Will email audit trails lead to more dirt on News International?

Staff at Bristol-based computing company Essential Computing are co-operating with the police in connection with the News of the World phone-hacking scandal.

The firm is helping police investigate reports that a News International executive allegedly tried to destroy part of an email archive dating back to 2005 during the period Essential Computing was contracted to work with the newspaper, which investigators hope may record daily contact between relevant News of the World editors, reporters and private investigators.

A spokesman for Essential Computing said he was unable to talk specifically about the News of the World case because a non-disclosure order is in place to prevent details being discussed.

However, the case has highlighted the importance of email and data management in large enterprises, and the value of understanding how the audit trails work with external providers.

Essential Computing is not a hosted email or managed archiving service: it does not store or hold its customers data, but helps them migrate email and messaging databases from one location to another. But the company says it does maintain a full audit trail of its activity, at least for the duration of the customer contract.

"We're a bit like the ‘Pickfords' of email archiving," Essential Computing said.

"We are not concerned with the [email] content only in helping the customer move it and providing a full audit trail and context for e-discovery. People get worried about the chain of custody and we have to show the full audit of the whole process, so that they know where each and every email goes."

Essential Computing's clients, which in the past have included EDF Energy, the City of London Corporation, EasyGroup and the YMCA, typically have between 500GB and 1TB of email data, and anything from 5 million to 60 million individual messages or records – including recipient history – that they want preserved.

"We put in on-premise archive systems for clients, but we also do migrations from one hosted service to another – to Microsoft cloud services from Symantec, for example," said the Essential Computing spokesman.

Barry Gill, enterprise consultant at hosted email and archiving service provider Mimecast, explains how a typical email management setup works.

"Anything sent through the systems integrator world would have the same checks in place as us [Mimecast], so only those with the relevant authority would be able to request deletion and deletion of data would produce a massive backend auditing process, which is there effectively to cover the provider's own back."

Mimecast retains audit logs that specify where items have been removed and by whom from a user-controlled perspective "in perpetuity", though the messages themselves can be erased. But different permission levels often result in varying audit details, which customers need to be aware of before they sign up to services. Mimecast has three levels, for instance.

"We'd be breaching client confidentiality if we retained the information after deletion, even if it was just the subject line rather than the content," said Gill. "But we cannot delete the audit logs as long as that organisation is a client of Mimecast."

Whether any audit trails held by Essential Computing can help police ascertain whether someone at News International tried to eradicate messages remains to be seen.

And the News of the World would not have necessarily breached the Data Protection Act (DPA) if it deleted or lost email: firms are not required to specifically retain messages beyond a certain date unless they are either covered by industry rules and regulations or the subject of a criminal or civil investigation at the time.

"It is 100 per cent up to the customer to decide what local laws apply to them. We give them the tools to apply those policies – 10 years data retention by default, which most of them keep, but some organisations need to store data for longer, others want to remove it as quickly as possible, in weeks or days for instance," said Gill.