Smart Policies for E-Mail Messages You'd better be careful--your company's e-mail messages could come back to haunt you in court.

If you thought the "e" in e-mail stood for"electronic," wise up. Nowadays, good old e-mail islikely to be "evidence" if you, your company or any ofyour employees is the target of a legal attack.

That's the lesson being hammered home across the countryover the past few years, beginning with Bill Gates' televisedfailures to recall embarrassing e-mail dredged up duringMicrosoft's antitrust hearings. Gates and Microsoft escapedthat incident without serious damage, but the costs of failure topolice e-mail are going up. Last fall, for instance, a manager at aWall Street investment firm was sentenced to one to three years injail, fined $400,000, and barred from the securities industry forlife for destroying e-mail sought by prosecutors in a tradingscandal.

Your chances of being caught in a similar trap are going up,too. In a 2001 survey conducted by the ePolicy Institute, aneducation and research organization, 9 percent of U.S. companiesreported being ordered by a court or a regulator to cough upe-mail. In 2003, the same survey found the number had risen to 14percent. "E-mail has become a real target of almost every typeof business litigation," says Michael R. Overly, an attorneywith Foley &Lardner in Los Angeles and author of E-Policy: How to Develop Computer, E-mail andInternet Guidelines to Protect Your Company and Its Assets(AMACOM).

Unfortunately, e-mail presents a daunting challenge forentrepreneurs. The problem starts with its image. Many people treate-mail as if it were casual and informal, when it is anything but.It may not carry a company letterhead or a signature, but e-mailhas the same legal weight as any memo, letter, report or otherwritten document your company prepares. "It's when peopleforget that they have the same responsibilities as when they werenegotiating a contract that they run into trouble," saysStephen Northcutt, director of training and certification for TheSANS Institute, a Bethesda, Maryland, computer securityorganization.

E-mail also seems less permanent than other writtencommunication, but e-mail may be more permanent than printeddocuments, warns Rick Edvalson, president of IntegriNet SolutionsLLC, a Boise, Idaho, computer services firm. Copies of e-mail arecreated on your computer and recipients' computers as well ason any mail-server computers that relay the mail. Some copies willbe backed up to tape and stored indefinitely. "They acquire aneternal life of their own," says Edvalson.

Any of those e-mail messages could become key evidence in civilor criminal litigation involving your firm. What to do? Expertsrecommend three steps:

1. Have a written e-mail policy. It should govern whatcan be said in e-mail as well as how long e-mail is to be kept.SANS Institute guidelines suggest keeping e-mail on administrativeand financial matters for four years and general correspondence forone year. "Ephemeral correspondence" such as personalmessages and status reports can be destroyed after reading. See asample policy at www.sans.org.

2. Train employees in the use of the policy. Forinstance, teach them to categorize e-mail as administrative,financial or other types with a line at the top of the message,making it easier to sort and dispose of e-mail as appropriate.Explain the purpose of the policy as well as penalties for failureto follow it.

3. Enforce those penalties. Twenty-two percent ofcompanies surveyed by the ePolicyInstitute said they had fired people for failing to followcompany e-mail policy. That kind of enforcement may convince ajudge or jury that you tried to control your e-mail in good faithand save you embarrassment or worse.

Whatever you do, don't forget that e-mail can be evidence."E-mail is a document like any other," says Edvalson."These files are not benign and innocuous. They carry meaningand importance that can affect the well-being of thecompany."

Mark Henricks writes on business and technology for leadingpublications and is author of Not Just a Living.