The Bush administration told a federal court March 21 that computers that were in use from 2003 to 2005 — when two groups allege that the White House lost millions of e-mail messages — have likely been replaced, making copying the data on current computers a waste of time and money.
Responding to the latest court order in ongoing litigation over the White House’s e-mail archiving system, administration officials said they should not be forced to make forensic copies of current hard drives because the drives from the period in question have likely been destroyed as part of routine information technology upgrades. Furthermore, officials said they could not justify the time and money necessary to make forensic copies of all electronic media, and they believe any missing e-mail messages can be retrieved from backup tapes.
A federal court is considering forcing White House officials to copy the current hard drives and other storage media because they could contain the e-mail messages the groups are suing the Bush administration for losing.
George Washington University’s National Security Archive, one of the plaintiffs, has said the court should extend its preservation order to force the White House to save data on current computers in addition to the backup disaster recovery tapes it was ordered to keep in November 2007.
Administration lawyers contend that such an order would be burdensome and unjustified. Officials explained in a response to the federal magistrate that they did not have the capability to make forensic copies, and it would be expensive to hire a private contractor to do so. They said they could create snapshots of the hard drives, but it would require hundreds of hours of employees’ time.
“Even creating and preserving active data copies, rather than forensic copies, of computer workstations would similarly impose significant time and cost burdens, which would far outweigh any marginal utility gained from creating and preserving those copies,” according to the administration’s response.
Theresa Payton, chief information officer at the Executive Office of the President’s Office of Administration, said in a March 21 declaration to the U.S. District Court for the District of Columbia that most workstations that were in use from 2003 to 2005 have been replaced and that the CIO’s office does not maintain detailed historical logs or other records to track the location history of computers. Furthermore, no formal process is in place to keep tabs on other media, such as Zip drives or floppy disks, she said.
Payton said the Office of Administration has been trying to replace about one-third of the computers on the Executive Office of the President’s network each year to improve security and performance. She also said that when the computers are retired, they are often sent off-site to be destroyed in accordance with Defense Department guidelines, but copies of active data — which could include e-mail messages, depending on the user’s settings — are made and transferred to the new machines.
Meredith Fuchs, the National Security Archive’s general counsel, said the White House’s filing did not answer the specific questions posed by the court regarding the estimated cost of creating forensic copies and how many computers would be involved.
The organization is expected to respond to Payton’s declaration and the attorneys’ filing by March 25.
