Episode #5: Archiving Microsoft Teams

Transcript:

Bill Tolson:

Greetings everyone, and welcome to The Information Management 360 Podcast from Archive360. This is episode number five, titled Archiving Microsoft Teams. With me today is Mike Osterman. Mike is president of the Osterman Research. And my name is Bill Tolson, and I am the VP of compliance and eDiscovery at Archive360. So, Mike, Osterman Research has created a new white paper titled Considerations for Archiving Microsoft Teams Content. Can you give us a kind of a brief synopsis or description of the paper?

Mike Osterman:

Sure. And thank you for having me here today. What we wanted to do in this paper is really understand archiving in the context of Teams. We've done a lot of research around archiving over the years, and we wanted to focus specifically on Microsoft Teams archiving to understand how organizations are archiving their content if they're archiving their content, and so forth. And really to understand all of the ramifications of that in the context of everything else that they archive.

Bill Tolson:

Yeah, now that's a great description. And the main thing we want to point out here... A couple of things. Number one, Microsoft Teams has been wildly adopted since a March time frame with the COVID pandemic. And I have found, and I think Mike, you may have found as well, lots of companies jumping on board for the collaboration capabilities of Teams quickly. And what we want to do and what you did in a white paper, what I want to do here is just to make sure people are aware of those areas that they need to pay more attention to, especially around regulatory compliance and eDiscovery requirements. But it's again, or I think the last I read since the March timeframe, Microsoft has signed up like 115 million new Teams accounts. So it's obviously snowballing, and again, it's a great product. We use it every day here at Archive360, and with that disclaimer, let's get right into it, Mike.

Bill Tolson:

So like all of your great research white papers, Mike, you base the content of the paper on a custom survey that your company puts together for users across many, many industries and many personas. Can you give us a rundown on the actual survey itself, what it includes, and the numbers, and those kinds of things?

Mike Osterman:

Yes, absolutely. Well, basically, we did a survey of organizations that were using Teams in a production environment. There are a lot that are evaluating Teams that have it in pilot and so forth. But we wanted to talk to the organizations that really were using this on a day-to-day basis. So what we found is, well, first of all, we surveyed organizations that were relatively large. The mean number of employees was a little over 10,000. So we were talking mainly to mid-sized and large organizations. And this is primarily in North America. And what we found is that a lot of their users are using Teams. About 60% of users at the time of the survey were using Teams. Even if it's in production in a company, it's not necessarily used by everybody all at once, but 60% today growing to about 76% within the next year. And the vast majority of organizations that we surveyed are archiving email, as you'd expect, as most of larger organizations do, but they don't archive a lot else.

Mike Osterman:

And a lot of them really are not archiving Teams content. We found that only 31% of the organizations we surveyed today are actually archiving Teams. So obviously, a lot of greenfield opportunity among organizations in terms of what they need to extract out Teams and archive, largely because it's now used by most users as a production system. And that use is growing. And among those that are archiving Teams, most are archiving texts content, chats, and files, but then it really falls off from there. So a lot of the other content, a lot of the content that contains business records, really is not being archived today.

Mike Osterman:

And what we found is that organizations that are using Teams are also using a lot of other collaboration platforms, things like Zoom, Webex, Skype for Business, Slack, and so forth. And part of what we're finding is that things are very much in a state of flux. Largely because of the pandemic, with everybody suddenly having to work from home, lots of different tools went into use. And I think part of the reason that so many organizations today are not archiving Teams content is because IT is still trying to catch up with what users had to do right away. A lot of organizations had to scramble to implement security and lots of the basics for enabling people to work from home. And they're really just playing catch up right now in the context of archiving.

Bill Tolson:

Yeah, this is a key piece that we want to make sure everybody understands. And you said something really in my mind, key there Mike, and that's a lot of people, a lot of companies have adopted this, but they haven't quite figured out, should I be archiving it? And how should I and why? And again, I mentioned both regulatory compliance and eDiscovery. If you're in the Finserv, financial services industry, you probably know better than most that, yeah, any communications between brokers and traders, the clients, or to other analysts within the company is absolutely required. And the SEC 17 in FINRA haven't gotten down into the depths of the kinds of data that Teams generates yet. So I think a lot of people are wondering what's it I actually need to capture to, at least for those Finserv regulations, what do I need to capture to remain compliant?

