Forrester Research, Inc., 60 Acorn Park Drive, Cambridge, MA 02140 USA Tel: +1 617.613.6000 | Fax: +1 617.613.5000 | www.forrester.com Market Overview: Social Media Archiving by Nick Hayes and Cheryl McKinnon, March 9, 2015 For: Security & Risk Professionals KEY TAKEAWAYS Most Archiving Efforts Don’t Address How Organizations Communicate Today Archiving and retention management efforts struggle to keep up with the rapidly evolving ways corporate workforces leverage social channels, including how they access these channels with mobile devices. Social channels introduce painful archiving headaches, with more metadata, proliferating networks, and countless devices and access points. Work Toward A Comprehensive Archiving Strategy An archiving strategy focused on email as the sole method for workforce communications is ill-suited to handle the dynamic and more complex data that results from social communications. To manage the numerous channels your workforce uses, develop a flexible strategy that preserves the full context and formatting of every social channel. Connectors And Supervision Features Differentiate The Social Archiving Market Social archiving vendors differentiate by the variety of social connectors they offer, their social and archiving partnerships, and how they enable search and supervision of archived social data both prior to and aſter publishing the social post. Another key factor is how they preserve and recreate social context and formatting.
Transcript
Forrester Research, Inc., 60 Acorn Park Drive, Cambridge, MA 02140 USA
Market Overview: Social Media Archivingby Nick Hayes and Cheryl McKinnon, March 9, 2015
For: Security & Risk Professionals
Key TaKeaways
Most archiving efforts Don’t address How Organizations Communicate TodayArchiving and retention management efforts struggle to keep up with the rapidly evolving ways corporate workforces leverage social channels, including how they access these channels with mobile devices. Social channels introduce painful archiving headaches, with more metadata, proliferating networks, and countless devices and access points.
work Toward a Comprehensive archiving strategyAn archiving strategy focused on email as the sole method for workforce communications is ill-suited to handle the dynamic and more complex data that results from social communications. To manage the numerous channels your workforce uses, develop a flexible strategy that preserves the full context and formatting of every social channel.
Connectors and supervision Features Differentiate The social archiving MarketSocial archiving vendors differentiate by the variety of social connectors they offer, their social and archiving partnerships, and how they enable search and supervision of archived social data both prior to and after publishing the social post. Another key factor is how they preserve and recreate social context and formatting.
Disruptive technology trends such as mobile, social, and cloud wreak havoc on information governance. Many compliance professionals still struggle to meet archiving and eDiscovery requirements with email, and now employees are using social and mobile channels, which are even harder to control. Their dynamic format creates headaches for those responsible for ensuring the authenticity of social posts and preserving related context — including author, location, and ensuing discussion threads. Social archiving vendors help meet these emerging challenges with tools that directly capture social posts, fully recreate metadata, and enable quick, intuitive searches to handle review and supervision tasks. This report highlights the key differentiating features of social archiving vendors, which are leading an evolution of the broader information archiving market important for risk and compliance professionals to understand.
table of contents
social Channels are a Growing Gap For Compliance and eDiscovery
Most Programs aren’t equipped to Handle How their Workforce communicates today
reconstructing Social Media as email is a Short-term Solution
Develop a Comprehensive archiving strategy
The social archiving Market is Nascent But innovating Quickly
key Differentiators: Breadth of connectors and tailored Supervision features
recoMMenDationS
Don’t Let Legacy infrastructure Dictate strategy
supplemental Material
notes & resources
forrester interviewed 45 vendor and user companies and drew from a wealth of analyst experience, insight, and research through advisory and inquiry discussion with end users, vendors, and industry experts.
