How does RMail and its services fit into the big picture? That is, how does it fit into the world of business practices? Although Chapter 8 pointed out that there is indeed a place for Registered Email and other services in personal matters, it is business matters for which you are likely to use RMail services the most.
This chapters covers several issues of interest to business people such as closed email systems, compliance with regulations, legal acceptance of digital documents, business entities, and a quick review of RMail services related to business. It also covers the famous case of a relatively small enterprise (a large law firm) that could be out of business due to a hack that could have been prevented by secure email practices.
Mossack Fonseca and the Panama Papers
Mossack Fonseca is a Panama law firm specializing in offshore financial operations. When it was hacked recently, the records of over 214,000 offshore entities protected by attorney-client privilege going back to the 1970s were exposed to journalists. It was a confidentiality breach of nuclear proportions affecting thousands of clients including a dozen world leaders.
The hacking was presumably an inside job coördinated by an international consortium of journalists that was intent on exposing financial details of the rich and famous that do business internationally through private trusts, companies, and foundations. This consortium then created a website to make it easy to expose the stolen information to the world. This hack was made possible by a poorly engineered IT security structure. Mossack Fonseca notified its clients in 2016 that it had had an email hack; it then also told journalists that the company had been hacked. Eventually experts noted that, among other poor security practices, the firm had not been encrypting its email.
A mirror of this incident followed in Bermuda, with a hack of the international law firm Appleby, coördinated by the same consortium of journalists. They named this information leak the Paradise Papers. The name association appears to be based on the beautiful beaches of Bermuda where the hack occurred.
It’s difficult to believe that these law firms can sustain these catastrophes and still stay in business. Naturally, they’re now involved in law suits as well as criminal investigations. The firms apparently took cyber safety lightly, or at least security wasn’t a top priority. The Papers are the hand writing on the wall that times have changed.
Disclosure Some attorneys have disclosure statements that say in effect: “If this email isn’t addressed to you, don’t read it.” That’s the extent of the security. Who are they kidding? This is an obviously lame security practice. Shame on them. Encryption is much better.
Still, attorneys aren’t the only professionals with a fiduciary duty to clients, and it’s incumbent on everyone in business to assess their security practices and make sure such practices provide adequate security.
Compliance
Some professions and industries may have self-imposed requirements regarding cybersecurity. There may also be laws and regulations requiring cyber safety. The healthcare industry is a good example.
The healthcare industry has to comply with HIPAA (Health Insurance Portability and Accountability Act) standards. Every time you go to the doctor’s office, you’re required to sign a one- or five-page document regarding HIPAA. Who knows what such documents say, but the medical profession is unrelenting in getting them signed.
Healthcare providers are held to civil liability and even criminal penalties for noncompliance. The result is that medical records are typically secure, even online. HIPAA clearly covers healthcare information communicated or stored in cyberspace. Anytime a healthcare professional or entity uses online services, it first has to ascertain that such services are HIPAA compliant.
HIPAA is and should be a model for every profession that requires a fiduciary duty to clients. But even in professions and industries that do not require a fiduciary duty to clients, there may be a common-sense obligation to keep clients, customers, and other relationships confidential. With that in mind, HIPAA becomes a good model, whether it be for regulations that are self-imposed or imposed by a regulatory body. That is not to say that HIPAA fits every profession and industry, but it does serve as a model. It’s probably accurate to say that HIPAA represents the current highest standard of information security in ordinary business.
HIPAA requires that all patient records and information be kept absolutely confidential. Only those healthcare workers with a need to know have access to such data. And even then providing access to such data to those with a need to know must have the permission of the patient.
Keep in mind that RMail Message-Level encryption and most of RMail’s other services are HIPAA compliant. By being HIPAA compliant they are likely to comply with almost any ordinary business standard of confidentiality existing.
In Europe, the European General Data Protection Regulation (GDPR) is expected to transform the way people think about the need for data privacy relating to email. Businesses dealing with consumer information will be compelled not only to transmit information securely but also to retain auditable proof of secure email delivery. For many businesses, the audit requirement will require them to change email encryption services.
