Email Metadata

To Whom It May Concern:

Pursuant to the Vermont Public Records Act, I hereby request the following records:

For all non-personal emails accounts in use by the governor and its staff, please provide me the following information for all emails sent and received between March 5 2018 and March 9, 2018.

1. From address
2. To address
3. bcc addresses
4. cc addresses
5. Time
6. Date

(Yes, this is a repeat from the last request, but judging by the actual documents sent to me, the cost should be dramatically different from the original estimate)

The requested documents will be made available to the general public, and this request is not being made for commercial purposes.

In the event that there are fees, I would be grateful if you would inform me of the total charges in advance of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or CD-ROM if not.

Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your response to this request within 3 business days, as the statute requires.

Sincerely,

Matt Chapman

My assumption is based on personal experiences from departments throughout the US who have made very similar claims that my request for metadata is not technically possible, but later agreed that the request required dramatically less time and effort than initially thought. Often times there's just a misunderstanding of the request, or there is a lack of in-depth technical skills (even within the IT department).

It makes more sense now why my request is deemed so expensive. Thank you for letting me know. Pragmatically speaking, the copying and pasting work can be done much more easily with the use of tools that your computer should already have (eg. excel). If that's not the case, then your IT department almost certainly has access to the tools needed.

With that said, based on the email headers of your response - specifically 'X-Ms-Office365-Filtering-Correlation-Id' - your department appears to be using Office 365 for email. If that's the case, then please run through the below steps. If anything is unclear, please let me know.

If your email server is NOT Office 365, or there are any reasons why this process won't work, please let me know. I am more than happy to write up similar documentation for the email service used by your department. If powershell is preferred, I can provide Microsoft-approved powershell scripts. If Excel is preferred, I can provide documentation explaining how to natively connect Excel to an external mail server.

Steps for exporting email metadata from Office 365:
0. Username must have access to search and export eDiscovery reports. If not, your IT department should have access to either grant the required permissions, or run through these steps themselves.
1. From Internet Explorer, log into https://protection.office.com/.
2. Navigate to "Search & Investigation" -> "eDiscovery" and create a new case.
3. Open the case, then create a new search through "Search" -> "New search"
4. Add a "Type" condition and select, "E-mail messages".
5. Under "Locations" -> "Specific locations" -> "Modify...".
6. Toggle the location that includes "Exchange email" and click "Save".
7. Click "Save & run" and give the search a name.
8. Navigate to "More" -> "Export results", then select the following options:
-Output options: "All items, excluding [...]"
-Export Exchange content as: "Individual messages"
9. Navigate to Export -> "[Name of export]_Export".
10. Click "Download results" and launch the "Unified Export Tool".
11. Paste the export page's "Export key" into the tool's key field.
12. Choose a save location and click "Start"
13. Open "results.csv" from the saved location.
14. Delete all columns that are not the requested metadata and save.

(Please note that depending on the size of the csv files, this may need to be done in batches through the use of a date or sender/receiver conditional within the search query. Similar can be said about filtering down to just your office's department's email addresses.)

Thank you for you understanding -
Matt Chapman

Hi - has there been any response from the IT department? I am worried now that your data retention policy might lead to a loss of the records responsive to this request.

Quick followup - has the IT department had any success?

Thanks again -
Matt Chapman

Quick check in - any luck?

Hi,

Thanks so much for your help with this request! I really appreciate it.

Sincerely,
Matt Chapman