Re: Institutional Security Policies

[Jere Retzer <retzerj () OHSU EDU>]

Thanks, I'll check it out. The problem isn't retaining the e-mail, rather the endless fishing expeditions you can be 
roped into in the event of a lawsuit -- and chew up huge amounts of staff time

> > > spaf () CERIAS PURDUE EDU 08/26/02 03:51PM >>>
At 9:18 -0700 8/26/02, Jere Retzer wrote:
> Out of curiousity, do you recommend retaining backups of e-mail? If
> so, for how long? I've heard the lawyers argue several different
> directions on this question.

In some places, email on state-university machines is covered under
state data retention laws and backups are mandatory.  That is a first
consideration.

As a matter of policy, it really depends on the nature of the email,
the applicability of state and Federal law, and the comingling of
personal (non-work) email.  No one answer is going to fit all
situations.   Email with student grade information is different from
email with promotion and tenure material is different than statements
by the internal auditor.

I find, personally, that keeping email for about 3 months is very
valuable to go back and refer to things that I forgot, or to
establish a date for a discussion.   Selected items get saved in
topical mailboxes if I think I will need to refer to them later.
Some personal email I delete immediately if the topic is sensitive.

I will point out:
<http://www.cra.org/CRN/articles/may01/spafford.html> as I discuss
several interesting incidents with stored email in that article.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/memdir/cg/.