Businesses Struggle Under Growing Weight Of E-Mail

E-mail keeps growing in volume, and so does the urgency for devising new and better ways of dealing with it. A typical office worker receives more than 100 messages a day--some get 200, 300, or more--and may send dozens more. At large companies, it adds up to millions of messages per week and many hours glued to PCs; it also hogs storage and demands hours of administrator and security pro time. E-mail has gotten so big that it's no longer a mere issue of personal productivity. Top executives and their companies are being judged on how they're controlling it, as mismanagement can lead to legal troubles.

"It scares us to death," says Jeff Cooper, system architect at AIM Healthcare, of e-mail's potential to wreak havoc. Health-care companies, financial firms, and others who must comply with government data management regulations are particularly vulnerable. At AIM, Cooper supports about 2,000 Microsoft Exchange users. "We deal with hundreds of clients, and it's all confidential information," he says. "We have to make sure at some level that it's not being sent to the wrong people or used in the wrong way."

E-mail, of course, is also the vehicle for sharing many great ideas within a large company. Its valuable yet volatile nature means businesses must have an e-mail strategy and plans and processes for storing e-mail, governing its use, and dealing with the growing deluge of both legitimate messages and spam.

At Penske Truck Leasing, the number of messages received and sent by its 20,000 global employees has more than doubled in about three years, ushering in a new way of thinking about e-mail. Says Bill Stobbart, senior VP of IT: "E-mail is becoming so ingrained into many business processes that today it's mission critical."

Archive, Archive, Archive!

Some businesses have experienced the worst of the beast's wrath. There's the embarrassing case of Boeing CEO Harry Stonecipher, axed last year after e-mails revealed an affair with a female executive at the company. Or Frank Quattrone, the former Credit Suisse banker who was barred in 2004 from the securities industry after e-mail revealed he tried to cover up his dubious investment practices. Morgan Stanley, fined millions of dollars for its inability to manage e-mail in compliance with Securities and Exchange Commission orders, is now tied up in a $10 million lawsuit filed by a former Morgan Stanley IT exec who claims he was fired for, among other things, discovering unethical e-mails from other execs in the company's bloated archive.

Such cases are partly why IT departments are paying greater attention to the need to archive e-mail so it's available when needed and under control when it's not. A surprising 21% of companies received court subpoenas for e-mail or instant messaging records, according to a study conducted two years ago by the American Management Association and ePolicy Institute. So the odds are good that a lawyer could come knocking on your company's door with a request for electronic correspondence. What's more, federal civil trial rules that go into effect Dec. 1 stipulate that reviews of business records for discovery purposes must include e-mail.

The importance of archiving is a lesson AIM Healthcare learned the hard way. The health-care provider became embroiled in a dispute with employees who had left the company; AIM alleges they breached their employment contracts. "The need arose to prove what was agreed to," Cooper says. AIM hoped e-mail files would provide much of that evidence, yet there was no way to efficiently search through older documents, if they existed at all.

The company has since installed an e-mail archiving and management system from C2C Systems. Third-party products such as C2C's fill gaps in the archiving capabilities in Microsoft's Exchange Server and IBM's Lotus Notes e-mail platforms. Microsoft plans to deliver improved archiving in a forthcoming upgrade (see story, Dig Out From The E-Mail Crush ).

Many e-mail systems let users run searches across message subject lines and contents. C2C's Active Folders go a step further and scan e-mail attachments. And its security settings can be configured to prevent system administrators from conducting searches beyond the scope of what they're tasked with.

That's not just a theoretical concern. Morgan Stanley has accused Arthur Riel, that former IT exec, of rifling through executive in-boxes under the guise of testing an archiving system he helped build. Riel's searches led him to messages that show a Morgan Stanley senior IT exec currying favor with tech vendors. Morgan Stanley doesn't dispute the authenticity of the e-mails but claims Riel had no right to sift through company e-mail and says that's the reason he was fired.

The SEC requires publicly traded financial firms to archive business e-mail for three years and to store messages in "an easy-to-retrieve form" for two of those years. It's a guideline that judges are applying to the discovery phase of civil trials. In a May 2005 case in Florida, a jury ordered Morgan Stanley to pay more than $1 billion in punitive and compensatory damages to financier Ron Perelman. The bank lost the case in part because it had failed to produce required e-mail and other documents in a timely fashion. It isn't the only investment bank to run afoul of regulators because of e-mail: In March, Merrill Lynch was fined $2.5 million by the SEC for lax archiving practices.

E-Mail Cops

When archiving, the big question for many companies is what to keep and what to delete. The easy answer would be to archive everything, but that's inefficient and expensive. "Companies need to make a clear definition between things they want to keep around as legal records and everything else that will have a more aggressive expiration date," says Kevin Cavanaugh, who heads IBM's development group for Lotus Notes/Domino.

Pretty obvious stuff, except that many companies aren't taking control of the situation. AIM Healthcare is, providing employees with a written policy about appropriate e-mail use and guidelines for what must be archived and for how long. AIM also has rules on what type of mail can be forwarded outside the company and what must be encrypted.

