As part of our ongoing look at email archiving issues, writer Peter Bochner spoke with Mike Gundling, iLumin Software...
Services Inc. Gundling is senior vice president of product management. He is responsible for the company's suite of secure and compliant products.
Q: iLumin has been in the e-mail archiving space since 1997. What was the compliance climate like back in 1997, before Sarbanes-Oxley came into play?
A: Back then [the SEC Exchange Act Rule] Section 17a-4 regulations were just emerging. These regulations were very proscriptive on how e-mail must be treated, it required investment firms to preserve records, including e-mail, for three years, and how it must be readily available. Since that time, not much has really changed except that IM has been added to the domain of those records.
Q: But Sarbanes-Oxley has put e-mail archiving on the map, so to speak, no?
A: Right. Because of the Sarbanes-Oxley poster children, such as Enron [Corp.] and Tyco [International Ltd.], companies know they can't throw out e-mail. But many of them are still unclear as to what their records management policy should be. And the draconian consequences of Sarbanes-Oxley have a lot of companies overreacting. Some companies think they need to retain their e-mail forever, just to make sure they're compliant.
Q: Is Sarbanes-Oxley merely, as one expert recently told me, "essentially a best business practices regulation"? Or is there a danger to being overcautious?
A: That's a controversial issue. Sarbanes-Oxley is certainly an opportunity for best practices, and a lot has been written about how companies should view it as an opportunity to put in place controls and practices that will enable them to get the most out of their content management and lifecycle management policies. But, at the same time, is it something that is lowering the productivity and efficiency?
Q: Whatever the cost of lost efficiency, surely the penalty of non-compliance is worse.
A: Absolutely. Philip Morris was fined $2 million by a judge for deleting e-mail. During a discovery phase, firms are being compelled to produce e-mail, and it doesn't matter if it takes them millions of dollars to comply. In fact, there are now lawyers out there practicing arbitrage -- simply threatening lawsuits, knowing that a company will probably settle since the costs of discovery can exceed the costs of settlement.
Q: You offer Assentor Enterprise SOX Edition as an e-mail records management product specifically packaged for Sarbanes-Oxley needs. You also have a version of your Assentor Mailbox Manager product specifically tailored to Notes.
A: It's a matter of mail storage management. You can't keep all this e-mail on your Domino server. You can't manage backup and restore if you let your e-mail server grow uncontrolled. Assentor Mailbox Manager reduces the storage burden by snubbing e-mail messages out on the server, based on your policy. The user can still see the message but now the message is stored in a secondary storage archive, resulting in lower storage costs.
Q: How is it specific to Notes and Domino?
A: Mail storage management must be platform-specific. And the benefit to a corporation using Domino is that they need fewer Domino servers. They spend less money on backup tapes, and with the confluence between storage management and records management, get a more efficient Domino footprint. The product also leverages Domino's quota-definition capabilities to archive e-mail automatically to meet individual mailbox quota assignments without user action. This eliminates the need for users to archive items in their inboxes manually.
Q: It's been said administrators are at the center of a perfect storm. Can you describe this perfect storm and tell us how e-mail admins can navigate and survive it?
A: For today's companies, the perfect storm is the convergence of skyrocketing e-mail volumes, rapidly growing e-mail stores, new and expanding regulations, heightened enforcement of existing government regulations and increased corporate liability related to the admissibility of e-mail during litigation. Ten years ago, we thought all users would be putting their important documents in a document and records management system. Now e-mail is the most mission-critical application. It's the business repository of all these business documents, workflow and collaboration that is the business itself.
So to address this perfect storm, IT wants backup, the end user wants infinite mailboxes without quotas, and the board and executive officers have their own issues, since they have a personal stake in compliance. Basically, you can survive the perfect storm if you have a solution that gives you all four things: mail storage management, discovery, supervision and storage retention management.
Q: What's the next challenge facing iLumin?
A: We've built a discovery tool that works with a storage solution. Now we're trying to connect the dots with software, to offer companies the ability to search and produce the data requested and turn it over to regulators. Simple retention of records is fine in the absence of discovery. But being able to produce and search and manage this information are critical aspects. Firms have always kept a lot of data, but in the past they paid someone $4 per megabyte to pull the data off of backup tape. That's an entire industry that may be eliminated soon.