1. Defining Success Meeting the Records Directive: Business Rules for Capstone Success Jason R. Baron, Esq., Information Governance and eDiscovery Group, Drinker, Biddle & Reath, LLP Tom Kennedy, General Manager, Veritas Anjalique Lawrence, Assistant Director, Information Management & Technology Issues, General Accounting Office Jeanette Plante, Director, Office of Records Management Policy, Department of Justice 13th Annual E-Discovery, Records & Information Management Conference & Expo

2. Email can be a federal record Email often meets the definition of a federal record as provided in the Federal Records Act (44 U.S.C., § 3301), which includes: “… all traditional forms of records, regardless of physical form or characteristics, including information created, manipulated, communicated, or stored in digital or electronic form.“ Source: NARA Capstone White Paper (2014)

3. Archivist/OMB Directive ● M-12-18, Managing Government Records Directive, dated 8/24/12: 1.1 By 2019, Federal agencies will manage all permanent records in an electronic format. 1.2 By 2016, Federal agencies will manage both permanent and temporary email records in an accessible electronic format. http://www.whitehouse.gov/sites/default/files/omb/memoranda/2012/m- 12-18.pdf

4. 289 Days to Go til Dec. 31, 2016……

5. NARA’s “Capstone” Policy: The Path Forward Email archiving in short term, synced to existing proprietary software on email system Designation of key senior officials as creating permanent records, consistent with existing records schedules Additional designations of permanent records by agency component “Smart” filters/categorical rules built in based on content, to the extent feasible to do Non-senior official email records and non-tagged records designated as temporary to be held for set retention period.

6. Capstone Officials Capstone officials may include: ● Officials at or near the top of an agency or an organizational subcomponent ● Key staff members that may be in positions that create or receive presumptively permanent email records Capstone accounts Other accounts Key staff accounts Other accounts

7. Benefits of the Capstone Approach Increasing the amount of email of permanent value transferred to NARA Reducing the burden on individual end-users within agencies Reducing reliance on print-and-file practices, and Allowing for systematic destruction of temporary email based on an approved NARA disposition authority, reducing the amount of email that has no further value being stored by agencies. Source: White Paper on The Capstone Approach and Capstone GRS (NARA April 2015)

8. Capstone Guidance: A New Approach to Managing Email Records ● Must agencies use a specific technology to implement Capstone? No, Capstone implementation is not dependent on a specific technology or software. This approach is designed to utilize technologies that already exist at many agencies. Agencies may use native email systems, email archiving applications (which many agencies are already utilizing for other purposes), or other repositories to implement Capstone. Evolving technologies, such as auto-categorization and advanced search capabilities, may enable agencies to cull out transitory, non-record, and personal email. In the absence of a technological solution, agencies must rely on policy, procedures, and training to fully implement Capstone. NARA BULLETIN 2013-2 (8/29/13)

9. Latest Capstone-Related Guidance GRS 6.1 Email Managed Under a Capstone Approach Published September 16, 2015 FAQs [Draft Appraisal Memorandum] Important caveat by NARA: “To ensure proper oversight and accountability, no agency may implement this GRS until the agency submits a list of Capstone officials to NARA and we approve that list.” (FAQ #3) See http://www.archives.gov/records-mgmt/memos/ac27-2014.htmlhttp://www.archives.gov/records-mgmt/memos/ac27-2014.html

10. 2014 SAO Reporting NARA received 84 reports for a 94% response rate Question: Is your agency going to meet the Directive goal to manage both permanent and temporary email records in an accessible electronic format by 12/31/2016? 93% of the 84 SAOs reported that they would meet the 1.2 goal.

11. 2014 Senior Agency Official for Records Management Annual Report Analysis 11/23/2015

12. What NARA said about the SAO reports…. “Agencies reported various approaches to meeting this goal. For example, some agencies have adopted a Capstone approach to managing their email. Others describe approaches that are not automated and require employees to actively manage email. Some agencies reported that they are still printing and filing their email into paper recordkeeping systems, which they will have to change in order to meet the goal outlined in the Directive to manage all email records in an accessible electronic format.” (2014 SAO Report, p. 5.)

13. Specific Approaches described in the reports Adopting or considering the Capstone approach Working with NARA to schedule or update schedules for email records Relying on end users to determine the records status of an email. Many agencies are trying to automate this decision. Seeking enterprise-wide solutions. Establishing a working group or tiger team. Purchasing and implementing commercially available products. (2014 SAO Report, p. 6.)