Ensuring that employees are adhering to the e-mail rules often involves some form of traffic monitoring. The New York Daily News, Taser International, and even the U.S. forces in Iraq are using Waterford Technologies' MailMeter Insight software to identify unusual or suspicious e-mail patterns, such as messages routed to a competitor. The system carries out random searches of employee e-mail based on keywords.

About 30% of companies with more than 1,000 employees surveyed by Proofpoint say they monitor employee e-mail. Many of Waterford Technologies' customers don't tell their employees, a practice legal in all states but Delaware and Connecticut. "It's an invisible process," Waterford president Tom Politowski says.

But most companies just aren't taking the time to develop e-mail systems and policies with compliance in mind, says Riel, who was hired by Morgan Stanley in 2000, in part to help the company build an e-mail archiving system, only to be shown the door five years later. Riel is now a partner at Lighthouse Global Technologies, which, among other things, helps businesses in regulated industries develop e-mail compliance strategies. He says too many organizations maintain e-mail archives on tapes that can't be easily searched. Tape still is used widely for backup because it's cheaper than networked storage, but Riel says that's a shortsighted calculation: "If you ever do need one of those e-mails, you've just eliminated all your savings by having to go look for it."

Whether businesses succeed in complying with SEC e-mail retention mandates and other regulatory requirements, not to mention living up to their own governance policies, largely depends on their ability to cut down on the sheer volume of e-mail.

Spam is a big part of the problem, not to mention the viruses riding along on those messages. MedStar Health is trying to control those threats with CipherTrust's IronMail security appliance and antivirus software. "This hasn't completely solved the problem. As new spam techniques are developed, we see an increase in spam," says Paul Shapin, assistant VP of IS. Regularly upgrading filters helps, he adds.

Turn Down The Volume

What about the problem that confronts us all: e-mail overload? It burdens users and clogs systems.

The Hartford Financial Services Group deals with about 100 million incoming messages each month, a 40% increase from last year, says Gary Baillargeon, director of enterprise messaging and security applications. He attributes the growth to the increased use of e-mail in the financial services business and spam. Internally, Hartfold Financial employees exchange more than 3 million e-mails a month.

Limiting the size of employee mailboxes is a common tactic; employees have no choice but to clean house once their storage limits are reached. At AIM Healthcare, employees can store up to 70 Mbytes of messages in their mailboxes. They're prohibited from sending and receiving extra-large attachments, like media files. "We do some blocking there," Cooper says.

The Conference Board, a New York research center that generates national economic data, has reduced e-mail volume using a Web content management system from HyperOffice, says Mark Lackey, senior manager for knowledge management. It lets users download large business documents from a dedicated Web server so they don't need to be passed around via e-mail. It also makes its key market-moving economic reports available only through a secure Web server. That cuts down on e-mail volume and prevents documents from being leaked ahead of public release.

Fletcher Allen Health Care is benefiting from a feature in C2C's Archive One product called Policy Manager that lets administrators adjust user mailbox sizes through a graphical user interface. It can also be configured to automatically back up e-mail to either short-term storage within Exchange or to external storage systems. David Haber, senior systems engineer at Fletcher Allen, has deployed Archive One across the company's 7,500 Exchange mail-boxes and says it's the only way he can maintain a usable archive of the 300,000 messages (not including spam) received by employees each day. "E-mail is exploding," Haber says. "We need new servers, we need new space."

Haber uses spam-blocking tools to limit volume and configures his Microsoft Exchange network to automatically block messages containing potentially malicious file extensions such as .exe or .vbs. Beyond that, he's resigned to dealing with ever-increasing e-mail loads. He adds that unified messaging technologies that route faxes and voice mail to in-boxes will add to the clutter.

To deal with it all, Haber is building an archiving system that will let users easily store and retrieve e-mail. The company currently stores e-mail on three clustered 32-bit Compaq servers, but it will upgrade to 64-bit systems as part of a planned move to Microsoft Exchange Server 2007.

For a privileged few, some of the above doesn't apply. It's not uncommon for businesses to have more lenient policies and larger in-boxes for top executives. At Fletcher Allen, execs get unlimited mailbox sizes. A second tier of workers gets 200 Mbytes, while the rank and file are limited to 50 Mbytes. "It depends on how big of a shot you are," Haber says.

Morgan Stanley's IT department took an entirely different tack, blocking e-mail to former CFO Stephen Crawford in an effort, it says, to shield the busy executive from the daily deluge. But that's hardly common practice. At IBM, a low-ranking programmer can send e-mail directly to CEO Sam Palmisano. And AIM Healthcare has an open-door policy when it comes to sending e-mail to the CEO. Anything less, Cooper says, "would send a bad message."

Bad message? The e-mail beast is licking his lips.

Illustration by Mick McGinty

Continue to the sidebars:
E-mail Lockdown ,
and Dig Out From The E-mail Crush