Migrated from eDJGroupInc.com. Author: Greg Buckles. Published: 2010-10-08 04:45:27Format, images and links may no longer function correctly. As corporations invest in the business process of litigation preparedness, many wrestle with the options for ongoing email preservation. I thought that it might be worth a quick look at some of these options and some potential issues that different methods pose. The first choice is whether the preservation method is user driven or an automated system. We all have heard the horror stories about user non-compliance. In Re Hawaiian Airlines is a good example and this U.S. Courts conference paper provides some context. However, a well implemented and documented user driven legal hold process may be the right solution in many circumstances. When you have a small number of key custodians and the matter relevance criteria is very clear, it may be reasonable to allow custodians to keep emails in a special folder. Automated systems have their own issues, the main one being overly broad or inaccurate preservation criteria.
After all, relevance is often subjective and the actual custodians would seem to be the best resource to make that call. If so, then why don’t we use custodians to do document review? If you relied solely on custodians to preserve and collect, then you have essentially done that already. Most discovery plans involve custodian designation in combination with reasonable sampling and diligence search/checks to find all the places that the custodians either forgot or just did not know about.
In the early days, especially for critical or potentially criminal matters, we would force IT to retain all the incremental and full back up tapes of the email servers. We still lost any email that was deleted on the same day that it was sent or arrived, but that seemed like the only way to ‘stop the presses’. Exchange 2003 introduced the ‘Message Journaling’ feature that enabled IT to essentially grab a copy of every email sent/received on a server. Next came ‘Envelope Journaling’ which added an ‘envelope’ email to hold all the BCC and distribution list addresses to fully understand all the recipients on an email. The final ingredient was the ability to journal capture traffic for specific mailboxes from the Exchange Management Console. This made ongoing capture of custodian lists practical.
Many clients have asked, “Is this defensible?” As always, that question has to be answered by counsel for every unique matter. However, Exchange Journaling has been the accepted method for compliance capture of communications for financial institutions under SEC/FINRA requirements and many governmental agencies for at least a decade. A quick check on our eDJ search engine for caselaw that mentions Exchange Journaling led me to this Preservation Order for In Re: New York Renew with Moistureloc MDL. Page 2 clearly shows that as long as the company was journaling all custodians, they could continue to allow email deletion and a normal back up tape cycle. They were required to proactively capture or ‘archive’ the existing email, but this is a clear example of court acceptance of email journaling for ongoing preservation. For an interesting read on how NOT to do this, check out the declaration on the Whitehouse email retention methods here.
So we have established that Exchange Journaling may be an appropriate and defensible method of ongoing preservation, but how does the email differ from that in user’s mailboxes? The secret to understanding this is that a single copy of every item sent or received on that Exchange server is captured in flight. That means you do not get anything created within the user mailbox or any user actions that are not sent or received. Below is a slide that I have used with clients.
Exchange 2010 and message transport rules now give IT many more options for conditional journal capture of messages, but journaling is still pretty much and all or nothing tool. There are other compliance, content management, archiving and search technologies that will ‘watch’ user mailboxes and log or capture user level items and actions. Most of these still leverage the MAPI protocol and represent a substantial storage and performance impact. Mimosa’s (now acquired by Iron Mountain) transaction log shipping method promised the most granular level of capture with the least impact until Microsoft changed the roadmap to phase out support of log shipping. Cloud based archives are leveraging a variety of protocols to remotely journal emails at bargain basement pricing. The real issue is whether you really need to store all that email and what it could cost you in review fees if you do not negotiate your relevance criteria well.
So we can see that Exchange Journaling can be used for ongoing preservation in many, if not most, litigation scenarios. If user actions such as replies, moving to folders and documents like Tasks, unsent calendar notes, etc are going to be relevant to your case, then you may need to look for alternative monitoring technologies or put a supplemental preservation/collection protocol in place for this relatively small data type. Remember that these non-communication Exchange forms are not typically large in size and they are almost never subject to the automatic deletion/retention policies.