Advice on handling threats from emails.

It's paradoxical: In the face of never-ending legal discovery challenges and legal codes (especially the new Federal Rules of Civil Procedure, or FRCP, which went into effect last December 1), companies are being told that they must retain key email messages, yet they need a system that allows them to cost-effectively eliminate messages they don't truly need for discovery purposes.

[ILLUSTRATION OMITTED]

A survey by LexisNexis found that 27 percent of companies didn't even have a written document retention policy. In addition, fully one out of three of companies' written documentation retention policies did not include or apply to electronically stored information.

In cases where companies were required to produce electronic documents, fully 15 percent of corporate counsels either had no processes in place or said it was "going to take a while." An additional 24 percent said they were not sure how that task had been accomplished.

"After seeing some of the onerous penalties that non-compliers have been hit with, one natural reaction among some corporations is to save everything," says Robert D. Owen, national co-chair of the E-Discovery and Information Management Group for international law firm Fulbright & Jaworski LLP. "But hoarding every document and piece of communication in perpetuity is not what the new federal discovery rules require. Nor does it provide immunity from future prosecution and liability. The real problem is that excessive retention of documents and electronically stored information can create potentially astronomical review costs in litigation."

Retaining any and all messages, notes email system vendor Message-Gate, significantly complicates the discovery process for litigation purposes. Yet, according to Osterman Research, six in seven enterprises don't have a tool in place to address email and instant messaging (IM) communication risks associated with litigation requirements. Corporate counsel--and a company's financial managers--must evaluate the minimum threshold for compliance, balancing their needs with IT, management and user expectations of privacy.

MessageGate suggests three steps an organization can take:

* Conduct a thorough analysis of email communication, including email traffic, content and metadata. With the right tools, companies have the ability to quickly view their email situation and the attendant risks. For example, through this process, one financial services company learned it was disclosing its customers' personal financial information via unsecured email as employees sought to close mortgages by sharing credit reports directly with applicants via email.

* Reduce email risk at the perimeter. Ninety-eight percent of email misuse is accidental, and most companies are not aware of what accidents are happening. Email governance software can implement predefined parameters and rules. At the time of hitting "send," any violations contained in the email are presented to the employee, providing an opportunity to stop the email before it goes out and enters the system as a corporate record.

* Implement archive categorization. Using email governance tools, a message to be "stamped" and categorized greatly improves the email archival and retrieval processes by sorting out irrelevant information and categorizing items by topic and retention time.

Hoike, a Hawaiian-based provider of content management software, urges a series of steps to pare e-discovery risk. These include: early involvement with IT, with the company's general counsel detailing the requirements of the new rules; developing a repeatable e-discovery compliance strategy for senior management, using existing technology; developing a strategy for instituting and managing legal "holds" and for tracking employee notification; and seeking early review of documents in-house to decide whether to fight or settle, and to cut legal costs by reducing the volume of documents submitted to outside counsel.