Last week, the Washington Post reported that the White House has lost an entire year's worth of Al Gore's (and his staff's) email. Evidently, daily backups neglected to include the vice president's email for more than a year because of what has been called a technical configuration error (TCE). It's too bad that Microsoft can't use the TCE excuse when providing email files to the Department of Justice (DOJ). I bet Al Gore's email is much juicier than Bill Gates'.
Putting humor aside, the incident brings up the growing dilemma of email retention policies (and the effects of procedural and operational errors on an email system). Many companies probably would like to see email retention policies set to zero based on Microsoft's experience with the DOJ. In some cases, however, organizations have specific government regulations (such as Securities and Exchange Commission—SEC—requirements and sunshine laws) that require them to retain email. In other cases, organizations might simply want to set their own rules about email retention based on business requirements. Regardless of the motivation, there doesn’t seem to be a good solution for this growing problem.
The poor-man's approach lets companies retain email using Exchange’s message-journaling features and tools such as the archive agent. However, this solution is not very elegant for large organizations. Vendors such as K-Vault Systems and others have tried to fill this space but some things are still missing. K-Vault leverages Microsoft SQL Server, Message Queue Server (MSMQ), and search engine technology (based on AltaVista) to provide a solution that allows policy-based archival to SQL Server and rapid recovery mechanisms. Although the product is functional, it requires a lot of extra pieces (such as SQL Server), isn’t very scalable, and might introduce new problems (e.g., what to do with the data once it's in SQL Server). CommVault Systems' Galaxy product can also help with the problem. Although not specifically designed for email retention, Galaxy has capabilities, such as mailbox-level and item-level recovery, that make it useful for this purpose. The truth is, no single solution provides all the functionality you need for an effective email retention strategy but, depending on your organization's requirements, a combination of these products might suit you.
Longer term, email retention is an area that Microsoft must tackle directly in Exchange Server. Exchange Server 2000 might make this easier with its capability for transport and store-based events; however, we still need some core functionality in Exchange Server that addresses this problem, which is only going to get bigger.
