|
Uh oh.
Time to backup up and take a breath.
I have not been following this, but have meant to go back and read it because of the implications of the subject.
Having gone back and read some of the posts, well, Matt, I like you a lot, but there are some issues.
Matt said: Not to debate the applicability of the technology, but you shouldn't proceed under the assumption that government regulators are out there giving IT staff lists of words to be used in "full-text search" of E-mail archives. That is not the law, and it is not how subpoenas are issued
In reality, that is exactly what they can indeed do. No, I have not reviewed the letter of the law, nor will I, nor do I have a desire to. However, I have been briefed on the matter by the in-house IT staff of clients I am involved with that are either subject to SOX or SEC regulations.
Matt said: What is at question here is document retention, or more specifically in this case, E-mail retention. There is nothing specific in Sarbanes-Oxley that indicates anything other than destruction of records, thereby implying that records such as E-mail are required to maintained for a period of 5 years. There is absolutely no mention of required technologies, but it is clearly implied that you can't lose access to such documents due to a failure to properly apply a technological solution that survives that length of time (i.e. archival means need to be accessible going 5 years back at any time).
While it is true that no mention of what technology is to be used, there are requirements, particularly in SEC regulations, that once a subpoena is presented, you have a time limit to comply and produce the requested information. This time period can be in as little as 4 hours. Obviously, you are going to need technology to provide copies of all e-mail to and from so and so for the last 3 years in 4 hours. Simply having an archive is not enough. You must have the means to search and retrieve quickly.
Matt said: There are applications that archive and mine data from E-mail, but IMO, these are really just big-brother types of apps, and I've never been big on invading people's privacy. There are other services that some companies use under the general guise of "policy enforcement" which is just a fancy way of saying content screening. I think that Sniffer's engine could be set up to do at least part of this work (outside of attachments), but there are large companies out there that already offer such services and this is generally limited to only large customers. I consider this to be an ineffective solution since it can be so easily bypassed with a flash drive on a key chain, or missed by a set of keywords or phrases.
Every one is intitled to their opinion. However, truth is the courts have found and upheld that e-mail using company assets are not private, and a company policy must be dictated to enforce such. This means that if a company policy states all e-mail is company property, and no personal e-mail is allowed, or words similar to that effect, the courts have upheld the companies’ explicit right to search, review, archive and take action on e-mails used within the company. Therefore, there is no question of privacy, as it is company property.
Matt, I do not see any personal attack on you by Sandy. What I see is his response to specific things you have said which appear to be incorrect. The various regulations regarding e-mail are convoluted for us to understand at best, and while yes every one is entitled to an opinion, it should not be stated as fact.
John Tolmachoff Engineer/Consultant/Owner eServices For You
-----Original Message-----
Let's please try to keep the personal stuff off of
this list for the good of everyone. Even though I might find it a tad bit
amusing at times when it is directed at me, I don't think that others appreciate
seeing it here, and I generally don't. I hesitated even to draft this
reply except that I felt it would possibly help in the future seeing as how
repeated this pattern has become. This is a support group where people
come to share ideas and learn from others, and flame wars have no place in such
a forum. One can express an opinion or attempt to establish fact without
in effect attacking or belittling a fellow participant, and unlike the
circumstance regarding IMail, there is no reason for anyone to become angry
about things so insignificant. I don't claim to be perfect in this regard
myself, but I think it needed to be said.
|