related research Documents
revamp your Social Media Guidelines to Govern today’s Social enterpriseJune 10, 2014
the forrester Wave™: Social risk and compliance Solutions, Q2 2014May 7, 2014
the Social Media legal and regulatory landscapeJuly 31, 2013
Market Overview: social Media archivingtop tools to capture a range of Social communicationby nick Hayes and cheryl Mckinnonwith chris Mcclean and claire o’Malley
sOCiaL CHaNNeLs aRe a GROwiNG Gap FOR COMpLiaNCe aND eDisCOveRy
The use of internal and external social channels across a range of mobile and personal devices is now the status quo for your workforce. And innovative companies across industries now actively encourage this type of engagement, looking for ways to improve the way employees collaborate with each other and build deeper, meaningful relationships with customers.1 Yet, as these social media habits crystallize, compliance professionals struggle to keep their archiving and retention strategies up-to-date, because:
■ More metadata and context have created new archiving headaches. To effectively archive social media conversations and ensure that the full intent and scope of social discussions are preserved, you have to capture additional data points that weren’t necessary or didn’t even exist in the past. This includes metadata like timestamps of edited, draft, and deleted posts, hashtags, the audience of the post, long conversation threads, geodata, shortened and full-length hyperlinks, and embedded images and videos. These not only create storage and retention issues, but make supervision and eDiscovery tasks more cumbersome as well.
■ Regulatory requirements are stricter and extend to all forms of communication. Many regulatory bodies — such as the Financial Industry Regulatory Authority (FINRA), the Federal Financial Institutions Examination Council (FFIEC), the Federal Trade Commission (FTC), among many other state, federal, and foreign government authorities, require organizations to archive social media communication just as any other form of electronic communication.2 These obligations even extend to all related metadata of social media as well.3 As the regulatory landscape takes shape, fines and penalties for noncompliance are sure to become much more frequent.4
■ Social channels continue to spawn and mutate. There are many more internal and external social channels today than there were even a few years ago, and more continue to come to market. For example, Pinterest and Instagram only first launched betas of their sites in 2010, and it was recently reported that Facebook plans to offer an enterprise social network called
“Facebook at Work.”5 Moreover, these social networks continue to develop at an incredibly rapid pace. Keeping up with these evolving features, functions, and permissions encumbers compliance professionals trying to effectively collect and preserve social media communication.
Most programs aren’t equipped To Handle How Their workforce Communicates Today
Archiving and retention programs lag behind in their ability to capture social media content, with only 7% of organizations actively capturing and archiving data from public social networks like Facebook and LinkedIn, and only 15% doing so for social collaboration sites like Jive and Salesforce Chatter (see Figure 1). Instant messaging (IM) has slightly better coverage at 30%, but it’s clear that social channels are well behind more traditional digital communication channels. Even when organizations do archive social data, the process is often ineffective, leading to incomplete search results during eDiscovery, investigation, and policy reviews.
Reconstructing social Media as email is a short-Term solution
The key goal of any archiving strategy is to preserve the context and form factor in the way the content was originally delivered. Unfortunately, because most legacy archiving solutions are designed for email, they can only integrate social data by converting it into an email format. While this approach can help you meet compliance obligations today, there are several reasons why this approach is limiting and should only be viewed as a short-term solution:
■ You lose context. Email formatting limits the relevance of captured data and isn’t flexible enough to demonstrate how hashtags, hyperlinks, or geolocation are related to other social posts, comments, or shares. Shortened hyperlinks get captured as text and aren’t associated with their full URL paths and original destination pages. This approach also treats images and videos as attachments, diminishing their relevance and value as visual aids during reviews.
■ Email size constraints are limiting. Social data is filled with rich media, including embedded images and videos that often exceed default file size limits of email archiving servers and transfer protocols.
■ Data integration isn’t continuous. The majority of email archiving solutions don’t have direct connectors to social networks, which means they have to rely on and integrate with vendors that do (most of which are referenced in this report). This approach lags, however, because these vendors only offer a finite number of queries per day, and there may be difficult formatting and data processing requirements between systems.
■ Search and supervision are cumbersome. When social data is converted into an email format, the data doesn’t always transfer consistently; unrelated records may appear in the same email, long comment threads get split across several emails, or in other cases, duplicate records start appearing across your archive. This creates inefficient searches, adds time to investigations, and can lead to inconsistencies in policy reviews that your organization uses to demonstrate regulatory compliance.
