E-Discovery and Microsoft Technology : Retention Hold

Is it "Safe" to Store Voicemail in Exchange 2007 Unified Messaging?

chris.chalmers — Mon, 25 Aug 2008 13:46:00 GMT

I've co-authored a post on the MS Exchange Team's blog, "You Had Me At EHLO." It's entitled "Voice Mail and Discoverability with Exchange 2007 Unified Messaging," and explores the features and functions, as well as some of the legal wrangling around storing voicemail, email, and faxes in one system.

You can read it here: http://msexchangeteam.com/archive/2008/08/21/449657.aspx

In summary, Microsoft hired a law firm to write a white paper investigating the problem, and the white paper concludes ".that no aspect of Exchange alters, by increasing or decreasing, the record retention obligations of these organizations in the U.S. or E.U. ." That is, if a company is obligated to retain voice mail messages, it doesn't matter if they're stored in Exchange 2007 UM or somewhere else - they still need to be retained. Likewise, if voice mail messages have been deleted in the normal course of business prior to an obligation to retain them, the fact they were in Exchange 2007 UM doesn't create a new obligation to retain where no obligation existed before.

Anyway, it's a great post, I had a lot of help with it, and I highly recommend reading it. There's also a lively comments section down below.

Am I Retaining IM?

chris.chalmers — Sat, 02 Aug 2008 20:29:00 GMT

"It depends."

As always, the correct answer is whatever your in-house counsel tells you: we never provide legal advice here, only information for you to consider. Here's a couple of interesting bits -

First off, for regulated industries like stockbrokers, it's a no-brainer: you save IM. That was easy!

For others, it's not electronically stored information (ESI) as long as you're not archiving your conversations. Gregory S. McCurdy wrote in the Yale Law Journal, "...IM conversations - like telephone calls - are not ESI so long as they are not stored in any analogous way…" and also, "…In terms of technology and user expectations, instant messages are like phone conversations and the law should treat them as such…"

You can check out the whole article here (it's a quick 5 pages): Thomas W. Burt & Gregory S. McCurdy, E-Discovery of Dynamic Data and Real-Time Communications: New Technology, Practical Facts, and Familiar Legal Principles, 115 YALE L.J. POCKET PART 166 (2006), http://www.thepocketpart.org/2006/08/burt_and_mccurdy.html.

What are you using IM to talk about?

The nature of the conversations may come into play. If your IM chats are of the typical water-cooler variety, that's fine. But if your users are explicitly using IM to avoid email retention, or they're using IM's file-transfer feature to exchange documents outside of your email system or workflow process, you could be on shaky ground.

In the recent Bear Sterns debacle, two executives apparently used their wives' home email accounts to have business-related conversations outside their company's retention mechanism. Needless to say, the court was unimpressed. Here's an interesting quote from the news coverage:

"If you have one or a handful of damning e-mails on a personal account, prosecutors will argue that use of e-mail is consciousness of guilt because they took a route to communication that they thought wouldn't be discovered," said Daniel Horwitz, a former assistant district attorney in New York, now a partner at the law firm Dickstein Shapiro. You can read the whole article here: http://seattlepi.nwsource.com/business/368153_email24.html

Is retaining IM easy, or does it require "heroic" effort?

FIOS has on on-demand webcast (registration required), led by Ronni Solomon, Esq., Counsel, King & Spalding that explores IM discoverability in depth. One of the issues she discussed is whether or not it's easy to turn on archiving: that is, if your system cannot archive IM, then recovering messages is very difficult. However, if archiving is installed but deactivated, it is (or would have been) very easy for you to store IM. The webcast has been archived here: http://www.fiosinc.com/events/webcasts/webcast_detail.asp?id=WC20080729

Of course, being able to easily archive IM is not always a bad thing. For instance, when your company changes from a normal operating environment to "litigation is reasonably imminent," your discovery needs will change, and you just might want to turn on archiving for a group of individuals, or the entire company.

So how does OCS 2007 IM Archiving work?

With OCS 2007, there is an optional Archiving server role that can be installed. The entire OCS Archiving deployment guide is online here: http://technet.microsoft.com/en-us/library/bb894700.aspx .

Here's the highlights:

It requires Microsoft Message Queuing (MSMQ), which is free Windows add-on,
It stores the conversations in SQL Server.
The reports don’t come with the server, they're part of the free OCS 2007 Resource Kit, which is downloadable here: http://www.microsoft.com/downloads/details.aspx?FamilyID=b9bf4f71-fb0b-4de9-962f-c56b70a8aecd&DisplayLang=en
All the messages are stored in a SQL table called "Messages," so you can write your own reports if you're so inclined
You can choose to turn on archiving for everyone, or only certain individuals
You can also choose archive all of an individual's conversations, or only conversations with people outside the company
If you're using OCS 2007 for voice calls as well as IM, you can archive Call Detail Records (CDRs), which stores data similar to what you see on a monthly phone bill.

Here at Microsoft, the IT department has deployed Archiving, and our internal OCS deployment is described in this white paper (with accompanying PowerPoint presentation): http://technet.microsoft.com/en-us/library/cc297283.aspx .