Bill Tolson:

And we'll get into this a little bit further down the line, but Teams generates a lot of different types of data and data objects, and it's not just a chat. It can be as mundane or as kind of far down in the stack as emojis or sentiments or uploaded files, or if somebody is recording a video. There are many, many data types within Teams. And depending on your requirements, whether it be clients for SEC FINRA or if it's for eDiscovery, just capturing a chat is not necessarily making you compliant. So these are the things that we'll point out here. And with that said, Mike, can you give us an idea of... For this paper, what the key takeaways were that you talk about addressing in the paper?

Mike Osterman:

Yeah. Well, as you noted earlier, I mean, there was really rapid adoption of Teams. And as we pointed out in the white paper, if you look at the early days of the pandemic, we went from 32 million Teams users in early March to 75 million by the end of April. So it's not only an issue of just the rapid adoption of a new tool, but it's now understanding this new paradigm where things were done in email before maybe they're now done in Teams. And so business records are being stored there they're being generated and stored and not necessarily being archived really because of just the rapid expansion we saw in a very short period of time. And also the mandate for a high-quality archiving of data in Teams really comes from three directions, compliance regulations, things like GDPR, the FINRA standards that you mentioned or FINRA requirements that you mentioned, SEC, and so forth.

Mike Osterman:

And there are a lot of these standards across a number of different industries. There's also internal monitoring standards. And then there's also legal process readiness being able to satisfy eDiscovery requirements, being able to do early case assessments, and so forth. And fundamentally, what we found is that Microsoft's approach to archiving and compliance in Teams is to offer native capabilities within 365. They're going to be appropriate for some business requirements. Microsoft has taken great pains to implement an archiving capability that will satisfy a number of different requirements. But when you get into some of the more strict regulatory requirements, as you noted with the financial services industry in the insurance industry, energy, life sciences, healthcare, and so forth, organizations really should evaluate the value of third party archiving and retention solutions, because you're probably not going to find what you need in the native archiving within Teams.

Bill Tolson:

Yeah, that's real kind of crux of a lot of the discussion. And one thing that was just occurring to me, you mentioned FINRA supervision. And for those of you in Finserv, most probably the only industry that really would center in on this. But the idea that brokers and traders have to have all of their communications supervised, and we won't get into the specifics of that right now, but when Finserv organizations are looking at adopting Teams, for example, a big question that should come up and probably does in most Finserv organizations is how do we run our supervision capabilities against a Teams meeting for example. I won't get into that in-depth right now, but that's a really important question too. But even outside of Finserv, obviously with 75 million organizations adopting it in a very short period of time, has continued to grow.

Bill Tolson:

Companies need to be very aware of the intricacies of Teams, and Teams archiving. One of the things I've mentioned in articles and blogs is, the architecture design behind Teams makes it more complex to actually capture and archive all of those different data types and data objects within a single Teams meeting, for example. So that's one of the crux of Mike's white paper and my blogs in the past as well is what are those data objects? And should you be capturing them? And again, I stress, especially for on eDiscovery side, anything is discoverable. So an opposing counsel in an early meeting confirming, can ask you what kinds of social media or collaboration applications do you employ, and what data do you capture? And if you do not list all of the different aspects of a team meeting that you should have recorded, they're going to center in on that very, very quickly, and that might get a company facing eDiscovery into some really deep problems very, very quickly.

Bill Tolson:

So Mike, another kind of hot point for me, not just with Teams, but with many companies, but Microsoft especially, and you point this out in the white papers, well, you specifically point out an important difference in how Microsoft uses the term archiving as opposed to how most compliance officers use it. And specifically talking about the interchangeable use of archiving and backup. Could you explain the difference?

Mike Osterman:

Sure, absolutely. Microsoft offers archiving for Teams workspaces, but when it talks about archiving capability, it's really talking about workspace management rather than compliance. And that puts Microsoft a bit at odds with what a lot of compliance managers are considering. Microsoft, for example, will use the term archiving really to refer to closing the Teams workspace that's at the end of its life, such as maybe when a project ends. So archiving a team's workspace will lock it from further activity. It prevents updates by members who are not owners. So it actually protects that content, it archives it in a sense, and the workspace can be permanently deleted by a workspace owner or by a 365 admin if they have the correct rights for managing Teams.

Bill Tolson:

We thought obviously it doesn't work for SEC rule 17, right? Because all communication must be stored in an immutable format. So it should not be able to be deleted.

Mike Osterman:

Oh, absolutely. Yeah. And yeah, particularly in the financial services space, but also, just if you're looking at legal requirements, there may be advice from legal counsel to retain everything for three years or five years, whatever the case may be. What Microsoft is doing is actually helpful. But in certain industries, like you've noted, it really could create a risk of noncompliance and an eDiscovery spoliation. What we recommend is a more holistic view of archiving, which is really the view held by compliance officers. And that includes securing against date of deletion, ensuring that the stuff cannot be deleted, modification, preventing inappropriate access, and so forth. And then enforcing timeframes, basically retention timeframes for how long this stuff has to be kept around.

Mike Osterman:

And this often has involved moving data to a storage location that's maybe separate from where it was created or sent or capturing a copy of each original data element in a very tightly controlled storage location, just to prevent that content from being deleted. And we've done a lot of work around retention regulations, and these are all over the map. I mean, it can be a year for some industries or certain types of data. It can be three years, five years, seven years, it can be indefinitely. And so, if you're really going to be talking about true compliance, you have to ensure that whatever you're archiving in Teams is going to be kept for the appropriate length of time and prevented from modification or deletion.

Bill Tolson:

Well, and that's a great point. The way Microsoft uses the term archiving does not necessarily imply regulatory compliance archiving capabilities. I mean, at the very top level archiving is basically saving the actual Teams meeting or chat room has to be for some predetermined period of time. And a lot of that is up to the individual organizations to determine where those retention policies need to be placed that meet those specific regulatory requirements. And again, one of the difficulties of Teams archiving is that the various data objects are stored in many, many different data repositories. So it's not like you can add them and go directly to Teams and say archive everything per SEC 17. You have to go to various different, within Microsoft 365, various different repositories and individually apply those retention policies. That obviously is manual. And I know that will cause some companies both on the eDiscovery side as well on the regulatory compliance side, some issues.

Bill Tolson:

So Microsoft does have a lot of data out there talking about and actually explaining in-depth Teams archiving. But I think one of the purposes, Mike, of your white paper, as well as the stuff I've written about, is know specifically what you're archiving for and then make sure that those information management data retention policies are set accordingly. And again, I'll keep going back to as well as eDiscovery. Your GC gets a notice, or they anticipate upcoming litigation, the [dirties bursar 00:15:38] starts right then. So do they have to call up the IT organization saying, "Okay, here's all the details of eDiscovery requests coming in. This is all the stuff that we need to start capturing." Because once eDiscovery starts, and you're looking at a case assessment placing litigation holds. If it's a going forward type of litigation, then you've got to make sure that all that team's activity is actually being captured fully enough to address an opposing counsel's ask later on.

Bill Tolson:

These are especially with companies adopting this so quickly, and the somewhat relative complexity of Teams archiving is something that you need to understand way upfront, so you can react to it very, very quickly.

Mike Osterman:

And that's a good point. I mean, it gets back to your earlier point about the difference between archiving and backup. When [inaudible 00:16:37] talk about archiving, what they mean is what you just described, what Microsoft is talking about is more backup, and both are useful. I mean, it's not a bad thing to backup, but it's not true archiving.

Bill Tolson:

No, And I apologize. I forgot to mention that. But then again, it's one of my pet peeves in going through the 1000s of pages of really great knowledge-based articles that Microsoft puts out on a daily basis. In a lot of cases, they tend to intermix the term archiving and backup. And in our industry, those are wildly different. Just so people understand that backup does not equal archiving. In fact I wrote a blog a year or two ago titled Back up does not make a Good Archive, But Archive can be a Great Backup. So just so people understand that. And when you are looking at descriptions of Teams and Teams archiving, and any other part of Microsoft 365, just make sure you understand when they're talking about backup or archiving. Make sure you get a little bit deeper, as in, what they're actually talking about. So Mike, in the paper, you call out this challenge of high fidelity archiving for Teams. Can you get into that a bit deeper? What do you mean by high fidelity archiving?

