Redaction has been traditionally practiced on paper documents, with black markers or correction tape.  In electronic documents, specific words may be deleted or blocked by changing fonts or background colors.   In the case of email redaction, complete emails may be removed from the divested employees’ email files.  A sound policy with clear objectives must be defined by business leaders and legal counsel prior to engaging the technology staff. Ideally, this will be defined during the due diligence

One objective may be to remove specific emails related to any legal or compliance topic, This objective may be difficult to achieve in organizations that have large number of employees involved in the transaction and/or large email files.  To address this complexity, often the objective is broadened in scope and emails that include specific people are removed in their entirety.  Examples of employees’ correspondence that may be removed are compliance officers, attorneys, supply chain managers, and other key employees that have participated in activities whose correspondence, if disclosed, may provide a competitive advantage to the acquiring company unrelated to the business unit being purchased.  The divesting company typically creates a policy that is conservative in nature to protect their interests.

Once a redaction policy has been created, technology teams must plan their execution strategy by performing investigation of all possible email sources. Divested employee emails exist on active email servers but also in other locations such as on user desktops or laptops, file shares, and third-party archival services.  The scope of the redaction should exclude third-party archival services as those emails typically are not included as part of the divested assets and are only made available to the acquirer in the event of future legal inquiries.  The other locations require extensive inventory scanning of file shares and desktops prior to beginning the redaction process.  Investigation of these sources may result in the discovery that terabytes of storage has been dedicated to email files depending on the number of divested employees and the strictness of the divesting company’s email policies on size and retention.  Sufficient storage is required to make copies of the original email files to process the redaction policy.  The technical execution of the redaction may focus on the removal of any email with a specified list of people in the “To”, “From”, or “cc” fields.  Embedded emails within an email must also be redacted.

Timing of the redaction is critical.  Assuming the acquirer provides email services to the divested employees on Legal Day 1, redaction of an email must occur at that time or shortly thereafter.  Redaction of the current server-based email is usually the fastest and processing this source first allows immediate transfer of current email to the acquirer.  If email files on file shares and desktops are too large to redact immediately, they must be restricted such that employees may not modify them, or remove employee access completely.  Once redaction has occurred, the newly redacted email files may be transferred to the acquirer for employees to have access at the new company.  Original email files may be retained by the seller if required per a  (TSA). 

The divesting company must inform the acquiring company of the redaction and the high level strategy applied.  However, it is strongly recommended that the redaction is kept confidential among those who are negotiating the terms of the transaction or TSA.  Confidentiality is required to assure that employees that are part of the transaction do not make attempts to print or save the emails to an unknown destination (e.g. outside of the company).  Redaction may have implications on a TSA which would require the divesting company to provide redacted emails upon request.  These requests are legitimate if they include information which maintains the best interest of divesting company and are relevant to the divested business unit.  However, fulfilling the request to provide the redacted email may be time-consuming and manual process.

Email redaction is a complex solution but acceptable for any company that is divesting of a business unit.  However, companies involved in a divestiture considering this solution to protect their proprietary information  must be aware of the potential longer term responsibilities related to the redaction as well as the significant time and resources to perform the redaction itself.

 JB

With increasing focus on individual privacy, and threats from malicious sources to gain access to individual’s information or corporate proprietary information, the importance of planning technology isolation during the TSA period has increased exponentially. This isolation is equally important to the organization that is selling the business unit as to the organization that is acquiring the unit to protect the interests of both parties and is required in regulated industries.

The most important, yet often challenging, step to a successful divestiture and impending acquisition of a business unit is to have a clear understanding of what encompasses the transaction. It is critical to have the application disposition defined, detailed inventory of the technology assets included sale, and the physical locations of the employees affected by the sale to develop an isolation strategy. Once the environment that is proposed to be sold has been defined, a crucial next step is to assess the applications and computing environment to garner an understanding of their dependencies on the selling organization, and the larger organization’s dependencies on them.

Technology organizations must work closely with real estate management divisions to develop a human resource strategy to isolate both physically and logically those employees that will be sold to the acquirer. Often this strategy involves the consolidation of employees and applications to designated sites, and the implementation of dedicated network and security infrastructure. Such isolation will assure that post-Legal Day 1, the individuals that became employees of the purchasing organization no longer have access to seller’s network and proprietary information. This task becomes more complex when seconded individuals exist which require access to both companies.

Investment by the seller is required to support the isolation of the business unit prior to its being sold. The IT component which potentially includes the purchase of new equipment and resource hours may be significant and should be considered prior to agreement on the deal. The amount of consolidation and number of employee affected may reduce costs, however, the seller needs to expect a minimal amount of activity to perform the isolation regardless of the size of the business unit, particularly if the industry is highly regulated. Aggressive timelines to complete the transaction may also significantly increase costs and need to be considered. A Forward Looking Due Diligence® assessment prior to finalizing the deal by an experienced team can uncover additional costs and provide the selling organization an accurate estimation of the cost involved to achieve the isolation thus providing the appropriate environment to assure their business is protected from malicious or unintentional damage from a business unit no longer part of their company.

For organizations that that don’t have the internal expertise to work through technology disentanglement, a professional M&A due diligence technology assessment consultancy such as Beacon Integration LLC, http://beaconintegration.com, can be engaged to orchestrate technology aspects of the transaction.

J. B.  is a seasoned technology executive with over 10 years of planning the technology aspects of mergers, acquisitions, and divestitures for Fortune 100 companies.