On Message: How Companies Store Communications

Technology executives at brokerage firms, banks and energy companies already store huge amounts of data on trades. Now, if they want to stay on the right side of federal regulators, they'd better be stepping up their storage of e-mail messages and instant messages, as well.

In the wake of accounting scandals at companies such as Enron and WorldCom, the U.S. Securities and Exchange Commission, the National Association of Securities Dealers and the New York Stock Exchange all are more vigilantly enforcing SEC regulation 17a-4, which requires trading firms to preserve all e-mail and instant messages—sent or received—for at least three years. Not only must they store all this data; it also must be kept in a nonerasable, non-rewritable format that can be indexed and downloaded on demand for regulatory officials.

"Everything from Martha Stewart to Enron has brought e-mail into focus. This is getting people's attention now and it's something you just have to do," says Jim Pirak, vice president of compliance at ShareBuilder Securities, a subsidiary of Netstock Corp.

Improved and increased data storage comes at a cost federally regulated companies are forced to address, but it's an issue other industries would do well to learn more about. In a climate where customers and investors are demanding more accountability, many analysts believe accessible record-keeping will become critical to providing evidence and establishing credibility.

"This is an expense, pure and simple. It's not like installing a CRM (customer relationship management) system where you expect to get some payback from it. It's a cost," says analyst Adam Couture of technology consultancy Gartner Inc.

A large securities firm with 10,000 brokers can generate about 500 gigabytes of e-mail a month. Storing e-mail for at least three years means roughly 54 million e-mails, or 16 terabytes of data.

Just storing the data on servers can cost a company hundreds of thousands to several millions of dollars each year. Having the personnel in place to index and retrieve the data further increases costs. And if a brokerage firm has not saved the data for the prescribed time, it will have to pay an outside digital document specialist to come in to hunt down and restore the pertinent data.

Analysts estimate that for every $1 a company spends storing data on tape or disk, it spends another $4 to $7 to manage it. When it comes to archiving, the vast majority of costs comes from the management, software and support needed to inventory and retrieve the data.

Steep Cost for Failing Standards

If you don't pay up front, you may pay later. Regulated firms that fail to meet the storage and retrieval standards face fines that range between $1,000 and $100,000 per offense, as well as the possibility of censure, suspension or expulsion from the trading floor.

"The stakes are so high that brokerage firms are starting to get religion about how they manage, store and supervise their electronic documents," says Henry Carter, who formerly served as part of Merrill Lynch's compliance team and now heads up H.W. Carter Consulting. "As we've seen from the recent scandals and subsequent decline in the stock market, companies now understand that it's far better to be safe than sorry."

E-mail evidence already has played a key role in investigations of homemaking maven Martha Stewart's sale of shares she held in biopharmaceutical firm ImClone Systems, as well as a $100 million settlement reached between investment firm Merrill Lynch and the New York state attorney general's office.

In the Merrill Lynch case, analyst Henry Blodget and the firm were nailed for publicly advocating that investors purchase stock in companies that did investment banking with the firm, while simultaneously lambasting the stock in private e-mails. For example, investigators discovered that while Merrill Lynch assigned an "accumulate" rating to Excite@Home shares in June 2000—essentially telling investors to buy the stock—Blodget privately referred to the stock as a "piece of crap" in an internal e-mail.

As a technology deployer, you have to decide if you want to take on the task of building a digital document storage and retrieval system internally, or contracting it to a document software firm, such as Iron Mountain or Zantaz Inc.

ShareBuilder Securities' Example

ShareBuilder Securities, an online trading firm, tried to store and retrieve all of its trades, statements and marketing e-mail itself until the summer of 2001, when it realized that an outside service provider could more efficiently and inexpensively manage its data.

"We were doing it internally by saving all of the e-mails on CDs and then storing them offsite," says Paula Harris, ShareBuilder's records manager. "But we were spending so much time labeling and indexing all these disks that we were getting away from our core competency. I mean, we're an electronic trading firm."

After researching and evaluating software and services from a variety of vendors, ShareBuilder chose to migrate all of its e-mail and instant messaging data to Zantaz. The software immediately copies all e-mails from ShareBuilder's e-mail server and sends them to the Zantaz data center. This data center uses blade servers—thin circuit boards containing one or more microprocessors. Each blade is intended for a single application. Each blade server comes with a 100-gigabyte drive. Zantaz' indexing system organizes the data for easy retrieval.

When a ShareBuilder executive or an SEC or NASD investigator wants to access an e-mail or, perhaps, an entire year's worth of messages, he or she simply logs on to a Web browser that connects to the data center. What used to take several technology employees several days to track down through an extensive search of ShareBuilder's e-mail server now takes just a few minutes.

Had ShareBuilder tried to do this internally, it would have cost at least $250,000 in initial hardware and software, Harris says. That does not count the costs of dedicating staff to implement and maintain it. Simply constructing the document management system could have taken a year.

Instead, ShareBuilder has budgeted $36,000 this year for the software and service support and, most importantly, already complies with SEC and NASD rules. "We're ready for any type of check or investigation," Harris says. "It puts us at ease knowing we're in full compliance."

Bob Colby, a deputy director in the SEC's division of market regulation, says investigators typically stumble across record-keeping violations while pursuing other investigations. Often, he says, brokerage firms are unaware they're not in compliance with regulation 17a-4.

A routine record-keeping violation is often a very small fine, he says. "But the fines increase if we find there's a systemic problem in how a firm saves this information. It's even more severe if we find they're destroying the data."

Some brokerage firms aren't comfortable storing all their internal and external e-mail and instant messages at an external data center.

Such firms can install their own archival servers, which can cost between $3,000 and $50,000 apiece. These can be attached to servers that collect, store and exchange e-mail for Microsoft Outlook or Lotus Notes users. Messages stored this way also may be backed up on either digital tape or an optical disk drive, these firms say.

What You Should Do About Data Storage Rulings

Assess your present system. Determine how near or far you are from full compliance with regulatory requirements

Ensure compliance. Make sure your legal counsel is involved in the planning process for any document storage system

Be aware. If you're global, make sure business and technology planners are current with all countries' rules governing e-mail storage and retrieval

Create a records management group. Make sure they're involved in planning

Bring in HR. Your human resources team can help protect against litigation or privacy issues that may arise

Document it all. Assign staff specifically to oversee the document storage and management process

Copyright © 2004 Ziff Davis Media Inc. All Rights Reserved. Originally appearing in Baseline.