Security Management : White House

Email Archiving and the White House

CA Community — Mon, 04 May 2009 10:25:00 GMT

With the new Administration entering the White House, we need to consider how previous Administrations managed emails and email records and how the current Administration can learn from those experiences. As we're all aware, there have been investigations, Congressional inquiries, and countless editorials on emails lost forever that were either sent or received by the White House during the previous Administration.

If history has taught us nothing else, it has taught us that we are a nimble country. That is, we are able to quickly change our ways based on occurrences "“ good or bad "“ and learn from them. After September 11th, the Bush Administration was faced with difficult decisions. Likely, much of the information generated in support of those decisions was delivered via email. Of the email generated during that period, it has been reported that millions are missing. Beyond end user deletion of email from their Inboxes, it is possible that those emails were stored on unsecured email servers, or in .PST or .NSF files that also may have been unsecured. Many of those missing emails were likely of significant historical value, and represented the ongoing movement of our country.

As we continue to learn from history, we can now see where email archiving tools should be deployed in not only the White House, but throughout the federal government. Via the use of email archiving tools, all emails that are sent or received are captured and stored within a secure environment that guarantees the capability to manage and save those items for a predetermined amount of time. To take this a step further, the capture of a subset of those items as records, that contain their own rules of retention, would enable future Administrations the capability to identify and quickly locate specific trails of information through the use of various discovery tools. For example, while a personal email from a spouse would likely not contain historically significant information, and would likely not need to be saved for an extended period of time, an email from President Obama that was sent from his blackberry might very well be significant. The former could be removed from the archive after a short period of time, while the latter should be retained based on Federal regulations such as the Freedom of Information Act (FOIA) and the Presidential Records Act (PRA).

Either way, the ability to permanently delete emails, so they become unrecoverable, from the email servers within the White House is not a practice that should be continued. In fact, simply managing emails directly from within email servers is not a suggested practice. Only via the use of email archival and records management tools, that remove capabilities to randomly delete, can the new Administration look to learn from the previous Administration and move forward to ensure that emails generated by the White House are managed and maintained appropriately.

Email and History in the Making

CA Community — Mon, 09 Feb 2009 15:00:00 GMT

A recent New York Times article got me thinking about Obama's email archiving challenge. As the result of many different entities working as part of the Obama election campaign, transition and inauguration teams "and now the White House, many individuals, including Obama, will have had multiple email addresses in four months:

@barackobama.com during the campaign;

@ptt.gov for the presidential transition committee;

wh.LASTNAME@gmail.com for the press office for the briefest of periods right before the inauguration; and finally,

@who.eop.gov after the inauguration.

Technology wise, that should not have been an issue for his team to roll one email address into the other. But I wonder if this did in fact impact productivity, or security or records management.

From a records perspective, I wonder if and how the transition of those records will be managed. Will they be archived for posterity so that future generations can view the inner makings of the first African American president? Were all email addresses included under the umbrella of records policies as the multiple changes occurred? Emails from any of the four email addresses may eventually be required as reference or evidence for a variety of reasons. Has this been considered during the transition?

Presidential transition teams are a private entity and typically exempt from disclosing records during and after the transition. They are not subject to the Freedom of Information or Presidential Records Act. However, from a historical aspect, one would hope that these records are preserved, no matter what changes occurred.

Once the emails are rolled over to the White House, they do become subject to FOIA and are required to be saved.

Hopefully, this tech-savvy leader and his transition team gave thought to this records issue, with the records that started his tenure becoming available and not lost due to transition changes as four email addresses.

The Cost of eDiscovery

CA Community — Mon, 26 Jan 2009 10:00:00 GMT

Without defined, repeatable processes and the right tool it's apparent that accurately estimating the cost of an eDiscovery response is dicey at best and is a complete unknown for most. Ask around your own company and the likely answer will be: "It depends."

There have been numerous articles recently about the Bush administration's email woes, including this Washington Post article that cites a $10m figure for finding lost emails. I'm sure that we will all carry that burden as taxpaying citizens of the US.

