Storage ITworld – Register Your Email For Legal Proof By David Hill, Mesabi Group

What seems to be the problem? One of the biggest targets for e-discovery is email. When you search your email archive you should be able to retrieve all internal email that was sent and received. But what about external email, which is all the email that goes to or comes from outside your enterprise – partners, competitors, customers/clients, or any person/organization outside your own? Yes, you should have all the relevant email that was sent from the outside and also that which was sent by someone in your enterprise to someone outside your enterprise. But can you prove that what was sent to someone outside the organization was also received by that someone? And therein lays the rub. If you cannot prove that someone outside your organization actually got an email, you do not have legal proof of receipt. And that can be a problem.

What do you need to know? A company called RPost illustrates a solution to the problem. RPost has the ability to register email. (As an industry analyst, RPost recently gave me a briefing on the Registered Email™ service.) RPost provides managed outbound messaging services that include software (an add-in to Outlook, Lotus, or Groupwise that allows you to send Registered Email™ messages) and service (an Internet-based server intermediary through which Registered Email™ messages are forwarded and delivery services verified back to you).

A Registered Email™ message must ensure three things: proof of delivery, proof of content, and proof of time. The first is proof of delivery. A Registered Email™ management server receives the Registered Email™ from a sender and sends it to the server that is responsible for the email of the receiver. The management server conducts a dialogue with the receiver’s email server to confirm receipt by the email server. When the management server receives confirmation of a successful delivery, analyzes the transaction meta-data, then it sends a Registered Receipt™ email back to the sender. That is an evidentiary record.

Note that the receiver’s email server, in effect, provides a “signature” that the email “letter” was delivered so it serves the same function as a signature for registered physical mail or a FedEx package. That does not prove that the receiver actually opened the email or read and understood it, even if opened. But you don’t have to do that for proof of delivery. The “signature” is good enough just as it would be for a physical mail or FedEx delivery.

But a Registered Email™ message has a second capability that neither a regular letter nor FedEx package can have. That is proof of content. You can prove that the email “package” which includes attachments contains certain information. And that is very powerful in establishing proof.

The final essential capability is proof of time. You have to bind the time the email was sent, and more importantly, precisely when it was received, to the content. And that is also what a Registered Email™ management server can do for you.

Now you have to have all three capabilities — proof of delivery, proof of content, and proof of time — to establish verifiable proof. You have not only just tracking or delivery confirmation information, but also verification of the content and time of sending and receiving of the email. You are now in good shape in enabling your organization to have the necessary evidence should you have to go to a court of law – evidence that will ensure that your email records are not only properly produced for discovery, but more importantly, admissible as evidence.

RPost charges for the service as if you were buying postage stamps. (Note that Pitney Bowes is one of its distributors so RPost’s purchase model is consistent with the general concept of virtual stamps.) RPost also provides accounting reports, such as monthly email usage reports on each user for cost allocation and management purposes.

What can you do about it? Certain types of organizations (such as trading firms or law offices) may want to register all emails (or at least all emails that meet certain criteria). Other organizations, such as industrial firms, may have to look into what specific categories of emails (such as those relating to purchase orders or contracts) would require the Registered Email™ service protection, rather than applying Registered Email™ services across the board.

The challenge is likely to be how to clearly identify all the emails that should be transmitted with the Registered Email™ service and put in place the proper processes and procedures to ensure that the proper people follow them. Organizations have to anticipate the consequences of what will happen if an outside party claims not to have received an email. Even if that happens rarely (only one out of many thousands of emails is a problem), the consequences might be sufficient enough to justify the RPost Registered Email™ service. You don’t necessarily need to register all emails; you only need to register those that meet certain criteria. And since you can pay-as-you-go (like buying books of stamps), the investment should be manageable. At the very least, RPost Registered Email™ services are something that you might want to consider to have available for when you need it – just as you would have a book of postage stamps in your desk drawer.

David Hill is the founder and principal at the Mesabi Group. The Mesabi Group is an industry analyst firm that focuses on networked storage and storage management. The second edition of the Mesabi Group report “Data Protection: Adapting to the Sea Change” is now available. Hill was VP of Storage Research and founded the Storage & Storage Management practice at Aberdeen Group, leading quantitative and qualitative market research. He directed data centers at Data General, introducing new analytical tools and business systems. He handled strategic marketing, competitive analysis, sales force planning, and market forecasting at a well-known storage vendor. He has an advanced degree from MIT’s Sloan School. He can be reached at davidhill@mesabigro up.com.