IM: invaluable new business tool or records management nightmare? Instant messaging's free-form nature is presenting risks and challenges for business and records managers everywhere.

?4U. RU retaining IM rcds? If URNOT, there may b FTF mtg w/ TPTB in UR futr IRL.

(Translation: Question for you. Are you retaining instant messaging records? If you are not, there mey be a face-to-face meeting with the powers that be in your future in real life.)

E-mail has entered the mainstream of business as a recognized business tool. Records managers routinely collect e-mail messages and apply proper retention practices. People use e-mail to conduct question-and-answer exchanges in near real-time. But e-mail is a communication medium that is designed for asynchronous written communications. If a paper letter is truly asynchronous, e-mail is its electronic equivalent.

Instant messaging (IM) changes the paradigm. IM is intended to be synchronous written communications, in the same way that telephone calls are synchronous voice communications. In fact, IM extends the functionality and can be synchronous, asynchronous group, and parallel communications. IM allows the user to conduct multiple IM sessions at one time and perform other tasks simultaneously (e.g., attend a meeting, talk on the telephone, compose an e-mail message, or browse a Web site). IM allows users to invite others to be part of the session. Where an e-mail message or a paper letter can constitute a single document, IM allows for continuous, free-flowing, stream-of-consciousness communications involving two or more individuals simultaneously.

While an e-mail message is a transaction, IM is a series of transactions: Its free-form nature makes for very challenging recordkeeping.

What Is Instant Messaging?

IM traces its roots to single-fine, person-to-person communications facilities built into mainframe computer operating systems. These rudimentary IM systems allowed computer operators to communicate in text form without stepping away from their control consoles. The advent of the public Internet and various online services such as America Online (AOL) brought IM into the mainstream. ICQ ("I seek you") software on the Internet was the first mass-market IM software available. As freeware, it spread rapidly.

IM allows a user to designate other IM users as "buddies" or "friends." Generally, IM software users enter their associates' screen names or other identifiers, thereby creating a "buddy list." The software will indicate when the others on the list are active, allowing a connection to be made. To send an instant message, the user clicks on the person's name, then types their message into a window that appears on their screen. The recipient's response is displayed in sequence in the same window, and the exchange will go on for as long as required. Either party may close his or her own window, but further communication from the other party will open a new window. If others begin IM sessions, their sessions will open additional windows, unless those users are invited to participate in an existing session. IM sessions can be established with wired users or with wireless users who have IM-enabled cell phones or pagers.

In addition to ICQ, other programs enable IM communications. Some are interoperable with other networks but many, such as AOL Instant Messenger, Yahoo Messenger, and MSN Messenger, operate only within their own respective networks. A variety of products are available to corporate users. IBM's Lotus Sametime (which is being re-branded as IBM Lotus Instant Messaging) is interoperable with AOL Instant Messenger. Microsoft provides Exchange 2000 Instant Messaging Service, and Sun Microsystems offers Sun ONE Portal Server: Instant Collaboration Pack. Each product has different key features, but all provide the same core messaging ability with other users on the same network.

From Personal Pastime to Corporate Tool

The article "Instant Messaging Goes Corporate" in the July/August 2003 issue of The Information Management Journal outlined the transformation of IM software from a personal plaything to a corporate tool. With that transformation, organizations must now begin to address the recordkeeping implications of IM traffic.

There are two key aspects of IM that concern records managers. First, messages tend to be casual and often cryptic, with users employing shorthand codes learned in casual personal interactions. These codes are often ambiguous in meaning and intent. The codes often yield "smileys" or emoticons, which translate a character string into a smiling face, a frown, or a wide variety of other facial representations. IM's casual nature tends to encourage use of sloppy or loose language and less restraint than is found in more formal communications.

The records manager's second challenge is IM's free-flowing nature. Two users will start a conversation seemingly in mid-sentence, change the subject, then return to the original subject minutes or hours later. IM does not lend itself readily to traditional document creation and cataloging systems. In many respects, IM is very much like a written version of a telephone call.

IM is spreading faster than information systems departments can react to the programs. Many organizations have an approved IM solution often limited solely to internal use, but savvy users will install personal IM software to connect with friends and family and, oftentimes, with outside business partners as well.

The proliferation of user-installed IM software is considerable. Gartner Inc. estimates that in the fourth quarter of 2002, "approximately 70 percent of enterprises were using unsanctioned consumer IM." For records managers, user-installed IM applications make systematic approaches to recordkeeping nearly impossible.

