To illustrate, we would challenge you to an experiment. Assuming your email policies allow this, we dare you to simply delete all the email in your inbox that is older than three days and see if it causes you much grief. All of it.

Then wait for 10 days and see how much of it was really important.

Lest you think us extreme, we think you will be surprised with how much of the “work” represented by those emails simply “goes away.” After all, much of what is in your inbox represents other people’s priorities, which are usually not the same as yours.

We are hearing of more and more people who have added a regular declaration of email bankruptcy to their strategies in trying to cope with information overload.

Taming your inbox is hard, but it’s a necessary step if you are to increase your productivity and sanity.

… David Sengupta

This argument does seem to apply to a lot of electronically stored information. However, sometimes it doesn’t. For example, sometimes it just takes too much time to run the search engine and fiddle with search criteria until you find what you want. Sometimes folders and categorization/tagging just feel like a far better solution.

One common approach is to automatically categorize email. However, this is often rather inaccurate.

Recommind’s Decisiv Email is a useful tool that helps categorize email. Foldering is done manually, but is machine-assisted:

• It suggests suitable places you can file email, based on TO, FROM, CC, Subject, Content, and your past filing preferences.
• It displays a ranking/confidence level for each suggestion.
• Multiple categories/folders are possible, but only a copy of the original is kept.
• You can see what’s been filed, and what hasn’t been.
• Users can easily browse the various folders.
• Users can define their folder structure.
• Emails are filed into Recommind’s own repository, facilitating search and sharing.
• Access controls apply to messages, so privacy is maintained.
• It works via an Outlook plugin.

When manual categorization is required, machine assistance is clearly the way to go.

… David Ferris

EEMA is outsourcing its operations, which is working well. This change has restored its finances to a sound footing. There are regular meetings around Europe and special interest groups.

There was an attendance of almost 200, and a good selection of worthwhile talks. Corporate membership is low cost, and worth considering for organizations and individuals interested in Electronic Identity.

… Steve Kille

• You can’t explain the algorithm, because the search vendor doesn’t reveal its proprietary secrets.
• Even if the vendor were to explain its algorithms, chances are a cocktail of approaches are used with varying weightings assigned to different filter criteria. Explanations of such algorithms are of questionable value.

Long term, this will be a less pressing issue. Search engines aren’t perfect. They often list material that’s irrelevant, and they often miss material that is relevant. There’s a trade-off: The less information that’s overlooked, the more irrelevant material you’ll have to sift through.

However, human beings have similar problems. They are subject to not understanding, or having slept poorly the night before and thus doing a slipshod job.

As time goes by, courts will get more and more comfortable with the fact that search technology isn’t perfect--in just the same way as they recognize that humans can make errors.

… David Ferris

One of the enjoyable parts of the trip has been observing Japanese customs. In particular, I have found their use of cell phones to be quite interesting.

For example, everyone has a cell phone. I saw all men, women, and children using portable cell phones. I saw everyone sending and receiving text messages, checking train schedules, reading news, and playing games. But I didn’t see many people taking phone calls and I’ve heard no phones ring at all — amazing considering the thousands of people I passed daily in the train stations. And finally, I did not observe any BlackBerries or similar phones with full QWERTY keyboards.

My Japanese host explained to me that the Japanese are very polite and consider it very rude for phones to ring in public places. That sounds reasonable to me and this is something Westerners should consider. He then explained that phones with a Western-style QWERTY keyboard are not popular in Japan. Users prefer simple menus and scroll buttons, better suited to Japanese character sets.

I’m reminded of Bill Murray’s line in the movie that went something like: “I am not sure if I am having fun, but it is very different here.” Japan is certainly very different, but these differences are fun to observe.

… Bob Spurzem

Summarizing the technology:

• Provides:
  • Virus and malware control.
  • Spam control.
  • Phishing and spyware control.
  • Surf control/URL filtering.
  • Malicious Web site protection.
  • Data leak prevention and compliance control via user-defined policies.
• These control technologies work over email and http.
• They are embodied in appliances that come in various names and form factors.
• Competitors include Cisco/IronPort, Proofpoint, and Barracuda.
• McAfee feels its major strengths include:
  • Best-of-breed functionality in individual control areas; e.g., spam control.
  • Well-integrated Web and email support.
  • Inexpensive pricing. Flat pricing per box; no per-user fees.

