Financial Firms Are Struggling to Manage, Archive and Monitor the Exponentially Growing Volume of Corporate E-mail
Feed the e-mail beast. We all do it, from the time we log on in the morning till late in the day when a last thought needs to be shared with a colleague or friend. We're sending messaging morsels over mobile devices to try to satiate its insatiable appetite. Stop feeding the beast -- take off a week, a day, even an hour -- and you fall dangerously behind.
E-mail keeps growing in volume, and so does the urgency for devising new and better ways of dealing with it. A typical office worker receives more than 100 messages a day -- some get 200, 300 or more -- and may send dozens upon dozens more. At large companies, it adds up to millions of messages per week and many hours glued to PCs; it also hogs storage and demands hours of administrator and security-pro time.
E-mail has gotten so big that it's no longer a mere issue of personal productivity. Top executives and their companies are being judged on how they're controlling it, as mismanagement can lead to legal troubles.
"It scares us to death," says Jeff Cooper, system architect at AIM Healthcare, of e-mail's potential to wreak havoc. Healthcare companies, financial firms and others that must comply with government data management regulations are particularly vulnerable.
At AIM, Cooper supports about 2,000 Microsoft Exchange users. "We deal with hundreds of clients, and it's all confidential information," he says. "We have to make sure at some level that it's not being sent to the wrong people or used in the wrong way."
E-mail also is the vehicle for sharing great ideas within a large company. Its valuable yet volatile nature means businesses must have an e-mail strategy and plans and processes for storing e-mail, governing its use and dealing with the growing deluge of both legitimate messages and spam.
Some companies are reporting that the number of messages received and sent by employees has more than doubled in about three years, ushering in a new way of thinking about e-mail. Some financial firms contend that the number of messages has tripled or quadrupled during the same period.
Some businesses have experienced the worst of the e-mail beast's wrath. There's the embarrassing case of Boeing CEO Harry Stonecipher, axed last year after e-mails revealed an affair with a female executive at the company. Or Frank Quattrone, the former Credit Suisse banker who was barred in 2004 from the securities industry after e-mail revealed he tried to cover up his dubious investment practices. The Securities and Exchange Commission has since rescinded Quattrone's lifetime ban, obstruction of justice charges have been thrown out of court and a 2004 conviction has been overturned on appeal. Morgan Stanley, fined millions of dollars for its inability to manage e-mail in compliance with SEC orders, is now tied up in a $10 million lawsuit filed by a former Morgan Stanley IT exec who claims he was fired for, among other things, discovering unethical e-mails from other execs in the company's bloated archive.
Such cases are partly why IT departments are paying greater attention to the need to archive e-mail so it's available when needed and under control when it's not. A surprising 21 percent of companies have received court subpoenas for e-mail or instant messaging records, according to a study conducted two years ago by the American Management Association and ePolicy Institute. So the odds are good that a lawyer could come knocking on your company's door with a request for electronic correspondence. What's more, federal civil trial rules that go into effect Dec. 1 stipulate that reviews of business records for discovery purposes must include e-mail.
Archive, Archive, Archive!
The importance of archiving is a lesson AIM learned the hard way. The healthcare provider became embroiled in a dispute with employees who had left the company; AIM alleges they breached their employment contracts. "The need arose to prove what was agreed to," Cooper says. AIM hoped e-mail files would provide much of that evidence, yet there was no way to efficiently search through older documents, if they existed at all.
The company has since installed an e-mail archiving and management system from Berkshire, U.K.-based C2C Systems. Third-party products such as C2C's fill gaps in the archiving capabilities in Microsoft's Exchange Server and IBM's Lotus Notes e-mail platforms. Microsoft plans to deliver improved archiving in a forthcoming upgrade.
Many e-mail systems let users run searches across message subject lines and contents. C2C's Active Folders go a step further and scan e-mail attachments. And its security settings can be configured to prevent system administrators from searching beyond the scope of what they're tasked with.
That's not just a theoretical concern. Morgan Stanley has accused Arthur Riel, the former IT exec, of rifling through executive's in-boxes under the guise of testing an archiving system. Riel's searches led him to messages that show a Morgan Stanley senior IT exec currying favor with tech vendors. Morgan Stanley doesn't dispute the authenticity of the e-mails but claims Riel had no right to sift through company e-mail and says that's the reason he was fired.