Businesses will need auditable proof of encryption to complete compliance audits and the potential accusations of data breach. This will be particularly true, as the fines prove to be as steep as the regulators have declared. The GDPR Regulation (EU) 2016/679 calls for penalties of 4% of global turn-over with a maximum of fine of 20 million Euros. Considering the potential of a fine tied to a percentage of global turnover, risk managers will begin to appreciate the maintenance of a record of proof of data privacy compliance, or better yet, proof on a message by message basis.
The RMail services provide not only simple-to-use email encryption but also focus on encrypting for compliance. This provides auditable proof of fact of data privacy compliance with a returned Registered Receipt evidentiary record for every encrypted message sent.
Closed Systems
Note that a closed-system approach to email security does not necessarily work well. In a closed system you first log in to the system (a website) and then use the email program provided by the system (inside the system) to send and receive email messages securely with other participants in the system.
For example, I belong to a healthcare network that covers two of my doctors. In order to use email to communicate with the doctors, I have to log in to a special website. After logging in I can use the internal email program provided by the healthcare network.
So one day I logged in to inquire about the safety of a prescription drug I was using. I sent an email to my doctor. The system displays all emails. You can’t erase them. They stand as proof of delivery and proof of content. But no one in my doctor’s office (including my doctor) read the email. As a result, my question went unanswered until an appointment with my doctor three weeks later. It turned out that I should have been using an alternative drug, and so for three weeks was at risk of experiencing an adverse medical event.
The lesson to be learned here is that such a closed system may constitute an extra email system that requires one to check one’s email in two places instead of one (normal email and the closed-system email), or four or five places instead of one. Who can be bothered or keep track? In fact, I also communicate with healthcare providers in two other closed systems in addition to the one I mentioned above. That’s three different healthcare closed systems with email provided. (I’m actually a fit and healthy person.) But that’s just healthcare. I have email capability provided to me in many other closed systems too.
Let’s face it. Am I going to log in and check my email in a dozen (or more) closed systems regularly? Not going to happen. Not me or anyone else. It seems to me that closed email systems are not beneficial (perhaps even dangerous) to senders and receivers alike.
That’s why RMail is so beneficial. It works with anyone’s email, that is, the email that people use every day.
Legal Acceptance
The question that comes up for Registered Email is, is it proof of service (i.e., notice, delivery) in court? How do you prove that registered email was actually delivered? RMail Registered Email was first known as RPost; and RPost has held up in court as proof of service wherever it has been litigated.
The way it works is that RMail Registered Email is delivered to the recipient. You receive a notification by email from RMail that your Registered Email was delivered to the recipient. If you’re not interested in legal proof, that’s the end of the matter. If you need legal proof, however, you need to ask RMail to verify the notification of receipt.
RMail will provide you with a verification that the email was delivered to the recipient and what the content of the email was. RMail does so based on your notification of receipt on your computer, not on data stored by RMail. (As mentioned before, verification of content is beyond what the US Postal Service registered mail provides or what Federal Express and other such carriers provide.)
Upon request RMail provides the verification directly to you based on the notification on your computer; and you keep the verification in storage on your own computer. Thus, you always have proof of delivery and content in your possession, and RMail does not have your email, the notifications, nor the verifications stored in its databases.
Should you have trouble presenting such evidence in court, RMail will provide you with assistance to persuade the court that such verification is unassailable. Since RMail can cite court cases where the verification was accepted, it’s going be hard for the other party (recipient) to successively challenge the verification.
Business Entities
RMail services can serve all business entities from sole businesspersons (e.g., a CPA working out of her house) to large enterprises (e.g., a Fortune 500 company). The following subsections cover a little about each.
Individuals
If you’re an individual reading about the advantages of RMail services to small businesses and enterprises, you must be thinking, boy I wish I could get some of that. The fact is that if you’re an individual, you can use RMail services just as easily as any other business and at a rock-bottom price. If you work for yourself at home without any employees (e.g., a patent attorney with a national clientele, a bookkeeper with local clients), you can use the RMail services conveniently. So RMail services levels the playing field for you too.
Small Businesses
The RMail suite of services levels the playing field for small businesses. Whereas enterprise business software packages, which can incorporate all the RMail services, are available to large companies, most small business cannot afford to operate such business software systems.
