For the Record

In Ancient Greece, they hanged people caught destroying antiquities thought

to be records. Modern state and local governments, not quite so extreme,

protect public records with laws. Today, those paper-based laws are fast

becoming antiques themselves.

Existing laws stipulate that government agencies must maintain files

for all documents regarding government policies or actions. Meeting minutes,

reports, policy memos as well as a wide array of photographs, books and

other material generally qualify as part of the public record and must be

archived or destroyed according to strict guidelines.

Managing those records has become second nature for most government

agencies, but not so when it comes to the computer. Government employees

now routinely exchange e-mail as they develop policies or plan new projects.

When, if ever, should an e-mail message be treated as part of the public

record? What about electronic databases or notices posted on a government

World Wide Web site?

With the volume of digital information increasing each day, government

archivists are scrambling to draft policies that answer those questions

before critical segments of the public record are irretrievably lost.

"Electronic records management is the biggest problem faced by government

archivists and records managers today," said Bruce Dearstyne, associate

professor at the College of Library and Information Services at the University

of Maryland. "It used to be a record was something fixed, tangible. Electronic

information tends to be constantly changing and volatile. The traditional

consensus and definition of records don't apply."

Preserving digital records seems simple: Use the storage capabilities

intrinsic in information technology. But for records managers working in

a new environment where a record can be created and deleted with a single

keystroke, electronic records management is not about the technology, it's

about the people.

"In government, there are lots of people who believe the term "personal

computer' means the information on their computer is theirs personally,"

said Gerry Handfield, state archivist and director of the Indiana Commission

on Public Records. "There are people in the technology world who believe

that e-mail is not a record. People in the policy world believe e-mail is

a record that needs to be managed."

Most local government agencies are looking to state policymakers for guidance

in electronic records management — particularly in Delaware and New York.

Both states are encouraging their agencies to incorporate electronic recordkeeping

requirements into new system development and purchases.

New York archivists are working closely with the state's Office for

Technology to integrate records management policy into their requirements

for new systems purchases. Alan Kowlowitz, manager of electronic records

services with New York's Archives and Records Administration, said this

type of partnership is key to ensuring that state technology staffers consider

records issues.

"We need to present our issues in a language that is understood by the

technologists and the people who run government programs," Kowlowitz said.

"It becomes extremely difficult to implement records management requirements

once systems are developed. Records issues are part of the general mix of

business issues that need to be considered when systems are implemented."

Delaware officials used a 1992 University of Pittsburgh study detailing

functional system requirements for maintaining evidence in electronic recordkeeping

systems to guide their policy work, said Timothy Slavin, strategic consultant

with the state's Office of Information Services.

As a result, the state in 1998 issued a "best practices" list for agencies

to consider when implementing new systems. The guidelines require that systems

create records for all business transactions that fall under an agency's

records management policy. In addition, it must be possible to export

records to other systems without changing the data.

"A lot of systems come up live and are thought to be a paperless process,"

Slavin said. "The trail of paper still follows it. Some declaration has

to take place that says, "The official copy is the electronic copy in the

system.'"

The state is launching a project to show how data on existing systems

can be rescued and stored as records.

Protecting the Legacy

Most states are developing policy to preserve records stored on legacy

systems and those generated via e-mail.

Mississippi has developed a concept called "conditional scheduling"

for databases, said Patricia Galloway, project manager of the electronic

records initiative for the Mississippi Department of Archives and History.

Officials negotiate conditional schedules with agencies detailing what

information will be retained, why it will be retained, how it will be preserved

and when it will be preserved, she said. The schedules specify retention

periods and how an agency will handle database migration.

"It will be there to be renegotiated at any time the agency wants to

do it a different way," Galloway said. "We're trying to work out a way in

which stuff can be handed over to us but still can be under the control

of the agency if they want it to be. Everybody says [databases are] so big

and so visible that nothing is going to happen to them. Yeah, right."

Washington uses its paper-based records legislation for electronic records,

said Phil Coombs, the state's archivist. But several groups within the state

are working together to update that law to encompass electronic records

management.

Officials are considering requiring state agencies to commit to a migration

plan for all electronic records that will need to be kept for more than

six years. That requirement would encompass 20 percent of all electronic

records generated by the state. The other 80 percent of data generated is

not considered to have archivable value and can be destroyed after six years.