No one is immune from a document request. eDiscovery responses are becoming more of a regular occurrence (or should I say disruption?) throughout both the public and private sectors. So let's just assume there is a high response cost to a document request as we noted above. This really elevates the need to "have your house in order."

Taking steps to proactively build a compliant and discoverable environment should be on the top of everyone's list, from IT to the CEO. I kind of equate it back to the days prior to everyone having a Disaster Recovery plan. Initially DR was just a plan that sat on a shelf, a check box item if you will. Then as businesses started realizing the impact that IT-related downtimes had on their bottom line, it became more of a commitment by upper management to ensure there was a real, tested course of action between the covers of the plan.

It's clear that eDiscovery responses are expensive when you aren't prepared. As is evidenced by the search for White House email, the dollars are mounting up for discovery cases. However, the better prepared you are to respond, the less impact there is on your bottom line!

To learn more go to
www.ca.com/ig
.

A New Era at NARA?

CA Community — Mon, 15 Dec 2008 11:06:00 GMT

In a recent National Archives and Records Administration (NARA) press release, it was noted that "On December 7, historian Allen Weinstein, Archivist of the United States, submitted his resignation to the
president, effective December 19, 2008. Professor Weinstein, who has Parkinson's disease, cited health reasons for his decision."

Allen Weinstein was a leader at NARA for 6 years and will be missed. We wish him well and thank him for his years of public service.

The previously mentioned press release also describes 13 major accomplishments under Weinstein's leadership at NARA. While each is commendable, I am reminded of three other significant events that occurred during his tenure that shed light on problems with records management in federal agencies and may shift a change in NARA's future direction.

Before I delve into those three topics, I want to remind readers that the NARA mission statement reads that "NARA serves American democracy by safeguarding and preserving the records of our Government, ensuring that the people can discover, use, and learn from this documentary heritage. We ensure continuing access to the essential documentation of the rights of American citizens and the actions of their government. We support democracy, promote civic education, and facilitate historical understanding of our national experience."

The first event I'd like to talk about is related to testimony delivered to Congress in April 2007 by Linda Koontz, Director, Information Management Issues, Government Accountability Office (GAO), entitled "Federal Records "“ Agencies Face Challenges in Managing E-Mail." In her testimony, Mrs. Koontz clearly described the duties and responsibilities of NARA and the heads of each federal agency in accordance with the Federal Records Act (Chapters 21, 29, 31, and 33). Under the Federal Records Act , each federal agency is required to make and preserve records that:

document the organization, functions, policies, decisions, procedures, and essential transactions of the agency and,

provide the information necessary to protect the legal and financial rights of the government and of persons directly affected by the agency's activities. NARA has responsibilities for oversight and guidance of federal records management.

Mrs. Koontz's testimony describes the findings of a GAO Report on the management of emails as records in four government agencies. Highlighted in the testimony are findings that while NARA has issued guidance for the management of email records, the agencies are not complying with the guidance. She states that "8 of the 15 senior officials we reviewed, e-mail messages that qualified as records were not being appropriately identified and preserved." Taxpayers may conclude that since recordkeeping requirements may not be followed, it cannot be assured that records, including information that is essential to protecting the rights of individuals and the federal government, are being adequately identified and preserved.

The second issue is highlighted in an Associated Press article, titled "White House E-Mail Case Can Proceed." U.S. District Judge Henry Kennedy ruled that two private groups may pursue their case as they press the White House to recover millions of possibly missing electronic messages. Kennedy rejected the government's request to throw out the lawsuits filed by Citizens for Responsibility and Ethics in Washington and the National Security Archive. CREW and the National Security Archive pursued a court order to direct the archivist of the United States to initiate action through the US Attorney General to restore deleted e-mails and initiate legal action under the Federal Records Act. A court order directing the White House to preserve 65,000 computer backup tapes remains in place. The article quotes a former White House computer expert who told Congress "the White House had no complete inventory of e-mail files, that there was no automatic system to ensure that e-mail was archived and preserved, and that until mid-2005 the e-mail system had serious security flaws."