For many organizations, consumer IM applications are a nuisance and a potential security risk. From management's viewpoint, IM presents an opportunity for employee misuse of time and resources. In some industries, use of unsanctioned IM is a significant business risk. In June 2003, the National Association of Securities Dealers (NASD) ruled that IM records must be maintained for three years. In a notice to its members, the NASD stated, "... [the] lack of formality of instant messaging does not exempt it from the general standards applicable to all forms of communication with the public." The notice cited the Securities and Exchange Commission's (SEC) Rule 17a-4(b)(4) and NASD Rule 3110 in recommending that its members require a retention period of not less than three years. While these rulings apply to organizations subject to NASD and SEC rules (generally, broker-dealer organizations), the precedent that IM is a retainable record should not be taken lightly.

Separating Records: Wheat from Chaff 

NASD and SEC rules require retention of copies of communications relating to the organization's business. This is certainly not a newsflash to records managers. Nor is the fact that e-mail presents recordkeeping challenges when personal use is permitted.

Records managers must be able to identify bnsiness-related communications and maintain them in some accessible form for the required retention period. Several companies are promoting software and/or services that archive every e-mail or IM transaction. While automating capture processes eases the burden on records managers in terms of collecting message traffic, making sense of the messages remains a considerable encumbrance.

Some organizations have chosen to treat IM like most telephone conversations and voice mail--undocumented and unrecorded. However, as the NASD noted, business can be, and often is, transacted through these communications mediums. Not treating these communications as records is often done at an organizations peril. At the same time, the "recordworthiness" of IM can be called into question when IM retention and archiving is not managed centrally and when all IM traffic is indiscriminately captured by the archiving system.

An IM archiving solution should automatically capture IM traffic. Allowing users to capture their own IM transactions adds considerable risk to the process. First, users will tend to choose easy paths--being selective about which conversations they capture and tending not to be timely in their submissions to the repository. Second, the native session-capture tools in most IM software retain the text in easily edited, clear text files. But users can easily manipulate these files with any editing software and save them in a manner that is not easily verified. A user may decide to edit out critical sections of a conversation in the interest of "cleaning up" the record. This can result in incomplete records of dubious authenticity. In addition, the feature that allows an IM user to automatically log on reduces the application's security, permitting user impersonation.

Another factor related to user identification is the choice of user names. Consumer IM software typically allows names to include any choice of available character combinations, which may result in IM messages of a business nature being created by "HotPantsGuy21." The user authentication issue is compounded when the naming conventions are not used and the IM software is unable to map user IDs to the organization's network and e-mail log-ons.

While policies alone will not solve the recordworthiness problem, enforced policies can minimize future IM recordkeeping issues. Policies requiring employees to maintain records and to ensure that their records are appropriately retained are necessary. In addition, employees should be clearly instructed on the recognition of organization records. Among the policies that organizations should have and enforce for all communications are:.

* No expectation of privacy. Users should not expect information created on an organization's systems to be private. This is subject to local laws and regulations but, in general, most organizations have a right to know how their systems are being used.

* Acceptable use of technology. In general, this policy covers when and where system users can install software--if permissible at all--as well as how the technology can be used.

* Harassment and treatment of other employees. These politics will reduce the misuse of technology.

The Future of IM

IM functionality is now being embedded in other software and promoted as "presence awareness" (i.e., alerting others to a user's online presence). This functionality will enable a user to find others who are referencing the same information in a corporate network. The software may also indicate the relative expertise of other users of certain information. For example, users who author several documents within a repository may appear as subject matter experts to others viewing that information. This allows users of the same information to connect with one another and, in theory, promotes increased collaboration among users.

Presence awareness technology may also follow users out of the workplace. The increasing functionality of wireless devices, coupled with more precise locating mechanisms built into the devices, may enable a user's physical location to be displayed. In organizations with highly mobile workforces, presence awareness could physically locate individuals for meetings or other functions. Privacy concerns have been expressed, but the functionality is still viewed as a valuable future enhancement.

For businesses, IM could potentially save telecommunications and network costs as well as storage space because experts say the technology would reduce e-mail and network traffic, which, in turn, lowers storage requirements.

The key to increased use and enhancement of IM will be interoperability between systems. This will require standards for client and server software. Where e-mail has standards that allow virtually universal receipt and sending of messages, IM is limited to exchanges within a given network. Currently, Yahoo Messenger users can only instant message other Yahoo Messenger users.