Mike Osterman:

Sure. Compliance officers really face a number of challenges in archiving content from Teams. Because Teams, as you've noted earlier, was really built as this sort of cross workload aggregator a functionality across Microsoft 365. So it's capturing stuff from Outlook, Exchange, OneDrive, SharePoint, and so forth. And while there's a Microsoft style unification on the front end, so that if you're using Teams, you see all this data, basically in a single pane of glass, as you pointed out, Teams data is really separately stored in a bunch of places across Microsoft 365. And so, if you're going for a high-fidelity archiving solution, what you have to be able to do was access and capture all of that data for regulatory compliance, for internal monitoring, for eDiscovery, for early case assessments, and so forth. And so, fundamentally, you need a way to basically aggregate all of this data into a single archive so that you're not archiving these little bits and pieces all over the landscape.

Bill Tolson:

Well, and they're easier and quicker to find if you are reacting to an eDiscovery or you do get an information request from some regulatory agency saying, "I need this data." And when they say this data, they mean all of the data. One of the things that your white paper points out around this archiving issue is, and I've mentioned that as well, is these various data objects from Teams are saved and archived across various repositories in Microsoft 365. Some of them are stored in SharePoint. Some of them are stored in OneDrive. And when I talk about that, in a lot of cases, they're stored in an individual's OneDrive account or an individual's SharePoint account as well. And sometimes, some of the data is stored in various exchange mailboxes. It might automatically store some of it in the Teams mailbox, some of it in an individual mailbox.

Bill Tolson:

And when you do go to react to a litigation hold requirement or even an ECA, or if you're trying to scrape data together to respond to a regulatory information requests, it could be rather complex. And the risk of you not finding all of the data that you're required to turn over, it grows dramatically. And depending on the regulatory agency or depending on the lawsuit, it could cause like you said, Mike, a spoliation order or designation, meaning that you either advertently or inadvertently destroyed data that you didn't turn over. And some of us know that a plaintiff's lawyer in a court case can use that to force you to settle early or to force the court to basically rule against you immediately before you actually ever get into court. Because might generate an adverse inference or something like that. What would you advise organizations look for when looking at third-party archiving solutions from Microsoft Teams?

Mike Osterman:

Well, I think the focus really needs to be on that high fidelity archiving. The situation with Teams archiving natively within the Microsoft paradigm is really the equivalent of storing all of your paperwork in 15 different file cabinets around a company, some in public places, some in individual offices, and that will work. I mean, you could go and recreate all of that data and bring it all together in one place, but it tends to be complex. There are more opportunities for that data to be lost, and so forth. So we recommend looking at an archiving solution that really focuses on bringing everything together and makes it easy to find. Because one of the issues in going through a regulatory audit or an eDiscovery exercise and so forth is missing something. If there's an important batch of data, there are certain data types that just aren't there, that can get you into a world of hurt with a regulator or a court. So you want to make sure that you have everything easily accessible and that you know that you've gotten everything.

Bill Tolson:

Well, and another good point that... One of the things that I've seen over the last 20 years, especially dealing with litigation preparedness, especially around custodian self-collection and all this kind of stuff, is once a litigation is either anticipated or in fact happening, the data that's potentially responsive, you need to be very careful with. You've got to make sure that you're not changing the metadata just by opening it and looking at it or moving it to another location or something like that. And a really good opposing counsel will look at this stuff. And if the data has been changed, edited, deleted, or if the metadata has been even slightly changed, then they will start arguing that you have spoliated the data. And again, that can be a specially large issue.

Bill Tolson:

Even on the regulatory side, the requirement for SEC 17 is storing everything immediately in an immutable format, meaning it could not have been changed. Metadata could not have been changed, that it's an original copy of record. So by storing all these data objects across many, many, many repositories and then actually going through and looking for it, the risk of data spoliation rises dramatically. And for those companies that have not been through a specially aggressive eDiscovery, these are the kinds of things that will cause the case that they lost immediately. And again, with Teams, it's all of the data objects. It's not just a chat conversation. It's all of those other things I talked about; sentiments and emojis and file uploads and file shares, video and audio recordings, and all of that kind of stuff.

