In-Depth
Where’s Your E-mail?
- By Alan Radding
- August 1, 2005
Talking Points
PAY NOW OR PAY LATER
- E-mail is a double-edged sword: Companies cannot function without it, but
they fear the availability or unavailability of e-mail, especially when a
judge asks for it, can have devastating consequences.
- Even when large sums of dollars are not at stake, the importance of e-mail
archiving and search, especially when a judge, regulator or litigation lawyer
is involved, can be great.
- Despite 5 years in the regulatory spotlight, the e-mail management market
is only now starting to emerge.
If management needs a good reason to invest in e-mail archiving and searching,
try this one: $1.45 billion.
This past spring, a jury awarded financier Ronald Perelman $1.45 billion in
damages ($604.3 million in compensatory damages and $850 million in punitive
damages) in a long-running dispute with the investment firm Morgan Stanley.
Regardless of the merits of the case, the judge in the case switched the burden
of proof from Perelman, the plaintiff, to Morgan Stanley when the investment
firm was unable to produce some e-mail the judge had specifically ordered. Usually,
it’s the other way around: The plaintiff must prove its case.
|
Beset by an onslaught on corporate governance mandates, SEC regulations and
a more litigious environment, managers are wrestling with how best to manage
their e-mail. E-mail is a double-edged sword: Companies cannot function without
it, but they fear the availability or unavailability of e-mail, especially when
a judge asks for it, can have devastating consequences. Clearly some form of
e-mail management is needed.
E-mail forensics quagmire
It is not difficult for a company to miss e-mail messages if it is relying on
conventional backups of its e-mail servers. Conventional backups lead to a potential
e-mail forensics quagmire. Some observers speculate that is exactly what happened
to Morgan Stanley. The e-mail forensics quagmire occurs when evidence of an
e-mail message surfaces during litigation. If the company can’t deliver
the e-mail and all related e-mail, it finds itself sifting through possibly
years of backup tapes, each representing a brief point in time, to find the
sought-after e-mail messages.
“All it takes is one person to take an e-mail message home on their laptop
and delete it,” says John Hegner, vice president for technology at Liberty
Medical Supply. Somebody knows that message once existed because it was sent
by someone to someone, regardless of whether it was deleted. However, if it
wasn’t captured and saved in a central archive, the organization may find
itself plunging into the e-mail forensics quagmire, painstakingly sifting through
millions of messages to find it.
Liberty Medical decided to avoid the potential quagmire by adopting iLumin,
an e-mail management and archiving product with a discovery feature. iLumin
captures every e-mail message as it arrives or is sent and stores a copy of
it in a protected, indexed archive. When Liberty Medical receives a litigation
discovery request, which happens a few times a year, it simply turns to the
archive. Even if a user were to delete a copy of an e-mail, it still would be
in the archive.
“We wanted to be proactive and avoid the kind of problems others encounter,”
says Hegner. The search takes seconds. The rest of the time is spent validating
and de-duplicating the messages and packaging them for review and delivery.
The whole deal is wrapped up within hours.
The demand for e-mail management
Even when large sums of dollars are not at stake, the importance of e-mail archiving
and search, especially when a judge, regulator or litigation lawyer is involved,
can be great. Microsoft, no stranger to litigation, suffered a major setback
this spring when a federal judge in Baltimore cited an e-mail from 1997 in his
decision to allow two of Novell’s claims against Microsoft to proceed.
The now-infamous e-mail details Microsoft’s view of desktop applications
as the key in its strategy to protect its Windows franchise by effectively locking
out competitive Windows applications.
In both the Morgan Stanley and Microsoft cases, e-mail proved crucial. “Compliance
has become a critical e-mail issue thanks to the problems of Morgan Stanley
and others,” says Kenneth Chin at Gartner. Under the compliance banner,
Chin lumps regulatory compliance, litigation and legal discovery, which is the
process by which lawyers for the opposing side are allowed to rummage through
an enterprise’s files in search of relevant evidence. If a lawyer requests
all the e-mail messages pertaining to a certain subject or involving certain
individuals, and the organization can’t deliver them, there can be serious,
quite costly consequences, as Morgan Stanley discovered.
Although many managers cite compliance concerns as the reason for their e-mail
archiving and searching, they are speaking about regulatory or court-ordered
compliance in a general sense. Sarbanes-Oxley calls for internal controls to
ensure the accuracy and integrity of the reported information, but unlike SEC
regulations, it does not specifically mandate e-mail archiving. Still, experts
are advising companies to institute e-mail management as part of a general Sarbox-inspired
effort to improve their internal controls. Even organizations not subject to
Sarbox may want e-mail archiving in the event they are involved in litigation
and its ensuing discovery.