■ Regulators may not accept it down the road. Today, regulators are satisfied to see you meet basic information archiving and retention requirements, but because of the limitations described above, that might not always be the case. Not in the next year or two, but soon thereafter, Forrester expects legal and regulatory bodies to tighten their requirements for social data archiving and supervision.
DeveLOp a COMpReHeNsive aRCHiviNG sTRaTeGy
As social channels gain relevance and email gets relegated to just one of many communication channels your workforce leverages, your archiving and retention strategy has to follow suit. You can’t change your strategy overnight, but you can begin building flexibility into your processes to capture
data across all workforce communication channels, as well as inbound social communications. This will help improve the efficiency of your program and prepare you for new channels your workforce adopts down the road. To start working toward a comprehensive strategy:
■ Integrate a wide array of social channels and connectors. Social media isn’t one communication type — social channels span across a range of disparate internal and external networks, publishing platforms, IM systems, and mobile devices (see Figure 2). No organization utilizes every single network, platform, and device (e.g., it’s not likely you use both Microsoft Yammer and Salesforce Chatter), but most workforces communicate across at least one (and in many cases several) within each major category. Make sure you have an approach to capture and archive data across every channel your organization leverages.
■ Extend your reach beyond your corporate network and VPN. When social activity is explicitly for work purposes, make sure you are able to capture it from all sources and devices your employees use. For social data, you can usually do this by using connectors that interact with individual social accounts. For mobile activity, archiving solutions can help you meet requirements for BlackBerry and Android devices, but difficulties arise with iMessages on iOS due to Apple’s app containerization and default message encryption.6
■ Capture public social data directly from your social accounts and publisher(s). When you have capabilities to capture data directly from accounts via API, corporate network, endpoint, or publishing platform, your coverage is more comprehensive because you gain access to a broader set of metadata and can capture it continuously throughout the day, rather than relying on scheduled data transfers. It also enables quicker identification and remediation of policy violations when you have automated social risk capabilities in place.7 And by connecting with your social publisher, you can gain visibility into review and moderation activity that takes place prior to interactions posting.
THe sOCiaL aRCHiviNG MaRKeT is NasCeNT BuT iNNOvaTiNG QuiCKLy
Investments in archiving still tend to prioritize email retention and other long-standing sources of enterprise content, such as document management systems.8 That said, social archiving vendors are gaining traction quickly, with interest growing especially among large enterprises in heavily regulated industries. While historically risk-averse and resistant to cloud services, these organizations appear more willing to move business applications and associated data to the cloud; as this trend continues, it creates more opportunity for social archiving vendors, which are largely cloud-based.9
Strong growth in social archiving is also a result of innovation among vendors that can now more effectively meet archiving challenges across all social communication channels. These vendors offer several unique capabilities that legacy archiving vendors do not. Specifically, they:
■ Capture social data through native connectors. Social archiving vendors all have proprietary capabilities to capture social data, including all relevant metadata and associated content. Many can connect to social accounts directly via OAuth if the account owner permits the connection. Vendors that take this approach work closely with social network companies, advocating for improvements in their APIs to allow more comprehensive integration and functionality. A few social archiving vendors, such as Bloomberg and Netbox Blue, collect social data differently; they monitor social data through customers’ corporate networks and provide connectors for when users access social accounts externally.
■ Offer unified archiving or partner with email archiving vendors. Many social archiving vendors offer platforms that can store multiple content types, including email, in addition to social channels. These platforms store all data types in a central repository and offer a portal to perform search and eDiscovery actions. Other vendors — including Hearsay Social, Netbox Blue, OpenQ, Socialware, and SunGard — offer social connectors and can capture social data, but they partner with email archiving vendors to offer more full-featured archiving and eDiscovery platforms.
■ Enable advanced search and filtering features for social media supervision. Most social archiving solutions capture social data in its original format (as opposed to email). In doing so, they retain each social post, comment, and status update as an independent record, enabling tags and other connections so records stay connected and maintain full context. To further enhance filters, searches, and general context, many vendors can also automatically tag social data based on preconfigured policies using metadata, actions, or keywords. This helps improve the efficiency of supervisory tasks like policy reviews, legal holds, and investigations.