It's handy to see what kind of hardware and architecture we use to archive here at a large corporation - however, please don't infer any legal advice or conclusions from the fact that we archive (or have the capability to archive). Microsoft IT has plenty of other reasons to turn archiving off and on, such as experimenting with the feature set, implementing chargebacks to business units, usage reporting, sheer curiosity, etc.

Hold Me Now! How to quickly put a retention hold on 1,400 employees using Microsoft Exchange 2007.

chris.chalmers — Tue, 15 Jul 2008 06:34:00 GMT

The consequences for failing to correctly implement a retention hold can be severe. For example, issues surrounding a litigation hold helped cause Intel to lose attorney-client privilege and work-product protection of certain materials relating to their defense against AMD and Class Plaintiffs in the ongoing saga of In re Intel Corp. Microprocessor Antitrust Litigation.

K&L Gates has an excellent blog posting discussing some of the problems Intel had that led up to the court's finding. There's challenges getting the retention letters to the right people, juggling backup tapes, and moving users from one email server to another, etc. You can find K&L's blog posting here: (http://www.ediscoverylaw.com/2008/06/articles/case-summaries/finding-waiver-of-attorneyclient-privilege-and-work-product-protection-court-orders-production-of-attorney-notes-of-employee-interviews-concerning-intels-compliance-with-evidence-preservation-obligations/).

The challenges of implementing a legal retention hold certainly are not unique to Intel, so let's examine the generalized case of a fictitious company named Contoso. Contoso has 50,000 employees using Exchange 2003. In order to avoid drowning in terabytes of email, they have implemented a 45-day purge policy using Exchange 2003 Mailbox Manager.

Because of impending litigation, Contoso's legal department has sent a litigation hold letter to 1,400 key employees who need to save emails beyond 45 days. Those employees must manually move their emails into a local .PST file on their desktop computer, or have their mailboxes moved to an Exchange database that has Journaling enabled, because Exchange 2003 only journals at the database level .

What could possibly go wrong?

For starters, there's the end users manually moving messages (or forgetting to move) to .PST files. Next, there's making sure those .PST files actually get backed up on a regular basis. You'd think people would just know to back everything up by now, but there's always an exception. Just last week I worked with a user who had a hard drive crash and lost everything. Haven't we all been there at least once?

If Contoso moves to server-side journaling to remove end-user complexity, it creates a new burden for the IT staff. Databases have an optimal number of mailboxes on them, and as you move too many mailboxes, or a few too-large mailboxes, to a journaling-enabled database , you run up against a new set of challenges: The databases' maximum size, the underlying storage design, running out of servers or having to move them from one location to another, etc. Journaling also has performance implications (since you're sending each message twice) that need to be accounted for.

How is Exchange 2007 different?

There are three excellent features that can specifically target this scenario: Retention Hold, Premium Journaling, and PowerShell scripting.

An Exchange 2007 "Retention Hold" suspends the ordinary email purge cycle applied to the user or organization. It's a simple mouse click (or a line of shell scripting, as we'll see below), and IT staff can also set an end date for the retention (which makes the feature useful for employees on vacation or infant care leave, for example). In the Contoso example above, we would apply a retention hold to each of the 1,400 mailboxes in question. Learn more here: (http://technet.microsoft.com/en-us/library/aa998580(EXCHG.80).aspx)

Premium journaling is essentially the ability to journal email to a separate system on a per-user or per-group basis. It puts an end to all the contortions IT staff used to have to undergo, because any database can have a mixture of journaled and non-journaled accounts. Users' mailboxes stay where they are, and journaling is turned on and off as needed. Learn more here: (http://technet.microsoft.com/en-us/library/bb124382(EXCHG.80).aspx)

PowerShell scripting is an exciting new innovation across the Windows platform, and Exchange 2007 is one of the first Microsoft applications to make full use of it. Here's a simple one-liner to apply a retention hold on Contoso employee Aaron Lee's mailbox:

Set-Mailbox -Identity 'Aaron Lee' -RetentionHoldEnabled $true

Easy! Now, just type that in 1,399 more times, and we'll be all set! Just kidding, PowerShell has another command called Get-Mailbox that lets you fetch mailboxes you want subject to retention hold. For Contoso, that will be everybody in the Sales and Developers departments (or Organizational Unit, as they say in Active Directory-speak).

Get-Mailbox -OrganizationalUnit 'Sales'

And there's a whole host of other attributes we can use to fetch mailboxes, like Title, Department, City, Country, etc. that can be used as a filter here. You can also mix-and-match, like all the Accountants based in New York.

Our last step is to marry the two commands together using the "pipe" character, so the final command would look like this:

Get-Mailbox -OrganizationalUnit 'Sales ' | Set-Mailbox -RetentionHoldEnabled $true

Voila! That's all there is to it. This one-line command has turned on a retention hold for the entire Sales department at Contoso! No dependency on .PST files, no dependency on end users remembering to do the right thing, and no moving mailboxes from server to server.

Next posting: we explore ways Exchange administrators might attempt to "erase" emails off their server