Comment by VLM | Hacker News Reader

Comment by VLM | Hacker News Reader

Parent Full thread

Technical users will have no problem, but for non-technical users email it is easier to do permanent record keeping and documented CYA. Non-technical users puzzle over how to document a text message in writing or how to permanently store and document a slack/irc type chat. Screenshots that are printed out on paper and scanned into a .pdf? I've seen things like that.

For a lot of situations the benefit of electronic communications is CYA and permanent record keeping, not speed or ability to notify 24/7 around the world.

"As you can see by the forwarded email chain below, I emailed ops about the backup process being broken a month ago, then reminded them two weeks later, then escalated the ticket after a month, and still have not heard anything back, as you know SOX compliance requires that we actually keep that data, so given the complete lack of communication over the last month, I'm curious if you know of an ETA to repair the backup process or if we should implement a local non-IT supported solution for backups of SOX compliance data, and if so how would that local process interoperate with existing documented security policies such as PCI-DSS and related requirements?" At least if it comes to a court case I won't be the one blamed, LOL. This is how business gets done at large companies, if someone can't get blamed individually, it ain't getting done.

There's some painful truth in this comment.

Not to mention - email is very easy to branch in order to more safely secure that record. If IT owns the email server, and IT is fucking up... very easy to BCC/Forward a copy of the whole chain to my personal email for my own records.

I don't know much about that Email and legal stuff, but here in Germany I pay a couple of Euros every month to a well-known and respected company whose server is set up in such a way that my emails can be used in court without any issue (like claims that I altered the emails after receiving them). At least they claim that and I do believe them. I do not (yet) have a business, but I use it nevertheless. Just in case.

> but here in Germany I pay a couple of Euros every month to a well-known and respected company whose server is set up in such a way that my emails can be used in court without any issue (like claims that I altered the emails after receiving them)

That's already cryptographically built into email with DKIM. An email message is signed with a private key, and can be verified as authentic by the receiver using the public key in the sender's DNS records.

Click on "Show Original" in a Gmail mail to see the meta data.

https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail

While this is technically true, it's not a correct use of DKIM: DKIM is meant to provide authenticity for the receiving mail server (by verifying the message against a key associated with the sending server), not nonrepudiation for the sending user.

Many email providers historically used short keys (RSA <512, and later 1024) for DKIM, meaning that lots of emails circa 2012 and older appear to be nonrepudiable but in fact are.

Long-term authenticity of emails is very difficult and is arguably an anti-feature; Matt Green correctly observes[1] that Google should be rotating and publishing its DKIM keys regularly to prevent people from falsely concluding that a DKIM signature is "proof" of a message's authenticity.

[1]: https://blog.cryptographyengineering.com/2020/11/16/ok-googl...

I belive that emails can be used in court without any specific setup within most EU jurisdictions or EU overall.

> For a lot of situations the benefit of electronic communications is CYA and permanent record keeping

Note that in a lot of industries, "permanent record keeping" is a regulatory requirement, it's not just politics. The culture of general employee communications being ejectable ephemera is somewhat unique to the US tech industry.

It sounds you see it as more CYA for employees than employers? That’s probably true. The companies I’ve worked at have deleted old emails rather than keep a record of all conversations, so that material doesn’t show up lawsuits. When someone leaves the company, all their emails are deleted.

Its not just employee vs employer but at large enough corporations most effort is spent on infighting between departments.

Employers don't need CYA as much, they can afford lawyers and write the internal policies.

Google started deleting old emails, big companies seems to see record keeping as a liability so it is important for them to control this infrastructure so that no inconvenient messages remains in the system when the inevitable lawsuits comes.

Most big companies started retaining email indefinitely after the Monica Lewinsky scandal, and then started automatically deleting it after the Sony hack. I would expect the balance of whether to retain or delete email to continue to change every decade or so based on what's the least cheapest given the current security threat landscape and legal situation. (The exception being financial firms and other companies in highly regulated industries, which are still required to retain all communication.)

Willie Brown, once the mayor of San Francisco, had this to say about e-mail: the 'e' is for "evidence."

What I've done for this sort of thing is use email for an evidence trail (and searching), but ping people via chat if it is something that needs to be looked at soon.

I find it helpful to think of my emails as documentation. Imagining myself figuring something out months or even years later changes the way I write.

That sounds perfectly async to me.

Apparently CYA is short for "Cover Your Ass".

Reply on news.ycombinator.com