Controlling the risks of content publication: Content management is the responsibility of all functional areas in an organization, but IT and records management should share managerial responsibility.

Colorado v. Kobe Bryant, the recent high-profile court case involving National Basketball Association star Kobe Bryant highlights some of the pitfalls inherent in poor content management. The criminal case stems from a 20-year-old woman's accusation that Bryant sexually assaulted her at a resort where she was working in Eagle County, Colorado, in 2003. The case has been plagued by a series of problems associated with the publication, dissemination, and management of court documents and records.

According to ABC News, in an unprecedented string of content publication and records management mistakes, the court

* published Bryant's accuser's name, protected by law in the state of Colorado, on a court Web site for a short period of time in September 2004

* e-mailed the transcript of a "closed-door" hearing dealing with the accuser's sex life and Colorado's Victim's Compensation Fund to seven major media outlets

* posted the accuser's name on a court Web site again in July almost a year after the first mistake

* posted court-sealed hospital examination evidence on a court Web site

ABC News also reported that, in association with the court investigation, the hospital in Glenwood Springs that examined both Bryant and his accuser as part of the investigation mistakenly turned over a copy of the accuser's medical records to Bryant's attorneys.

The result of such mistakes can be extremely serious. Bryant's accuser received death threats after her name was mistakenly published. The lack of trust she now has in the legal and court system as a result of these mistakes has at least twice caused her to consider withdrawal from the case, according to her attorneys, and ultimately may have contributed to her decision to refuse to testify at trial, which was reportedly a major factor in the court's decision to drop criminal charges against Bryant.

There are important lessons to be learned by all organizations, both public and private, from the mishandling of Internet-based content and documents in this court case.

At the heart of this problem is the fact that human beings are fallible. They make mistakes and misjudgments, forget things, and are not omnipotent. They get tired, bored, distracted, angry, happy, or sad. All of these particularly human characteristics and more can and do lead to variations in performance, or mistakes, more so in some individuals than in others. Organizations also cannot ignore the occasional disgruntled employee who may want to publish damaging content in order to "grind an ax" or to take a parting shot before leaving for a new position elsewhere.

In today's environment, where individuals at virtually all levels of an organization can and often do publish content using Internet technology--content for which the organization is responsible and liable--the question is, "How does an organization gain control over content publication in a fashion that still allows and encourages appropriate content publication and at the same time protects the organization as much as possible from inevitable mistakes?"

A Two-Part Solution?

An answer to this question, at least for most organizations, can consist of two components: a technology component and a procedural/process/workflow component. Publication of content via the Internet, whether the outlet is a Web site, e-mail, newsgroup, or something else, requires technology for generating, editing, and ultimately publishing and disseminating content. In such an environment, organizations must leverage technology to help control content publication and dissemination as well.

The Technology Component

A wealth of technology is available to assist in controlling and managing the publication and dissemination of Internet content. Collectively, these technological tools can be bunched together under the umbrella term "content management systems" (CMS). There are a wide range of solutions that advertise themselves as CMS, ranging in price from free to well into six figures. Table 1 includes a few commercially available CMS solutions, the Web address for each, and the estimated cost of a basic installation.

As with many types of software, the price of commercial solutions varies widely as does the capabilities and features of each system. Of course, the more expensive solutions are positioned as "enterprise-level" solutions while the less expensive solutions are more desktop-focused.

For those on a severely restricted budget, those willing to accept a dearth of structured post-installation service, and/or those idealistically oriented toward open-source, free-software, for-the-greater-good community-type solutions, there are many solutions that fall into the "free" category. Table 2 lists some examples of free CMS solutions. More can be found at www.thefreecountry.com/php/contentmanagement.shtml.

The purchase price is typically only a small part of the total cost of using a CMS in an organization, so when evaluating solutions purported to be free, consideration must be given to the potentially high implementation costs represented in installation and configuration procedures, which often require the services of a programmer/consultant. Implementation, utilization, and maintenance of any CMS require extensive hardware and human resources.

A CMS permeates the entire organization and probably involves more individuals, and/or requires more of their time, in the content management process than would otherwise be the case. A few of the myriad available CMS solutions were presented only to show the wide range of solutions available. Presenting the CMS technology first is not an indication that the technology component is most important; in fact, just the opposite is true. The people and the organizational processes the CMS technology is to enable and support are the most important components of content management.

The Process Component

The process component in a CMS solution is really quite complex. It consists of at least three steps that initially occur in sequence but eventually evolve into parallel activities:

1. Inventory organizational content. (CMS technology will eventually facilitate this on an ongoing basis.)

2. Identify and document organizational needs.

3. Design and implement CMS processes that, in combination with CMS technology, satisfy organizational needs.

Recognizing that an organization is in need of improved content management is all too often the result of a problem or series of problems much like those in the Colorado v. Kobe Bryant case. The objective, once the need for better content management is recognized, is to use CMS technology to institutionalize content management processes such that human fallibility is minimized. An organization's most important assets--its people--will continue to make content production mistakes. An enterprise CMS should detect mistakes and Facilitate corrections before publication occurs.

