8 ms·

I think that most companies have 'N-month email retention policies', where N is somewhere between 1-6. Did the malfeasance happen more than a few months ago? G

I think that most companies have 'N-month email retention policies', where N is somewhere between 1-6. Did the malfeasance happen more than a few months ago? Gee, sorry, no internal communications; that's policy. Did someone keep incriminating communications from more than a few months ago? Oooh, that's against policy - the recalcitrant employee has since been terminated and clearly does not represent our lofty ideals. But I don't think that most companies go out of their way to use encrypted platforms to shield communications which they know are likely illegal from investigators.

patmcguire 9y ago
For Google, at least, I believe it's 18 months. And that's quite new, it happened after the Oracle fiasco, which had all sorts of goodies like: Subject: Java class libraries With talks with Sun broken off[,] where does that leave us regarding Java class libraries? Ours are half-ass at best. We need another half of an ass. That came out in discovery.
- revelation 9y ago
  It is such a shame groklaw is no longer a thing. Another Snowden casualty.
  - pjc50 9y ago
    I missed that, how was groklaw connected to Snowden?
    - toomuchtodo 9y ago
      https://techcrunch.com/2013/08/20/groklaw-shuts-down-as-the-post-snowden-chilling-effect-continues/ https://techcrunch.com/2013/08/20/groklaw-shuts-down-as-the-... https://www.csoonline.com/article/2133906/privacy/groklaw-shutdown-shows--chilling-effect--of-nsa-surveillance.html https://www.csoonline.com/article/2133906/privacy/groklaw-sh... http://www.zdnet.com/article/privacy-concerns-cause-pj-to-close-groklaw/ http://www.zdnet.com/article/privacy-concerns-cause-pj-to-cl...
    - gpm 9y ago
      You can read the post at the top of groklaw.net still, in case that ever changes (unlikely) here is a perma link [0] Basically the author decided that she would rather disconnect from the internet than be spied on. [0] http://www.groklaw.net/article.php?story=20130818120421175 http://www.groklaw.net/article.php?story=20130818120421175
    - deleted 9y ago
      [deleted]
  - linkregister 9y ago
    I consider it a failure of journalism editing. Pamela (the author of groklaw) earnestly believed that her communications were being monitored and read by American intelligence services, which was a rational conclusion to draw from the prevailing news stories in The Guardian, The Washington Post, and The New York Times. She was so disillusioned with the perceived trampling of 4th amendment rights that she stopped posting to her blog and moved her email to Lavabit. Such was the breathless nature of the reporting, that the editors and ombudsmen didn't consider that the reporting drew conclusions and made unfounded allegations based off of slide decks. Other countries' government secrets being taken through computers == "they monitor everything." Now with the benefit of the Shadow Brokers leaks, we see that the NSA is severely constrained by manpower, processes, and software bugs. It's practically a joke compared to its perceived might in 2013. I hope that she returns to writing, but I understand if she still feels privacy concerns with the internet.
    - jacquesm 9y ago
      > It's practically a joke compared to its perceived might in 2013. But it's a lot worse than we thought before Snowden. And with stuff like this erring on the side of caution seems like a pretty good idea.
      - linkregister 9y ago
