Federal rules now require companies, government agencies, school districts, and other organizations that might be sued in federal court to have systems for retrieving electronic data, such as e-mail correspondence, if it is needed as evidence. Education Week’s Digital Directions brought together three experts for an online chat to answer questions on this topic, which was the focus of the cover story in the Fall 2007 issue of the magazine. The experts were Kim A. Rice, the chief information officer for the Boston school system; Linda Sharp, the director of cyber security for the digital-district project at the Consortium for School Networking; and Jay Attiya, the network manager for the Middletown, N.J., school district. Here are edited excerpts from the discussion.
Q: Does all e-mail have to be archived (personal e-mail, spam, nonessential messages, etc.)?
Kim A. Rice: The oversimplified answer is yes. The question is then, what is a record? We are wrestling with this very question. In terms of volume of e-mail, we hope that because of our filtering systems we have excluded spam from the equation, and we encourage personal e-mail to be done with personal e-mail accounts. So the question then boils down to whether or not the e-mail communication is a record, and it seems that currently there is not consensus as to what that means. For this reason, it looks like we are going to be establishing a set of policies and procedures centrally to back up and store all e-mail.
Q: How important is it to be able to archive voice mail and instant messages, as compared with e-mail?
Linda Sharp: The law states that you must archive designated documents or electronically stored information, including writings, drawings, graphs, charts, photographs, sound recordings, images, or other data or data compilations. Broadly interpreted, that could mean voice mail and IM. I would certainly contact your school district’s attorney for his interpretation.
Q: Are “nightly backups”—when e-mail is received and deleted the same day and not archived—sufficient?
Jay Attiya: Nightly backups would not be sufficient to address the [federal requirements]. It would be similar to creating a Word document, printing it, delivering it, and then destroying all copies of it. This does not remove the responsibility of having to produce the document in a legal proceeding. The same would hold true with e-mail. If it is sent through your e-mail server, then it must be archived based on your retention policies.
Q: How does the law affect data-destruction policies? Does it in effect not allow for data-destruction policies?
Rice: Sounds like you are having the same kinds of conversations that we are in Boston. We are unclear about the true impact and the extent to which all e-mails are documents of record. What we are doing is clearly establishing our backup policies, procedures, and retention schedules—in sync with our paper records—and we are having them reviewed by our legal advisers.
Q: How do the federal rules affect charter schools?
Sharp: Please check with an attorney, but I think that if a charter school has the ability to be sued, they are required to archive. The law doesn’t specifically state school districts; it states an entity that could be sued.
Q: Who should monitor e-mail activity? Classroom teachers, principals, guidance counselors, technology specialists?
Attiya: I think e-mail activity should be monitored by the technology department because it requires some level of administrative access to the network and mail servers. There are programs available that can monitor e-mails for particular words and phrases and automatically send an e-mail alert if triggered.