In addition, there are enterprise software systems available to large companies that purchase each secure service separately from multiple vendors and incorporate them the enterprise system at substantial cost.
RMail services provide such capability to small businesses at a low cost. Getting set up to use RMail services is quick and easy. If you decide to use RMail services this morning, your personnel can be learning to use RMail by afternoon. It’s pretty easy.
For instance, if you are an independent physical therapist with one partner and two employees, you can set up RMail Services for the four of you and use such services at little expense with no requirement for additional software. That enables you to have the same secure email services as a medical clinic with twenty employees (another small business) or a hospital with 400 employees (an enterprise). And you will be able to comply with HIPAA.
Enterprises (Large Organizations)
Large companies using enterprise business software, such as Salesforce and IBM Notes offer RMail capability. Other such software can easily install RMail services. By easy installment, I mean that the provider of the software can program a button into the enterprise email programs that enables employees to use RMail services. If you are using such enterprise software and don’t have the RMail button, talk to your IT manager about incorporating it.
Another way you can use RMail services in a large company is to simply install the RMail plug-in (extension) into Microsoft Office 365 or other programs that will take an RMail plug-in. That will give all enterprise employees access to RMail services. In addition, an email service provider may provide integration of RMail service for large companies upon request, in particular those operating with Zimbra email services.
If other avenues are not available, a large company can also always use RMail Inbox and RMail Web. They work in any browser.
The thing to remember about RMail services is that they work with all email software and are not limited to working with or within any particular enterprise business software. Consequently, the enterprise IT department can set up RMail services for its personnel with no additional software.
At the enterprise level, RMail services are customizable with more than a hundred off-the-shelf deployment options. You can work with RMail to provide your personnel with RMail services in a way that fits in with your enterprise activities. In other words, RMail becomes the backend for your enterprise email service or as a supplement to your enterprise email service, and no extensive custom programming is needed to incorporate RMail services.
In today’s corporate world where many things are outsourced, outsourcing your secure email services to RMail is painless and inexpensive. And you don’t have to do it piecemeal with several providers. The RMail suite of services is a larger smörgåsbord than available anywhere else. Some important enterprise features to consider are:
- RMail services are accepted worldwide and meet national and international email system standards and requirements
- RMail has fifty patents worldwide to protect its email services
- 24/7 premium support is available from RMail, making it easy for enterprise personnel to use RMail services.
You can get a better idea of exactly what you can do by talking to RMail about how you can incorporate RMail services into your enterprise communication and information systems.
The Essence of Each RMail Secure Service
What is the essence of each RMail email service? Without getting into the details expressed elsewhere in this book, we can take a look at what each service provides to business people.
Registered Email (Proof of Delivery)
The original service, formerly known as RPost, was the first of the RMail services in 2000. Since then it has been used by a wide variety of business organizations. Initially the most intense users were government agencies and the insurance industry. Then bar associations, such as the Florida Bar, starting approving it, the latest being the State Bar of Montana. Today a number of international post offices offer Registered Email under their own name with RMail actually providing the service.
RMail Registered Email is made more convenient by the incorporation of the RMail button into enterprise business software as well as popular email software.
Many different industries have to provide legal notice, send high-value documents, or send sensitive communications. For these businesses, registered email can be a real timesaver (e.g., no trips to the post office, no reformatting your email for snailmail), and it provides peace of mind as well as proof that your email message was delivered. Unlike registered mail, registered email also proves the content.
The essence of registered email is:
- Universal use (works with any email system or software)
- Timestamped proof of delivery
- Proof of what content was delivered
- Convenience
Note that the low cost makes this service sensible to use in more situations than registered mail.
Message-Level Encryption
Message-Level encryption, provides complete security from sender to recipient. The essence of RMail Message-Level encryption is that it makes this process very easy even for a one-time email message. Accordingly, in the instances where you need absolute security, it’s difficult to imagine a simpler encryption service than RMail Message-Level encryption.