And the third on my list, H.R. 5811 - the "Electronic Message Preservation Act." This House Resolution requires the Archivist of the United States to promulgate regulations governing federal agency preservation of electronic to:

require the electronic capture, management, and preservation of such electronic records in accordance with the Federal Records Act;

require such records to be retrievable through electronic searches;

establish mandatory minimum functional requirements for electronic records management systems and a process to certify federal agency compliance with such requirements;

include timelines for federal agency compliance; and

include requirements for the capture, management, and preservation of other electronic records. H.R. 5811 will require the head of each federal agency to report to the Archivist on the agency's compliance with the Archivist's regulations and will require the Archivist to report to the House Committee on Oversight and Government Reform and the Senate Committee on Homeland Security and Governmental Affairs on federal agency compliance.

As stated above, NARA has two responsibilities under the Federal Records Act. One is
oversight
and the other is
guidance
. NARA fulfills its guidance responsibility, but, traditionally, NARA has not included oversight in its mission, except where invited by an agency.

I first became involved with records management when I was a First Lieutenant in the US Army. My unit passed an Inspector General inspection in every area except for records. My company clerk, a Specialist 4 (E-4) was responsible for the unit's records management program. She was the only person in the company who understood anything about records but sadly nobody listened to her. She did not have enough rank and authority to perform her job. Nor did she have the backing of senior management. As the senior lieutenant in the company, I was ordered to get our records in shape. It took an Information Governance inspection and a direct order from the company commander to make us serious about our records management responsibilities. Isn't that true for most organizations?

Recent reports and articles about the state of records management in government agencies may result in a congressional mandate that will transform NARA from its current "paper tiger" culture to one of enforcement as well. We would welcome such a change. I sincerely hope that as new the administration takes place, including a new Archivist, a change in the enforcement policies at NARA will occur. The public trust in federal records management requires both oversight and guidance. As the reports indicate, without oversight, we cannot be assured that records, information that is essential to protecting the rights of individuals and the federal government, are being adequately identified and preserved.

Economic Crisis Highlights Need for Information Governance

CA Community — Fri, 31 Oct 2008 10:10:00 GMT

The current economic crisis has all of us on edge. Everyday we have the pleasure of watching our investments and 401ks ride the rollercoaster that is Wall Street. Professionally we watch our employers tighten their belts and we naturally ask ourselves what does this mean to us as Legal, Compliance, Records and IT professionals? It is appropriate for us to take action and do everything in our power to help our companies respond to this new challenging environment. We want to insure that our businesses are well prepared to weather this storm and will be well positioned to gain momentum once the storm passes.

One natural consequence of any crisis like the one we are in today is an increase in oversight and likely the enactment of more regulations. This will translate to more complex records management requirements, retention policies and tighter governance. One may also expect more litigation and therefore more Discovery requests, making a consistent methodology for eDiscovery ever more essential. Regardless of who wins the election, more rules and regulations are inevitable. More government transparency and accountability is also likely. Especially if there is a change of control in the White House, look for many requests for discovery and many more FOIA requests.

What can you do as a professional responsible for Information Governance? You need to make sure you business has a solid information strategy to meet these demands. Here are some steps you can use to get started. First, it is critical to understand the compliance regulations that govern your business. These may include but are not limited to regulations, laws, industry standards (e.g. DoD 5015.2, ISO 15489) and organizational best practices.

Build a Team or Task Force to work on your policies and procedures. It should include not only your Compliance Officer and Records Manager but IT and Corporate Counsel. Build and review Records policies for retention and disposition, as well as discovery procedures for all corporate knowledge (records and non-records). Understand privacy and need to know limits, FOIA impacts. Review security infrastructure to secure information accordingly. For example, if you have sensitive documents, such as HR information in email and the HR professional moves to another department, do you have a way to secure the sensitive information that may be in his/her mailbox.

Identify IT Challenges such as email disruptions, disaster recovery, backup procedures and eDiscovery/ audit response.

Define your policies clearly and have a clear plan for phasing them in.

Educate your user community. Without education policy is meaningless.

Continued education is KEY in all areas including changing regulations, changing technology.

Establish continuous improvement process. This should be a living document, always checked for changes in the law, business practices etc...

Monitor and measure results "“ auditing is key. Make sure you have metrics to measure against.

With this outline you can get yourself ready to come out on top.