Next Generation Email Archiving Appliances WHITE PAPER 8 Wellington Street East, Mezzanine Level, Toronto, Ontario, CANADA, M5E 1C5 Tel: 416.840.0418 1.888.JATHEON (1.888.528.4366) Fax: 416.849.9971 info@jatheon.com
2 Introduction The business world we live in has changed dramatically over the last two decades. Advances in technology have changed the way business is done forever, especially the way we communicate. Communication has quickly moved to a virtual, paperless plane, one in which both short commands and large amounts of information can be transmitted in seconds from one location to another, anywhere in the world. This communication transformation has had both positive and negative repercussions. Our efficiency and work capacity have increased exponentially, thanks to the advent of email and instant messaging. But, as often happens with emerging technologies, sometimes our full understanding and ability to manage these new operating paradigms comes later. As companies adopt and benefit from messaging technologies, they also struggle to define the parameters for their appropriate use. Forcing the issue are governing bodies and regulators in all industries, who have imposed strict requirements on the storage and management of messaging data in response to ground breaking lawsuits in recent years. Organizations of all sizes are now realizing that creating a corporate email archive is no longer a luxury, but a necessity in today s regulatory environment. What may seem an overwhelming prospect, however, should also be viewed as a key tool in creating a company s strategic advantage. The prospect of email archiving need not be daunting due to the incredible growth in this market, there are easy and affordable archiving options for companies of all sizes. In this whitepaper we examine, one of the main functions of email archiving, and its role in compliance and meeting litigation requests.
3 What is? Electronic discovery, better known as, is the process in which any electronic data is sought out, located and searched with the intent of using it in a court case as evidence. takes place in the pre-trial phase of litigation and is simply the extension of the discovery process to include any Electronically Stored Information (ESI) that an organization may hold. This ESI includes email, spreadsheets, word documents, contracts, social media posts and messages and any other form of communication or information that may be used in a civil legal action. can therefore also include any device where ESI is stored such as: desktop computers, laptops, phones, tablets, backup tapes, servers, and even employees personal computers and other devices. Electronic information is considered different from paper information because of its intangible form, volume, transience and persistence. Electronic information is usually accompanied by metadata that is not found in paper documents and that can play an important part as evidence (for example, the date and time a document was written could be useful in a copyright case). The preservation of metadata from electronic documents creates special challenges to prevent spoliation. Each party is allowed to request electronic documents as evidence in a trial. Essentially this is the modern way of following the paper trail. However, because we might be able to conveniently forget a certain piece of evidence, we are mandated to store email in email archiving appliances electronically, which can t be altered. There is no way around this as regulations have become increasingly strict on the matter. Those who don t prepare for can face hefty fines and penalties and even court cases if they are caught.
4 Consider a scenario in which a lawsuit is pending and all emails connected with a particular client are being reviewed, by your lawyers, the opposing party s lawyers, or both. What can and has taken months of billable hours by a team of lawyers and IT professionals can literally take minutes through a keyword search of an email archive. In this scenario, three outcomes are possible: Good News An email, IM, or user file is found that proves the company is innocent of wrongdoing in the case. Bad News A smoking gun email, IM, or user file is found that implicates the company or confirms its guilt. No News No confirmation of guilt or innocence is found. With all three outcomes, early knowledge is extremely important. If bad news is indeed uncovered, it s to the company s advantage to know this early on. Often the strategy is to settle on the case, thereby saving on legal fees. If good news is the result, this can quickly be shared with legal advisors for the opposition, who may opt to end the lawsuit. If no critical information is found, the company can proceed as necessary, secure in the knowledge that there will be no hidden surprises along the way, While complying with may seem like excessive work, it is a legal obligation to keep data archives of all sensitive data.
