GB2440173A

GB2440173A - E-mail auditing system

Info

Publication number: GB2440173A
Application number: GB0614293A
Authority: GB
Inventors: John Paul William Patrick Corr
Original assignee: Individual
Current assignee: Individual
Priority date: 2006-07-18
Filing date: 2006-07-18
Publication date: 2008-01-23
Also published as: GB0614293D0

Abstract

A system in which data is collected when users read e-mail. Preferably, the system monitors the network and file system protocols used when the messages a retrieved from a store or a client installed application or mail add-in will collect the data when the messages are retrieved from a local store. The system will preferably record all interactions between a user and e-mail messages.

Description

EMAIL AUDITING SYSTEM & METHOD

BACKGROUND

The invention relates to the analysis of electronic messages in particular the gathering of information relating to the viewing, use and/or other interaction with electronic messages by users. Users' interaction with a message is recorded to provide a chronological record which provides a context or frame of reference upon the said message. This facilitates the identification of other or associated message relationship strings which are not immediately obvious or discoverable using existing technologies. Electronic messages or electronic data are defined in this document as emails, messages and associated attachments.

Many large organisations using email are regulated by acts such as Sarbanes Oxley, HIPAA.

SEC I 7a-4 and the FSA. Many of these acts or regulatory bodies mandate the retention of business information (such as email messages) for set periods of time. As a result many companies now employ email messaging archiving solutions (such as Symantec's Enterprise Vault, Computer Associate's liumin, Zantaz EAS, etc) to automate their compliance with these :**::: regulations. These archives are growing at an incredible rate often containing millions of S...

messages plus their associated attachments.

In a typical environment where an email archiving solution exists, emails are captured at the point of entry to a mail server I mail store. The benefit of this is that a message can be : retrieved or restored to a user's mailbox should deletion occur, whether intentional or accidental. In most environments email resides for extended periods of time within the mail store for access by a user. This is an environment that users are familiar with. Most email archiving systems have a storage management component that allows messages to be purged, deleted or removed from the mail store after a given period of time. In most cases this process takes place when a message is 30, 90 or even 360 days old.

From this point forward the email message resides only within the email archive environment.

A significant number of email archiving solutions are then able to record details of when messages are viewed and restored by either administrative personnel or the users' themselves. They are in effect able to create a partial audit trail of events. Chronological records can be created pertaining to the searches undertaken, messages viewed, restored, and deleted in line within retention policies. In many cases administrative users or reviewers assigned the correct privileges may annotate, flag or categorise messages relating to particular investigations for easier reviewing by other users.

The problem arises when a company is required to refer to its archive in support of a legal case or similar discovery requirement. For disclosure purposes the company may be asked for relevant email messages relating to the case. A typical search across the archive for keywords, employee and or customer names will usually reveal a large dataset, which must in many cases be manually reviewed to assess relevance to the case.

* The process of determining relevance and or relationships between messages in the current :*s::: commercially available market relies heavily on the following search methods or combinations thereof: : * Searching to or from fields of an email message for names, email addresses or domain **.

I

names. **

* Searching the subject field for keyword matches, similes or derivatives.

*..*** * * Searching the body content or attachment text for keyword matches similes or derivatives including the use of Boolean operators.

* Searching using a time limitation parameter set e.g. messages sent after date X, but before date 1r.

* Searching for an attachment name.

* Searching for header information (e.g. IP address, message ID etc).

Emerging, more intelligent methods look for the repetition of snippets of content within a message (e.g. an email message that is ureplied to may quote the original message or parts of it, but the original subject line may have been changed). More recent developments have seen the introduction of organisational" relevance whereby a company's hierarchy is introduced to the equation to lend weight to search results.

It would be fairly simple to demonstrate how such methods may be prone to error, especially if the search for such an investigation being undertaken was done so by a novice user.

Our approach is unique as we collect, analyse and allow comparison of user interaction or behaviour to establish relevance and highlight relationship patterns.

By comparing the results produced by the archive search with our user based interaction data we can score the relevance to each other and also highlight potential relationships to other messages that may not have been immediately obvious or discoverable with the keyword searching process alone.

: ..* To help understand the importance of our approach we can reference a simple corporate * . scenario as follows: * * * .:. Background simple scenario: sexual harassment lawsuit.

:. Employee A has been accused by employee B of harassment. To support their claim * : employee B has referenced a number of email messages as evidence of inappropriate conduct. With the use of an email archive the company will probably only be able to determine one thing; that the emails were sent in the first place. They may also be able to determine that the message was read on a particular day (but not what time or the frequency of reads), and have a log of access to the message if it has since been retrieved from within the email archive.

