Thursday, October 04, 2007

The email scandal

Remember the White House email scandal? All those missing emails that were supposed to be archived?
When Congress asked about 5 million executive branch e-mails that went missing, a White House lawyer pointed the finger at an outside IT contractor.

The only problem? No such IT contractor exists, according to sources close to the investigation of a possible violation of the Federal Records and Presidential Records acts.
The offices of the president and vice president are required to preserve all official communications, including e-mail, by the Presidential Records Act, a Watergate-era law which establishes that such communications are the property of the American people and cannot be destroyed. The Federal Records Act covers the archiving of communications by other parts of the executive branch.
The National Security Archive and CREW lawsuits paint a picture of a White House that gave low priority to compliance with its archival duties under the law. The research institute alleges that the Executive Office of the President abandoned the automated record management system (ARMS) built by the previous administration to securely archive e-mails in 2002, never implementing another system for that purpose. The time period for the abandonment of the legacy archival system coincides with the Executive Office of the President's switch from Lotus Notes to Microsoft Exchange and Outlook, referred to by White House Press Secretary Dana Perino in an April 13 press briefing.

"In 2002, they abandoned Lotus Notes, went to Microsoft Outlook, abandoned ARMS, but never put in a new electronic records management system. So I'm told they just dumped e-mail on servers. This meant that anybody with access to the servers could potentially dump data and delete documents," said Weismann.

"Each agency of the EOP's records are commingled. It's all just a dump. How much is missing? I think 5 million is the low end of what's missing."
Let's not regard this story as an opportunity for cheap anti-Mircrosoft jokes. (But you can take the opportunity anyway, if you feel like it. I mean, what the hell.) It's pretty clear to me that someone set up the situation to allow for the accidentally-on-purpose erasure of evidence.

What about the hard drives? The story gives no indication of forensic examination of physical storage devices. Traces of erased data will remain even after that data has been overwritten. But can't the drives simply be replaced?

No comments: