists (Score:2)
Exempt from all this of course (Score:4, Insightful)
Want to see the biggest crooks and ones fudging the numbers, look at congress. Enron couldn't come close. They all would have been locked up years ago if they had to abide by the laws they pass.
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
We live in a capitalistic society and therefore everything works on money. As such, every entity has a balance sheet (real or imagined) applied to it. Our government is no exception. Congress has its own budget, goals, and charter. The only way it's different from any corporation is
Re: (Score:2)
So... you want to pay $10,000 for a candy bar, is that it?
Re: (Score:2)
The minumum wage hasn't kept up with inflation in over a decade but the already-wealthy people in congress continue to get raises that outstrip it.
If you've got a better solution I'd like to hear it.
Re: (Score:2)
We're talking about a living wage, not getting rich doing menial labor. $5.15 here in michig
Re: (Score:3, Informative)
The $61 trillion in unfunded liabilities we currently have for Medicare ALONE. Medicare which is set to go bankrupt in 2018, Social Security in 40 years. "Emergency war spending" so that we can "pretend" we get "closer" to balancing the budget. Printing out gobs of money destroying the value of our savings so they can pretend to pay for all this shit
Please, if you think they are somewhat honest in how they present any of the ways they pay for or fund anything you are kidding yours
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Post office (Score:2, Insightful)
Re: (Score:3, Insightful)
That would be like making the post office open every letter then copy and store them...I guess it's not EXACTLY the same thing because it's all digital, but it's still illogical, and a waste of resources.
No, it's more like saying you have to permanantly store every piece of paper you ever write on. Every memo, every piece of scrap paper. It gets ridiculous eventually.
Re: (Score:2)
Misleading (Score:5, Informative)
This is a bit misleading. Its only "virtual shredding" if you don't keep the records around for a reasonable period (either by statutory requirements or insutry standards) or if you have notice of litigation in which the evidence is relevant, and you continue to shred.
Thats why there is a document retention policy safe harbor in the rules themselves.
FWIW, lawyers, even the "technology experts" don't seem to understand technology as well as someone who came through IT before becoming a lawyer.
(disclaimer: IT guy-turned-lawyer, so I always think I know more than "pure lawyers" when it comes to tech).
Re: (Score:2)
And of course as the PP mentioned, it also helps if your retention policy complies with the law.
Re: (Score:2)
Businesses aren't required to keep all data indefinately.
Microsoft (Score:2)
This will have to change, then.
Re: (Score:1)
Re: (Score:2)
The amendments (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Rising cost of business (Score:3, Insightful)
Re: (Score:2)
Legislated expense (Score:3, Interesting)
Couple that with the fact that the company I work for is a regulated utility that has to convince the local PUC each year that costs to provide service continue to go up, and the margins just keep getting tighter. Every year around March, there's a panic call from Accounting asking everyone to contribute some of their budget back to the bottom line because of some new development that wasn't forseen the previous year. For a cash-strapped IT department wanting to provide good service, the problems just mount up, stresses are high, and the employment door keeps revolving.
Re: (Score:2)
Therefore I view the IM storage requirement as a kind of unfair tax on businesses like yours. I mean take this far enough and what's next? Will the government require that digital recordings of all hallway conversations be m
Re: (Score:2)
Massive Pretty Good Privacy (Score:5, Insightful)
Your government can probably crack any nonsymmetric crypto (with help from the US), but might not have the resources to crack everyone's all the time. You can try a tinfoil hat, YMMV.
The real problem is webmail, which can't use any installed crypto on either end (with possible rare exceptions, but the rarity and/or nonintegration makes them useless at only one end of the comms).
If GMail let me upload a PGP applet I signed myself (which I could validate in the pages when I hit them), which they embedded into their pages in Javascript the public could audit for holes, they might actually become by far the best email system for the masses. And win the webmail wars. And really piss off the government(s) that have been trying to pry into their transactions for years.
Re:Massive Pretty Good Privacy (Score:4, Insightful)
Don't ever use "PGP" and "the masses" in the same sentence. There's a reason people don't use it unless they really need to. It's the hassle of exchanging keys and building a trust database, and getting people to use it as it should.
