Why BCC is important when you migrate to Office 365
Why do people use BCC in work-related emails?
- To raise an issue concerning a co-worker?
- To lodge a confidential record of an email exchange with a third-party?
It’s secretive and deceptive and it follows that the nature of the email will be more ‘shady’ or confidential than an openly CC’d email. It also follows that the person being BCC’d is just as important, if not more so, than those that are CC’d.
Good news: The default Exchange journal setting creates what is called an ‘envelope’ journal to ensure your email records are complete. The envelope includes a record of the TO: and CC: fields as well as any BCC’d recipients and all the individuals included in distribution lists (DL) at the point in time the email was received.
Bad news: In the process of migrating to Office 365, you could be stripping out BCC and DL information from your email records.
Having helped with the News International eDiscovery process, we know the importance of maintaining complete email records and maintaining due diligence when handling email archives in particular. https://www.theguardian.com/media/2011/jul/08/phone-hacking-emails-news-international
What’s the problem?
The key ‘gotcha’ is that Office 365 does not have a journal service - at all.
Until recently if you wanted to move to Office 365 and maintain a conventional envelope journal you’d have had to subscribe to a third-party service from an organisation like Mimecast, or keep an Exchange journal running back on-premises.
But in the last few years Microsoft has been filling a few holes. Office 365 can now effectively replace the role of the envelope journal and provide a one-stop-shop for compliant and complete email records retention. This is how it works:
- Instead of using a large, centralised, single-instanced mailbox that is inherently difficult to scale and failover, Microsoft uses its optimised multi-instance storage model. This allows each user to retain his/her copy (journal) of all emails sent/received with zero performance penalty and no single point of failure.
- By putting all relevant mailboxes on Litigation or In-Place Hold, all emails sent and received are retained indefinitely.
- Deleted emails are removed from the user’s view, but held into a special hidden folder inside the Recoverable Items Folder (RIF), where they are available to the eDiscovery process.
- Any BCC’d recipients will be retained indefinitely in the senders’ mailboxes.
- The members of any distribution lists (DLs) are expanded at the point of sending and stored in hidden headers in senders’ emails so they are fully discoverable.
- Inactive mailboxes (i.e. those belonging to leavers) can be put on Indefinite Hold and made available for eDiscovery, without a license penalty.
So assuming you’re not going to dump over 10 years’ worth of email records when you move, all you’ve got to do it map what’s in your existing journals and any journal archives (which are commonplace given the size to which journals can grow) into the new model.
You’ve actually got a few options for doing this, ranging from quick and potentially dirty to slower and comprehensive?