Hacker News Reader

Comment by twistedpair | Hacker News Reader

I worked at a large company during a migration from Lotus to Outlook. We were told we'd get our current Lost email storage + 100MiB as a new email quota limit under Outlook.

I made a bunch of 100MiB files of `/dev/random` noise (so they don't compress, compressed size was part of the quota) and emailed them to myself before the migration, to get a few GiB of quota buffer.

My co-workers were constantly having to delete old emails in Outlook to stay under quota, but not me. I'd just delete one of my jumbo attachment emails, as needed. ;)

View on HN

Email quotas aren’t just a cost thing. It forces deletion of files/communications that aren’t relevant anymore. The last thing the legal department wants is some executive’s laptop with 10 years of undeleted email to make it’s way to discovery.

Unfortunately, those goals are rarely communicated and accepted by the people they're imposed on.

My first full-time job had an unexplained email expiry policy. After being frustrated several times at losing some explanation on how/why, I started forwarding all my emails to gmail. In retrospect, that's probably a worse result to whoever imposed the expiration.

Fortunately, these days people are better about consolidating knowledge on wikis or some kind of shared docs instead of only email.

It’s a hush hush kind of thing. You advertise it’s to avoid discovery and you are openly admiting to liability should someone find out while trying to pull your execs email during discovery.

The excuse of resource contention provides plausible deniability

Yeah, this is really common. Normally there'll be one unrecorded/easily deleted means of communication, and people use that for discussing things that potentially could expose the company to legal liability.

But nobody ever talks about it (except on said un-recorded meetings. That reminds me, I should explain this to our junior today, so that he knows for the future).

I just spent 20 minutes trying to find an article by Bryne Hobart vaguely in this area [0], but for personal messaging. The idea being if you control the storage (or deletion) you can avoid casual or speculative regulatory interest in your chat logs.

(apologies it's on medium, I couldn't find it anywhere else)

[0] https://byrnehobart.medium.com/the-stealth-regulatory-arbitr...

Lotus to Exchange migrations were all likely in the pre-Sarbanes Oxley and other retention regular era of email retention requirements

iirc at the time the only industries that required retention were health, legal and government

With SOX (PCI, FDIC, et al) retention laws we had another explosion of work rolling out all the compliance features of Exchange

Those were crazy times getting everybody either migrated with email or onto corporate email - there's a similar explosion of work right now with migration to M365

I was using lotus at one of the largest banks in 2015... So no. Not pre sox.

JP Morgan? They’re infamous for bad internal IT

Then why not just tell Exchange to delete any emails older than 5 years (or whatever your lawyers tell you to put)?

I knew a place where Exchange was configured to delete all mails after 6 months. Soon after I discovered that people started to form circles in which they would forward older mails from internal mailing lists to each other to retain them longer than that.

Fannie Mae did this. When you have targets on your back you minimize the collateral damage from possible blowback.

Imagine getting sued and having the entire paper trail in your email going back 3+ years. I expire all email after 1 year.

A previous company I worked for had a one month retention window in the email server. People just ended up storing email in their local machine's Outlook folder so they can refer to old emails.

Or for the more technical folk with access to a linux server, setup postfix/dovecot, connect outlook to it and arrange for archived emails to go to the IMAP server.

The IT people get smart about looking for OST or PST files, but let's see them catch that :-)

Any pointers on getting started with the postfix/dovecot method?

If you have a Linux box (or a VM), install and configure it to route mail and provide IMAP support. Digital Ocean has the best tutorials for this:

https://www.digitalocean.com/community/tutorials/how-to-set-...

Then configure a new mail account in Outlook and connect to the IMAP server. It's optional, but convenient for replies, to configure the account to send via postfix if you have an internal SMTP server to connect to.

I gave up on email folders years ago, so at the end of the month would just create two new folders in the archive account (YYYYMM and YYYYMM_Sent) and drag all the mail from the Exchange account into the IMAP folders. Et voila! You now have your own local email archive.

I imagine it looks better at discovery time to say 'oh sorry we lost these emails because we ran out of disk space' rather than 'we deleted them because we didn't want you to read them'.

No, companies need to be able to point to an official retention policy that says in writing that emails older then x months or years get deleted. Most do (including my employer), and it's because of legal discovery. But it feels like we're lobotomizing ourselves, as often the reason some odd thing was done was based on a long-deleted email discussion.

And the right way to do it is with an archiving service/appliance

Archiving is likely solving the wrong problem, for legal reasons they don’t want those old emails hanging around.

Sounds like the retention policy is also solving the wrong problem. If for legal reasons you want to destroy any potential evidence, maybe it's a good idea to stop doing illegal actions.

It's not necessarily illegal actions, just those that would look bad in discovery. Lawyers (as always) tend to err on the side of caution.

I remember Matt Levine talking about how regulators would often find emails along the line of "Let's sell this crap to those idiots" and use that as leverage to force settlements rather than showing actual violation of regulations.

The reason being that it's hard to show intent to defraud, and much easier to threaten bad press.

Thanks to patents, everyone in technology is doing "illegal actions" all the time, since you can't do anything without infringing hundreds of patents. And if you can find an email somewhere indicating that someone knows that a competitor has feature X, or knows about the existence of a patent, viola, evidence of knowing infringement! Triple damages under US law.

That's why I did it. I'd always be trying to find an email from the prior year, that held a fix I needed to use again, but it had been deleted to stay in quota. Old email can be helpful.

Also prevents users from using email as a filing cabinet or shared drive.

Email hosts love 50/100gb/unlimited mailboxes because nobody wants to migrate a bunch of giant mailboxes

I am sure "legal" might want it but is it not better for society in general if they where discoverable.

A bit like when investigating police/government misconduct and a lot of files turn out to have been destroyed - but of course our data gets kept forever

Sane companies just have retention policies instead of doing some obtuse hack like this.

Reply on news.ycombinator.com