The SEC requires publicly traded financial firms to archive business e-mail for three years and to store messages in "an easy-to-retrieve form" for two of those years. It's a guideline that judges are applying to the discovery phase of civil trials. In a May 2005 case in Florida, a jury ordered Morgan Stanley to pay more than $1 billion in punitive and compensatory damages to financier Ron Perelman. The bank lost the case in part because it had failed to produce required e-mail and other documents in a timely fashion. It isn't the only investment bank to run afoul of regulators because of e-mail: In March, Merrill Lynch was fined $2.5 million by the SEC for lax archiving practices. In late 2005, Raymond James Financial fought e-mail retention charges brought against it by the SEC and, in a rare occurrence, won its case in court.
E-Mail Cops
When archiving, the big question for many companies is what to keep and what to delete. The easy answer would be to archive everything, but that's expensive. "Companies need to make a clear definition between things they want to keep around as legal records and everything else that will have a more aggressive expiration date," says Kevin Cavanaugh, who heads IBM's development group for Lotus Notes/Domino.
Pretty obvious stuff, except that many companies aren't taking control of the situation. Companies that are on top of the situation are providing employees with a written policy about appropriate e-mail use, guidelines for what must be archived and for how long, and rules on what type of mail can be forwarded outside the company and what must be encrypted.
About 30 percent of companies with more than 1,000 employees surveyed by Proofpoint, a provider of messaging security solutions, say they monitor employee e-mail. Many of e-mail archiving solutions provider Waterford Technologies' customers don't tell their employees, a practice legal in all states but Delaware and Connecticut. "It's an invisible process," Waterford president Tom Politowski says.
But most companies just aren't taking the time to develop e-mail systems and policies with compliance in mind, says Riel, the former Morgan Stanley employee who was hired by the firm in 2000, in part to help the company build an e-mail archiving system, only to be shown the door five years later. Riel is now a partner at Lighthouse Global Technologies, which, among other things, helps businesses in regulated industries develop e-mail compliance strategies. He says too many organizations maintain e-mail archives on tapes that can't be easily searched. Tape still is used widely for backup because it's cheaper than networked storage, but Riel says that's a shortsighted calculation. "If you ever do need one of those e-mails, you've just eliminated all your savings by having to go look for it," he says.
Whether businesses succeed in complying with SEC e-mail retention mandates and other regulatory requirements, not to mention living up to their own governance policies, largely depends on their ability to cut down on the sheer volume of e-mail.
Turn Down the Volume
E-mail overload burdens users and clogs systems. The Hartford Financial Services Group deals with about 100 million incoming messages each month, a 40 percent increase from last year, says Gary Baillargeon, director of enterprise messaging and security applications. He attributes the growth to the increased use of e-mail in the financial services business and spam. Internally, Hartford Financial employees exchange more than 3 million e-mails a month.
Seven IT people are dedicated to the task of managing all that. "As with any organization, we're asked to be more creative with our support and our ability to manage our volumes," Baillargeon says. "We're expecting future volume growth, and we'll deal with it."
Limiting the size of employee mailboxes is a common tactic; employees have no choice but to clean house once their storage limits are reached.
The Conference Board, a New York research center that generates national economic data, has reduced e-mail volume using a Web content management system from HyperOffice (Rockville, Md.), says Mark Lackey, senior manager for knowledge management. It lets users download large business documents from a dedicated Web server so they don't need to be passed around via e-mail. It also makes its key market-moving economic reports available only through a secure Web server. That cuts down on e-mail volume and prevents documents from being leaked ahead of public release.
For a privileged few, e-mail quotas may not apply. It's not uncommon for businesses to have more-lenient policies and larger in-boxes for top executives.
Morgan Stanley's IT department took an entirely different tack, blocking e-mail to former CFO Stephen Crawford in an effort, it says, to shield the busy executive from the daily deluge. But that's hardly common practice. At IBM, a low-ranking programmer can send e-mail directly to CEO Sam Palmisano. And AIM has an open-door policy when it comes to sending e-mail to the CEO. Anything less, Cooper says, "would send a bad message."
Bad message? The e-mail beast is licking its lips. <<<
Courtesy of InformationWeek, a CMP Media property.
E-mail Management
Tweet This