Request for Email Metadata (Information Technology)

To Whom It May Concern:

Pursuant to the Ohio Open Records Law, I hereby request the following records:

For all email accounts under the management of this city, please provide me the following information for all emails sent and received during January, 2019:

1. From address
2. To address
3. bcc addresses
4. cc addresses
5. Time
6. Date

E-mail metadata is trivially exportable from the IT infrastructure of any modern e-mail archiving or data retention system - such as Microsoft Outlook 365, Google, Datacove, etc. - and should be deliverable in a .CSV, .XLS, or other machine readable format.

Please note that I am not requesting the contents of each email. E-mail metadata does not include the contents of the specified e-mails, thus do not need individual review for redaction.

The requested documents will be made available to the general public, and this request is not being made for commercial purposes.

In the event that there are fees, I would be grateful if you would inform me of the total charges in advance of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or CD-ROM if not.

Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your response to this request within 10 business days.

Sincerely,

Matt Chapman - Free Our Info, NFP

This request does not require the creation of records, as the records pursuant to this request already exist in a discrete context separate from the contents of emails themselves. Any steps to retrieve the requested documentation is simply retrieving those discrete records.

Here is the technical documentation which describes how messages are stored within Exchange for storing emails: https://msdn.microsoft.com/en-us/library/ee158780(v=exchg.80).aspx . The takeaway from this document is that while a message itself is an object (a record), there are subobjects (also records) for 1. the message body, 2. recipients and sender(s) 3. subject line and 4. attachments. To the extent that you would likely consider an attachment to be a distinct record, despite being a component of an email message in its method of storage, then it follows that the recipient objects of an email would be a distinct record apart from the message themselves.

While I understand the concern of the extent and volume of this request, I ask that you reconsider on the basis that the work involved to procure the requested information is a trivial task, as stated in the original request. Two examples to produce the requested output are one of the following powershell one-liners. These are trivial to run by your IT staff:

`get-messagetrackinglog -Start "1/1/2017 00:00:00 AM" -End "2/1/2017 00:00:00 AM" | select timestamp, sender,{$_.recipients} | export-csv c:\results.csv`

`Get-Mailbox | Search-Mailbox -SearchQuery "received >= 01/01/2017 AND received <= 02/01/2017) OR (sent >= 01/01/2017 AND sent <= 02/01/2017" -LogOnly -LogLevelFull`

If this is too technical, then the process can also be done with Excel without any additional software. The only requirement would be a permission set similar to the above commands.

With this information in mind, please re-review the request.

Could you provide some more information about why the powershell didn't work? The powershell I provided is fairly vanilla in that Exchange has had functionality to run those commands since 2010. My impression from your response is that little to no troubleshooting was done - something that is typically a core tenet of IT work. Furthermore, I'm not sure that "augmentation" is required in this case, especially considering the relative banality of what I'm requesting and how widespread the use of the commands are throughout the industry - in particular for ediscovery and litigation.

Some things could have happened to prevent the provided powershell from working:

1. A connection was not made to the exchange database. The IT dept. should ensure that they've created a connection prior to running the provided commands.
2. The retention policy does not have a retention policy that retains message tracking logs up to the provided timeframe. (Not relevant for the mailbox search cmd).
3. A typo in one of the one liners I provided. This ought to be easy to fix, and I can help.
4. The commands weren't available from where the server/PC that the commands were executed from. It is likely easier (but not required) to run the commands directly on the exchange server.
5. The user account did not have the correct privileges. Ensure that an admin, or similar, account is used.

This all said, there are other routes to extract the information that still require no exceptional work, nor production system changes. I'm not certain what email system you use, but if your agencies use Office 365, then there are even easier methods for retrieving the requested records. I can provide a step by step guide for Office 365.

For now, I kindly ask that the following documentation be forwarded to your IT department for their review:
https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/search-mailbox?view=exchange-ps
https://docs.microsoft.com/en-us/powershell/module/exchange/mail-flow/get-messagetrackinglog?view=exchange-ps

Let me know if you would like any further documentation or tips. If it's helpful, I am always available for a phone call to discuss, or walk your IT department through any work. For what it's worth, I have ten years of systems administration experience in large, distributed infrastructures, and am very cognizant of what might be considered technically sensitive work. I can be reached at 312.721.7448.

Thanks and regards -
Matt Chapman
Free Our Info, NFP

Any updates or additional for this request?

Thanks in advance.
Matt Chapman