5 The Challenges of The total amount of digital information created worldwide grew from 494 billion gigabytes in 2008 to 800 billion gigabytes in 2009 to 1.2 zettabytes (1,200 billion gigabytes) in 2010. This represents growth in digital content of 50% or more, even during a year marked by a significant worldwide recession IDC s estimate of the total number of business-to-business and business-to- consumer transactions by 2020 will be 450 billion each day. IBM estimates that 15 petabytes of data is created every day. The American Records Management Association (ARMA) has estimated that more than 90% of records created today are electronic. More than 70% of electronic information is never printed. Email is still one of the most common forms of crucial data produced by organizations. Email is still one of the most common forms of crucial data produced by organizations. It would be easy to think that technology has made an easy task but it does present many challenges. It can cost a lot of time, effort and money to respond to requests. But there are some ways to manage these challenges effectively: For a long time the IT department had little to no involvement with. However, the IT department is now becoming responsible for data management in many organizations. This is because the volume of digital data is growing so fast and IT departments are usually the best equipped to deal with it. Data growth is exponential in both the private and public sectors. It is now a major challenge to manage data storage and archiving across a company network, especially because data storage mediums have evolved and remnants of old
6 technologies can be found mixed in with new technologies. Is your organization still using disk and tape data backup and archives? adds a whole new level to the complex management of data. The challenge with is that all fast growing data archives must be ready for compliance, and the IT department needs control of this data for data restoration purposes and costeffective storage management. Understandably, IT departments have been reluctant to take on these responsibilities as the combination of data stores and compliance duties can equal one big mess. But there is no way to avoid it anymore. The fines and court action associated with poor are too large to ignore. Overcoming these Challenges The good news is that there are solutions available to ensure coherent data backup and data archiving for. Email archiving solutions will reliably store messages and make them available for at a moment s notice. All-in-one appliances are easy to install onto a network and really take the workload off the IT department in the process, enabling them to get on with more important tasks. By installing an appropriate email archiving and system you can negate the effects of the challenges faced, reduce costs and effort and most importantly protect your business from non-compliance sanctions. Compliance An increasingly litigious environment surrounding the use and storage of email and other messaging data has affected companies in virtually all industries. Failures in finding, saving and sharing emails are bedevilling large and small litigants, undermining their credibility with judges and affecting the outcome of high-stakes trials, writes Don Clark in The Wall Street Journal. New federal rules have reinforced companies obligations to produce electronic evidence, which has exploded in volume as emails replace phone calls and other business
7 communications. Analyst firm AMR Research estimated that compliance spending exceeded $80 billion in North America in 2010. Companies in virtually all industries are now subject to some level of regulation concerning the storage and management of their electronic data. represents a major part of this data management. The following table summarizes some of the key regulations: Industry Key Regulators Overview of Requirements Financial Services Basel II Accord (EU) Schedules for records maintenance Health Care and Life Sciences Government Agencies All Commercial Enterprises Securities and Exchange Commission (SEC) National Association of Securities Dealers (NASD) New York Stock Exchange Health Insurance Portability and Accountability Act (HIPAA) Medicare Conditions of Participation Food and Drug Administration General Records Schedules from the National Archives and Records Administration Sarbanes-Oxley Act (SOX or Sarbox) Gramm-Leach-Bliley Act Personal Information Protection and Electronic Documents Act (PIPEDA) (Canada) Internal Revenue Service Fair Labor Standards Act Americans with Disabilities Act Occupational Health and Safety Act Various other statues and requirements How records are submitted How records of communication with clients are to be maintained and supervised How privacy of financial information is protected across international borders Schedules for records maintenance Disposition of records Standards for records storage Individual policies for email retention developed by each agency Schedules for records maintenance How records are maintained How personal information is gathered, stored, and protected
8 Cases: Zubulake Vs UBS Warburg On February 15, 2002, Laura Zubulake filed a lawsuit in New York City against her former employer, UBS Warburg LLC, alleging sex discrimination and retaliation. During discovery, Zubulake requested that UBS produce all documents concerning any communication by or between UBS employees relating to [Zubulake], which included e-mail messages that had been stored on backup tapes. However, certain backup tapes at UBS were missing, and e-mail had apparently been deleted at UBS. As a result, the federal court imposed sanctions against UBS for its failure to preserve and produce the missing tapes and e-mail. In April 2005, Zubulake was awarded U.S.$20.1 million in punitive damages and $9.1 million in compensatory damages, in part because UBS was unable to produce the e-mail messages in question. Zubulake is a landmark case in the world of, and there have been countless articles written, opinions pontificated, and policies modified based on its result. However, while few cases may rise to the level of Zubulake in terms of financial liability, there are numerous other cases that involve a party s inability to properly produce requested documents. In the context of readiness, Zubulake is one of many cases that demonstrate the need to proactively prepare for, and be prepared to conduct, in response to a lawsuit, audit, or governmental investigation. DuPont Vs Kolon Industries A federal jury returned a stunning, $919 million verdict in September 2011 for DuPont in a trade secret theft case. In E.I. du Pont de Nemours v. Kolon Industries, the verdict was the conclusion a legal battle that lasted two and a half years which DuPont waged against Kolon Industries to prove that Kolon had effectively stolen key aspects of its formula for Kevlar. The court dealt the critical blow just before trial when it found that Kolon had destroyed emails and other electronically stored information connecting it to the trade secret theft.