Rising fears of litigation alone should spur action. Gartner recommends that
companies “must address their e-mail retention and management needs now,”
as Chin writes in an e-mail management report.
In 2004, according to the Radicati Group, the average corporate user sent and
received 14.7 MB of e-mail data per day in 2004, up 53 percent from the previous
year. A company with 10,000 employees, each averaging 84 e-mail messages a day
plus attachments, works out to nearly 220 million e-mails plus attachments per
year, or more than 38 TB of data.
Despite 5 years in the regulatory spotlight, the e-mail management market is
only now starting to emerge. Today, Gartner estimates the e-mail management
market, which encompasses mailbox management, archive management, compliance
support and discovery, at $88.6 million worldwide in 2004, a more than 100 percent
increase from $35.3 million in 2003. “We expect significant growth in
2005 as well,” says Chin.
Emergence of e-mail management tools
The numbers seem small, especially in light of the Morgan Stanley judgment.
“This isn’t new. It’s been going on for at least 5 years.
We got our first tool, SRA, in 1999,” says Chu Abad, vice president of
technology for Seattle Northwest Securities.
Chin, on the other hand, insists the market is young and immature and is yet
to take off. “This is still a new market. New players are coming into the market
from data archiving. We also expect to see new players coming into the market
from among the enterprise content management players,” he notes. In the long
run, he expects e-mail management to converge with records management. (See
related story, “E-mail
management tool landscape.”)
At the other end of the scale are search engines such as ISYS’ indexing
and searching tool, which includes sophisticated Boolean and proximity logic,
for e-mail that can be integrated into other systems using a software development
toolkit. Seattle Northwest purchased SRA’s Assentor, an e-mail search
tool, at a time when there were few e-mail management tools on the market and
fewer that could do the robust kind of searching financial services most companies
need.
“Most of the tools were geared to e-mail archiving. Assentor [now iLumin]
could do compliance searching. You could give it key words and it would flag
those words,” says Abad.
In late 2002, Assentor was the dominant message screening and archiving tool
for financial services firms that were scrambling to ensure they could comply
with SEC mandates. SRA reported a client base of more than 80 firms for its
Assentor product. These firms collectively supported more than 200,000 users
in the financial services industry.
Seattle Northwest liked Assentor because it used text mining to review the
content of electronic correspondence. This enabled financial services companies
to screen every e-mail, thereby protecting themselves against unauthorized communications,
as required by industry regulations. Seattle Northwest has never been the target
of litigation or a regulatory compliance investigation, so it has not had to
test under fire its e-mail searching capabilities.
However, it has played tangential roles in litigation between others when it
has been asked to search its e-mail archive. It gets a few such requests a year.
And, of course, its auditors regularly test the firm’s e-mail search capability
during regular audits of its entire e-mail management process. “They want
us to demonstrate that we have this capability,” Abad notes.
Prior to getting Assentor, Seattle Northwest simply archived its e-mail on
optical disks. “Searching for e-mail was a complex process back then,”
Abad recalls. The administrators had to keep popping optical disks in and out
of the disk drives. A search could take an entire week. With iLumin, “it
is a lot easier,” he adds. The company can fulfill a complex search request
in a day. Seattle Northwest uses the iLumin product in conjunction with Permabit’s
Permeon electronic storage vaulting product that uses write once/read many and
low-cost ATA disks.
E-mail management alternatives
While e-mail management indeed is widely recognized among financial
services firms as a critical survival technology, many of the firms, especially
small and midsize firms, are not necessarily inclined to spend the big money
some e-mail management products command. Many of them are finding different
ways to solve the problem.
“We are not using an archiving tool. We looked at them, but the cost
is pretty significant. You could end up paying $500,000, which is a bit pricey,”
says Josh Wopperer, network engineer, UVEST Financial Services, which provides
services to banks.
Instead, the company took a homegrown approach, something Wopperer suspects
many other financial services firms are doing. “When we archive our e-mail,
we also copy it to a SQL database. Our programmers set up all the criteria for
archiving,” he explains. The database contains only the e-mail the firm
is required to keep, and the programmers can tap the power of SQL to search
the archive in response to any court, regulatory or litigation request. The
SQL database is stored on UVEST’s EqualLogic SAN. The e-mail volumes are
then replicated to UVEST’s disaster recovery hotsite to ensure full protection
of the e-mail as required by the regulators.
