Taking the Cost and Risk Out of the Inbox: Why the Unchecked Growth of Electronically Stored Information Is Unsustainable
Jeremy Barnes, Open Text Corporation

Because e-mail just keeps on coming, one dreams of stemming the flow. Despite its unparalleled corporate value — facilitating business across geographies and time zones in ways once simply impossible — the mismanagement of e-mail has created overwhelming problems and unsustainable practices in companies of all sizes. Still, we cannot function without it.

The massive volume of electronically stored information, including e-mail, creates increasingly complex and daunting challenges. Organizations invariably come to terms with a disheartening reality:
Substantial corporate costs and risks, particularly those incurred throughout the e-discovery process, directly correlate to the volume of content retained. Indeed, given the process of hiring outside service providers to identify and collect content, and the billable fees incurred by lawyers to review information for relevance and privilege, it makes sense that every expense is intensified by the volume of content involved.

Unfortunately, when most companies begin to evaluate their legal situation, they realize they’ve wound up on the horns of an e-discovery dilemma. Companies must secure and retain information or face fines and sanctions associated with the destruction of electronic evidence. Saving too much information, however, drives up costs.

This is why many companies eventually endeavor to dispose of unnecessary electronic information — that is, to determine what content should or must be kept — and aggressively purge everything else. It becomes a balancing act of risk tolerance: What do we believe we can responsibly dispose of, and how do we ensure the rest is kept appropriately?

Not All Email is Created Equal
Common sense helps us appreciate the cost and risk of adopting a “keep everything” mentality. And fortunately, we are not legally obligated to. The Federal Rules of Civil Procedure in the United States, in particular Rule 37(E), have clearly established such a “safe harbor”:

Failure to Provide Electronically Stored Information:
Absent exceptional circumstances, a court may not impose sanctions under these rules on a party for failing to provide electronically stored information lost as a result of the routine, good-faith operation of an electronic information system.

Many organizations interpret this guidance to mean that they may dispose of unimportant information, so long as they have done so in a documented and systematic manner. Legal provisions like these allow us to feel confident in practices that routinely purge such transitory e-mail messages. However, in order to implement such practices responsibly, companies are expected to:

• Maintain policies that clearly describe their practices, and be able to demonstrate that IT systems function accordingly
• Have the capacity to safeguard any potentially relevant information, i.e., to disable such practices at a moment’s notice

Many companies generally adopt a framework that identifies three major “categories” of e-mail: transitory, intended records, and business value.

• Transitory — Many of the messages exchanged on a daily basis bear no long-term value to the company, and some are not related to business activities at all. Out-of-office replies, reminders to attend social gatherings, brief thank-you messages, and the like clutter inboxes and create noise that makes it difficult to find and work with the information that actually has value.

• Intended records — In many industries, users send and receive messages that the organization mandates should be captured and retained in accordance with policy, such as discussions around potential acquisitions and contract-related correspondence. Activities such as these can generate important and sensitive content that companies might be later compelled to produce, which means that messages of this nature demand to be identified as intended records of the company or the firm and retained in accordance with policy.

• Business value — Finally, some of the messages sent and received as employees are not formal records of the company, but serve some purpose to us in doing our daily jobs. These e-mail messages can’t be considered transitory because they do have business value, and we need them to do our jobs optimally.

Many companies typically establish general guidelines around how each category is managed:

• Transitory information is retained only for a relatively short time frame, such as 90 or 180 days.

• Intended records are retained wholly in accordance with what policy dictates. For example, content related to HR matters might be required to be saved for seven years following the termination of the associated employee.

• Business value content is typically retained for an extended time period, based on company policy, such as two or three years, during which time ongoing retention or deletion can be left to user or attorney discretion.

If You Don’t Have Time to Do it Right, Will You Have Time to Do it Over?
When most organizations first consider e-mail retention, they haven’t yet realized the cost and risk impact. This is largely because many different factions in a corporation experience the burdens of messaging growth. Not surprisingly, the first to incur symptoms of e-mail excess is the IT department, as server space is devoured and system performance degrades.

To resolve their problems, IT departments have commonly invested in and implemented conventional e-mail archiving technologies — those that extract messages from the mail environment and store them in a more suitable place, while providing users with ongoing access to their messages.

Organizations often find themselves re-evaluating the investment after several years’ time, with many discovering that terabytes upon terabytes of content have been accumulated arbitrarily and that they are uncertain if the information has any business relevance.

When such technologies were initially implemented, companies sidled up to a strategy that mandated the deletion of messages after they had been kept for a static number of years. What seems like a good idea to IT is, of course, not always in the best interest of the corporate legal department or the firm. With large-scale litigation in the headlines every week, and mismanaged e-mail the centerpiece of electronic evidence, lawyers realize that it is neither responsible nor defensible to delete information merely because it has reached a certain age.