What the company may not know is that Employee A and B had been involved in a relationship for some time. When the messages (in this example, cryptic love notes) were originally sent employee B had read them over and over again, perhaps several times a day for a week. The relationship has now finished and employee B is unhappy with the break-up and is seeking revenge. A quick delve through their email messaging system reveals pertinent racy emails that were sent months ago. With our system a company would be able to determine all of the user interactions with the messages concerned. As such they would be able to see the high frequency of reads after the messages initial receipt and the subsequent lack of interest for weeks or even months after, followed by a renewed interest prior to the complaintllawsuit being filed. Analysis of such user behaviour information provides a context to all of the information viewed in a chosen timeframe which provides a valuable insight for an organisation to determine whether to settle or defend the case. S. S. * S.. S... * . * *5*

S *S. S. * S * I.,

S

*....S * S

STATEMENT OF INVENTION

To overcome the deficiencies of gathering information in the aforementioned manner the invention proposes to provide detailed and valuable usage information (an audit trail) about any email message that exists within a mail system's mail store, a file system or a users email client local database or caching environment.

For the purpose of this description we define usage as an action imposed on an email message by a user or process (e.g. mail rules). These actions include: opening, previewing or closing the email, forwarding the email, replying to the email, printing the email, deleting the email, marking, flagging, tagging, commenting, categorising or moving the email to a specific folder. Through a variety of non-invasive monitoring techniques the system and its optional agents gather and store detailed usage information. kUsage lnformation is defined as a user's PP and or MAC Address, message ID, Message addressee information (from, to, cc, bcc), time and date of usage, usage type (i.e. action taken: read, printed, forwarded, replied to, etc). Usage information will be collected by the primary system and its optional agents when :.. usage occurs in relation to the message/email. S... * S **.

The data gathered by the system will provide a detailed usage history of the email messages : and also places a context or frame of reference upon the email messages which establishes S..

patterns of user behaviour. S. * S * S..

:! Usage data will be gathered in the following situations: * When usage occurs (as detailed above) while the message exists within the mail server I mail store environment or, while the message exists in flat-file format or published locations (eg. Public Folders under MicrosoftTM Windows).

* Usage data may also be gathered for all access to messages that exist within an archive system.

Usage data will also be gathered from a client based agent which will provide usage data for messages that exist in a local cache, local database (.pst or.nsf files) and particularly when a user is offline or not connected to the corporate LAN or WAN.

A client is defined as a personal computer, laptop, Personal Digital Assistant (PDA) or mobile device (e.g. BlackbenyTM or other smart-phone).

ADVANTAGES

Whether used as a standalone reference point or when cross referenced with existing content, mete-search or time based results, the system highlights which messages within the results set are most likely to be related to each other or relevant (based on time proximity usage patterns). In addition, the system will suggest email messages that may be relevant to a search but are as yet undiscovered via content, metadata or time based search.

* The data collected by the invention provides a valuable audit trail of interaction with a :..::: particular email message or messages. This data will help people like auditors, legal S...

investigators & authorities and HR understand the behaviour over a designated time period of an individual in relation to the information within the message or messages in question. S..

S *S * S * SS.

* S* *

S S

DESCRIPTION

INTRODUCTION TO DRAWiNGS

Having described the invention in general terms, reference will now be made to the accompanying drawings which are not necessanly drawn to scale, and wherein: Figure 1 -shows a simplistic view of a basic corporate email environment.

Figure 2-highlights potential data collection points according to the invention.

Figure 3-shows the data stored in the usage database.

Figure 4-shows the data collected by the email plug-in software.

Figure 5-shows typical corporate email lifecycle timescales.

Figure 6-Example primary system interface showing a list of messages in the mail store.

:. Figure 7-Example primary system interface showing usage information for one specific :..::: email.

:*. Figure 8-Example usage information display method to show potential relevance between :. messages.

Figure 9-shows a simple flow diagram with user I sending a message to user 2 and user 3. * *

Figure 10-shows the header detail of this message as stored by user 1.

Figure 11 -shows the header detail of this message as stored by user 2.

Figure 12-shows the header detail of this message as stored by user 3.

Figure 13-shows a typical network topology.

S

Figure 14-shows a flow chart relating to the systems data collection and processing methods.

DETAILED DESCRIPTION

The systems and methods of the present invention are described below with reference to block diagrams and flowchart illustrations. It should be understood that blocks of the block diagrams and flowchart illustrations and combinations of blocks in the block diagrams and flowchart illustrations, respectively, may be implemented by computer program instructions.