Key Differentiators: Breadth Of Connectors and Tailored supervision Features
Social archiving vendors differentiate in a number of ways, including the variety of social channels they can capture, the method of capture (via API, proxy, corporate network, or endpoint), their social and archiving partnerships, and the effectiveness of their search and supervision capabilities (see Figure 3).
Other features that differentiate social archiving products are the speed with which users can perform searches, the flexibility of their dashboard and reporting features, and the ability to capture historic data and full hyperlink context, including full versions of shortened hyperlinks and links’ destination pages. The authenticity of social context and formatting captured by these products varies as well. For example, ArchiveSocial’s archive presents social data in a completely authentic format for each social network, meaning that search results appear in a native stream format with high-resolution photos and video playback.
Finally, organizations that want to archive LinkedIn data should look for vendors that are “certified compliance partners” with the professional social network.10 Participating vendors gain access to proprietary LinkedIn APIs, which provide enhanced archiving capabilities, including the ability to capture company pages, groups, and all user activity including posts and private messages, as well as the ability to moderate profile pages for authorized accounts.11
Figure 3 The Social Archiving Vendor Landscape (Cont.)
Source: Forrester Research, Inc. Unauthorized reproduction or distribution prohibited.117533
Socialware
SunGard Protegent
Actiance
ArchiveSocial
Bloomberg Vault
Erado
Global Relay
Hearsay Social
Integritie
Netbox Blue
Proofpoint
Smarsh
Social Safeguard
Key eDiscovery And Archiving Features3-2
eDiscoveryplatform
Recreatessocial formatting
Hyperlink capturewith destination
screenshots
Images & videosautomatically
display
LinkedIn Compliance
Partner
R e c o m m e n d at i o n s
DON’T LeT LeGaCy iNFRasTRuCTuRe DiCTaTe sTRaTeGy
The rapid rise of social communications and mobile devices has quickly made a lot of archiving strategies outdated for risk and compliance professionals. However, just because you have legacy infrastructure and technical capabilities better suited to handle longer-standing archiving requirements like email, don’t let these systems dictate how you address new communication channels. Instead, focus on agility, and look for ways to adapt your systems to these new channels and different formats over time. To build a flexible archiving strategy prepared for your firm’s more social future, Forrester recommends that you:
■ Prioritize breadth of channel coverage and flexibility over data centralization. There are benefits to having a central repository to retain and archive all required corporate data, but if it means reformatting data or comes at the expense of integrating other channels into your archiving strategy, it likely isn’t worth it. Particularly for social media, legal reviews and investigations are more efficient when search filters are consistent and social media
records contain full context with a unique identified user. This may mean you archive social channels separately from email and other content types to start, but that’s an acceptable approach for now, as integration can take place over time.
■ Streamline review processes with automated tagging and filters. The more data you capture, the more difficult it is to perform searches and conduct investigations. Combat this with more efficient classification of inbound data. By applying tags based on certain keywords, people, or behaviors, you can apply a risk-based approach to reduce the time it takes to complete your policy reviews and investigations.
■ Consider capabilities that enable active compliance and policy enforcement. Some social archiving vendors also provide capabilities to help ensure your workforce adheres to corporate social policies before they officially publish posts onto their respective accounts.12 Through API, proxy, or corporate network integration, these platforms monitor account activity and will automatically trigger review and approval processes for social posts prior to publication.13 These features can act as an additional compliance layer, and mitigate reputational as well as information security and privacy risks inherent in widespread workforce social media engagement.