Organizations can really only delete e-mail when it is clearly demonstrable what business relevance that information holds, and that its disposal is performed in good faith and in accordance with policy. This is why companies find themselves in a precarious and pressing situation: An inability to ever delete any information leaves the organization floundering in a mire of unchecked content growth.

The challenge is no longer simply curbing the cost of storing e-mail, but instead, minimizing the risk associated with keeping it.

Identify the Right Approach to E-mail Retention
Companies take many different approaches to the capture of e-mail messages. There is, of course, no single strategy that fits the business environment and risk tolerance guidelines of every organization. Thus, it is critical for companies to understand the cost and risk implications, as well as the business impact that any approach might incur.

The Chronological or Role-Based Approach
Some companies adopt a chronological approach to determining which e-mail messages to save. For example, they might provide users with simple retention “buckets,” such as mail folders labeled “Three Years,”“Five Years” and “Seven Years,” and then instruct users to place e-mail messages into those folders accordingly. Other companies consider a role-based strategy; they might capture and save e-mail from IT staff for one year, e-mail from sales staff for three years and senior management’s e-mail for seven years.

Both approaches share the same fault — the e-mail retention policy is not based on the content of the actual messages. In other words, e-mail is being saved simply because it is e-mail. Companies who adopt such practices typically find that employees do not think in terms of a simple time-based retention; instead, people in their daily jobs, such as a decision or they think in terms of what messages actually represent. So, not surprisingly, most users will simply place everything into the folder with the longest retention since that is the safest and easiest decision. Similarly, basing e-mail retention solely on a user’s role within the company is flawed because users often have many different roles. This creates dotted lines that complicate not just their reporting structure, but also the information with which they work.

The Content-Based Approach
Other companies adopt a content-based strategy. For example, matter-related messages are identified as such and inherit a retention period appropriate for content of this type — perhaps being saved for 10 years following the completion of the matter. A content-based strategy is typically optimal because it gives organizations a better sense of what information has actually been retained and more granular control over ensuring content is kept and disposed of in a structured fashion.

Some organizations pursue a strategy characterized by users making overt decisions to identify the e-mail messages that should be kept, meaning messages are transparently captured into a managed environment and retained in accordance with policy.

Other organizations investigate possible options for an intelligent system to evaluate content and make a determination on behalf of the user.

It is plausible that an intelligent engine could, perhaps, identify and capture some intended record messages, because such e-mail messages might have a contract attached to them, and an intelligent system could compare the contract to a “sample contract” that had been used to train the system. Or outgoing e-mail messages might have a client or matter number inserted into the subject line, which the system could examine to trigger classification.

Consider that e-mail is notoriously contextual and often deliberately vague. What has business value to people in their daily jobs, such as a decision or approval, could contain just a few words, making it very difficult for an automated system to identify as useful to keep.

Furthermore, if our policy is to purge transitory e-mail in an aggressive manner, but the system fails to mark business value content for retention, we’ll ultimately end up disposing of messages that were important to both users and to the business. And of course, as a consequence, most users will take their own measures to ensure this doesn’t happen again — circumventing the system altogether!

The most common argument that a user-involved approach is doomed to failure is that employees will never take the time. Such a stance more or less ignores the blatantly obvious. After all, each of us has felt the frustration of trying to find an important e-mail message and can relate to the time and effort spent sifting through thousands of irrelevant messages. As employees, we both envision and crave a world where we manage our information better. What we lack is not the inclination (in our personal lives it’s second nature to describe and tag our content on websites like Flickr), but the mechanisms to make it easy and that don’t require us to change the way we work.

E-Mail is Costly – But it Doesn’t Have to Cost You Everything
While user engagement and adoption are ultimately both the source and measure of a successful e-mail management project, it is the bad publicity and financial hardships associated with poor practices that are often the primary catalysts for an e-mail management initiative. Successful e-mail management projects are underscored by three fundamental tenets:

• E-mail represents corporate risk and liability. Left unchecked, mismanaged e-mail invariably drives up legal costs.

• Not all e-mail is created equal, and accordingly, not all e-mail needs to be retained. Organizations can have the capacity and confidence to curb costs by purging unimportant information in a timely manner.

• Empowered and trained users are the cornerstone of a measured and sound approach to e-mail management. Legal risk and business impact ensue from excluding users altogether.

That said, the one approach that can be graded conclusively insufficient is to simply do nothing — to establish no corporate policy and simply leave it entirely to whim and circumstance what is retained and what is destroyed. Today, an organization unwittingly adopting this approach might find themselves in good, but dwindling, company — a surprising and alarming percentage of organizations still have no measured and decisive approach to e-mail management. But as lawsuits garner media attention, and poor practices draw the ire of trial judges, companies can no longer afford to ignore the problem.

About the Author
Jeremy Barnes holds worldwide responsibility for Open Text’s e-mail management, including business planning, go-to-market execution and product strategy. He has been with Open Text for six years, serving in a variety of marketing functions with a particular focus on records management, compliance and e-discovery. Jeremy can be reached at jbarnes@opentext.com.