However, recognizing the need for better organizational content management is not analogous to understanding organizational needs in the content management process. The technological solution that is ultimately selected and implemented should be one that well supports the organization's current procedural needs and one that can meet those needs into the future.

Determining organizational needs is a critical, time-consuming, and expensive step. Before an organization can determine its needs, it first must determine what it has. Most organizations are unaware of the total volume of content generated by organizational members. So the first step in determining organizational needs is taking an inventory of organizational content. At a minimum, the following questions must be answered:

* What content is published in each "unit" of the organization?

* Where does each item fit into the following generic content categories?

** not sensitive

** business-sensitive--internally published

** business-sensitive--externally published

** legally sensitive--internally published

** legally sensitive--externally published

* For sensitive content, how serious are the ramifications of content publication mistakes in each category (i.e., what is the organizational liability; what damage does the organization suffer?)

* For each type of content identified, what should be the chain of authorization that content must follow prior to publication?

By inventorying and categorizing organizational content in this wa> an enterprise can determine what capabilities a content management solution must provide.

An organization needs a CMS when content production reaches a point where the volume of content is too large to be efficiently controlled manually and/or when there is significant business and/or legal risk associated with mistakes in published content. When either of these conditions is reached and recognized, implementation of a CMS requires reengineering of the content production process such that what was probably a loosely supervised (at best), two-step process (author--publish) becomes a highly supervised, three-step process (author--approve--publish). Figure 1 illustrates the difference between the two-step, sole-responsibility process and the three-step, separate-responsibility process.

The reengineering of organizational content production processes to improve oversight and to incorporate an approval step is the most vital aspect of a CMS implementation process. Content management is fundamentally about much more than managing content publication; it is about risk reduction--the risk of publication errors and the liabilities that come with those errors. If a CMS solution does not support a solid review and approval process that is enabled via an easy-to-administer workflow component, it likely will not satisfy the needs of an organization of more than a few dozen employees.

The addition of a formal approval step to the content management process means that content should not be published until it has been approved by a responsible person or persons other than the author(s). Formalization of a review and approval process in an organization combined with mandatory and documented content management and policy training for all employees who generate content may actually limit liability should an employee circumvent policy and publish damaging content without the benefit of review and approval.

The Version-Control Requirement

Version control is inherent--and must be included--in content management. Version control is certainly not a new concept, and IT departments have for years used tools such as Microsoft's SourceSafe to retain and control the versioning of software and programs. Tight version control for organizational information content is much less common, but increasingly as vital. Version control modules should

* maintain a complete history of all changes made to any content

* track who is responsible for the changes made to each version

* easily"recall" a published version and "rollback" to an earlier version

At a minimum, a CMS must include a workflow module to manage the approval process and content version control. Additionally, a CMS often offers additional capabilities that facilitate content production throughout the entire process--authoring through publishing.

Table 3 lists some of the features CMS may offer for each of the three steps in the generic content management process. The list of features is nowhere near complete but is intended to represent the basic functionality of a reasonably comprehensive enterprise CMS solution.

"Rules-based content filtering," one function listed in Table 3 under "Approval" is worthy of special note. A three-step content management process is not foolproof--no process is. Individuals responsible for approving content for publication make mistakes for all the same reasons authors do. At least in part, however, a rules-based content filter adds another layer of authorization to the process. For example, if a rules-based filter had been incorporated into the authorization process in the Kobe Bryant case, the victim's name, address, vital statistics, parents' names, high school name, and other personal details could have been specified as unpublishable (or at least sensitive enough to warrant additional authorization scrutiny) in content filtration rules.

All content, prior to final approval and publication, would be scanned by the rules-based content filter and documents that violate the rules would fail the approval process. As long as the rules are adequately maintained, a content filter based on rules is a very useful last line of defense. Where content publication mistakes could result in organizational exposure to serious legal risk, content inspection by a rules-based filter should probably be considered mandatory. Of course, this also means responsibility for maintenance of the filter rules must be assigned to an individual or individuals, and the process of regularly reviewing and updating filter rules must be a formal part of the content management process.

What Many Organizations Miss

A good content management system, when used to support an authorapprove-publish process designed to meet organizational needs, can be very effective in improving the quality of content generated in an organization.

However, not all content is affected equally. In fact, some content is likely not affected at all. There are two types of content that most often are completely ignored by CMS:

* Content delivered dynamically from a database

* Content authored and distributed in e-mail clients, chat rooms, online forums, instant messages, and pager text messages

Much of the content delivered via the World Wide Web is not stored in static documents that can be examined during or prior to publication and approved, rather it is built"on the fly" programmatically as it is requested by people both inside and outside the organization, in environments where content is dynamically generated by merging data from organizational databases with templates on a Web server, most, if not all, CMS solutions fail.

