Archiving and the Limitations of E-Discovery

Last week we read about yet another major financial scandal allegedly exposed through the discovery of an e-mail message from a fund principal that apparently stated that their fund was going to be "toast."

The first thing I thought about this was that (if true) it was a fantastically stupid communication to put in an e-mail exchange. Secondly, I wondered why it took so long to find this e-mail - surely such high-profile financial managers would have their e-mail exchanges monitored automatically and an exchange like this should have rung every major alarm bell in the firm within seconds. Of course they could have been using an external system to get around that; we don't know at present. But this case once more highlights the limitations of e-mail monitoring (recently discussed here) and e-discovery, and conversely the value of content archiving.E-discovery is in many regards simply glorified Enterprise Search technology, but with the added ability to apply legal holds to data. Just as Enterprise Search is limited by the quality and location of the content it indexes, so too are e-discovery tools. Though in the case of e-discovery the limitations are often more severe: evidence may or may not be conveniently located in an e-mail message, as seems to be the case at Bear Stearns. More commonly evidence has to be culled from not only e-mail stores, but also from instant messaging systems, document systems, ERP systems, financial and business applications, external drives, and so on. The idea that e-discovery is limited to mail - as many vendors (and worryingly many buyers) seem to think - is naive in the extreme. Yet this misplaced belief is based on the reality that the bulk of the data you will have to search will indeed be mail. Mail represents the largest form of data in any organization, typically by an order of magnitude (10x) or more.

But here's the rub. Most of that e-mail mountain consists of redundant data or as the technical terms goes, "crap." As we discuss at length in our E-mail Archiving & Management Report, typically 80 percent of e-mail data consists of a duplication. Yet any search tool has to treat each piece of data equally, slowing the process down massively and shooting discovery costs through the roof. How much more sensible to use an archiving method to capture, filter, and reduce that volume - and ease the burden and cost of discovery?

What did we learn from the Bear Stearns scandal? Not much really, other than that e-mail and messages continue to be the key "gotcha" elements of the data mountain, and that we need to monitor and manage them ever more closely. Though the monitoring elements are far from mature, EAM tools today archive and filter very efficiently indeed. The need to take e-mail and e-mail content seriously is now an imperative, and building a strategy, agreeing methods and policies, and selecting the right tools - however complex - is a must.Last week we read about yet another major financial scandal allegedly exposed through the discovery of an e-mail message from a fund principal that apparently stated that their fund was going to be "toast." First, this was (if true) a fantastically stupid communication to put in an e-mail exchange. Second, I wonder why it took so long to find this e-mail message...