■ Improve the business case by leveraging the data in new ways. Your archiving data is a potential gold mine for risk and compliance use cases that can benefit from big data and predictive analysis. For example, some compliance departments already monitor their employees’ use of internal communications in the hopes of detecting misconduct and other policy violations early on by correlating employee performance with their level of interaction with clients.14 Actively monitoring social communications can also help uncover fraud, corporate compliance violations, and operational risk events. Make sure to evaluate any potential vendors to determine how well you’ll be able to use their products for additional analysis.
suppLeMeNTaL MaTeRiaL
survey Methodology
In the Forrester Research And Arma International Records Management Online Survey, Q3 2014, Forrester conducted an online survey of 445 records management decision-makers from August 5 to September 4, 2014. Approximately 74% of respondents were located in the United States. The remaining participants were based in Canada, the UK, Europe, Asia, and Australia/New Zealand. Government, other, and education/nonprofit were the industries with the most respondents (approximately 34%, 18%, and 9% of the pool, respectively).
eNDNOTes1 Internal social tools such as instant messaging and enterprise social networks like Microsoft Yammer or
Salesforce Chatter are already widely adopted by enterprises today. See the February 25, 2015, “Benchmark The Use Of Your Social Business And Collaboration Systems” report.
Engagement technology has only recently become critical. As of Q4 2013, 43% of information workers use a smartphone for work, and that trend is rising rapidly. See the June 11, 2014, “Serving Your Customer-Obsessed Employees” report.
2 This list also includes the Securities and Exchange Commission (SEC), the National Labor Relations Board (NLRB), the Health Insurance Portability and Accountability Act (HIPAA), the UK Financial Conduct Authority (FCA), the Investment Industry Regulatory Organization of Canada (IIROC), and even the Texas Public Information Act, as well many others. For a detailed look at how the current regulatory landscape applies to social media to help compliance and risk management professionals focus their efforts and prepare for an even more regulated future, see the July 31, 2013, “The Social Media Legal And Regulatory Landscape” report.
3 For example, the state of Washington Supreme Court ruled that metadata is subject to disclosure under its Public Records Act. The Washington Superior Court ordered the City of Shoreline to pay $538,555 after the presiding judge ruled that metadata associated with public records is subject to disclosure under the state’s open records law. Source: Rebekah Bradway, “Metadata as a Public Record: What it Means, What it Does,” Digital Media Law Project, July 25, 2013 (http://www.dmlp.org/blog/2013/metadata-public-record-what-it-means-what-it-does).
4 For example, FINRA’s targeted examination letters demonstrate how regulatory bodies will first adopt guidance, and then find ways to further review and scrutinize newly implemented mandates. In FINRA’s case, it issued examination letters to targeted organizations under its purview to determine how effectively firms had adopted its social media guidelines. This action demonstrates how FINRA is taking action to
scrutinize and ensure that its two regulatory guidance postings (10-06 and 11-39) are properly adopted and applied by all required entities. Source: “Targeted Examination Letters: Re: Spot-Check of Social Media Communications,” FINRA, June 2013 (http://www.finra.org/Industry/Regulation/Guidance/TargetedExaminationLetters/P282569).
5 Facebook is secretly working on a new website called “Facebook at Work” to get a foothold in the office that will see the social network of more than 1 billion people compete directly with Google, Microsoft, and LinkedIn. Source: Hannah Kuchler, “Facebook seeks foothold in your office,” Financial Times, November 16, 2014 (http://www.ft.com/intl/cms/s/0/db8722bc-6d10-11e4-b125-00144feabdc0.html?siteedition=intl#axzz3Ml4DkZIw).
6 In contrast to other mobile operating systems like Android or Windows, the highly containerized architecture of iOS limits interaction between certain apps such as iMessages and eliminates the ability for data capture to take place natively on the device. A few archiving vendors offer workarounds to this dilemma either by: 1) partnering with telecommunications companies to capture SMS texts via their networks or 2) requiring employees to upload data to their corporate PCs via iTunes on a weekly basis. Both options are less than ideal and require additional policy controls that burden employees and may push them to turn to other, unapproved solutions for work-related mobile communications. See the October 1, 2014, “Brief: Apple Throws Down The Privacy Gauntlet” report.
