Regulations ping instant messaging

Although instant messaging is not as mature as e-mail, it has already been deemed just as important in the eyes of regulators.

A handful of regulatory bodies, including the Securities and Exchange Commission with rule 17a-3 and 17a-4; and Congress with the Health Insurance Portability and Accountability Act (HIPAA), are treating IM communication as a form of electronic communications in the same vein as e-mail. This means IMs must be archived for a period of time, depending on the regulation, on WORM (write-once read-many) media. And in order to be compliant, enterprises using IM are turning to companies such as FaceTime Communications, MessageGate, and IMlogic to provide a way to monitor, capture, and archive IM conversations.

“Many [regulatory bodies] have ruled that IM is just like e-mail,” says Jon Sakoda, vice president of products at IMlogic. “Enterprises need help archiving and indexing their IMs with information about who, when, and the conversation itself.”

FaceTime is one of many companies that offers a management framework that can monitor and record IMs within a corporation and externally.

Jonathan Christensen, CTO of FaceTime, explains the company’s IM Director product sits in the message path of IM and can apply policies to users, such as blocking file transfers, blocking messages, and inserting disclaimers in real time.

Michael Osterman, president of Osterman Research, explains that companies that use IM need to understand the breadth of the liability that IM introduces, and know specifically what content needs to be preserved and for how long.

“It is really critical to have auditing, logging, and security with IM, even in unregulated industries,” Osterman says.

David Weld, president and CEO of MessageGate, agrees. He explains that government regulations, such as Sarbanes-Oxley, aren’t the only reason to manage IM. He says other industries, such as energy, government, and military, have their own corporate regulations that explicitly forbid contractors from divulging information about the project they are working on — which means IM must be monitored.

“Data spills can result in big fines,” Weld says. “Shortly following fines is: ‘you’re no longer doing work for us.'”

Weld says MessageGate’s product, which also offers real-time surveillance of e-mail, uses a series of techniques to look at the context and content of a message, based on policies defined by an administrator.

“To be in compliance means to have a solution in place,” Weld says. “But catching inadvertent or malicious activity is more important.”