An overview of encrypted email benefits are:
- Universal use
- Convenience
- Highest-level security
- Low cost
- Direct delivery to recipient’s inbox
The real question for businesspeople is not whether you need encryption service but rather what you need it for.
Do you really want to take the risk of a hacker intercepting your email message when you instruct your client to deposit $300,000 in XYZ bank? Do you really want to have your email exposed to hacking when you discuss the propriety specifications of a future product that your company is developing in a highly competitive market?
When discussing sensitive matters about clients, patients, trademarks, copyrights, finances, proprietary processes, and the like, it makes sense to keep the communication far out of reach of hackers. In such cases, a hacker’s interests may not be general or random. A hacker may specifically target your business.
Many other encryption procedures, while readily available, are difficult to understand, tedious to implement, and requires a significant degree of coöperation between sender and receiver.
LargeMail Transfer
You can’t count on recipients to have more than a 10MB limit on email. Thus, for exceptionally large digital files that need to be sent securely, RMail LargeMail transfer makes the task easy.
You can think of an RMail LargeMail transfer two ways. First, it’s an extension of encryption. You can send large files to somebody, and it works similar to RMail Message-Level encryption. Large files can consist of images, audio files, video files, software, and the like. The transmission of such large files is absolutely secure from sender to receiver.
Second, LargeMail transfer is useful from a completely different point of view. It enables secure collaboration. Most business people have to collaborate digitally with someone else to get things done.
Collaboration within a company on the company’s local network is as secure as the company’s network (hopefully very secure). But sometimes one must collaborate with outside vendors, contractors, partners, other organizations, and even customers. Even opposing attorneys may need to collaborate on documents that the opposing parties do not want to be made public. Where sensitive information, intellectual property, and proprietary processes and products must be protected, using LargeMail transfer is a common sense practice.
This handy RMail service is important for these reasons:
- Universal use
- Convenience
- Collaboration
- Secure transfers of sizable digital assets
- Low cost
- Automatic purge of files after a set period of time
Keep in mind also that you can bundle multiple files together for transmission via one LargeMail transfer.
E-sign
E-sign is designed to obtain a digital signature useful for getting signatures on business documents, such as leases, insurance cancellations, real estate contracts, and thousands more. No trips to other offices and no FedEx expenses to get ink on paper. The benefits are:
- Universal use
- Easy to use
- Recipient can add a word(s) to an attached document also
- Convenience
- Low cost
- Close deals faster, anywhere, anytime
For documents where only a signature is required, it’s hard to beat E-sign for simplicity.
RSign
Where more than a signature is required, RSign enables you to get the blanks in a document filled in as well as get a signature. For instance, a contract may require that the recipient fill in a number of blanks before signing. Although RSign requires a little learning (i.e., their free web-based training at the RSign website) to be employed effectively, it makes the handling of a wide range of business documents more convenient and faster. Its benefits are:
- Universal use
- Easy learning curve
- Convenience
- Low cost
- Close deals faster
- Create forms templates
For businesses that routinely handle many different types of digital documents in the course of dealing with customers, clients, and other businesses, RSign can be a handy asset.
RForms
For complex digital forms such as contracts and surveys that require that a lot of blanks be filled in according to rules that control the input, RForms enables the creation of efficient document systems. Although typically used by enterprises, this service can also be used effectively by medium-size business firms thus leveling the playing field for businesses that don’t otherwise need to use expensive enterprise software.
General Benefits
The strength of the RMail suite of secure services is that they work with any recipients. There is no requirement that the recipient have any special email service or email program.
There are many systems that provide secure service internally. That is, if both you and the recipient are members or customers of the same closed system or network, you can send and receive messages securely and have built-in proof of delivery.
If you are inside the enterprise network of an organization, if you use certain business software dedicated to enterprise business use, or if you subscribe to a closed system providing email security, you probably don’t have to worry about in-organization security. But such security only extends to the other members of your internal network, not to the general public. Therefore, you are limited in using your email securely.
On the other hand, RMail provides a suite of secure services that work with anyone else on the internet who has an email program. In that sense, RMail is universal.
Summary
It’s time to get serious about cybersecurity in business. You can do it with RMail easily, conveniently, and inexpensively whether you’re a person or an enterprise.