[conspire] email retention [was Re: VPN]

[Rick Moen]

Quoting Tony Godshall (togo at of.net):

> The legal distinction is probably the issue in this case, where recent
> email is considered protected communications while old email is
> considered a digital archive, requiring less of a warrant, I recall
> this being the case in the USA, but am hazy on the details, and I am
> not a lawyer, and obviously all legal matters depend on jurisdiction,
> and one should not take such guidelines at face value without a better
> legal analysis of one's own situation, such as where one lives, where
> the data lives, and which laws bind the corporation holding your data.

We're all outside our areas of competence on our matters, none of us
being attorneys.  That implicit disclaimer having been made:
My understanding is that there is no such strict dividing line, not at
90 days or anywhere else.

Corporate best practices suggest that there _should_ be an in-force,
enforced retention period for e-mails, which may for diverse reasons
differ between departments and functions.  As a general, rule, long
policies also increase your company’s exposure to legal examination that
focuses on conversations and decisions captured in e-mails, within the
"discovery" process of civil litigation.  Short e-mail policies avert
that problem, but introduce other problems such as interfering with
collective memory and effective documentation of the context for actions
taken -- and also, occasionally, Federal, state, local, and/or industry
requirements may interpose a minimum period.

Having explicit, documented retention (which also means erasure)
policies protects the firm against claims of "spoilage" of evidence, if
the firm is sued -- in the sense that the firm can cite the policy and
say "Hey, we weren't hiding anything; we were just carrying out a normal
erasure policy."  (In other words, deleting mail _absent_ a policy 
could look furtive, and implementing a longstanding policy averts that
perception problem.)  That notwithstanding, it's also true that any
moment a firm reasonably anticipates being a party to litigation on a
matter, it has a legal obligation to _suspend_ for the duration any such
policy on any matters relevant to pending litigation.

Anyway, I haven't found the new Google policy Paul is referring to.
Perhaps he could cite it.