Data Loss in a Downturn | BTalk Australia

(10min 54) Ex-employees take a lot of knowledge away with them, but they leave as much behind. It’s sitting on their desktop computer, hidden in email messages or stored on files lost on your file servers. So what should your IT department be doing when an employee leaves to protect knowledge and ensure you are meeting your statutory obligations? Phil Dobbie talks to Adrian Briscoe, the APAC General Manager for Kroll Ontrack.

Add your thoughts and experiences in the Talkback section at the end of this post.

View all BTalk Australia podcasts here.

Subscribe to BTalk Australia on iTunes.

• Today’s Transcript

Phil Dobbie: Hello I’m Phil Dobbie and welcome to BTalk Australia. Today if you have to let an employee go, what happens to all the data?

Downsizing, that’s a word we’re going to hear a fair bit of this year, but what about all that employee data? All those files sitting on an ex-employee’s laptop or on a server. And that gigabyte of email attachments. What do you do with all of those? When an employee leaves, how much knowledge goes with them? Well Adrian Briscoe is the general manager APAC for Kroll Ontrack. They provide data recovery for corporate customers. Adrian, I guess the worst thing you can do is just delete the data that’s sitting on the computer of an ex-employee.

Adrian Briscoe: I think so. I’ve seen occasions where the IT department taking the computer back and recycled it very quickly and passed it on to another user just by doing a reload of the operating system. And, of course, once that reload is done, files start getting overwritten and the data from the previous owner is lost.

Dobbie: Right, and what sort of data should you really be looking at to hang on to?

Briscoe: Well, we see a big requirement in email data, email archives, going back maybe the seven years that the ATO or the ASIC require. They basically want to see seven years of data from a business, a lot of the interesting information is now contained within email. Those maybe contain attachments with spreadsheets or on a Word documents or agreements. So certainly employers need to hang on to those archives.

Dobbie: In fact, I wouldn’t have thought it’s legal to delete them, is it?

Briscoe: I guess there’s always the backup tapes. But backup tapes are taking a snapshot of when a user has had a mailbox on the server. It doesn’t necessarily mean that the archives, the historic email is on that server. It basically means that it’s probably being moved to a local store such as a C drive or D drive.

Dobbie: Hindsight is always a beautiful thing, but with a benefit of it. Should we be encouraging people to store some of their data in a different way? At least putting more on the server I guess rather than storing stuff on their own local PC.

Briscoe: I think one of the checklists when an employee leaves is that they need to actually make an image of the hard drive of that PC or that laptop computer so that when there is any questions raised about a deal or an agreement that was made, they can refer back to that employee’s information so that they can sort of pull the relevant information from it. So certainly a computer forensic image is a very quick process. A person comes to site, they forensicly image the hard drive, basically a sector by sector copy of the workstation, the laptop drive. They can then make a duplicate of that for security purposes. Put that into an evidence bag, seal it up so that there is always a reference point for that moved on staff.

Dobbie: Now when a company does downsize, I mean they don’t get rid of the jobs totally of course, it just goes to somebody else who all of the sudden finds they’re doing two jobs now for the same salary normally. And they inherit a whole load of this data often. I mean how can they make sense out of that long history of communication and should they be getting access to those old emails and old files and how can you get on top of that?

Briscoe: Well, certainly duplication is the biggest enemy here as far as emails duplicate and as far as ran the department and you know for the original email it could go out to maybe 200 people. Therefore those emails are appearing elsewhere in the department and in the organization. Therefore, actually de-duplication is a service that we can provide and that will at least allow you to get back to the original email so that you don’t have to read multiple copies of it.

Dobbie: Because it’s often a huge volume of email, isn’t it as well? I mean you know historically if you got any figures as to what people are sending in emails these days?

Briscoe: Well I think the average size of an archive per year is somewhere in region 2 gigabytes for a management level person. But certainly servers are limited to maybe 500 megabytes of storage space. Therefore a lot of the emails are going to archive. So certainly you’ve got a whole wealth of information being held on a local device and that can easily be lost.