7 Social risk and compliance (SRC) solutions help enable, and even optimize, social engagement while enhancing oversight and mitigating risk and compliance concerns with automated monitoring and enforcement capabilities. See the May 7, 2014, “The Forrester Wave™: Social Risk And Compliance Solutions, Q2 2014” report.
8 According to our data, records management professionals continue to prioritize retaining other content types instead of social channels, including intranets, business applications, and even file sharing and web archiving. Source: Forrester Research And Arma International Records Management Online Survey, Q3 2014.
9 This trend is important to note because: 1) social archiving vendors are more frequently cloud-based as they rely on connectors and APIs with other cloud apps, including all public social networks, and 2) technology management professionals appear to be more at ease with cloud services, meaning they’re more willing to consider moving their archiving solution to the cloud.
10 LinkedIn is the only social network to offer a compliance certification, and works with vendors to develop features and APIs specifically targeted to improve social engagement and compliance in heavily regulated industries.
11 Vendors that are part of LinkedIn’s Compliance Partner Program also gain access to capture and moderate user profiles and LinkedIn’s full Sales Navigator application.
12 The following social archiving vendors offer these control monitoring and enforcement features: Actiance, Bloomberg Vault, Hearsay Social, Integritie, Netbox Blue, Proofpoint (via Nexgate acquisition), Social Safeguard, Socialware, and SunGard Protegent.
13 These automated monitoring and enforcement capabilities are a key feature of a social risk and compliance (SRC) solution. Each solution connects and communicates with social media accounts and networks via API or proxy to allow organizations to set user, group, and account permissions, as well as enforce policy across social networks, including Facebook, Twitter, and LinkedIn. See the May 7, 2014, “The Forrester Wave™: Social Risk And Compliance Solutions, Q2 2014” report.
14 Banks have long worried that staff may turn to personal cell phones or social media platforms such as Snapchat or Facebook to avoid having their work communications monitored by compliance systems. To combat that risk, some compliance departments are benchmarking staff ’s performance against average use of internal communications — trying to detect discrepancies between their profitability and the number of messages sent to clients. Source: Tracy Alloway and Kara Scannell, “Banks tap into big data to trap wily traders,” The Financial Times, November 30, 2014 (http://www.ft.com/intl/cms/s/0/8c2452ee-72c9-11e4-803d-00144feabdc0.html?siteedition=intl#axzz3Km6zGbBt).
Forrester Research (Nasdaq: FORR) is a global research and advisory firm serving professionals in 13 key roles across three distinct client segments. Our clients face progressively complex business and technology decisions every day. To help them understand, strategize, and act upon opportunities brought by change, Forrester provides proprietary research, consumer and business data, custom consulting, events and online communities, and peer-to-peer executive programs. We guide leaders in business technology, marketing and strategy, and the technology industry through independent fact-based insight, ensuring their business success today and tomorrow. 117533
«
Forrester Focuses On Security & Risk Professionals to help your firm capitalize on new business opportunities safely,
you must ensure proper governance oversight to manage risk while
optimizing security processes and technologies for future flexibility.
forrester’s subject-matter expertise and deep understanding of your
role will help you create forward-thinking strategies; weigh opportunity
against risk; justify decisions; and optimize your individual, team, and
corporate performance.
sean Rhodes, client persona representing Security & Risk Professionals
About Forrestera global research and advisory firm, forrester inspires leaders,
informs better decisions, and helps the world’s top companies turn
the complexity of change into business advantage. our research-
based insight and objective advice enable it professionals to
lead more successfully within it and extend their impact beyond
the traditional it organization. tailored to your individual role, our
resources allow you to focus on important business issues —
margin, speed, growth — first, technology second.
foR moRe infoRmation
To find out how Forrester Research can help you be successful every day, please contact the office nearest you, or visit us at www.forrester.com. For a complete list of worldwide locations, visit www.forrester.com/about.
client suppoRt
For information on hard-copy or electronic reprints, please contact Client Support at +1 866.367.7378, +1 617.613.5730, or [email protected]. We offer quantity discounts and special pricing for academic and nonprofit institutions.
