IRS loss of emails believed avoidable
It's “possible” the IRS could have lost top executives' old emails, a leading computer storage expert told the Tribune-Review.
“But to do so requires an incompetent IT staff and ignorance of federal law in this case,” said Ethan Miller, an electronic archival expert at the University of California, Santa Cruz.
Internal Revenue Service Commissioner John Koskinen can expect to get questions over the agency's email storage priorities when he testifies before Congress on Friday.
The tax agency has told Congress it cannot produce emails written by Lois Lerner, a retired administrator, and six other top officials involved in a controversy over whether conservative Tea Party groups received extra scrutiny when they sought nonprofit status.
The IRS said it told employees to save old messages on their individual computers, and that Lerner lost the messages when her computer hard drive failed.
Federal regulations require agencies to preserve emails that include substantive information about policies and activities so “records can be readily found when needed.”
Beyond that, the National Archives says systems should be designed to “ensure the security and integrity” of electronic records. It specifically cautions that electronic records should not be maintained solely on one staff member's computer hard disk.
“Poor documentation may result in an unresponsive government or a government that cannot account for its actions,” the archive says.
Each organization's policy for saving emails depends on whether it expects to need old information — and how much it is willing to pay, said Tom Cullen, director of computing facilities at Carnegie Mellon University's School of Computer Science.
Researchers at the school want to be able to access decades-old emails, so the school saves every message, backing them on tapes that are stored in an off-campus site, he said. The university was able to prove CMU researcher Scott Fahlman invented emoticons because it has the original message he sent in 1982.
“Every organization has different needs,” Cullen said. “Within the organization, its culture and its policies really drive how long the data would be retained and treated.”
Law firms and financial institutions tend to save every message, regardless of cost, because clients and regulators demand retention, experts said. Small nonprofits, meanwhile, might regularly delete messages after a few months.
Government agencies, such as the IRS, tend to receive mandates from lawmakers and regulators that can be hard and expensive to follow, especially amid budget cuts, said Garth Gibson, a computer information expert at Carnegie Mellon.
The risk of losing old emails might not be as great, either, he said.
“If you are a lawyer or you are a bank, then the government can take you to court and take a lot of money away from you if you lose things you're supposed to keep,” Gibson said. “But I don't know who would take the IRS to court and extract money.”
The IRS estimated it would cost more than $10 million to save every email sent and received by its 90,000 employees. Last year, the agency started saving storage tapes with a daily snapshot of all emails, at an annual cost of about $200,000.
The agency's total spending budget is about $12 billion a year.
Outgoing White House spokesman Jay Carney this week told reporters that the agency tried to recover the lost emails. “IT professionals worked to restore Lerner's hard drive, but were unable to do so,” he said.
Experts agreed that saving old messages can be costly and cumbersome, especially when users rarely go back to them. But for key executives, Miller said the agency could have done something as simple as buying each one an external hard drive for less than $200 and asking them to back up information regularly.
“If they were using standard tools it would have been easy for them to do the right thing,” Miller said. “The question is, ‘How important for your business practices is it to not lose the data?' ”
Andrew Conte is a Trib Total Media staff writer. Reach him at 412-320-7835 or email@example.com.