… David Ferris

• Sits at the Internet boundary.
• Opens incoming encrypted email, checks that it conforms to policy, and sends on to the user (if necessary re-encrypting).
• Encrypts outgoing email based on policy, and sends on to recipient.
• Uses public key cryptography.
• Works with third-party email gateways that can detect encrypted email and route based on policy, such as Clearswift and Tumbleweed.
• Aimed at organizations that want to have policy-controlled encrypted email within a community.
• Main competitors include Tumbleweed and Cisco/IronPort/PostX.
• Marshal sees its main strengths as turning around automated certificate management; for example, automatic warnings to admins when a certificate is due to expire, automatic processing of certificate revocation lists, and automatic harvesting of certificates of inbound email.
• Sample pricing: for 100 users, around $11/seat per license for existing Marshal customers plus maintenance; if not a customer around $22/seat per license plus maintenance.

More details on the PKI side:

• For outgoing mail, recipient certificate is picked up from local or remote repository.
• For incoming mail, decryption is normally done via receiving organization’s organization-wide private key; it can also be done by the recipient’s own private key if this applies.
• Typically most users have an organization-wide private key, and a few users have their own private key (e.g., execs dealing with sensitive financial information).

… David Ferris

It recently launched LiveOffice Mail Archive, a hosted email archiving offering. In summary:

• Provides archiving, e-discovery, and compliance services.
• Aimed at small to medium-sized firms concerned about compliance; e.g., education, local government, law firms, construction firms.
• Works with Exchange.
• Pure hosted solution, no on-premises appliance, works through Exchange journaling.
• User access via a Web browser.
• List pricing is $5 to $8/user/month, regardless of how much email and how long kept. Volume discounts apply.
• Main competition among hosted options are probably Google/Postini, Microsoft/Frontbridge, Fortiva, and MessageOne.
• LiveOffice thinks its competitive strengths compared with other hosted archiving solutions include:
  • Pure hosted offering, nothing on-site.
  • User interface designed to be very attractive to the midmarket.
  • Strong search.
  • Automated searches that check for policy compliance conflicts.

… David Ferris

This isn’t right. IT can’t do a good job with this alone. Teamwork is needed among IT and user departments in order to determine what the policies should be.

This is easier said than done. Many user departments are evasive, and seek to avoid responsibility. But they must get involved, as they are more sensitive to the issues than IT.

Once policy has been defined, IT can be responsible for implementing technology that enforces policy.

… David Ferris

We are very interested in hearing from you on the following questions. Send your responses to david.sengupta@ferris.com (if you wish to remain anonymous) or leave a comment at the foot of this post:

1. Do constant interruptions at work (email, IM, phone, etc.) cause you to feel ADD-like symptoms, often referred to as Attention Deficit Trait (ADT)?
2. Do people in your company constantly read email during meetings?
3. Do your colleagues constantly read their BlackBerries or Windows Mobile devices?
4. How much time (hours) do you spend reading email every day?
5. What percentage of time spent on email is “wasted” that you could have been productive?
6. Does reading work email at home cause stress on your family/personal life?
7. If someone emails you a question during working hours, how many hours can go by before you are expected to respond?
8. Compared to 12 months ago, do you work more hours triaging email or less? How many more/less hours per week?
9. If you carry a mobile email device, could you turn it off and leave it on your desk at work without looking at it for 24 hours?
10. What strategies do you use to cope with “information overload”?

Stay tuned. And join in the discussion. We will expand on various “coping strategies” and will challenge you to take some “challenges” with us.

Challenge #1: If you carry a BlackBerry or Windows Mobile device, turn it off (yes, now), put it down on your desk but within sight of where you sit during the daytime, and spend the rest of your workday without touching the device. (Betcha can’t.)

Once you’ve tried this, feel free to leave a comment with your experiences.