Bill Tolson:

And the other thing that I've noticed with Teams as Microsoft continuously makes it better is also those repositories, to a certain extent, are a moving object. I noticed that Microsoft has stated here very shortly that they're going to start instead of saving video and audio recordings of the team meeting in stream, Microsoft 365 team or stream, they're now moving it to OneDrive and SharePoint.

Bill Tolson:

So again, we need to keep off on exactly where this stuff is going. I'm sure Microsoft is going to get to the point where it's all settled down. But the bottom line here on this is just be very aware if you're capturing this stuff for regulatory or eDiscovery requirements, be very sure of what you need to do and that you're actually doing it. And one of the questions, when you look at all these various data types, how do you place a litigation hold on all of these different datatypes on all of these different repositories? It can be obviously pretty daunting.

Bill Tolson:

So, Mike, we've talked about regulatory compliance for Teams, and we've talked about litigation and litigation support. And I know there are lots of companies out there who have never been faced with it before, faced especially with eDiscovery. They probably have a general idea they need to follow compliance requirements, but what are those expectations at that high level that clients should be aware of? And we've talked about a lot of it. And again, I just want to stress that the more you know about this stuff, the less risk you're going to face, and right now, it's a continuously moving target. So after I've dwelled on eDiscovery quite a bit here, Mike, in the survey you conducted for this paper, was there anything that surprised you or anything that kind of jumped out at you as trends?

Mike Osterman:

Yeah, one thing that was really surprising is that almost half of the respondents told us that they're not archiving Teams content today because they don't have a need to do so. And that's surprising because I mean, everybody really understands that they need to archive their business records. Whether they do it or not, they know they really should be. And I think part of the explanation for this is that we saw such a rapid increase in the number of Teams users in most organizations, that again, IT is really just playing catch up. And I think a lot of IT is viewing the use of Teams as sort of a quick replacement for email, having video conversations because you can't [shules 00:26:08] around the water cooler anymore since everybody's working from home.

Mike Osterman:

So I think they viewed it as sort of this ephemeral type of communication when in fact, Teams is being used for real business work. People are conducting meetings with other employees, with members of their supply chain, with customers in some cases. So I think that'll catch up. And if we were to do the survey on another three months, I think we'd find a much smaller number of people that said that they're not archiving Teams because they don't have to. But I think at the time we did the survey everybody was really just playing catch up and not really understanding just how important Teams is in the context of capturing business records.

Bill Tolson:

Yeah. I have an interesting real-life story from my consulting days, and it doesn't revolve around Teams, but it was around instant messaging. And I remember sitting in a meeting with both sides of a lawsuit in which... What amounted to an early meeting [inaudible 00:27:03]. And I remember the plaintiff's counsel asking the other side, the other side basically was their general counsel and their VP of accounting and VP of engineering, so on and so forth.

Bill Tolson:

And I remember the plaintiff's counsel asking the general question to the table of, "Does any of your departments or employees use instant messaging i.e. chat?" And the GC on the other side immediately spoke and said, "No, we don't allow that at all. It's forbidden within our organization." And I remember the VP of accounting sheepishly saying, "Well, many of our accountants use it because it's a great productivity tool. So yes, we do use it." And I remember the plaintiff's counsel, basically looking actually at the GC on the other side of the table, saying, "Did you apply a litigation hold to those?" And the defendants have the GC basically, is... You could hear his head hit the table. It was like, "Oh no!" So yeah, knowing what your responsibilities are, is very good.

Bill Tolson:

And on that same subject, and again, for both compliance and for eDiscovery, Mike, your paper pointed out that a high-fidelity archiving solution should build beyond just capturing individual chat and channel messages, but also capturing all the different data objects. But one of the break points you brought up was, can the system actually enable a reconstruction of a larger, say, Teams meeting transcript? Who said, what, at what time, did they click an emoji, did they upload a video, those kinds of things. So having that, like you say, a higher fidelity, a reconstruction of a total meeting versus just a bunch of single standalone chat messages is important. Do you agree with that?

