School Security

FOIA Headache Cured at Howell

• By Dian Schaffhauser
• 10/27/09

Paul Pominville faces a challenge that most small school districts rarely if ever experience: a steady stream of FOIA requests. The IT director for Howell Public School District, located in a suburban setting between Detroit and Lansing in Michigan, estimated that he has had to respond to six Freedom of Information Act (FOIA) requests in the last year. "I've never even heard of another district around here that's had a single FOIA request," said Pominville. "Last week it was for one of our radio stations. I'm doing one this week for a newspaper."

Michigan's FOIA stipulates that anybody (aside from a prisoner) has the right to request copies of records from public bodies, including school boards. In each case that Pominville has dealt with, the request asks the district to supply copies of e-mail messages typically sent from or to specific individuals during a particular period.

The district, which has undergone board of education turmoil--two supervisors have been replaced in as many years--and union battles over the last couple of years, has received a great deal of scrutiny from the press and others with interests in the political fallout. One FOIA request generated 5,500 e-mails, each of which Pominville had to track down, print out in full, and send to human resources staff at the district to have personal information redacted. It consumed days' worth of Pominville's time. Another request involving a former superintendent and six board members, which Pominville was working on at the time of this interview, was expected to be even more extensive. That was expected to be completed--with the help of a service called RestorEmail--in only five hours.

The Tedium of ExMerge
The district runs Exchange 2003 on three separate servers to support about 800 mailboxes. Nightly, Pominville runs ExMerge, a Microsoft utility that extracts data from mailboxes and merges it to generate PST files that can be exported to disk at offsite locations for archiving. This process is run for each of the three servers.

That's great for disaster recovery scenarios, said Pominville. Should an Exchange server go on the fritz and have to be rebuilt, he can simply import the PST files ExMerged the night before and do a restore of the files.

But the process provided very little help in responding to FOIA requests. In those situations, he'd have to go "digging through databases." He'd open up a single database at a time and poke through it to find the messages from or to individuals whose e-mail was being requested. That would involve restoring the PST containing all mail for that day, moving it into his own mailbox, and performing the search. If the period under question was more than a day (and it typically was), he'd have to pull PSTs for each day--one for each of the servers. "I couldn't pull them together and look across the organization when filtering or querying for data," he explained.

Why not simply go into the individual's e-mail box itself and track down the messages in question? "I could never trust that they hadn't deleted mail 20 or 30 days ago during the period when I was looking for data. So I'd have to go back to PST files knowing that the data was going to be there for those time periods."

Spam Filtering Service Holds the Key
About six years ago Pominville had begun using a spam filtering service called SpamStopsHere from Ann Arbor-based Greenview Data.

As part of that service all of the e-mail sent to a howellschools.com address goes first through the spam filter. "The firewall says, 'Only accept mail from [SpamStopsHere],'" he said. "I don't receive mail from anyone else."

Pominville wondered why the same company couldn't also provide e-mail archiving services,. "Legally I have to be archiving messages for two years," he said. "They were already looking at every message that got sent through our district. I kept saying, 'Please, build something.' Finally, they did."

Pominville did beta testing on the new service--RestorEmail--for about a year, until it was officially launched in July 2009.

One version of the service, Email Archiving Edition, provides indefinite archival storage and is priced at $45 per user per month. The Business Continuity Edition preserves e-mail on a rolling basis for 30 days for a dollar per user per month.

What Pominville said he finds invaluable is the way it enables him to perform e-mail lookups. "I can run filters on multiple mailboxes at the same time," he explained. "I can go in and place different queries on mail from [this person] and [that person] and [that other person] and just keep adding filters for dates. It's a lot easier for me."

As the results are returned, they're listed message after message. Pominville can highlight the ones he wants and export them as individual MSG message files.

That exporting capability is the only feature of the service he'd like to see upgraded. "It would be nice to export out to a single PST file." (The company said it expects to be offering a PST export option soon.)

Exchange May Go, but Not SpamStopsHere or RestorEmail
Pominville said he plans to move his e-mail off of Outlook and Exchange and onto a hosted platform, either Gmail or Live@Edu, sometime during the school year. He's testing both currently among a group of users. What won't be moved is his spam filtering service or his e-mail archiving practices. "The pricing I've received [for Gmail spam filtering] is a lot more than I pay now," he said. "So why change?"

In fact, he said he doesn't understand why anybody hosts solutions for those types of services anymore. "In a school, we're limited in size and scope. We're going to continue to lose people. We're having to do more with less every year. Things like hosted mail, spam filtering--that doesn't help kids learn at all. But it's stuff we still have to support. Let the experts do that, so we can concentrate on the classroom, student information systems, online learning--things that are actually helping kids."