These computer program instructions may be loaded on to a general purpose computer, special purpose computer, or other programmable data processing apparatus (e.g. appliance with embedded code) to produce a mechanism, such that the instructions which execute on the computer or other programmable data processing apparatus create a means for implementing the functions specified in the flowchart block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a *.

* particular manner such that, the instructions stored in the computer-readable memory produce an artide of manufacture including instruction means that implement the function specified in the flowchart block or blocks. The computer program instructions may also be * loaded onto a computer or other programmable data processing apparatus to cause a series * of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that, the instructions that execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

Accordingly, blocks of the block diagrams and flowchart illustrations support combinations of means for performing the specified functions, combinations of steps for performing the specified functions and program instruction means for performing the specified functions. It will also be understood that each block of the block diagrams and flowchart illustrations and combinations of blocks in the block diagrams and flowchart illustrations, can be implemented by special purpose hardware-based computer systems (e.g. appliance with embedded code) that perform the specified functions or steps, or combinations of special purpose hardware and computer instructions.

In figure 1, we show a simplistic view of a mail setup in a corporate environment. A customer (1) would send an email message via the Internet (2). When the email message is routed to the company it will pass through the firewall (3). The email message is then likely to pass though anti-Virus, anti-SPAM and content filtering programs (4) before arriving at the mail server (5). Once processed by the mail server the message is stored in the mail store (6).

The message is then delivered to their local mail client (7) and usually cached for future use.

In figure 2, we show the addition of an email archiving solution to the corporate email messaging environment. The archive would usually consist of the archive server (8), a n... database (9) and an asset store (10). In this configuration we are able to collect data from several locations. The most popular will most likely be at the network level (11). Such a *** configuration will allow all network traffic related to the mail server (5) it's mail store (6), the archive server (8) its database (9) or asset store (10) to be collected and filed for future :. reference. In addition, a client based install will provide greater clarity to the network acquired data. Finally, if required a further collection point could be place at the Internet network level (2).

In figure 3, we show a list of the field data collected at the aforementioned collection points in order to build a user profile of interaction. As well as important data for the purposes of auditing, there are control fields (e.g. 29, 30 and 31) which will allow quick reference relationships to be built. These fields will enable a much faster more scalable repository of data.

In figure 4, we can see a subset of the data required. In figure 2, this data is collected by a program installed at (7) and synchronises with a primary system (11).

In figure 5, we see a typical simple tifecycle for an email message within a business. When an email message arrives, it is stored by the mail server in a mail store. At the same time a copy is usually taken for archive purposes, though this will generally not be accessed unless a user accidentally deletes a message from their mailbox and needs it restoring. When a user reads an email message, a cached copy usually exists on their local machine (computer I pc). After a predetermined time (usually somewhere between 30 and 90 days) most businesses start to remove the older messages from the mail store. From this point on, a cached copy may still exist with the user; however they may have to access these older messages within the archive to see them. Most archives allow users to restore older messages manually back to the mail store. * S

:*::: In figure 6. we see an example of the main administrator view of the system. The results table S...

shows all messages in the mail store in this view sorted by date sent. The sender, recipient * and subject information is also shown along with the last 5usage" information. The column can S..

be sorted or the results search and filtered to restrict dates & times, sender or recipient data or S. subject content. Clicking on the "usage data drills down to a greater level of detail S.....

* specifically regarding that message ID. An example of the level of detail can be seen in figure 7.

In figure 7, the interface shows the entire usage history of a specific message. Summary information as well as detailed user information, IP addresses time dates etc can be easily viewed.

In figure 8 we show a visual representation over time of a selection of messages for a particular user. The 3 rings highlight a possible enhanced relevance between several messages. An archive search may have produced only I of the 4 or 5 messages shown in

this example.

By including the one message ID the archive did manage to find in a search, the primary system will suggest the other messages as potentially relevant based on the proximity of these time based usage events.

In figure 9, we show a simple scenario where User I sends an email to two people at the same time. By comparing the Message ID section on Figures 10, 11 and 12 it can clearly be seen that the Message ID is a consistent record for the sender and both recipients.

In figure 13, we can discuss a typical process for clarity.

PROCESS

0. User clicks on email message in email messaging client 7. Email messaging client issues file system or network request to retrieve data from local data store (.pst file or S...

similar) or remote location (exchange folder, public folder, mail store or similar).

