How do you lose 2 years of emails?
On Friday, June 12, 2014, the Internal Revenue Service informed congressional investigators that it could not recover two years of emails from the former head of the IRS’s tax-exempt status department, Lois Lerner. 1 Lerner is at the center of an investigation into how and why the IRS applied additional scrutiny to the tax-exempt applications for Tea Party-affiliated organizations.2Her lost emails now fan the flames of the controversy behind the IRS activities. Two years of lost emails! But all of this could have been prevented.
The Make-up of Failing Email Archiving Policies
The first failure of the IRS was due to a poorly configured mail retention policy. Prior to the Lois Lerner controversy, the IRS had an email archiving policy that backed up its Microsoft Exchange email server every day. The exchange archive was saved on digital tape for six months, after which the IRS would reuse the tapes for newer backups. For any business, six months is a substandard length of time to archive any useful data. It is clearly an inadequate amount of time for any government-related agencies to reasonably comply with the Freedom of Information Act (FOIA), but unfortunately, the FOIA does not give specific guidelines for how long electronic records must be kept. And when Congressional committees began requesting Lerner’s emails from the IRS, the email backups only went back to late 2012.
The Electronic Freedom of Information Act Amendments of 1996 (eFOIA) signed by President Clinton, specifically states:
Each agency, in accordance with published rules, shall make available for public inspection and copying–copies of all records, regardless of form or format, which have been released to any person under paragraph (3) and which, because of the nature of their subject matter, the agency determines have become or are likely to become the subject of subsequent requests for substantially the same records;…each agency shall make such records available, including by computer telecommunications or, if computer telecommunications means have not been established by the agency, by other electronic means.
Government agencies must archive all electronic messages, which includes email, instant messages, and social media posts. And not just for months, but for years. The public request could come now, or years in the future. FOIA requires these agencies be able to provide the data.
The second failure was relying on end users to backup their data. At the IRS, the only email messages saved for longer than six months were those considered “official record” emails, which are loosely defined by IRS policy as emails that were “created or received in the transaction of agency business,” “appropriate for preservation as evidence of the government’s function or activities,” or “valuable because of the information they contain.”3 Amazingly, this government agency let the user decide what was or was not an “official record” email, and expected them to manually save the files to their hard drive. What’s more, Lerner’s computer had crashed in 2011 and the IRS information technology division was unable to recover any of the data on her hard drive. 4 Because the “official record” emails were saved locally on her computer, all of those archived emails were lost. The IRS’s retention policy required Lerner to print out hard copies of her emails, although they have yet to be produced.
ZDnet agrees, “In this case, the IRS placed the responsibility for archiving emails on individual employees instead of an automated and searchable archive. Employees typically responded by saving .PST files on their disk drives and when those crashed the “archives” were lost. By the way, Microsoft specifically recommends against using .PST files as archives.”5
Not only does this deletion policy allow the possibility that important “official record” emails might not be archived as required in FOIA, but it allows the employee to actually delete any inappropriate or offensive emails without any record of their existence prior to archiving. Strong policy filters are far more effective. This is where the power of Retain comes into play.
Success with Proper Email Retention Policies
Retain provides organizations fully configurable policies that allow you to define the email, social media, and mobile messaging data you want to archive, and the policies are set on a global/organizational level. You can define what is archived based on mailbox type, message source, data type, message status, the age of the message, and the attachments. You can also filter by folder and attachment type. Had the IRS used Retain, or a similar solution, there would not have been any missing or deleted email data. And the responsibility to archive would not be left to the individual user.
Search and eDiscovery Tools
FOIA also requires government agencies to archive electronic messages, and it also requires them to be able to produce those messages at the instance of a FOIA request. Although extensions can be granted if the requests are voluminous, agencies have twenty days to respond with the data.
The IRS, by requiring employees to archive “official record” emails on their individual workstations, placed themselves in a very difficult position. Imagine the amount of time necessary to search the computers of those individuals who could have possibly interacted with Lerner. While we do not have specific figures on the amount of time spent in eDiscovery, just imagine the dollars spent in legal costs alone, just to discover the communications that were lost. If the correct archiving system had been employed, the search and discovery times would have been greatly reduced.
Retain includes built-in search, discovery, and publishing tools. These tools make searches and email discovery quick and easy and help save the time and money associated with discovery tasks. Furthermore, the eDiscovery tools, included with Retain, allow for litigation hold, redaction and strikeout of email messages, making litigation preparation that much easier.
Message Tagging
Another way in which these emails could have been preserved is through tagging. Retain allows emails to be automatically tagged while being archived according to set criteria, including regular expressions. These tags are customizable and can be created for any need, which means that messages can be grouped or flagged based on criteria that users or administrators set.
Archive Controls
Finally, the IRS needed to have a way to prevent email from ever being lost or deleted. With the correct archiving system, an organization can prevent users from deleting email messages until they have been archived and it can prevent archived messages from being deleted. Retain provides for both of these archiving policy controls, which means that messages cannot be deleted by users, or administrators, until the message has met the defined policy. For example, if a policy has been established that all email must be saved for six years, no email can be deleted until it has reached that six-year mark. And once it meets that date, the email is automatically deleted from the archive. This capability ensures compliance and guarantees that data is preserved.
Success with Retain
Companies and government agencies worldwide depend on Retain to manage their email, social and mobile data archiving, because Retain is the correct choice. It archives all electronic communication in one central location with built-in eDiscovery tools. Regardless of enterprise email platform (Exchange, Office 365, Gmail, or Groupwise), Retain gives you peace of mind when it comes to keeping emails safe and discoverable. Retain is flexible and can be installed on-premise or in the GWAVA Cloud.
The IRS’s failure to secure and archive their emails for future review is a perfect example to all organizations of what not to do. Instead of relying on a failed email archiving policy, the IRS should have relied on a proven messaging archiving solution like Retain.
For more information on Retain check out http://www.gwava.com/Retain
or you can try Retain FREE for 30 days! Click this button to download your FREE Trial.
Reference:
1. Washington Post – Here’s how the IRS lost emails from key witness Lois Lerner
2. Reuters – FBI opens criminal probe of tax agency, audit cites disarray
3. IRS Standards for Using Email
4. Scribd – Email exchange about Lerner hard drive
5. ZDnet – $18 million to recover lost emails?