Dobbie: Now, when somebody does leave and a company downsizes, what happens to the old computers? I guess fairly often they get auctioned off don’t they? And that sounds like a huge liability.

Briscoe: Well, certainly it is. And we’ve done exercises here in Australia where we’ve bought up ex-leased computers and found that there is a lot of useful data still on them.

Dobbie: Find anything interesting?

Briscoe: Absolutely. There’s been, I think there was a recent documentary by BBC where they found that a lot of computers exported to West Africa had contained client data, credit card numbers because they hadn’t actually been erased correctly. So certainly when a company is passing on IT equipment that’s no longer needed and needs to be recycled, they should make sure that it has actually been erased correctly, that no other data is left on the hard drives.

Dobbie: Now IT spending is going to be cut way back this year and I guess that means we’re going to be relying a lot on older equipment. That’s potentially going to produce some problems as well I would have thought.

Briscoe: That’s right. Every storage device has a mean time before failure. Some reach that point sooner than others. So typically, companies are going to make sure that they are backing up and following the disaster recovery plans as best as possible basically. It’s very difficult in this day and age because certainly 90 percent of the documents used in business are produced electronically, never see the light of paper. So that information, that intellectual property is always kept in some electronic storage. And therefore any disasters that occur could mean that there could be a significant data loss.

Dobbie: So if you’re wanting to do things right from now on, I guess a lot of companies will say, well you know this is all good and you know, but we do have a confused mess, the user has done what they wanted by and large in terms of how they store their data. Are there a couple of simple rules that you could apply to say look, well if we’re going to be smarter about this and try and prevent problems when people leave. Because even when times are good obviously we’re seeing increasingly that people are spending shorter amounts of time with each company. A couple of golden rules that you can apply to how you should really be applying the storage of data, particularly emails?

Briscoe: Well I think when an employee does leave, it is worth considering the investment of making copies of what that user had. Certainly, collecting up mailbox from the server, putting it onto maybe a DVD, collecting up the workstation or the laptop computer and making a forensic image, so that again you have that reference point. And making sure when that computer leaves the work environment that it’s been erased correctly so that there’s no compromise of company data.

Dobbie: But moving forward, are there things that companies could be doing better to try and get more integrity I guess of the, don’t know if integrity is the right word, but trying to prevent problems when people do leave?

Briscoe: I think certainly having some type of offline storage where archived email accounts are kept rather than local hard drives. You know that’s a big step forward because certainly losing just an archive for one year can make quite a big hole in the intellectual property of a company.

Dobbie: And is this keeping you busy this year with clients calling for your services because of staff turnover?

Briscoe: We’re seeing more and more requests for email archives to be restored and certain mailboxes to be recovered. Because I guess there’s regulatory issues coming up, probably litigation issues in the pipeline. So certainly I would see that the need for disposing of equipment and of backing up that equipment will continue throughout 2009.

Dobbie: Right, and I guess the other confusion this year and last year is who actually owns the device. Of course, you know a lot of people went out buying their iPhones. They might be using that for office email and for personal email. And storing them altogether on their iPhone rather than on any corporate network.

Briscoe: Certainly as in the merging of personal data and the work data is very much an issue because a lot of work computers now contain photographs of the family because that’s where they’ve been stored because it’s easy just to plug in the digital camera so that they can offload the photographs to it. You know certainly personal email accounts can coexist with maybe the Outlook or Lotus Notes email on a PC. So we’re always being told by the IT industry that there’s consolidation of data sources coming. And the TV will merge with the computer and whatever basically. It’s already happened in the workplace, that personal data is certainly very much blended with work data nowadays.

Dobbie: That’s right. You get a history of a company and everyone who worked for it. Adrian, thank you very much for your time today.

Briscoe: OK, thank you.