        I whole heartedly disagree. Erring on the side of caution got us the TSA, DHS, the War on Drugs, the Iraq invasion, and justifies the continued operations in Afghanistan. Erring on the side of caution is a rational individual strategy in many cases, but it has disastrous collective implications. In a sense, if the editors of those publications had erred on the side of caution, then they could have reduced the drag on commerce and free expression that exaggerated claims yielded.
        jacquesm 9y ago
        > I whole heartedly disagree. Erring on the side of caution got us the TSA, DHS, the War on Drugs, the Iraq invasion, and justifies the continued operations in Afghanistan. That's nothing to do with the subject, which is an individual no longer comfortable with their online communications. Dragging all this other stuff in has no bearing on that. Besides the fact that quite a few of those entries have absolutely nothing to do with 'erring on the side of caution'.
deleted 9y ago
[deleted]
chkuendig 9y ago
I keep hearing this here, but AFAIK there's plenty of record keeping regulation which won't allow for that. No? I assume many companies auto-clean the user-facing mailboxes for different reasons, but they probably all are required to archive the emails on some type of long-term storage for a few years. But maybe that's just industry-specific regulations...
AnimalMuppet 9y ago
But a lawsuit changes that. You don't get to delete stuff that's relevant to the lawsuit, no matter what your retention policy is.
- praptak 9y ago
  Still the policy makes it <date of litigation hold> minus X months, rather than everything since the creation of the company.
  - AnimalMuppet 9y ago
    Correct. And "litigation hold" is the term that I knew existed, but didn't come up with.
- comatose 9y ago
  While working at a pharmaceutical co I was backing up a drive onto the os drive of our local pc for general it support / utilities when I got a call from the user. She forgot to tell me she was on legal hold. I stopped the backup, went through the e-discovery process on her drive, rebuilt the pc and did e-discovery on our pc as well, because it was now also covered by her legal hold. You don't want to involve yourself in a case by ignoring those discovery laws, they are very serious about enforcement in court.
ggcdn 9y ago
structural engineers are required to keep all communications, notes, etc for seven to ten years, depending on the jurisdiction. These super short email retention policies seem extremely unethical to me.
- deleted 9y ago
  [deleted]
- dnadler 9y ago
  Same goes for financial firms.
- simonrobb 9y ago
  Only for official RFIs though right? Not all email communication. (speaking from my experience as a structural engineer in Australia, things may be different here)
- mslate 9y ago
  The Sony Pictures hack of 2014 caused a lot of companies to reflect on their data retention policies. Uber's special in that they set their retention policy to subvert criminal investigations, not to protect "trade secrets" I agree about structural engineers being an ideal though--old school engineers get "accountability" better than anyone
cpitman 9y ago
These policies go two ways. Companies need to be able to delete data eventually, but they also need to make sure that employees are not deleting data on their own in order to hide illegal activity. Having a retention policy of X months then cuts both ways. If you delete data before 18 months, well that looks awfully suspicious.
pmorici 9y ago
Prior to even being sued the opposing sides lawyer can give you notice of a possible lawsuit and it is your responsibility to not destroy any documents related to it regardless of your companies retention policies.