Applications that store data in data-bases are most often not designed with content management as a primary function or even as a secondary function. There likely are no functions built into the applications to allow for content review and approval between data entry and storage. Applications are basically designed to operate following an adaptation of the two-step content production process, but rather than author-publish it is enter-store.

Additionally, the sensitivity associated with storing data in databases versus publishing that data in contextually significant content is quite different. It may be necessary to store data in a database, yet vitally important that the data not be published. Although a rules-based content filter positioned appropriately in the publication process in this environment would certainly be helpful, it is also the equivalent of putting a "finger in a leaking dike." The act of storing data in a database is effectively a form of publication in many environments; the storing application should incorporate a review and approval process supported by a work-flow component before data is permanently stored and/or made publishable.

In most organizations, a large number of resources have been spent to ensure that unsolicited messages do not enter organizational e-mail systems. While this is entirely appropriate given the costs associated with spam, few organizations have expended an equal number of resources to control what leaves the organization in outgoing e-mails. Even fewer have successfully implemented systems to control content distribution via newsgroups, forums, chat rooms, and the like. Network administrators have had some success by filtering and/or closing the ports used by common instant messaging programs, but with the development of browser-based applications, embedded messaging clients can exchange content via ports that must remain open to give organizational members access to the World Wide Web. In this situation, content management is as much a function of education and policy as it is technology and oversight.

Making Content Management Education a Priority

Once the necessary steps to implement proper content management processes and technology have been taken, there must be an ongoing commitment at the organization's highest levels to training and education. New employees must of course be educated regarding organizational-specific policies and sensitivities regarding content publication prior to actually publishing any internal or external content. Employees will require periodic reinforcement and upgrade training. The ready availability of high-quality and current education and training sends a clear message to all in the organization that content management is a priority and a necessity.

Managing content production, publication, and dissemination is of vital importance in an organization. The risks associated with non-existent or poor content management run the gamut from simple embarrassment to loss of competitive advantage to, in the case of Kobe Bryant's accuser, death threats. In addition, millions of dollars are often put at risk when sensitive content is published.

It is only through an unwavering commitment to quality content management --commitment that must begin at the top levels of management, implemented using needs-appropriate technological solutions and well-designed and implemented content management processes--that an organization can get control of content and minimize the risks associated with its publication and dissemination. Arguably, the leadership in implementing and managing the content management process must come from two functional areas: records management and IT.

The two-component solution is best managed by putting records management professionals in charge of the procedural component of a CMS and by allowing IT professionals to lead the technology component of a CMS. Working together, records management and IT professionals can efficiently and effectively help an organization achieve the objective of risk reduction via content management.

At the Core

This article

* explains why content publication presents real risk, business and legal, for organizations

* addresses the technology and specific processes/policies that are required to adequately manage content publication

* discusses why content management must be a priority commensurate with the risk associated with content publication

Table 1: Commercial CMS Solutions

CMS Solution      Web Address                   Price         OS(s) *

Teamsite          www.interwoven.com            $200,000       U,W

Microsoft CMS     www.microsoft.com/cmserver    $42,000/CPU    W

Livelink          www.opentext.com              $80,000       L,S,W

Maestro CMS       www.maestrocms.com            $10,000        Any

Contribute3       www.macromedia.com            $149/Copy      M,W

L = Linux, M = Mac, S = Solaris, U = Unix, W = Windows, CPU = central
processing unit Prices current as of October 2004. The Information
Management Journal does not endorse any of the companies or solutions
listed.

Table 2: Free CMS Solutions

CMS Solution           Web Address                     OS(s) *

Phpcms                 www.cmsimple.dk                    W

OpenACS                www.openacs.org                    U

Open-Medium CMS        www.cms.open-medium.com/de/    IIS, Apache **

TYPO3                  http://typo3.com               IIS, Apache **

Back-End               www.back-end.org               IIS, Apache **

* U = Unix, W = Windows

** IIS & Apache are Web servers. IIS runs on the Windoes operating
system. Apache generally is run on some variant of the Unix operating
system but also can run on Windows. Consequently, these CMS' claim
to run on "any" operating system.

Table 3: CMS Features

Authoring

Non-technical authoring tool

Collaborative authoring

Content re-use and indexing

Content cross referencing

Approval

Workflow

Supervisor/Editor sign off

Version control

Audit trail

Editor annotation

Security

Integration with other systems

Reporting engine

Rules-based content filtering

Publishing

Translation between formats

Publication of content to multiple locations and in multiple formats

Application of style standards to all content

Metadata creation

A more complete list of available CMS solutions, one that identifies
an extensive list of features associated with each solution, is
available at www.cmsmatrix.org.

Timothy P. O'Keefe, Ph.D., is Associate Professor and Chairman of the Department of Information Systems and Business Education at the University of North Dakota. He may be contacted at [e-mail].

Mark Langemo, Ed.D., CRM, FM, is a Professor Emeritus at the University of North Dakota and a veteran records management professor, seminar leader, consultant, and author. He is a recipient of the Emmett Leahy Award, one of the highest awards internationally in the profession of records and information management. He may be contacted at [e-mail].