1. If the data is requested locally on the client machine, an agent 13 (likely in the form of :*. an FBA -Faceless Background Application) or email messaging client plug-in 13 will * : * capture details of the request and synchronise this to the primary system. Usage Information captured will include: User ID, current machine IP or MAC address, time and date of request, email message ID, activity performed (e.g. opening of a message, forwarding of a message, replying to a message, printing of a message etc.) Machine configuration data (OS, browser details, plug-ins installed etc). The data collected and stored by any client side application will be encrypted to assure integrity. Though not essential, if the email client is accessing mail from a remote location the FBA or email client plug-in may still be employed asa safeguard to verify requests recorded by a primary system match those of the client machine.

2. If the data is requested across the network infrastructure it will be captured and stored by the primary system 11. The primary system will employ port mirroring or ethernet repeater techniques with the addition of a dedicated protocol analyser feature set designed to capture and filter the operating system or network protocol requests to retrieve email message data from a remote (i.e. non client) location (e.g. Microsoft exchange folder or mail store). The analyser will capture returned data and extract key data such as the message ID, message headers, Time and date of request, destination machine (IP address, machine name, MAC address etc) as store the data in a database 12.

3. Data may be synchronised to the primary system 11 from client machines 7 if FBA's 13 or email client plug-ins 13 are being used.

4. A query interface (shown in figures 6 and 7) will allow the data to be interrogated. Data will be analysed to suggest messages (as per figure 8) that could be related to each other based on user behaviour (i.e. interaction) and time implied relationships.

* Messages will be ranked based on a number of metrics including (but not limited to) *** the number of times opened, what other messages were opened within a given : W timeframe by the same user or group of users. * *

Figure 14 shows a flow chart representation of user actions, the process of collecting usage data and its consolidation to the primary server database and the interfaces for retrieving the resulting processed data.

CLAIMS SUMMARY

The email auditing system collects, stores and evaluates usage informationu in relation to specific email messages and those users or processes that undertake actions against those messages. The system method provides an accurate audit trail of user and process interaction with emails. With such a comprehensive dataset, the system can suggest relationships between messages based on time and user behaviour.

The system method will work as described on the following page. S. I. * S.. S... * . *SSS * I..

S S..

I S. S. * *S*

S

* I5 elI

I S

Claims

CLAIMS

1. The primary system method intercepts and records (monitor) network and file system protocols associated with the retrieval of email messages data from message stores such as MicrosoftTM Exchange Server, Lotus Domino, local or network based email message storage formats such as upst files and public folders.

2. The system of claim 1, where in the primary system will extract and record data from these network and file system protocols to determine a users ID (identification), IP (internet protocol) or MAC (Media Access Control) address, the message ID of the message they are requesting from the mail store or file system location, the message subject, the action undertaken and the time and date of opening and closing.

3. The system of claim 1, whereby the primary system builds a tamper proof database of all user interaction with individual messages.

4. The system of claimi will store usage data, illustrating potential relationships between multiple messages based on time related user interaction with specific email messages and their attachments. I. * .**

 5. The system of claim 1, whereby an interlace as detailed in figures 6, 7 and 8 will S...

represent usage data to an administrator or authorised user of the system.

* .:. 6. The system of claim 1, whereby the primary system will also provide an API (Application Programmatic Interface) for the purpose of passing a SQL (Standard Query Language) query to the primary system.

* 7. The system of claim 6 whereby the query passed to the system will contain message ID's provided by user administrator operators or other applications, namely email archive applications.

8. The system of claim 6 whereby the primary system will return a result set containing the message ID's of messages that correlate to a user definable time relevance window as illustrated in this simple example as message ID 1234 was read at lOam, 11am and 12 noon whilst message ID 1236 was sent at 10:05am and read at 11:05am and 12:10pm the timings of which may indicate a relationship based on the proximity of when the emails were sent, read and received.

9. The system of claim 8 whereby a scoring method will rank message ID's in relation to other message ID's providing higher scores to message ID's where the frequency of timings and the proximity of those frequencies is closest.

10. System to collect data via a client installed application or mail program add-in, will collect data when a user reads an email that resides in a local cache or database of the mail program (such as Microsoft OutlookTM).

11. The system of claim 10, where available the application will collect the users ID, IP or MAC address, message ID, message subject, the action undertaken and time and date of opening and closing.

12. The system of claim 10, whereby the data collected will be synchronised with the primary system for the purpose of determining all interactions with messages both on and offline.

:... 13. The system of claim 10, whereby the client agent will be a computer program running S...

on a users client pc or computer, personal digital assistant (PDA) or mobile or handheld device such as a smart-phone or Blackberry"TM.

S

S S. * S * ***

S

S *5 S 55

S