Mike Osterman:

Oh, very much so. Absolutely. Because when you're talking about Teams or any collaboration solution, you are talking about a number of different data types. You've got obviously text and chat and video and audio and all the rest, and you need to be able to reconstruct that into a coherent stream. For example, let's say somebody asks a question in chat, "Should we go ahead with this project?" And the response from the decision-maker is a smiley face emoji. Well, there's no texts there, but you need to capture that emoji because that implies approval. And if you are ever involved in litigation or a regulatory audit, whatever the case is, that's evidence that there was approval from the decision-maker for this project. So you need to be able to capture that. If there's content in video, in addition to chat, you need to be able to capture that as well. So you really do need that high-fidelity so that you can go back and reconstruct the timeline with all of the different data types and so forth because all of that is really integral to explaining what went on.

Bill Tolson:

And wouldn't it also be nice if those videos and audio or audio recordings could be automatically transcribed to make it more searchable. Teams is not necessarily doing that. But when we're looking at again, like you say it, this high fidelity reconstruction and there's video or audio there, wouldn't it be nice that if you did a search that those audio video files had actually been transcribed. So when you do a search, it's actually searching those spoken words as well, so that you're not listening, you're not missing potentially responsive content.

Mike Osterman:

Yeah, absolutely.

Bill Tolson:

Yeah. Microsoft offers a very interesting approach to Teams archiving bias, but for many, it's going to do what they expect it to do. They're just capturing it for note-taking. I know I do go back and review a call and make sure I didn't miss anything. But when we're looking at regulatory compliance, a lot of the new privacy requirements, litigation, M&A all kinds of things, or even down to the point where you're talking about corporate history, having that higher fidelity capture is important.

Bill Tolson:

And what we found from many of our customers, especially banks and so forth, is having the ability to know that you're capturing everything and can find it. And that it's meeting those requirements, those compliance requirements, again, around WORM storage, immutability, the ability to be able to search for and bind stuff quickly. A lot of the especially SEC is not going to sit around for months as you try to figure out what was in the one terabyte of data that you're supposed to be turning over, they want it fast, and they want it accurate. They don't want you to turning over 10 terabytes worth of data that has 500 gigabytes worth of real-world compliance data in.

Bill Tolson:

So being able to center in on and in a high fidelity way capture and manage that data is not only a productivity sayer but also could mean whether you're in compliance or not. And I've seen again, back in my consulting days, I've seen companies lose their business to the governments and all kinds of things. In one extreme case, I saw a very well-respected kind of small to medium-sized IT outsourcer for one of the government agencies. The CEO had been having conversations with his brother through the company email, and the indication was for government regulatory retention requirements. Everything needs to be captured and made available [inaudible 00:32:56] this other kind of stuff. And the CEO and his brother had some rather personal conversations through email, and later, the CEO figured that out and went in and individually removed a lot of those personal messages.

Bill Tolson:

Well, not too long after, the attorney general showed up at the front door wanting just as a standard matter of business, "Hey, we want to review this stuff." And they found that there were large pieces of conversations missing across the timeline. And eventually they left, and the AG's office, one of the departments of the criminal division, they all showed up with sidearms and took all the data. And the moral of the story was the CEO ended up serving 18 months in a federal prison for destroying data, even though he didn't mean it, it was inadvertent, but... And that's a horror story, and that's not going to happen hardly ever, but it can. So I think like you point out really well in the paper, Mike, that knowing what your requirements are and knowing how to meet those requirements, especially for Teams, [inaudible 00:34:05] everything else, as we go forward is just extremely important and can help you lower your overall risk in a very obvious manner.

Bill Tolson:

So, Mike, I think we've reached the end of this edition of our podcast, The Information Management 360 Podcast. I want to thank you for that great insight today. Great discussion. And I think the white paper is just, just tremendous. And I think our clients, our listeners, are going to get a lot out of it. Just as a reminder, you can go to the archive360.com resource page and download Mike's white paper. And if you do have any questions on this topic, please send an email mentioning this podcast to info@archive360.com, and we'll get back to you as soon as possible. You can, again, like I said, you can also download the white paper, the Osterman Research white paper from our resource page. And also, check back on our podcast page regularly because we will be publishing a lot more of these on really interesting topics as we continue to watch this stuff. So with that, Mike, I very much appreciate it. And thank you.

Mike Osterman:

Bill, thank you so much. It was a real pleasure being here today.