For years I’ve advocated a policy of archiving enterprise email centrally, under the control of the IT department. I wish to refine my position. First, in this note I review my argument for archiving email centrally. Then I discuss whether centralized archiving should apply to records other than email.
Argument for Centralized Archiving of Email
I often cite Disability Rights Council of Greater Wash. v. Washington Metro. Area Transit Auth.
In that case a transit authority suffered because it directed individual employees to preserve certain emails under litigation hold while a lawsuit was pending. The individual employees were inept at preserving the emails; therefore, emails were lost. The court concluded the transit authority had misbehaved. The court forced the authority to engage in an expensive search through backup tapes to recover deleted emails.
I’ve argued the transit authority would have done itself a favor if it had installed an archiving system. The archiving system would have pulled email records into a central facility under the management of the IT department. It would have avoided relying on individual employees, who are not experts in records management, to manage their legal records.
Email is Suited for Central Archiving
I’ve further argued that email is especially suited for centralized archiving because:
(1) email is a well-defined class of data;
(2) in the modern enterprise, email is a critical, if not the dominate, form of communication among employees and managers;
(3) email tends more often to be relevant to litigation and official investigations compared to all the other data in an enterprise (The reason is that email documents what people are thinking and saying, in chronological order.);
(4) email records tend not to be voluminous compared to all the other data in an enterprise; and
(5) numerous products on the market economically support centralized archiving and searching of email.
In other words, creating a central email archive reduces ediscovery and investigation risk by targeting a key class of records for disciplined retention and searching.
Non-Email Digital Records
But what about all the other electronic records in an enterprise? They too can be needed in litigation, and they can be scattered far and wide. Should they be migrated into a central archive?
That could be a tremendously large archive, which would dwarf an email archive. Creating and maintaining that archive could be a massive undertaking. Generally speaking, such an archive does not make sense.
Search Solution for Distributed Data
John Patzakis at X1 Discovery makes an interesting argument. He argues against pulling all that miscellaneous data into a central place just so you can be prepared for litigation and official investigations.
He argues that if and when an enterprise is required to search that scattered, miscellaneous data, there is no need for it to be in a central place. A technical solution designed for searching diverse data in a big, distributed network (or the cloud) can be deployed to go find the data.
That makes sense to me.
I must note that John’s company sells such a search solution. I have no experience or connection with it.
Other Central Archives
In different enterprises, other select classes of records may be good candidates for central arvhival on account of the long-term legal and regulatory value of the records. In a hospital, such records might be patient records. In an accounting firm, they might be audit work papers.
–Benjamin Wright
Mr. Wright teaches the Law of Data Security and Investigations at the SANS Institute.
Related Post: Email Records to Answer Audit Demands
Argument for Centralized Archiving of Email
I often cite Disability Rights Council of Greater Wash. v. Washington Metro. Area Transit Auth.
In that case a transit authority suffered because it directed individual employees to preserve certain emails under litigation hold while a lawsuit was pending. The individual employees were inept at preserving the emails; therefore, emails were lost. The court concluded the transit authority had misbehaved. The court forced the authority to engage in an expensive search through backup tapes to recover deleted emails.
I’ve argued the transit authority would have done itself a favor if it had installed an archiving system. The archiving system would have pulled email records into a central facility under the management of the IT department. It would have avoided relying on individual employees, who are not experts in records management, to manage their legal records.
Email is Suited for Central Archiving
I’ve further argued that email is especially suited for centralized archiving because:
(1) email is a well-defined class of data;
(2) in the modern enterprise, email is a critical, if not the dominate, form of communication among employees and managers;
(3) email tends more often to be relevant to litigation and official investigations compared to all the other data in an enterprise (The reason is that email documents what people are thinking and saying, in chronological order.);
(4) email records tend not to be voluminous compared to all the other data in an enterprise; and
(5) numerous products on the market economically support centralized archiving and searching of email.
In other words, creating a central email archive reduces ediscovery and investigation risk by targeting a key class of records for disciplined retention and searching.
Non-Email Digital Records
But what about all the other electronic records in an enterprise? They too can be needed in litigation, and they can be scattered far and wide. Should they be migrated into a central archive?
That could be a tremendously large archive, which would dwarf an email archive. Creating and maintaining that archive could be a massive undertaking. Generally speaking, such an archive does not make sense.
Search Solution for Distributed Data
John Patzakis at X1 Discovery makes an interesting argument. He argues against pulling all that miscellaneous data into a central place just so you can be prepared for litigation and official investigations.
He argues that if and when an enterprise is required to search that scattered, miscellaneous data, there is no need for it to be in a central place. A technical solution designed for searching diverse data in a big, distributed network (or the cloud) can be deployed to go find the data.
That makes sense to me.
I must note that John’s company sells such a search solution. I have no experience or connection with it.
Other Central Archives
In different enterprises, other select classes of records may be good candidates for central arvhival on account of the long-term legal and regulatory value of the records. In a hospital, such records might be patient records. In an accounting firm, they might be audit work papers.
–Benjamin Wright
Mr. Wright teaches the Law of Data Security and Investigations at the SANS Institute.
Related Post: Email Records to Answer Audit Demands
