The Industry Standard - Psystar case reveals Apple's questionable policy on email retention - Comments

I run a email system for a

Keith — Tue, 25 Nov 2008 10:49:21 -0500

I run a email system for a large public entity. And here's how the rules really work.

You do what you can, and its up to the judge whether you did enough. The fact is that if your a multi-billion dollar company (in the technology sector no less) then the standards are going to be higher than if your a small business with a couple of computers and use yahoo email.

The standard is that the entity must retain records produced by the entity applicable to the type of entity (see FIRPA, HIPPA). A record is basically anything including and up to a post-it note on someones desk as long as someone working either directly or as a contractor produced that record.

Clever attorneys will send a notice to the lowest person in the organization 30 days before they plan on filing suit. Knowing full well that the notice (if it does pass up the chain) will take at least that long to reach someone who can do something about it. And then it will take even longer to get the data (if any) and by the time its all said and done the attorny's will request summary judgement if the entity is unable to produce the records within the allowed time frame. And will probably get that judgement.

Just a side note, typical fanboi'ism detector went off reading others posts. If this were another technology company I am sure these same people would be screaming about how awfull it was that a company didnt keep their emails. Or perhaps folks who bought apple at $180ish. Anyways good luck !

Brad: Since when is using an

Ian Lamont — Tue, 25 Nov 2008 10:38:34 -0500

Brad: Since when is using an anonymous source not legitimate? It's certainly not our preference to use them, but in some cases granting anonymity is the only way people will speak with journalists. As Cyndy pointed out, we're hardly alone in using anonymous sources. I see this every day in the Wall Street Journal and other publications.

Relatively few companies let their employees speak with the press unless it's been vetted by PR departments, marketing staff, or senior executives -- people who are not always inclined to give journalists their heartfelt opinions about an issue, if they respond at all. In addition, more and more sources are coming to the realization that their names will live for a long time in Google search results, and they would rather avoid leaving a personal data trail that others can see.

Ian Lamont
Managing Editor
The Industry Standard

The place I work will go

pft — Tue, 25 Nov 2008 02:44:18 -0500

The place I work will go un-named... but we have over 40,000 employees. The e-mail is stored on a server for 14 days only. If a user wants to keep a copy longer than that... it's up to them. If you want to sue us, then you can have access to that 14 days. There is no law or reason for a law that requires people to save all their correspondences.

Brad, I'm sure that The

Cyndy Aleo-Carreira509894 — Mon, 24 Nov 2008 21:02:49 -0500

Brad, I'm sure that The Washington Post would agree with you. Oh wait... didn't their reporters win the Pulitzer?

there's actually a LOT MORE

frank senbaynes — Mon, 24 Nov 2008 20:33:03 -0500

there's actually a LOT MORE to this story. go to http://stuffididlastnight.com

Not really on topic, but I

Brad — Mon, 24 Nov 2008 17:58:07 -0500

Not really on topic, but I really have a problem with A.) People who speak to the press "anonymously" because their employer does not want them speaking to the press, and B.) 'Journalists' who aid and abet these people by relying on these 'anonymous' sources for their story. This source is not a whistle-blower that needs protection. He's just someone playing outside the rules and the journalist is taking the easy way instead of using a legitimate on-the-record source for their information.

I suspect this article would have (or SHOULD have) been severely criticized in any decent journalism class in any decent university.

Ya... Psystar's just trying

JJ Pagac — Mon, 24 Nov 2008 17:29:47 -0500

Ya... Psystar's just trying to still make headlines again. They don't seem to like to follow the rules when it comes to "proper" licensing policies. However, now they strike at Apple for what seems to be something that doesn't even exist. Good luck.

Look, so long as it is an

John — Mon, 24 Nov 2008 10:40:25 -0500

Look, so long as it is an established and accepted policy, and so long as the policy is upheld, this should be perfectly acceptable. The appalled tone of this article seems a bit extreme. It's not like all companies must keep everything, and few really ever do. A former employer of mine had such a narrow "retention" policy so as to seem to some to be more of a destruction policy. But so long as it's up-front, documented and upheld... sorry plaintiff, you can't just get whatever you demand.

Now it's true, Apple might wish they had better archives if they ever really need to dig up something to save their bacon, but something tells me Apple's army of lawyers is satisfied with the present arrangement. It sounds like they have mechanisms for activating retention when a threat of discovery has been identified, and that's no less a retention policy than logging everything or even logging nothing.

Being an IT guy and dealing with this sort of thing more and more, quite frankly, I think many companies would do better to focus more on running their business right, right now, and less on being able to point fingers when things go wrong in the future. Perhaps the folks at Apple would agree.

in reading both the

Craig LS — Mon, 24 Nov 2008 09:43:19 -0500

in reading both the LexisNexis overview and the Sedona guidelines I think Apple is ok, they issued a memo to those that MAY have relavent documents to retain them, that is outlined as a step in the Sedona guidelines.

by not having a set guideline, like in saying all emails will be retained for 5 years, they are not exposing them selves to fishing tactics.

handle it case by case, and if no litigation is pending or anticipated, hit the delete key.

makes sense to be

Psystar case reveals Apple's questionable policy on email retention

Jordan Golson — Wed, 19 Nov 2008 19:31:20 -0500

Apple has sold enterprise-class storage hardware and software for years, but the company has yet to embrace systematic email and document retention policies that are common among publicly traded companies.

According to a recent legal filing (see page 7, below) in the Psystar vs Apple antitrust case, Apple employees are responsible for maintaining their own documents such as emails, memos, and voicemails. In other words, there is no company-wide policy for archiving, saving, or deleting these documents.

This could pose a problem in the event of a lawsuit. In recent years, companies have been fined millions after failing to retrieve old emails and other files required as evidence. The fear of fines and other legal sanctions has resulted in many companies instituting strict "e-discovery" retention policies, and has helped give rise to a new class of enterprise-class storage and indexing tools.

An e-discovery lawyer, who asked not to be named because his employer (a firm you probably have heard of) doesn't want him speaking to the press, explained the basic legal requirements surrounding email and document retention to The Standard. "If litigation is anticipated, the party has a duty to preserve potentially relevant documents," he said.

"An employee retention program with no organization or coordination is effectively incapable of compliance," he continued, "barring an act of God, or luck akin to picking every game right in an NCAA pool. Apple's retention policy is negligent."

Consider this scenario: Employees could have emails from five years ago that become "potentially relevant", but because there was no policy in place regarding e-documents, those records could easily become destroyed -- making it potentially impossible for a plaintiff to make a case from internal documents.

However, Apple claims in the Psystar document that its policy is fine because once the company anticipated litigation:

[Apple] identified a group of employees who could potentially have documents relevant to the issues reasonably evident in this action. Apple then provided those individuals with a document retention notice which included a request for the retention of any relevant documents.

Psystar's antitrust claim has been dismissed, but Apple is currently involved in many other cases. Apple's weak e-discovery practices could very well come back to haunt the company.

If you're interested in learning more about e-discovery, the relevant court case for e-document retention is Zubulake v. UBS Warburg LLC. LexisNexis gives a nice overview of what is legally required from a corporation.

For even more information, The Sedona Conference recently issued a series of guidelines which, while not legally required, are a good "best practices" guide to document preservation.