A migration plan can be a commitment by agency management or a contract

with a vendor to provide migration services for the systems storing the

records so that they always can be retrieved.

You've Got Mail

Because it has become so ubiquitous to agency communications, the management

of e-mail that may contain record information is being folded into many

state government records policy.

Spurred by recent records requests from the media for access to e-mail,

Oregon has focused its electronic records management on it, said Roy Turnbaugh,

the state archivist. Under Oregon public records laws, the global backup

of e-mail and whatever e-mail is being managed are both considered public

records.

"Because the e-mail has not been managed, the agency has had no alternative

other than turning over everything — the whole global e-mail file," Turnbaugh

said. "Electronic records should be managed on their content rather than

their physical form."

Electronic records fall into the state's general records retention policy

or, if they're unique to an agency, they fall under special schedules, he

said. The state has released general guidelines outlining how existing laws

apply to e-mail, but agencies are free to develop their own methods to

manage e-mail records.

"They need to put into place a procedure and make sure that everybody

in the agency is familiar with the procedure," Turnbaugh said. "It's had

mixed success. Agencies tend to be a little bit unclear of who really has

the authority in this area. We have to go out there and do some evangelizing."

E-mail guidelines can take a variety of forms:

* Wisconsin is allowing individual state agencies to choose what method

they use to retain e-mail based upon their own business needs, said Amy

Moran, IT consultant with the state's Division of Technology Management.

While one agency is saving all e-mail in a database, others are storing

only selected e-mail messages within a backup system, she said.

"We consider the information the record, regardless of the format,"

Moran said. "In our e-mail policy, we give some general guidance as to what

is or is not a record."

* Mississippi's draft electronic records management guidelines stipulate

that agencies adopt one standard schedule and one standard method to archive

e-mail, Galloway said. The guidelines suggest agencies develop a filter

to avoid flooding the system. The state archive plans to store all e-mail

from each agency together regardless of the schedule and apart from other

records.

* Washington state officials are promoting the use of electronic folder

systems to store and manage e-mail messages that may be records because

e-folders most closely resemble the file cabinet of the paper-based world,

Coombs said. "If it was good enough to keep, it's good enough to put in

a folder," he said. "[But] if the folders contain legal information along

with "while you were out' notes, it's problematic."

* New York's e-mail guidelines advise agencies to set up electronic filing

systems to capture e-mail because the e-mail applications were designed

for communication not storage, Kowlowitz said. The guidelines suggest agencies

use version control measures to ensure the records are authentic and name

documents to make them easy to find. This filing system can be designed

with controls to prevent unnecessary duplication and to permit regular removal

of obsolete records.

* Indiana is experimenting with having employees assign a priority for

e-mail messages so those that need to be saved can be identified. "The problem

is that you and I can determine the priority on it and whether or not it

gets saved," Handfield said. "If you save everything, than you've got chaos.

Just the act of deciding that it's important e-mail is very time-consuming."

Agencies are also looking at authentication. Indiana officials have

warned agencies that they should assume that any electronic records they

create may be scrutinized before they are accepted as authentic, Handfield

said.

Because electronic data can so easily be altered, these guidelines suggest

agencies build hierarchies of access and rights, — such as read-only and

write-only — into a system and use passwords, firewalls and encryption to

secure the stored records. In addition, agencies are encouraged to create

audit trails with automatic date and time stamping and to maintain logs

identifying who had access to what records and when.

Enforcement Issues

Most state archive agencies have not traditionally had enforcement authority

over public records issues. In the paper-based world, they really didn't

need it because agencies benefited from requirements to sort the massive

amount of paper they generated, identify what was important and ship those

records off to the archiving agency for storage.

In the digital world, however, recordkeeping often means more work.

So states are looking for ways to enforce their policies.

Mississippi officials may soon propose legislation to enforce electronic

records management guidelines. They also are considering having the state

auditor's office do performance audits and plan to work with the state's

central IT agency to monitor compliance for databases.

New York uses guidelines for its records management grants program to

spread its policy to local governments, Kowlowitz said. Each year, the state

awards $7 million to local governments for records management improvement

efforts. In addition, New York has set up field offices in every region

of the state to provide records management advisory services to local governments.

— Heather Harreld is a free-lance writer based in Cary, N.C.