RealTime IT News

Expert: White House Can Recover E-mail on The Cheap

A group suing to force the White House to preserve current e-mails -- and restore allegedly missing ones -- is firing back at claims that archival and recovery work would be too costly.

In a court filing Tuesday, the National Security Archive blasted claims by the U.S. Executive Office of the President (EOP) that complying with an earlier order to preserve data would prove overly expensive, labor-intensive and ultimately futile in preserving e-mail from its current and retired workstations.

"The costs associated with copying or imaging ... sources of missing e-mails is not only quantifiable, but is also nominal," wrote attorneys for the National Security Archive, an independent, non-governmental research institute at Washington, D.C.'s George Washington University.

"EOP's bald assertions that costs cannot be quantified and are not presently knowable are disingenuous," they added in the filing.

When the U.S. District Court for the District of Columbia requested a cost affidavit from the EOP, the U.S. Department of Justice (DOJ) -- representing the EOP -- said that if older workstations were still in use, finding and copying hard drives would create an "awfully expensive needle to justify searching a haystack."

The effort would require "hundreds of hours of work" and outweigh any "marginal utility" gained from creating and preserving copies, it also said in earlier filings.

Additionally, the EOP said complying with the cost-affidavit order would require a lengthy process of identifying and contracting with a vendor to even estimate cost.

Citing the pending litigation, DOJ lawyers representing the EOP declined to comment.

In its reply to the U.S. District Court for the District of Columbia yesterday, the Archive included a declaration from a forensic and data-mining expert, Al Lakhani, who said forensics work would be minimal in labor and money.

The typical cost of forensic imaging a 100GB hard drive is between $400 and $1,000 and takes two to three hours, according to Lakhani, a managing director in Alvarez & Marsal's dispute analysis and forensic services unit.

Imaging of smaller external devices ranges between $50 and $250 and can be done in a half hour or less, he said in the filing.

Lakhani also said another approach for extracting files from a hard drive -- write-block copying -- could prove useful since it doesn't require forensic software.

The write-block copying method uses hardware attached to a hard drive to "freeze" the hard drive in a read-only mode. Cost ranges between $250 and $500 for the device, which Lakhani said can be reused multiple times.

The technique's one drawback is that it does not capture unallocated space from a hard drive that could contain e-mail files, he added.

The latest back-and-forth comes as merely the latest in an ongoing saga pitting White House technical staff against a host of critics, who are seeking access to stored e-mails and other data files, as well as further information on the office's backup and retention policies.

Federal laws require White House e-mail to be considered part of the nation's historical record and preserved.

The National Security Archive joined a year ago with the left-leaning advocacy group Citizens for Responsibility and Ethics in Washington (CREW) to jointly file a lawsuit against the EOP, seeking to retrieve what the two contend are missing e-mails.

Initially, White House IT officials admitted in previous court depositions and in congressional testimony that potentially millions of e-mails from the past eight years have been erased.

Since then, the White House's Office of Administration had sought to dismiss the legal action, indicating missing e-mails actually may be recoverable.

Two weeks ago, Archive and CREW jointly requested a temporary restraining order (TRO) to stop any destruction or deletion of computing media within the EOP's domain.

A similar TRO is currently pending against the White House regarding backup tapes. That order came about in response to allegations by the groups that the EOP had poor backup processes in place.

White House officials, responding to allegations that tapes had gone missing or were improperly recycled, stated at one point that efforts to reconstruct lost documents from disaster recovery tapes could cost taxpayers upward of $15 million.

Also earlier this month, CREW asked the FBI to investigate whether White House officials obstructed justice by allegedly destroying documents related to the leak of CIA agent Valerie Plame Wilson's covert identity.

An FBI spokesperson said the agency had reviewed the request and then referred InternetNews.com to a DOJ spokesperson, Peter Carr. Carr later told InternetNews.com that the matter "is under review."