Watching Outgoing E-mail

[R.A. Hettinga]

<http://www.forbes.com/2005/02/16/cx_ah_0216tentech_print.html>

Forbes



Ten O'Clock Tech
Watching Outgoing E-mail
Arik Hesseldahl,   02.16.05, 10:00 AM ET

Sometimes it's amazing that people in the business world continue to use
e-mail at all.

 Sure it's convenient and fast, but it's also an increasingly difficult
method of communication to manage, especially if your company is covered by
some of the new regulatory rules like Sarbanes-Oxley, HIPAA and the like.
There are new rules governing how long a company must store your e-mail,
and if someone takes your company to court, how quickly you must be able to
produce copies of e-mail messages covered by a subpoena.

 There are new standards coming in to play governing the level of an
employer's legal responsibility for the e-mail that their employees send
around the office. One case frequently cited is that of Chevron, now part
of ChevronTexaco (nyse:  CVX -  news  - people  ), which in 1995 paid a
$2.2 million out-of-court settlement to four female employees after the
women said that an e-mail circulating around the office containing some
tasteless jokes created a hostile work environment.

 A startup company called InBoxer, demonstrating a new software product
here at the Demo Conference this week, has shown that companies can and
will try to minimize their exposure to these kinds of legal risks by
screening the e-mails that employees attempt to send.

 InBoxer, which used to be called Audiotrieve, calls its new product
OutBoxer, and it scans outgoing e-mail messages looking for inappropriate
content, unauthorized disclosure of information and tries to encourage
senders to clean up their messages before they actually send them.

 CEO and Founder Roger Matus says as part of building its technology the
company scanned and analyzed more than a half million e-mail messages
written by senior executives at Enron. Those messages, which have been made
public as part of the investigation into Enron by the Federal Energy
Regulatory Commission, proved useful, he said, for the purpose of analysis
and testing an e-mail filtering technology.

 Matus says OutBoxer uses a technique called "linguistic processing" that
is in part derived from related work in speech recognition by his
co-founder and chief technologist, Sean True. Using its methods against the
Enron mails, the company found that 20% of those messages contained some
"non-business" content. Another 4% of the messages--or about one in 25--in
the Enron collection contained content that was either pornographic,
racially or ethnically insensitive or which contained questionable images.

 So, people pass around obnoxious e-mails. Big deal, right? Well, you may
have a thick skin or simply not be offended easily, but how about when it
comes to company secrets being passed around? What's to stop somebody who
just got passed over for a promotion from sending out some sensitive
information about your best customers to an old friend who happens to work
for a competitor?

 OutBoxer works with Microsoft's  (nasdaq:  MSFT -  news  -  people  )
Exchange server and will in time extend its reach to Research In Motion's
(nasdaq:  RIMM -  news  -  people  ) Blackberry wireless e-mail devices as
well. When it's running, it gives a range of responses to e-mails you try
to send that it thinks you should at least think twice about. In some cases
it will simply raise a red flag and point out that you may want to delete
something in the message.

 If nothing else, if gives you a chance to listen to second thoughts and
make sure you really want to send that e-mail. But in other cases it can be
configured to prevent a user from sending a particular e-mail entirely.

 What it misses--and this raises another set of information security
questions altogether--is the fact that many employees who would be likely
to e-mail sensitive company information around would also tend to be
naturally suspicious that their e-mail activity is already being watched by
the company, even though it probably isn't. If they really want to send
something they're not supposed to, they'll find a way to take it home and
send it from a personal e-mail account not subject to the screening process
in use at the office.

 OutBoxer is expected to be available this summer, and it will join
InBoxer's other product, an anti-spam screening product called InBoxer. A
price has yet to be set.

-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'