Am I Retaining IM?

chris.chalmers — Sat, 02 Aug 2008 20:29:00 GMT

"It depends."

As always, the correct answer is whatever your in-house counsel tells you: we never provide legal advice here, only information for you to consider. Here's a couple of interesting bits -

First off, for regulated industries like stockbrokers, it's a no-brainer: you save IM. That was easy!

For others, it's not electronically stored information (ESI) as long as you're not archiving your conversations. Gregory S. McCurdy wrote in the Yale Law Journal, "...IM conversations - like telephone calls - are not ESI so long as they are not stored in any analogous way…" and also, "…In terms of technology and user expectations, instant messages are like phone conversations and the law should treat them as such…"

You can check out the whole article here (it's a quick 5 pages): Thomas W. Burt & Gregory S. McCurdy, E-Discovery of Dynamic Data and Real-Time Communications: New Technology, Practical Facts, and Familiar Legal Principles, 115 YALE L.J. POCKET PART 166 (2006), http://www.thepocketpart.org/2006/08/burt_and_mccurdy.html.

What are you using IM to talk about?

The nature of the conversations may come into play. If your IM chats are of the typical water-cooler variety, that's fine. But if your users are explicitly using IM to avoid email retention, or they're using IM's file-transfer feature to exchange documents outside of your email system or workflow process, you could be on shaky ground.

In the recent Bear Sterns debacle, two executives apparently used their wives' home email accounts to have business-related conversations outside their company's retention mechanism. Needless to say, the court was unimpressed. Here's an interesting quote from the news coverage:

"If you have one or a handful of damning e-mails on a personal account, prosecutors will argue that use of e-mail is consciousness of guilt because they took a route to communication that they thought wouldn't be discovered," said Daniel Horwitz, a former assistant district attorney in New York, now a partner at the law firm Dickstein Shapiro. You can read the whole article here: http://seattlepi.nwsource.com/business/368153_email24.html

Is retaining IM easy, or does it require "heroic" effort?

FIOS has on on-demand webcast (registration required), led by Ronni Solomon, Esq., Counsel, King & Spalding that explores IM discoverability in depth. One of the issues she discussed is whether or not it's easy to turn on archiving: that is, if your system cannot archive IM, then recovering messages is very difficult. However, if archiving is installed but deactivated, it is (or would have been) very easy for you to store IM. The webcast has been archived here: http://www.fiosinc.com/events/webcasts/webcast_detail.asp?id=WC20080729

Of course, being able to easily archive IM is not always a bad thing. For instance, when your company changes from a normal operating environment to "litigation is reasonably imminent," your discovery needs will change, and you just might want to turn on archiving for a group of individuals, or the entire company.

So how does OCS 2007 IM Archiving work?

With OCS 2007, there is an optional Archiving server role that can be installed. The entire OCS Archiving deployment guide is online here: http://technet.microsoft.com/en-us/library/bb894700.aspx .

Here's the highlights:

It requires Microsoft Message Queuing (MSMQ), which is free Windows add-on,
It stores the conversations in SQL Server.
The reports don’t come with the server, they're part of the free OCS 2007 Resource Kit, which is downloadable here: http://www.microsoft.com/downloads/details.aspx?FamilyID=b9bf4f71-fb0b-4de9-962f-c56b70a8aecd&DisplayLang=en
All the messages are stored in a SQL table called "Messages," so you can write your own reports if you're so inclined
You can choose to turn on archiving for everyone, or only certain individuals
You can also choose archive all of an individual's conversations, or only conversations with people outside the company
If you're using OCS 2007 for voice calls as well as IM, you can archive Call Detail Records (CDRs), which stores data similar to what you see on a monthly phone bill.

Here at Microsoft, the IT department has deployed Archiving, and our internal OCS deployment is described in this white paper (with accompanying PowerPoint presentation): http://technet.microsoft.com/en-us/library/cc297283.aspx .

It's handy to see what kind of hardware and architecture we use to archive here at a large corporation - however, please don't infer any legal advice or conclusions from the fact that we archive (or have the capability to archive). Microsoft IT has plenty of other reasons to turn archiving off and on, such as experimenting with the feature set, implementing chargebacks to business units, usage reporting, sheer curiosity, etc.

E-Discovery and Microsoft Technology : Instant Messaging

Am I Retaining IM?