Journaling by any Other Name

Posted by Bill Tolson • March 13, 2017

The Journaling function in “on premise” Microsoft Exchange email systems was originally developed back in the late 1990s for financial services organizations to meet SEC requirements.  The main requirement consisted of capturing broker/dealer communications (emails) immediately, ensuring those emails could not have been altered or deleted before they were stored on immutable storage (WORM) per SEC 17 a-3 and a- 4 requirements. The SEC wanted to ensure that broker/dealer communications were available to review in an unaltered state if complaints were later filed against the financial services organization or individual broker/dealers. In fact, other companies adopted journaling for various reasons, mostly when under litigation hold to ensure target custodian email was captured and held thereby avoiding spoliation charges.  However, the financial services industry was the only industry to really require it via government regulation.

The Cloud Changes Things (Sort Of)

With the migration of financial services email systems to the cloud, journaling per say is going away. However, the need to lock down broker/dealer communications immediately on immutable storage that no one from the financial services company (including company IT administrators) has access to remains; otherwise, it is not considered immutable.  

Machine Learning and Journaling

Some have held out the potential of evolving machine learning capabilities to help companies tackle the problem of automating the decisions around compliance retention/disposition i.e. what data should be kept and for how long. By the way, I agree!

I was at Recommind when Craig Carpenter and team (and yes, in this case, I was the “I” in team) were working toward establishing Predictive Coding in the legal market as a revolutionary technology to drastically reduce the cost of legal document review using supervised machine learning. It is still not universally accepted in all courts but has made huge advances over the years.  While at Recommind I wrote extensively about using machine learning techniques for predictive information governance and categorization. On a (somewhat bitter) side note, after I (and Craig Carpenter) left, Recommind removed my name from all Blogs and other papers I had authored on the subject… somewhat petty… but I digress.

Microsoft purchased Equivio, also a leader in machine learning software a little later. Microsoft’s purchase of Equivio provided them with extensive machine learning capability for both their eDiscovery and information governance platforms. In fact, Microsoft has written about their advanced data governance plans in a blog titled “Applying intelligence to security and compliance in Office 365.” and we look forward to these new IG capabilities.

However, machine learning and advanced information governance will not really address the journaling/SEC requirement that I started out describing. In reality, the SEC is even slower to adopt new technology than the U.S legal system has been. The requirement to capture all broker/dealer communications immediately in an unaltered fashion and store it on immutable storage will not be helped by machine learning anytime in the near future only because the regulations are very prescriptive and not open for interpretation by machine or human.