Rossander’s Security Reader

Back by popular demand, this "encore tip" is a reminder to be especially professional in your email communications. Please share this seasonal message with your co-workers. (This Tip was first run in October 2006.)

Halloween is a time for scary stories – tales of vampires and ghouls rising from the dead to terrify innocents – a time when things that you thought were dead and buried come back to haunt you.

Unfortunately, the analogy between badly written email and the undead is sometimes all too appropriate. A hasty word can return to haunt you long after you hit the send button and thought the conversation was over. Careers have been destroyed, money lost and relationships ruined when an email returned from beyond.

Americans have a bad habit of treating email very casually – as an extension of our last phone conversation or a continuation of the chat in the hallway. We assume that the message is private and that recipient will understand the context and correctly interpret our tone.

In fact, email is more like a postcard – anyone can read it while it’s in transit^† and any of the recipients can save it, forward it or post it to the internet. Electronic copies can remain in archives and electronic message hubs all over the Internet – places that neither the sender nor the recipient can control. Emails can be subpoenaed and forced into the public record. You have no right of privacy in your email, either sent or received. When you write an email, you must assume that it will be read by an unknown and unforeseen audience.

That unknown audience will assume that you carefully crafted and wordsmithed your message (or, if not, that the hurried email is evidence of the writer’s “real state of mind”). They will not believe that you were “just joking” and won’t care that you were trying to dash off a quick note. They will interpret the tone according to their own preconceptions.

Always assume that anything you write will come out at the worst possible time and in the worst possible light. Be professional in your email. Include enough context that the unforeseen reader understands the message. Be personable yet professional in tone. (In particular, never use sarcasm in email.) Never write anything that you would be embarrassed to see on the front page of tomorrow’s newspaper.

Remember, email can come back to haunt you.

^† Footnote: The comment that “anyone can read [your email] while it’s in transit” is less true if you have email encryption with your business partners but your words can still be saved, forwarded or otherwise sent outside your control. Please don’t assume that email encryption will protect you from sloppy wording.

This article was originally published in the Apr/May 2006 edition of The Agent Newsline, a publication of Westfield Insurance.

As e-mail continues to soar in popularity, be careful what you write. Working in information security, I’ve seen how e-mails can come back to haunt you – see the sidebar for some specific court cases. Here are some guidelines and suggestions to help you draft your next e-mail.

There is no right of privacy in e-mail

When reading e-mail, outsiders assume that e-mails are written with the same care and attention as written momoranda or that the "casual" e-mail reflects what the writer really thinks about the situation.

The new buzzword is "eDiscovery." It means that plaintiffs in court cases have the right to examine and request copies of all electronic communications to or from a person or agency. E-mail is often introduced as a key exhibit in trials on corporate misconduct. The costs incurred by companies to meet discovery requests can go into the millioins of dollars. Even if the e-mails are not directly relevant to the case at hand, discovery requests move the e-mails into the public record, which means they can be used for future lawsuits (potentially class-action) and other discovery requests.

E-mail is a formal business communication

Electronic communication, because of its speed and reach, is fundamentally different from paper-based communication. In a paper document, it is essential to make everything clear and unambiguous because your audience may not have a chance to ask for clarification. With e-mail, your recipient can ask questions immediately. Like conversational speech, e-mail tends to be sloppier than communications on paper.

We forget that e-mail does not convey emotions nearly as well as face-to-face or even telephone conversations. we assume that the context is understood. Your client may have difficulty telling if you are serious or kidding, happy or sad, frustrated or euphoric. Sarcasm, in particular, is very dangerous to use in e-mail.

The spoken word fades – e-mail is eternal

E-mail can come back to haunt you years after you sent the message. Once you hit the send button, you no longer control the messate. It cannot be called back and cannot be deleted. You can delete your copy but you can never be sure that the recipients have destroyed theirs. They can save it or forward it to anyone they want, whether you approve or not.

Remember also that electronic copies of the message can remain in archives and electronic message hubs all over the Internet – places that neither the sender nor the recipient can control. E-mail is like a postcard in that everyone watching the flow of mail can read your message.

E-mail etiquette: Rules to live by

Before you e-mail a prospective customer or existing policyholder, consider the following rules of thumb:

• Be fact-based and professional.
• Write for unintended and unforeseen readers.
• Assume that your words will be taken out of context.
• Write as if the document will never be destroyed.
• Always assume that somebody has a copy of your e-mail and that it will come out at the worst possible time and in the worst possible light.
• Never write something in an e-mail that you would not ordinarily include in a memorandum. If you would be embarrassed to discuss it with a stranger, you should probably rethink the message.

The e-mail rules listed above also apply to instant messaging and voicemails. Soem conversations are just best handled in person.

Examples of E-mail Troubles

• In American Home Products Fen-Phen litigation, lawyers found one message (among 33 million messages) from a disgruntled worker who wrote "Do I have to look forward to spending my waning years writing checks to fat people worried about a silly lung problem?" Though the information did not relate to the company’s policies, this was considered enough to sugest a pattern of behavior and contributed to a settlement of $3.75 billion.
• In the Zubulake case, when the company could not produce backup tapes containing relevant e-mails and other documents in a timely manner, the judge instructed the jury to infer that the company was hiding something, resulting in a $29 million award.
• Morgan Stanley was ordered to pay $1.4 billion in connection with a stock sale to Sunbeam because they failed to preserve e-mails for the 24 months required by the SEC, failed to disclose the presence of backup tapes, and failed to adequately search archived emails and attachments.
• In a life insurance company case, the IT department was not informed of a litigation hold and continued to destroy electronic records on its own retention schedule, resulting in a $1 million penalty and a court order to deploy a multi-million dollar records management program.