It's a very minor hassle for those who use it well, but getting the masses to follow protocol is next to impossible.
Re:Massive Pretty Good Privacy (Score:5, Insightful)
Re:Massive Pretty Good Privacy (Score:4, Informative)
http://www.squirrelmail.org/plugin_view.php?id=15
Re: (Score:2, Insightful)
Providing an easy interface for you to encrypt your email undermines that goal utterly. For it to be of any value to you, they won't ever have access to your keys or plaintext.
So, it will never happen with Gmail.
Re: (Score:3, Interesting)
I agree with your sentiments, but I think no one cares about encryption. For what it's worth, freenigma [freenigma.com] provides GnuPG webmail through a Firefox extension and an existing webmail account supported by freenigma (includes GMail, Yahoo, Hotmail, others). I have not used freenigma, but last time I read the docs I got the impression it was not compatible with, say, mutt's PGP/MIME which I use for kicks (I have zero encryption using friends).
One thing that always bugged me about mutt's PGP is that attachments
Re:Massive Pretty Good Privacy (Score:4, Funny)
413b57037 buying guide
replacement 6cf46e1dfc quote
fd8869a15cb936d8e59 Free Shipping!
bee5e2b at Amazon
Re:Massive Pretty Good Privacy (Score:4, Interesting)
Google is a US company and should a court request those keys.. they'd give them.
Re: (Score:2)
Like someone said, GMail exists to read email, and therefore the possibility of it supporting encryption seems unlikely... but, if a webmail were to support encryption, it could either store the PGP private key encrypted with a passphrase (storing neither the passphrase nor the decrypted emails permanently), or it could rely on browser support for performing all decryption. Still not unbreakable, but requires theoretically large resources and could probably not be done en masse.
I would love to see browse
Re: (Score:2)
Google's "do no evil" motto is the same "goodwill value" that any company wants to project. When there's a scandal about privacy invasion at Google, like the Bush admin tried to force on the pretext of "catching kiddi
Tape? (Score:3, Funny)
Might all this extra data clog the system of tubes that is the internet?
Re: (Score:2)
Re: (Score:2)
Standard Conversation (Score:5, Insightful)
Bean Counter:- How much do the tapes cost
Techie:- Lots - we need at least one DLT per backup
Bean Counter:- We can't afford it.
Techie:- We have to afford it
Bean Counter:- Just leave the requisition in my intray
Months Pass
Bean Counter:- The courts are on to us. Where are the e-mail backups for the 1st December 2006
Techie:- I had to overwrite them so as to keep a reasonabley current backup
Judge:- Techie, you shredded evidence - now you're for it
Re:Standard Conversation (Score:4, Insightful)
I've actually had that conversation with the bean counters, but it went like this:
Techie: We need $5,000 to buy another 100 DLT tapes to comply with this no-rewrite order.
Bean Counter: Again! We don't have any money in the budget to buy any more tapes
Techie: Ok, no problem. Send me an email and CC your boss and my boss and tell them that we can not comply to this federal ruling because we don't have any money in the budget.
Bean Counter: Erm.. Uh.. Oh! Here's some money for tapes you can have.
As long as the gun is pointing at them, they are very cooperative.
Obvious followup (Score:2)
I understand the intent of the law, but it's so easy to bypass
because most decisions and discussions are made outside the computer
in most businesses. And if a decision is going to have legal reprocussions,
you can be sure that it won't have a paper trail. I don't see how
this law can be enforced, unless you record all voice conversation
made by all employees (inside and outside the office) and ensure that
employees can't turn off
Re: (Score:2)
invest in storage (Score:3, Insightful)
Predictable (Score:1)
All Conversations (Score:2)
bad blurb (Score:2)
I can understand laws which requires retention for companies that log IMs. But they wouldn't pass a law requiring companies who do NOT log IMs to start doing so!
Legacy systems (Score:2)
A lot of companies will have to change (Score:1)
This is plain old FUD... heavy on the 'F' (Score:2, Informative)
This is not legislation.. it is part of the court rules. In a lawsuit, you have to provide all relevant documents to the other side. In the past, there had to be a *lot* of court time wasted on deciding what was subject to disclosure (i.e. a man does work for the company from home... is his home computer subject to examination? Answer: yes)
Stupid thing! (Score:4, Insightful)
And storing them is not enough: you'l need to browse them for searches!
This is a very very smart move!
And when litigations will go with browsed web pages, we'll need to store all the web we browse!
Re: (Score:2)
Disk space is cheap. I can't wait to have a browser that caches my life's search history and lets me search it. Cryptographically, of course.
Encryption (Score:2)
Can do a pub/priv key exchange or just use a symmetric key and do a Diffie-Hellman exchange. Changes text colour based on authentication type, warns you about possible compromises, etc.
I have nothing to do with the company it is just something i
What about spam? (Score:2)
Exchange 2007 (Score:2)
Microsoft set a internal policy for delete after a year ( i think, could have been 2 ) after being burnt in court due to old emails..
I was wondering when this would happen.
Copy of the Ruling with Legalese? (Score:2)
So far, our department has taken on the impression that this doesn't affect them because they are not a public company (though we are an ASP for many companies that are, and host their data). They have NO legal policy governing data protection or r
Re: (Score:3, Insightful)
Maybe avoiding tortious conduct might be a better idea?
Re: (Score:2)
Hahahahahah... this is America. Looking at someone the wrong way could be tortious. Hence, the cautions and warnings. Plus, we're in the insurance biz. Like there's no lawsuits there huh?
Better get your infrastructure ready (Score:2)
1) These new rules apply to the discovery phase of a trial. Any trial. That means if you do business with a company that is being sued or one of your employees is being sued you're under the "discovery umbrella" and can be held accountable if you can't provide requested documents.
2) If your company we
Re:Nice; tell you about new rules, just not the ru (Score:2)
Re: (Score:2, Interesting)
The scariest parts of the new federal rules are:
Re: (Score:2)
Re: (Score:2, Interesting)
Re:Nice; tell you about new rules, just not the ru (Score:3, Informative)
Re:Nice; tell you about new rules, just not the ru (Score:3, Informative)
This only applies to compaies [myway.com] under federal litigation, but I'm sure it'll get a lot more pageclicks if you make it sound terrifying and scream things like WE'RE ALL GONNA DIE!
Truth time, kiddies! You absolutely must hold on to email and IM data... IF it is part of a subpoena or a discvoery process, and so on. But there's nothing requiring companies to hold on to such data for any specified period of time.
Re:Nice; tell you about new rules, just not the ru (Score:4, Informative)
Re: (Score:2)
That really doesn't work with the new ruling. In order to comply with it, we will need to create a policy that's real and adhered to. So yes, the ruling effects everyone. It only changes things for some.
As the summary says... (Score:5, Funny)
Odds are you already know if you're one of these.
(Use your best Jeff Foxworthy voice for this next part)
"If your CFO has been escorted out of the building on the national news by people with big yellow letters on their backs..."
"If the new guy in the office spends all his spare time chatting up his sleeve instead of the secretary..."
"If your office phone system now says Press 1 for Customer Service, Press 2 for Public Defenders..."
"If they show Dennis Kozlowski on Biography and your boss snorts "Huh. Pikers..."
"if you check your email and a cheery voice announces "You've got bail!"
Re: (Score:1)
Links to the rules (Score:4, Informative)
The pertinent rules appear to be the Federal Rules of Civil Procedure, specifically Rule 16 dealing with pretrial scheduling and Rule 26(f) relating to discovery and disclosure.
Cornell University has these rules online. They might be outdated already.
Rule 16 [cornell.edu]
Rule 26 [cornell.edu]
Wikipedia also has a writeup on the Federal Rules of Civil Procedure [wikipedia.org].
Do a search for rules on electronic discovery [google.com] for more commentary.
Re: (Score:3, Informative)
Re: (Score:2)