The news is filled with stories about companies paying large fines and corporate officers being prosecuted, stemming from employee Email misuse. By example, a prominent consulting company was sued by one of its former employees for $3.7 million over an alleged defamatory job reference. He requested copies of all Email records containing his name, dating back 10 years. But the company contested, claiming that the cost of retrieving the Emails would be $7.8 million to search the 61 backups. According to company’s IT manager, "Compliance would theoretically require us to restore every server for every backup data over the last five years. And, there is no guarantee that any Email which may have referred to the claimant would still exist." According to IDC, twenty-seven percent (27%) of Fortune 500 companies have had to deal with similar harassment claims concerning Email.

So what does that mean for you? Are you personally liable? Probably not, but the CEO and other top executives could well be, and the company could be subject to fines and penalties under new regulations from the Federal Rules of Civil Procedure (FRCP). Yet, many organizations see human resources as the department that has the responsibility for creating and enforcing Email policies. But without the right tools, human resources doesn’t have the ability to manage this process!

So if your company is potentially at risk every time an employee sends an Email, what steps can you take to mitigate that risk? Your key defense is your ability to demonstrate that processes are in place to monitor and respond to compliance breaches. If there are technologies or best practices that are reasonably available to your company and are not instituted, there is a case for negligence. To help you better understand how this relates to your and your organization, start by asking yourself the following 10 questions.


Questions for the Human Resources Manager

- Do we have formal company policies on the use and misuse of email?

- How are we educating our employees about the Email policies?

- How do we ensure they understand the policies?

- Do we have a way to determine when and how Email policies are broken?

- What is the process when a policy breach is found?

- Do our employees understand how Email-based security breaches put the company at risk?

- How many investigations has the company performed this year involving Email?

- How many required you to find and produce Email to prove or disprove something?

- Were/Are you able to find Emails yourself or does IT have to gather them for you?

- What is the cost of finding Emails today?


Now, to protect your company and yourself, consider the following actions:

Establish formal Email policies. Organizations need an Email usage policy that is supported by formal processes for Email monitoring, archiving and storage. Critically, they require an Email forensic solution that can track, report and monitor Email usage to avoid costly manual Email recovery processes. Email forensic solutions can be used, in response to a specific allegation, or proactively, to easily discover Email transaction patterns. Whenever an audit trail, or forensic discovery is needed, you will have a great advantage and be able to take immediate action. An Email Policy Guide and an Email Acceptable Use Policy Statement can be requested from info@mailmeter.com.

Protecting your business from Email misuse requires more than an Email policy. Here are some additional things you can do.


Enforce Email Usage Policies:

- Better Employee Oversight: HR can begin to see patterns of behavior or suspicious trends that need to be investigated by combining an advanced reporting engine with an Email archiving system. Companies can see who is sending large attachments to too many people, who is sending too many Emails to their friend’s hotmail accounts, even who is sending confidential information to unauthorized users. Once problems are made visible, it is easy to prevent Email abuse or re-educate users and overall improve the ability to manage a new aspect of employee performance.

- Perform Investigations Directly: It is often the HR department that will spearhead investigations of employees suspected of questionable Email usage or wrongdoing. It is very common for HR to take the lead in researching inappropriate behavior complaints or whether a policy has been broken. However, a balance must be achieved to not violate that suspected employee’s right to privacy and fairness, while resolving the matter as quickly as possible. HR can put teeth behind policies with access to Email reports. Visibility into Email patterns can yield better management awareness and policy enforcement.

- Better Confidentiality: By allowing HR managers to have access and an easy search interface to the corporate Email archive, they bypass handing off the request for Email research to the IT department. This saves the IT department from using technical resources to accomplish an employee relations function, and it allows the company to protect the privacy of the individual from non-HR management. It also eliminates the need to “browse” through employee’s potentially personal Emails.

- Abuse Prevention: Many times, when a company simply announces that Emails will be monitored and are retrievable, it is enough to prevent many undesired behaviors and incidents from happening in the first place.

- Ongoing Policy Management: After reviewing Email for some time, HR managers will learn that some policies are being broken, but also identify a need for new policies to be written. This cycle of creating, adding and changing policies to reflect the needs of the business and realities of employee behavior is a continuous optimization process that will carry on over time. Make sure that new policies are appropriate for your industry and your company culture. Make sure that your policies are well distributed and that employees know what they are and what the consequences of breaking a policy are.

Human resources need many ways of being “plugged in” to their company. Whether they walk the halls and spend time talking with employees at every level or invest employee surveys, they need to have extra insight and intelligence about their employees. One of the latest sources of information is the communications between employees and customers, partners, and suppliers, and human resources’ ability to tap into this source, make inquiries and pull reports from it.

Email archive software solutions are available to help companies enforce Email policies by allowing IT and functional managers to quickly and easily report and search on Email usage and discover Emails and users that are in policy violation. Email patterns, trends and behaviors can be identified at a high level with the ability to drill down into specific Email threads. This way management can directly and immediately address policy violations, educate users, and create or adjust policies based on actual company usage. This cycle of active management, user education and policy optimization is the only way to improve the business and reduce risk in the long term.




Evaluate Your Risk An Email Risk Profile Assessment Tool is available free for download, as well as White Papers on how Email Risk Management applies to various industries (Healthcare, Legal, Government, Finance, and Education markets) and can be requested at info@mailmeter.com.

Tom Politowski is CEO of Waterford Technologies, provider of MailMeter email and data management and reporting products for archiving, compliance, legal discovery and storage management.