NASDAQ handles tens of thousands of e-mails per day. It too must comply with
demanding rules requiring it to archive and protect mail messages and be able
to find them quickly should the need arise. It turned to a high-performance
storage archiving and retrieval product, Hewlett-Packard’s StorageWorks
Reference Information Storage System.
The NASDAQ system stores, indexes and rapidly retrieves not only e-mail but
voice mail as well. The system supports 4 TB of data and provides a foundation
for the company’s overall information lifecycle management strategy.
Still, the most common approach to e-mail search remains backup and restore
from tape. Many, if not most, organizations rely on their backup process for
what amounts to archiving, search and retrieval, says Jeffrey Hausman, director
of product marketing for Veritas Enterprise Vault.
In the backup-and-restore approach, the company makes a full backup of its
data, including its e-mail archive, then it makes incremental backups daily.
The backups are regularly shipped offsite for safekeeping and disaster recovery
until the point when more recent backups replace them. At this point, they are
trucked off to a vault for long-term storage. This is the normal corporate backup
process companies have relied on for years.
This approach, however, directly leads to the e-mail forensics quagmire, but
the company doesn’t know it until it gets a request for particular e-mail
messages relating to, say, a certain transaction or person. Now, the organization
has to restore large chunks of this vast store of data from full and incremental
backups, to find what amounts to the proverbial needle in the haystack. This
entails retrieving the tapes from the offsite vault, mounting and restoring
the volumes, then searching for the relevant messages.
The process could take weeks or months and eat up many hours of labor. And
still it may not be nearly fast enough to satisfy the courts and the regulators.
Or, if you don’t find everything, well, just ask Morgan Stanley.
Beyond compliance and litigation
Although regulatory compliance and litigation remain the high-profile applications
for e-mail archiving and searching, there are other reasons that organizations
want to manage their e-mail. For Direct Media, a catalog marketer and mailing
list broker, the sheer size of the e-mail archive first drove it to e-mail management.
“We have a lot of big attachments with our e-mail,” says Kevin
Ladd, director of infrastructure. The company, which has 200 employees, had
200 GB compressed worth of e-mail in April, and it is growing at the rate of
10 GB compressed each month. Some of the attachments alone exceed 10 MB.
The large volume of e-mail bogs down the company’s Microsoft Exchange
servers. In addition, users try to keep more of the e-mail in their Windows
PST files, which causes additional problems. “When PST files get over
2 GB, the folder gets unstable. People could end up losing data,” Ladd
explains. In addition, the files, uncompressed, were eating up a lot of storage
capacity, forcing the company to buy more. Efforts to enforce policies and set
quotas proved ineffective.
“There are problems with setting quotas,” Ladd notes. After using
up its direct-attached storage and most of an EMC CLARiiON FC-4700 array, the
company turned to a new EMC SAN and Veritas’ Enterprise Vault e-mail management
software.
“It was a question of getting Vault or buying even more disk,”
Ladd says. Vault hooks into Microsoft Exchange, moves messages into a separate
storage area, compresses them and archives everything. It leaves a shortcut
for users who come looking for their messages. “The users don’t
notice a thing,” he adds.
Vault also provides powerful search capabilities. “Our business runs
on e-mail. Users are always looking through their e-mails, trying to find a
quote they gave or something,” Ladd explains. Vault indexes the e-mail,
which enables very fast searches—usually less than 2 seconds, he reports.
A variety of search tools let users do broad and highly targeted searches.
The company has never been involved in litigation that necessitated a search
of e-mail for the purposes of legal discovery. Veritas Vault, however, offers
compliance and discovery modules. “We don’t use the compliance or
discovery now, but if we ever get a request, I’m calling Veritas immediately,”
says Ladd.
That’s probably the attitude of most managers at companies today. Unless
they are directly under the gun of a regulatory mandate requiring e-mail archiving
and searching capabilities, they are likely to wait until they find themselves
involved in litigation and facing the possibility of e-mail discovery.
Unless the market develops faster than it has up to this point, however, when
that first request for discovery comes, they may not find a lot to choose from.
Sidebar: E-mail management
tool landscape
Sidebar: Leading e-mail
management providers
On ADTmag.com
When Corporate Lawyers
Attack
By Stephen Swoyer
IBM Releases Spam-Fighting
Tool
By Linda L. Briggs
Meeting Demand for E-mail
Encryption
By John K. Waters
PHOTO BY AMERICAN IMAGES INC.