… David Sengupta

Say they charge $15/month for support. RIM charges the service provider $3-$5/month for the use of a BES Server. This means the end user gets charged around an extra $10/month for mobile support. That’s expensive.

MailSite has a solution. The email vendor recently announced ActiveSync software for the BlackBerry. This is code that’s downloaded to the device. It then allows the BlackBerry to speak directly to Exchange, without any interim BES server. Hosted Exchange providers should investigate; it can help them cut a lot of cost and complexity.

… David Ferris

At first sight, these numbers sound large, but remember that this is over an entire year and that there are some 200 million active SMS users in the nation. In other words, the problem is negligible, and nothing like the size of the email spam problem. The typical user receives “a few” SMS spam messages per year. Obviously some unlucky people receive considerably more, but many receive none at all. Compare the 2007 estimate with CTIA’s 2007 numbers for legitimate U.S. text messaging: Spam is about one-third of 1% (0.3%) of the total messages received.

Mobile service providers such as Sprint and AT&T Wireless are highly motivated to keep it this way, for obvious customer satisfaction reasons. The good news is that cell phone networks aren’t completely “open” like email is, so it’s much more difficult for a sender to anonymously send spam. (Note that we’re being careful to estimate the number of spammy messages received--this is the figure after the carriers have thwarted other attempts to spam. We can’t accurately estimate how many unsuccessful attempts there are, but it’s a substantial number--probably at least another 1.5 billion in the United States.)

Very few of these spam messages are sent from a real handset in the conventional way. Mainly they are injected via an SMSC (Short Message Service Center) or email/Web gateway, possibly from overseas.

For the most part, the cost to a consumer of receiving a spammy SMS message is only theoretical. Many U.S. users pay a monthly charge, which entitles them to send or receive a “bucket” of messages. Even for those who pay per individual message, the average number of messages per consumer is small--one or two a week. (The North American mobile market is unusual in this respect. The vast majority of countries’ wireless providers do not charge for receiving messages or calls. For example, consumers in the U.K., France, and Germany can receive as many text messages as they like, without charge and without fear of exceeding a monthly allowance.)

… Richi Jennings

However, many policies turn out to need a lot of thought in order to define them, so that:

• You catch most of the stuff you want to (i.e., high catch rate).
• You don’t catch a lot of the stuff you shouldn’t be catching (i.e., few false positives).

With today’s technology, most user organizations want help in defining their DLP policies. It doesn’t matter if you’re a very big organization, with loads of well-paid and expensive people. The focused experience of the vendor concerned usually comes in handy.

In short: It’s a good idea to anticipate getting your DLP vendor’s help with policy definition, and check that the vendor is set up to give you the support you’ll need.

… David Ferris

MailShadow for GoogleApps lets you use Outlook as a front end to Gmail. As the software develops, Cemaphore plans to provide a very high level of compatibility with full-blown Exchange. To do this, it will need to offer, among other things, full free/busy time and GAL support. The product is currently available in Beta 2.

… David Ferris

This may be alright for simple policies. But, in general, users need more specific information about what’s gone wrong, because many different circumstances can cause a filter to be triggered. For example, they may need to be told that the problem is that they’re trying to send out personal financial information, or that balance sheet information cannot be sent to such-and-such external email address.

The ability of DLP products to explain themselves in this way is crude today. Five years hence, it will have to be much better. Vendors will invest substantial efforts to allow their products to be more self-explanatory.

Note: It’s also true that sometimes you don’t want to give users the full reasons they got caught. So you don’t make it easy for the bad guys to subvert the system.

… David Ferris

What the author provides is awareness of the problem, leaving us to learn how to increase focus and reconnect with the people and world around us. Five of Amazon.com’s customers gave the book 5-star reviews.

Now if you can excuse me, I have to get back to my email.