patmcguire 9y ago

For Google, at least, I believe it's 18 months. And that's quite new, it happened after the Oracle fiasco, which had all sorts of goodies like: Subject: Java class libraries With talks with Sun broken off[,] where does that leave us regarding Java class libraries? Ours are half-ass at best. We need another half of an ass. That came out in discovery.

revelation 9y ago
It is such a shame groklaw is no longer a thing. Another Snowden casualty.
- pjc50 9y ago
  I missed that, how was groklaw connected to Snowden?
  - toomuchtodo 9y ago
    https://techcrunch.com/2013/08/20/groklaw-shuts-down-as-the-post-snowden-chilling-effect-continues/ https://techcrunch.com/2013/08/20/groklaw-shuts-down-as-the-... https://www.csoonline.com/article/2133906/privacy/groklaw-shutdown-shows--chilling-effect--of-nsa-surveillance.html https://www.csoonline.com/article/2133906/privacy/groklaw-sh... http://www.zdnet.com/article/privacy-concerns-cause-pj-to-close-groklaw/ http://www.zdnet.com/article/privacy-concerns-cause-pj-to-cl...
  - gpm 9y ago
    You can read the post at the top of groklaw.net still, in case that ever changes (unlikely) here is a perma link [0] Basically the author decided that she would rather disconnect from the internet than be spied on. [0] http://www.groklaw.net/article.php?story=20130818120421175 http://www.groklaw.net/article.php?story=20130818120421175
  - deleted 9y ago
    [deleted]
- linkregister 9y ago
  I consider it a failure of journalism editing. Pamela (the author of groklaw) earnestly believed that her communications were being monitored and read by American intelligence services, which was a rational conclusion to draw from the prevailing news stories in The Guardian, The Washington Post, and The New York Times. She was so disillusioned with the perceived trampling of 4th amendment rights that she stopped posting to her blog and moved her email to Lavabit. Such was the breathless nature of the reporting, that the editors and ombudsmen didn't consider that the reporting drew conclusions and made unfounded allegations based off of slide decks. Other countries' government secrets being taken through computers == "they monitor everything." Now with the benefit of the Shadow Brokers leaks, we see that the NSA is severely constrained by manpower, processes, and software bugs. It's practically a joke compared to its perceived might in 2013. I hope that she returns to writing, but I understand if she still feels privacy concerns with the internet.
  - jacquesm 9y ago
    > It's practically a joke compared to its perceived might in 2013. But it's a lot worse than we thought before Snowden. And with stuff like this erring on the side of caution seems like a pretty good idea.
    - linkregister 9y ago
      I whole heartedly disagree. Erring on the side of caution got us the TSA, DHS, the War on Drugs, the Iraq invasion, and justifies the continued operations in Afghanistan. Erring on the side of caution is a rational individual strategy in many cases, but it has disastrous collective implications. In a sense, if the editors of those publications had erred on the side of caution, then they could have reduced the drag on commerce and free expression that exaggerated claims yielded.
      - jacquesm 9y ago
        > I whole heartedly disagree. Erring on the side of caution got us the TSA, DHS, the War on Drugs, the Iraq invasion, and justifies the continued operations in Afghanistan. That's nothing to do with the subject, which is an individual no longer comfortable with their online communications. Dragging all this other stuff in has no bearing on that. Besides the fact that quite a few of those entries have absolutely nothing to do with 'erring on the side of caution'.

deleted 9y ago

[deleted]

chkuendig 9y ago

I keep hearing this here, but AFAIK there's plenty of record keeping regulation which won't allow for that. No? I assume many companies auto-clean the user-facing mailboxes for different reasons, but they probably all are required to archive the emails on some type of long-term storage for a few years. But maybe that's just industry-specific regulations...

AnimalMuppet 9y ago

But a lawsuit changes that. You don't get to delete stuff that's relevant to the lawsuit, no matter what your retention policy is.

praptak 9y ago
Still the policy makes it <date of litigation hold> minus X months, rather than everything since the creation of the company.
- AnimalMuppet 9y ago
  Correct. And "litigation hold" is the term that I knew existed, but didn't come up with.
comatose 9y ago
While working at a pharmaceutical co I was backing up a drive onto the os drive of our local pc for general it support / utilities when I got a call from the user. She forgot to tell me she was on legal hold. I stopped the backup, went through the e-discovery process on her drive, rebuilt the pc and did e-discovery on our pc as well, because it was now also covered by her legal hold. You don't want to involve yourself in a case by ignoring those discovery laws, they are very serious about enforcement in court.

ggcdn 9y ago

structural engineers are required to keep all communications, notes, etc for seven to ten years, depending on the jurisdiction. These super short email retention policies seem extremely unethical to me.

deleted 9y ago
[deleted]
dnadler 9y ago
Same goes for financial firms.
simonrobb 9y ago
Only for official RFIs though right? Not all email communication. (speaking from my experience as a structural engineer in Australia, things may be different here)
mslate 9y ago
The Sony Pictures hack of 2014 caused a lot of companies to reflect on their data retention policies. Uber's special in that they set their retention policy to subvert criminal investigations, not to protect "trade secrets" I agree about structural engineers being an ideal though--old school engineers get "accountability" better than anyone

cpitman 9y ago

These policies go two ways. Companies need to be able to delete data eventually, but they also need to make sure that employees are not deleting data on their own in order to hide illegal activity. Having a retention policy of X months then cuts both ways. If you delete data before 18 months, well that looks awfully suspicious.

pmorici 9y ago

Prior to even being sued the opposing sides lawyer can give you notice of a possible lawsuit and it is your responsibility to not destroy any documents related to it regardless of your companies retention policies.