9 The sanction for that spoliation was an instruction to the jury that Kolon executives and employees had deleted key evidence after the company s preservation duty was triggered. The verdict against Kolon was just the beginning of its problems. DuPont requested over $50 million in punitive damages from Kolon, another $30 million for the reimbursement of its legal fees and a permanent injunction prohibiting Kolon from using the misappropriated trade secrets. Unsurprisingly, Kolon s stock dropped 15% after news of the verdict reached the markets. The sanctions order and corresponding verdict make it clear that organizations should invest the time and effort to properly prepare for litigation and discovery. Having the appropriate tools in place, especially in the case of email, could have prevented much of the spoliation, the resulting instruction to the jury and negated many of the financial effects thereafter. AIG Vs Bank of America Lawmakers picked the entire private internal email archive at Bank of America subsidiary Countrywide apart during a court case worth $10.5 billion, filed by AIG Insurances. Executive Countrywide emails that were sent before Countrywide s much publicized collapse have been detailed in court, as AIG sued Bank of America (Parent company of Countrywide) over fraudulent sales practices. Countrywide s collapse was a very high profile case after the mortgage market issues which developed as a result of the financial crisis. The lawsuit by AIG alleges that top executives at the company knew that certain loans were being given to person s who could not afford to pay them back, and so have contributed greatly to the credit crisis. This court case highlights the importance of email archiving and. While it has been used against Bank of America in this case, had the bank not been able to produce these records then they would have been in a whole other world of trouble for breaching compliance laws. Every business is mandated under legislation to keep a backup and
10 archive of company records so that they can be used when called upon in legal cases. Email communications are classed as company records, and so businesses are mandated to have some form of archiving system in place. is also essential when trawling through potentially millions of emails looking for certain emails in particular. Had Bank of America not been able to produce these records, they could have been fined billions by the state for breaching data compliance laws, and also have suffered great reputational damage. Being able to produce email archives for evidence, either for the protection of your company or for the courts, is not only a prudent policy but also it is a legal requirement. According to a recent study that was published by the Duke Law Journal, there has been a huge rise in sanctions for violations. In fact, there are now more sanctions than ever. At Duke, the study was based upon a review of 230 sanctions awards in 401 different federal cases. Motions and awards have been increasing steadily since 2004. The so-called get out of jail free card of the Federal Rule of Civil Procedure has traditionally provided some amount of cover for attorneys and parties. Is this rise in sanctions due to becoming a more complex beast or is it an increase in organizational flippancy? We believe that some organizations may be becoming flippant about their policies but also has become somewhat more complicated due to the increase in email usage.
11 Is your organization prepared? As email use rises in businesses, the confidential data communicated in emails becomes more at risk. It is now vital that businesses treat their email data the same as their regular data for archiving purposes and. This is because corporate email is classified as a form of record and so corporate email demands its own email archiving solution. If your organization was asked to produce specific electronic documents or emails would you be able to do it? The last thing you want is to be in a similar position to UBS. The only way to avoid this is to make sure you have a comprehensive and email archiving system in place. By doing this you are ensuring you are in line with compliance regulations and have any evidence that may be required for litigation requests.
Next Generation Email Archiving Appliances Jatheon Technologies 8 Wellington Street East, Mezzanine Level, Toronto, Ontario, CANADA, M5E 1C5 Phone: 416.840.0418 Fax: 416.849.9971 About Jatheon Technologies Honored with Deloitte s Top 10 Companies-to-Watch Award, Jatheon Technologies is the designer, developer and marketer of Plug n Comply, a family of network appliances that simplify archiving, indexing, retrieval and dynamic monitoring of corporate email and messaging data. Jatheon s Plug n Comply family provides in-house, integrated archiving appliances for organizations of all sizes. The appliances are simple, secure and scalable, adapting as a company grows, and offering absolute control of confidential messaging data, including email and instant messages. The Jatheon family of appliances enables organizations to meet and exceed the highest standards of regulatory compliance and corporate governance. Founded in 2004 and headquartered in Toronto, Canada, Jatheon serves North America and Europe through its network of global business partners. For more information, please visit. Plug n Comply is a trademark of Jatheon Technologies, Inc. All other names, brands, or products may be trademarks or registered trademarks of their respective owners.