Billg's dream? Honey, I disappeared the emails…
Catch: you can only do it when you're not being sued
Down at the bottom of the Microsoft Office eServices home page you'll find an intriguing link to Disappearing, Inc. The sites linked to in this area appear to be largely Office eServices partners, some of them Microsoft-owned, some apparently paid-for ad links, but presumably what they have in common is that it has been deemed appropriate for them to be associated with Office XP in some shape or form.
You may recall Disappearing's product, Disappearing Email, which shipped late last year; essentially, it makes the email you send disappear at whatever time you wish it to. It works by sending encrypted mail, which the recipient can only read for as long as a key is available on a key server. Hence, the key vanishes from the server, then so does the email. We've absolutely no idea what the FBI and our very own Home Office think of this, but...
Given Microsoft's recent legal history, the piquancy is quite delicious, even without Disappearing becoming an eServices partner. And even without some of the wonderful things Disappearing says in its backgrounders.
Of email as it exists (and persists) today: "Every quick little note is archived in so many places, it might as well be etched in stone. Any remark could be used out of context in a lawsuit..." Snippets, did we hear?
Or here we have information technology attorney Michael R Overly's contribution: "The current Microsoft antitrust litigation provides another example. There, the government was able to discover damaging email that Microsoft thought no longer existed."
As Disappearing says: "...legal discovery request are expensive. Even if your email is squeaky clean, complying with these requests can cost millions of dollars... All copies of of your email are destroyed, wherever they might be - your computer, recipients' computers, intermediate mail servers, even backup tapes."
It's so tempting, isn't it? If this product had existed years ago, then Microsoft would have been able just to flip a switch and all of those unpleasant snippet emails the DoJ trawled out of the company systems could have been just disappeared. That of course, would have been wrong, and we'd be the last to suggest that Microsoft would be the kind of company to obstruct justice in that way, or that Disappeared, Inc, would be the kind of company to recommend that people do so.
On the contrary, as Disappeared specifically states, "you can suspend regular document expiration on a moment's notice, in case of a legal enquiry." Or, "if legal action is threatened, all employees must immediately stop destroying archived email; those who continue to follow the destruction policy may be guilty of "spoliation of evidence," an action that often forfeits a lawsuit."
You're no doubt now puzzled. You can avoid the costs of discovery requests that poor, entirely innocent companies like Microsoft had to go through by implementing Disappearing Email and an appropriate expiration policy. But if legal action is threatened you must stop destroying stuff immediately. One might observe that as legal action has been threatened for something in excess of a decade now, this isn't actually much of a lifesaver for Redmond.
But in the case of other entirely innocent companies, the ones that haven't even been wrongly accused yet, clearly the crux of the matter is the appropriate setting for the expiration policy. The good people at Disappearing Inc have a suggestion: "For example, a common retention policy for email would require deletion after 60 days. If an employee desires to keep an electronic past the automatic deletion date, she [that's what it says here, so they don't mean Bill] must take affirmative action to preserve the document (e.g. contact the MIS department or copy the document to a special directory)."
There's hope for Microsoft, nevertheless. "A business is only under a duty to preserve evidence if it is aware of a pending or threatened dispute or lawsuit." So, as we understand it, Fort Redmond first has to come out of the other end of all of its lawsuits, and avoid getting into any kind of litigation, and then it can implement the 60 day destruction policy and be safe... No, looking at it again, that's impossible and there's absolutely no hope. ®
Sponsored: Becoming a Pragmatic Security Leader