Like e-mail servers, IM servers will need to be configured to recognize other networked servers and be able to store and forward messages to disparate systems. This may not happen for a while, however. Experts say interoperability has not been impeded by technical challenges but rather by IM providers' refusal to give up their control over users.

Another key concern is the traffic generated by users with extensive buddy lists--these large lists contain names from multiple systems and require the sending of nearly continuous queries to other systems for active users. This would result in significant traffic congestion on the Internet as multiple users on multiple systems continually look for each other.

If businesses and technology players can shore up all the potential security risks and recordkeeping challenges, IM could become a valuable communications tool for millions of business users.

At the Core

This article

* explains what instant messaging (IM) is and how it works

* examines the records management implications of IM

* discusses the risks of using IM in the workplace

How Instant Messaging Works

Most instant messaging (IM) software consists of two components: server software and client software. While some IM programs can operate through an Internet browser, most require installation of client software on the user's personal computer. The server software maintains the registered user's directory and serves as a switchboard for communications traffic. Thus, in most instances, every character of instant messages routes through the IM server.

The server software also has the ability to store and forward "offline" messages--those sent to users who are not presently connected to the IM sewer. When the offline user next logs on, the stored messages are displayed. On occasion, the user can retain these stored messages on the server for indefinite periods of time.

A user has the option of being listed as active in the IM directory or remaining "invisible"--able to see other users and send and receive messages. The user is also typically able to designate his or her status--generally "online," "busy," or "do not disturb." Status messages are often user-customizable.

The client software installed on the user's computer is configured for particular server connections. The user's identity is either set up by a system administrator or registered upon first connection to the server. Depending on the system's configuration, users may input additional information about themselves into the IM server's user directory. The user logs in with username and password; the user may opt to have his or her password permanently stored to allow automatic server connection upon IM software start-up. Successful connection to the server lists the user as active (unless the user changes status), and he or she may select other users to list in the "buddy list." The status of buddy list users is then displayed.

The user is now free to exchange messages. In addition to text messages, some IM software allows users to transfer electronic files and pictures. File and picture transfers generally pass through the IM server and can be stored on the IM server when the recipient is offline. Web cams may also be activated via IM software if the appropriate hardware has been installed, allowing users to see real-time motion pictures of each other. Web-cam traffic is generally real-time and tends not to be stored on the server, although the traffic is generally routed through the server.

Some IM software includes additional functionality that allows collaboration between users. One user may make his or her computer available to another so that both can work on documents or share a virtual whiteboard. Depending upon the IM software package's sophistication, collaboration tools may have extensive capture functionality to preserve information content from online meetings.

IM Goes Global

Each day, according to ITWorldCanada.com, more than 3 billion instant messages zip around the world, moving among 400 million users connected through global instant messaging (IM) networks. Thirty percent of current IM traffic is business-related.

A recent study by the Radicati Group predicts that corporate IM accounts will reach 60 million this year and increase to 349 million in 2007. Experts say IM adoption worldwide has occurred faster than adoption rates for fax, cell phones, e-mail, and the World Wide Web.

Radicati's study, "The Messaging Technology Report," found that North America (United States and Canada) has led the charge toward corporate IM implementation. In fact, about 67 percent of the companies currently using enterprise IM Worldlwide are in North America. However, Radicati expects North America's percentage of the worldwide implementations will drop to 50 percent by 2007 as Europe's usage increases.

In 2003, enterprise IM deployment in Western Europe is 20 percent, but that number is expected to increase to 32 percent of worldwide IM deployment by 2007. Enterprise IM use in Asia-Pacific is not as high and is not predicted to change much in the future. Currently, Asia-Pacific IM deployment is 12 percent and is expected to increase to only 14 percent in 2007, according to Radicati. The rest of the world comprises only 1 percent of enterpnse IM implementations in 2003 and will increase to only 2 percent in 2007.

[GRAPHIC OMITTED]

References

Flynn, Nancy and Randolph Kahn. E-mail Rules: A Business Guide to Managing Policies, Security, and Legal Issues for E-mail and Digital Communication. New York: AMACOM, 2003.

"Instant Messaging Goes Corporate." The Information Management Journal. July/August 2003.

National Association of Securities Dealers (NASD). "Notice to Members 03-33." July 2003.

Younker, Edward and Maurene Grey. "Management Alert: 2003 Instant Messaging Predictions for Enterprises." Gartner Research. 11 December 2002.

Patrick J. Cunningham, CRM, is Industry Leader for Information Management with Hewitt Associates, LLC, where he is responsible for strategic information management, records and imaging management operations, and records management technology. He may be contacted at [e-mail].