Hacker News Reader

Comment by leggomylibro | Hacker News Reader

I think that most companies have 'N-month email retention policies', where N is somewhere between 1-6.

Did the malfeasance happen more than a few months ago? Gee, sorry, no internal communications; that's policy. Did someone keep incriminating communications from more than a few months ago? Oooh, that's against policy - the recalcitrant employee has since been terminated and clearly does not represent our lofty ideals.

But I don't think that most companies go out of their way to use encrypted platforms to shield communications which they know are likely illegal from investigators.

View on HN

For Google, at least, I believe it's 18 months. And that's quite new, it happened after the Oracle fiasco, which had all sorts of goodies like:

Subject: Java class libraries

With talks with Sun broken off[,] where does that leave us regarding Java class libraries? Ours are half-ass at best. We need another half of an ass.

That came out in discovery.

It is such a shame groklaw is no longer a thing. Another Snowden casualty.

I missed that, how was groklaw connected to Snowden?

https://techcrunch.com/2013/08/20/groklaw-shuts-down-as-the-...

https://www.csoonline.com/article/2133906/privacy/groklaw-sh...

http://www.zdnet.com/article/privacy-concerns-cause-pj-to-cl...

You can read the post at the top of groklaw.net still, in case that ever changes (unlikely) here is a perma link [0]

Basically the author decided that she would rather disconnect from the internet than be spied on.

[0] http://www.groklaw.net/article.php?story=20130818120421175

I consider it a failure of journalism editing. Pamela (the author of groklaw) earnestly believed that her communications were being monitored and read by American intelligence services, which was a rational conclusion to draw from the prevailing news stories in The Guardian, The Washington Post, and The New York Times.

She was so disillusioned with the perceived trampling of 4th amendment rights that she stopped posting to her blog and moved her email to Lavabit.

Such was the breathless nature of the reporting, that the editors and ombudsmen didn't consider that the reporting drew conclusions and made unfounded allegations based off of slide decks. Other countries' government secrets being taken through computers == "they monitor everything."

Now with the benefit of the Shadow Brokers leaks, we see that the NSA is severely constrained by manpower, processes, and software bugs. It's practically a joke compared to its perceived might in 2013.

I hope that she returns to writing, but I understand if she still feels privacy concerns with the internet.

> It's practically a joke compared to its perceived might in 2013.

But it's a lot worse than we thought before Snowden. And with stuff like this erring on the side of caution seems like a pretty good idea.

I whole heartedly disagree. Erring on the side of caution got us the TSA, DHS, the War on Drugs, the Iraq invasion, and justifies the continued operations in Afghanistan.

Erring on the side of caution is a rational individual strategy in many cases, but it has disastrous collective implications.

In a sense, if the editors of those publications had erred on the side of caution, then they could have reduced the drag on commerce and free expression that exaggerated claims yielded.

> I whole heartedly disagree. Erring on the side of caution got us the TSA, DHS, the War on Drugs, the Iraq invasion, and justifies the continued operations in Afghanistan.

That's nothing to do with the subject, which is an individual no longer comfortable with their online communications. Dragging all this other stuff in has no bearing on that.

Besides the fact that quite a few of those entries have absolutely nothing to do with 'erring on the side of caution'.

I wouldn't have brought them up if they weren't examples:

TSA: making searches mandatory just in case there's a hijacker

DHS: vastly expanding federal police powers just in case there's a terrorist in the country

War on Drugs: fund expensive and invasive federal and state police operations just in case someone overdoses

Iraq invasion: invade Iraq just in case there are weapons of mass destruction

Afghanistan occupation: stay there just in case the Taliban permits Wahhabi radicals to use the country as a home base for planning and training.

Okay, in this instance, it's "avoid doing stuff online just in case newspapers are right that my government is surveilling my actions." In this case, it's a radical life change that has little upside. She did not abandon her blog on a whim; she hated that she felt she was forced to do so.

But the risk was overblown: when the police kick down the door of Pamela Jones, I assure you they already have me and perhaps you (in the Netherlands) in prison as well.

TSA: Feel good security theater, practically quite useless.

DHS: Powergrab using terrorism as an excuse

War on Drugs: Paraphrased slightly: War on colored people, way to keep the prisons filled.

Iraq Invasion: Pretext to use large amounts of toys so MIC profits, nobody actually believed Iraq had WMDs.

Afghanistan Occupation: Belated attempt to go after Osama Bin Laden who actually was holed up in Pakistan.

I'm in full agreement with all those except for Afghanstan, you might want to re-check the time line.

I'm just saying that "erring on the side of caution" was how all these bad decisions were pitched to the public, and they agreed to it.

These policies go two ways. Companies need to be able to delete data eventually, but they also need to make sure that employees are not deleting data on their own in order to hide illegal activity. Having a retention policy of X months then cuts both ways. If you delete data before 18 months, well that looks awfully suspicious.

structural engineers are required to keep all communications, notes, etc for seven to ten years, depending on the jurisdiction.

These super short email retention policies seem extremely unethical to me.

Same goes for financial firms.

Only for official RFIs though right? Not all email communication. (speaking from my experience as a structural engineer in Australia, things may be different here)

The Sony Pictures hack of 2014 caused a lot of companies to reflect on their data retention policies. Uber's special in that they set their retention policy to subvert criminal investigations, not to protect "trade secrets"

I agree about structural engineers being an ideal though--old school engineers get "accountability" better than anyone

Prior to even being sued the opposing sides lawyer can give you notice of a possible lawsuit and it is your responsibility to not destroy any documents related to it regardless of your companies retention policies.

I keep hearing this here, but AFAIK there's plenty of record keeping regulation which won't allow for that. No?

I assume many companies auto-clean the user-facing mailboxes for different reasons, but they probably all are required to archive the emails on some type of long-term storage for a few years.

But maybe that's just industry-specific regulations...

But a lawsuit changes that. You don't get to delete stuff that's relevant to the lawsuit, no matter what your retention policy is.

Still the policy makes it <date of litigation hold> minus X months, rather than everything since the creation of the company.

Correct. And "litigation hold" is the term that I knew existed, but didn't come up with.

While working at a pharmaceutical co I was backing up a drive onto the os drive of our local pc for general it support / utilities when I got a call from the user. She forgot to tell me she was on legal hold. I stopped the backup, went through the e-discovery process on her drive, rebuilt the pc and did e-discovery on our pc as well, because it was now also covered by her legal hold. You don't want to involve yourself in a case by ignoring those discovery laws, they are very serious about enforcement in court.

Reply on news.ycombinator.com