What seems to be the problem? One of the biggest targets for e-discovery is e-mail. When you search your e-mail archive you should be able to retrieve all internal e-mail that was sent and received. But what about external e-mail, which is all the e-mail that goes to or comes from outside your enterprise - partners, competitors, customers/clients, or any person/organization outside your own? Yes, you should have all the relevant e-mail that was sent from the outside and also that which was sent by someone in your enterprise to someone outside your enterprise. But can you prove that what was sent to someone outside the organization was also received by that someone? And therein lays the rub. If you cannot prove that someone outside your organization actually got an e-mail, you do not have legal proof of receipt. And that can be a problem.

What do you need to know? A company called RPost illustrates a solution to the problem. RPost has the ability to register e-mail. (As an industry analyst, RPost recently gave me a briefing on the Registered E-mail service.) RPost provides managed outbound messaging services that include software (an add-in to Outlook, Lotus, or Groupwise that allows you to send Registered E-mail messages) and service (an Internet-based server intermediary through which Registered E-mail messages are forwarded and delivery services verified back to you).

A Registered E-mail message must ensure three things: proof of delivery, proof of content, and proof of time. The first is proof of delivery. A Registered E-mail management server receives the Registered E-mail from a sender and sends it to the server that is responsible for the e-mail of the receiver. The management server conducts a dialogue with the receiver's e-mail server to confirm receipt by the e-mail server. When the management server receives confirmation of a successful delivery, analyzes the transaction meta-data, then it sends a Registered Receipt e-mail back to the sender. That is an evidentiary record.

Note that the receiver's e-mail server, in effect, provides a "signature" that the e-mail "letter" was delivered so it serves the same function as a signature for registered physical mail or a FedEx package. That does not prove that the receiver actually opened the e-mail or read and understood it, even if opened. But you don't have to do that for proof of delivery. The "signature" is good enough just as it would be for a physical mail or FedEx delivery.

But a Registered E-mail message has a second capability that neither a regular letter nor FedEx package can have. That is proof of content. You can prove that the e-mail "package" which includes attachments contains certain information. And that is very powerful in establishing proof.

The final essential capability is proof of time. You have to bind the time the e-mail was sent, and more importantly, precisely when it was received, to the content. And that is also what a Registered E-mail management server can do for you.

Now you have to have all three capabilities -- proof of delivery, proof of content, and proof of time -- to establish verifiable proof. You have not only just tracking or delivery confirmation information, but also verification of the content and time of sending and receiving of the e-mail. You are now in good shape in enabling your organization to have the necessary evidence should you have to go to a court of law - evidence that will ensure that your e-mail records are not only properly produced for discovery, but more importantly, admissible as evidence.

RPost charges for the service as if you were buying postage stamps. (Note that Pitney Bowes is one of its distributors so RPost's purchase model is consistent with the general concept of virtual stamps.) RPost also provides accounting reports, such as monthly e-mail usage reports on each user for cost allocation and management purposes.

What can you do about it? Certain types of organizations (such as trading firms or law offices) may want to register all e-mails (or at least all e-mails that meet certain criteria). Other organizations, such as industrial firms, may have to look into what specific categories of e-mails (such as those relating to purchase orders or contracts) would require the Registered E-mail service protection, rather than applying Registered E-mail services across the board.

The challenge is likely to be how to clearly identify all the e-mails that should be transmitted with the Registered E-mail service and put in place the proper processes and procedures to ensure that the proper people follow them. Organizations have to anticipate the consequences of what will happen if an outside party claims not to have received an e-mail. Even if that happens rarely (only one out of many thousands of e-mails is a problem), the consequences might be sufficient enough to justify the RPost Registered E-mail service. You don't necessarily need to register all e-mails; you only need to register those that meet certain criteria. And since you can pay-as-you-go (like buying books of stamps), the investment should be manageable. At the very least, RPost Registered E-mail services are something that you might want to consider to have available for when you need it - just as you would have a book of postage stamps in your desk drawer.

David Hill is the founder and principal at the Mesabi Group. The Mesabi Group is an industry analyst firm that focuses on networked storage and storage management. The second edition of the Mesabi Group report "Data Protection: Adapting to the Sea Change" is now available. Hill was VP of Storage Research and founded the Storage & Storage Management practice at Aberdeen Group, leading quantitative and qualitative market research. He directed data centers at Data General, introducing new analytical tools and business systems. He handled strategic marketing, competitive analysis, sales force planning, and market forecasting at a well-known storage vendor. He has an advanced degree from MIT's Sloan School. He can be reached at davidhill@mesabigro up.com. Please visit the Mesabi Group Web site at www.mesabigroup.com.