Educause Security Discussion mailing list archives

Re: Email Disclaimers


From: Valdis Kletnieks <Valdis.Kletnieks () VT EDU>
Date: Mon, 12 Mar 2012 10:33:09 -0400

On Mon, 12 Mar 2012 09:51:03 EDT, Pete Hickey said:
Does anyone know if there has ever been a court case... in any
country in the world.... where the email disclaimer made a difference?

I remember one case (cite is unfortunately eluding me) where the judge was of
the opinion that blindly sticking the disclaimer about sensitive and
confidential info on everything, including postings to public mailing lists,
was uncomfortably close to overwarning.  Unfortunately, the judge's comment was
basically an aside during trial, and the case was resolved on other grounds, so
it didn't create any case law.

I've seen a number of opinions that blindly sticking the exact same disclaimer
on all mail could be *dangerous*, because it could be used to show that you
stuck the disclaimer on there because you don't have any *real* control or
tracking of the messages that *do* contain info covered by the disclaimer.
After all, if you *knew* which messages had sensitive info, you could have
just stuck the disclaimer on those, right?

My personal favorite?  A disclaimer doesn't do any good unless it creates a
contractual obligation.  Now if it *does* do so, how much of a liability have
you just created for yourself by using the phrase "please delete all copies"?
Hint - you *did* want that done in a forensically secure manner, so copies
can't be dredged off the disk, right?  Including the big RAID filesystems on
our main mail hubs, and the backup tapes, and the....  (What, you didn't think
we were going to do that secure deletion for *free*, did you?)

Attachment: _bin
Description:


Current thread: