Anatomy of a messaging breakdown

Following the release of the Debelle Commission report, a Select Committee of the South Australian Parliament undertook its own inquiry into the circumstances around the missing email. It reported to Parliament in late 2013. It undertook rigorous questioning of Telstra, provider of the South Australian Government Electronic Messaging System (SAGEMS), and the then SA Government Chief Information Officer Andrew Mills.

At the time, more than 76,000 Exchange 2007 mailboxes were provisioned to 26 different SA Government Agencies through SAGEMS under contract through Telstra. The contract was for 3 years and completed in May 2014.

In 2012-13 just over one billion emails passed across the system, and that comprised over 110 terabytes of data.
Mills confirmed the SA Government policy of wiping data from computers used by the Minister and the Minister's staff when there is a change of Minster, after which the computer is then reused. The purpose of the DBAN process is to overwrite every sector in the hard drive on numerous occasions and thereby make it impossible to recover data from the computer. That process prevents forensic analysis of the hard disk.

This process had been followed when Mr Weatherill had ceased to be Minister.

Mills also commented that Telstra kept a backup of the Exchange mail server but was not responsible for email retention.
“Telstra doesn't hold the existence of emails. That's under the control of the user of every email box,” he said.
“Telstra takes backups for technical restoration of the system if it breaks down. There is a series of different backups. They are snapshots in time of the system. They are not a continuous record of the system.”

Daily backups were kept for a week, with weekly backups on a Saturday kept for a month and 12 monthly backups taken on the first Sunday of each month and kept for a year. Then there is a yearly backup taken on the last Saturday in June, and that is kept for contract plus three years. Only 14 days of deleted emails are retained in backups.

At the time of the email sent by Mr Weatherill’s Chief of Staff in 2010, email archiving was not included as part of the SAGEMS Service, although there had been some discussions with Telstra about a potential rollout.

Mills was queried on how SA Government Agencies could comply with record-keeping obligations if they were routinely destroying all emails”

“Just because an email is not on the messaging system doesn't mean it has been destroyed,” he responded.

“It could be on paper in a file. It could be held on other storage media because that is where agencies store their records.

“They vary from electronic document record management systems. Some agencies have implemented those and so they will shift the email to that system if it is a record, through to storage on what's called .psts, which is a way of storing messages away from the messaging system and maintaining those for a record.”

Asked for his own regime for retaining emails considered to be records, Mills responded “At this stage I store them in .psts for myself. If I printed every email record, I would fill a file in probably a week with the paper, so I maintain them in electronic form on our file server.”

Simon Blewett, then Chief of Staff for Minster Jay Weatherill, was asked how he came to find that he had retained a copy of an email deleted from Exchange.

“ … I had a set of folders from the education days on my computer in the Premier's office, and that is the set of folders that I searched on the day in which I found this email.

“My recollection is that I found that forwarded email by clicking on the original email—at the top of the email—and that indicates that the email was forwarded. I think what that then occurred was that I took a screenshot, or something, of that forwarded email.”

The Select Committee also explored the possibility of forensic analysis of the SAGEMS mail server to search for the missing email, but this was shot down as hugely impractical by Telstra.

“Telstra does not have the technical capability to search across all 76,000 individual email boxes for a particular email,” it responded.

“Telstra maintains back-up and disaster recovery facilities as outlined in clauses 25.1 & 25.2 of the EMSA. At the written request of a State Authorised Representative, Telstra is able to use the backup to recover the contents of individual mailboxes to a ".pst" file.

"This is done one mailbox at a time and carries an agreed charge by Telstra to the State. The restoration of 76,000 email boxes would be very time intensive. Based on current tools and processes this would take more than 12 months, and possibly much longer.

“Even if a particular mail box is restored, Telstra does not have the current capability or contractual obligation to search electronically for a particular email within the recovered mail box or boxes. Under Schedule 5 of the EMSA, when the restoration of a particular mailbox is required, Telstra is required to provide the entire contents of the individual recovered mailbox or mailboxes to the State Authorised Representative. Telstra does not access or view the contents of that mailbox.”