… Bob Spurzem

• Getting contracts signed is a big pain. You email documents, the recipients have to print them, maybe they don’t have a printer handy, then they sign the document, post it back, or they scan it and email it back, and things get lost sometimes, etc. It all takes elapsed time and there’s the cost of the people doing the shuffling.
• RPost’s system lets the sales rep email the contract, which is then digitally signed by the recipient in a one-click sign-off process that does not require the recipient to visit any Web sites or install any software. Normally this is done during the sales rep/customer conversation; if not, it’s done within say 5 or 10 minutes of the end of the conversation.
• The system provides verifiable evidence of the signing, including content associated with the e-signature.
• The sender simply needs the RPost plug-in for Outlook, Lotus, or to set his/her mailer configuration. The recipient needs nothing--and can even sign off by email received in a BlackBerry or Pocket PC.

Cox Business uses RPost. It handles about 10,000 contracts per month. Use of RPost for e-signature/e-contracting takes days off the sales cycle, allowing faster revenue accruals, plus saving on the cost of staff time handling the contract sign-off process.

… David Ferris

These tests are not a good indication of how well a product will do in practice, because many policies will end up having to be far more complex.

Here’s our suggestion:

• Ask a variety of vendors what they think your top five most important DLP policies will be. At this point, you’re just looking for explanation in ordinary language. For example, “Anything to do with our upcoming IPO can only be viewed by such-and-such people,” or “Communications with the media can only be sent from such-and-such departments.”
• Draw up a list of the various policy proposals and put them in order of what you think are the most important.
• Take the 10 most important and implement them.
• Run a day’s or a week’s worth of material against the policies, such as from an email or instant messaging archive, or from a fileshare. Check that you’re catching as much offending material as possible, while getting as few false positives as possible.

… David Ferris

On July 7 8, Microsoft formally announced its new Online hosted services. These are “in the cloud”, or software-as-a-service (SaaS) implementations of Exchange and SharePoint (not to be confused with Exchange Hosted Services, which is the hosted email security service formerly from Frontbridge).

The key new piece of information announced was the prices. As David predicted a typical small or medium business would pay $20 per user per month for the combination of Exchange, OCS, LiveMeeting, and SharePoint Online. However, Microsoft announced the price would actually be $15.

$15 is too expensive. Here’s two reasons why:

First, compare that price with Google Apps at $50/year ($4.17/month). At one fifth third the price, the combination of white-label Gmail, Google Calendar, Google Sites, and Google Talk may not provide 100% feature equivalence — but in most cases it will be more than good enough. Don’t forget that Google offers 25GB of email storage at that price, versus Microsoft’s 1GB, which is paltry by comparison. Some organizations may even find the free version of Google Apps is sufficient for their needs, assuming they can live with the lack of a service-level agreement.

Second, Microsoft doesn’t seem to have learned from the mistakes of others. Over the past ten years, we’ve seen vendor after vendor try to offer hosted Exchange — many of them backed by substantial Microsoft resources — but few have survived. Again, the problem is one of cost. Although the vendors would make a coherent, well-argued case that an organization should migrate to its hosted service, few IT managers believed it would save them money.

These vendors would tell potential purchasers that they could provide the service for less money than it was currently costing to run it in-house, but when it came time to actually quote for the service, most IT managers simply didn’t believe it cost them that much.

For fans of Economics 101, the hosted providers were charging more than the market would bear. Looks like Microsoft is making the same mistake. It’s a pity: Exchange 2007 is much more suited to offering the required economies of scale than previous versions.

… Richi Jennings

Microsoft first announced this more than a year ago, and has been offering it in beta form for several months.

The services run in Microsoft’s own datacenters, on shared hardware — or dedicated hardware for larger customers.

We’ve seen a demo of the tools to migrate users from an in-house Exchange network to the service. It looks comprehensive. The most useful aspect is that a customer can choose a subset of their users to move to the service, retaining other users on the in-house system.

Naturally, the service allows customers to synchronize their Active Directory (AD) forest between their in-house AD servers and the ones in the cloud.

Of course, this puts Microsoft into direct competition with their partners who are already offering hosted Exchange/Sharepoint — often using market development funds from Microsoft itself. However, this does at least validate the market. Microsoft will also allow partners to resell the Online services, with some attractive affiliate kickbacks.

… Richi Jennings