14. Examples of Agencies That Have Completed Or Have Articulated Clear Plans To Complete Goal 1.2 DoD/Navy --Has met the goal by using an e-records management app, and is working on implementing Capstone-type schedule NARA --Met goal by deploying two separate cloud-based COTS products and adopting Capstone approach. Senior officials’ emails remain in RMA system for 15 years before accessioning; all others retained for at least 7 years, and NARA will follow Capstone GRS. Once captured in RMA, email residing on original email system is a convenience copy to be retained or deleted by individual users. SEC --In process of drafting email recordkeeping functional requirements that will apply to either existing or future SEC email repositories/tools. Baseline requirements use Capstone. US Access Board --Small agency using cloud based email system, where inbound/outbound emails journaled from an exchange server to the cloud vendor’s server.

15. From 2014 Agency SAO Reports EPA: uses proprietary e-archiving software and plans to adopt Capstone HHS: issued Enterprise Records Management Policy in Nov 2015, will issue an email policy in 2016 to include Capstone Deconstructing statement in HHS Report: “The department plans to expand the use of the new Capstone approach so that it applies to all employees. Currently, the Capstone approach only applies to employees with permanent records.” -- For discussion

16. More SAO Agency Reports…. HUD: - HUD has recently completed the implementation of Microsoft Office 365 (O365) for email and this cloud solution is the automated system used to satisfy HUD’s email capture requirements. HUD will electronically retrieve permanent email records (i.e. Capstone designated email accounts) in O365 and electronically transfer these records to NARA in an approved format.

17. From DOT’s SAO Report: “A particular challenge that impacts both the Department and other agencies is the vendor community’s lack of understanding of Federal records management requirements. The result is higher development and deployment costs unsustainable one-off solutions as US Department of Transportation SAORM 2015 each agency establish different baseline requirements. The DOT recommends NARA more directly engage vendors, particularly those engaged in email provisioning and management and provide guidance and establish technical and functional requirements supportive of GRS 6.1/Capstone so that all agencies will have access to a core set of capabilities across platforms. The Department supports NARA’s continued efforts to engage vendors and promote the inclusion of capabilities suitable to meet federal requirements into their products.” Source: https://www.archives.gov/records-mgmt/agency/sao-reporting-2015.htmlhttps://www.archives.gov/records-mgmt/agency/sao-reporting-2015.html

18. Information Lifecycle in a Capstone World Department of Justice/ORMP

19. DOJ Email Management Success Criteria Governance Business Foundation Supporting Technologies Training Evaluation and Review Department of Justice/ORMP

20. Frequently Identified Agency Issues What technology/storage? What to do about Capstone email that is not record? Who are Capstone Officials? What do we do with the rest of the Agency email? What are processes for active use? How will we know it is working? Department of Justice/ORMP

21. Sometimes Unidentified Agency Issues How to process at retirement? Do we use distributed v. enterprise approach at each lifecycle phase? Do we develop/implement an enterprise wide v. distributed migration strategy and storage? What are the Governance requirements for each lifecycle phase –active through disposition? Department of Justice/ORMP

22. It’s Time Data Made Good on It’s Promise Harness the Power of Your Information Tom Kennedy VP and General Manager, Veritas Public Sector

23. 1.2ZB 40ZB THE WORLD’S DATA 7.9ZB 201020152020 Without control

24. Visibility, Action, Control Copyright © 2015 Veritas Corporation24 Visibility Understand What you Have Broad Deep Combination Action Have a Plan and Enforce It Policy Move / Archive Change Access Assign Retention Control Automate Automate Policy Report Validate

25. JUNK DATA (ROT) Gartner estimates that around 30% of data is Redundant, Outdated or Trivial (ROT) & 50% of data has indeterminate value ”Organizations Will Need to Tackle Three Challenges to Curb Unstructured Data Glut and Neglect”, Gartner, June 2015 IDC believes in 2013, 78% of the information in the digital universe is Worthless “The Digital Universe of Opportunities: Rich Data and the Increasing Value of the Internet of Things”, IDC, April 2015 Copyright © 2016 Veritas Corporation25

26. Preliminary Information Map Findings Select Agency Deployments Copyright © 2015 Veritas Corporation26 Agency A 45 TB 34% Stale Agency B 80 TB 45% Stale 1,004 Servers Agency C 151 TB 47% Stale Key Insights: 1 share with 73% stale info; another 90% older than 1 year Millions of small ‘audio’ files located 31 TB of unknown non-business data

27. Copyright © 2015 Symantec Corporation27