sealed inboxes

Problem statement

University archives, government records offices and libraries now routinely acquire the email accounts of scholars, officials and organizations — collections that run to tens or hundreds of thousands of messages plus attachments — but before any of it can be opened to researchers, an archivist must find and restrict messages that contain personal data, third-party privacy, legal privilege, or material the donor never meant to make public. Searching for structured items like Social Security or phone numbers is easy; the CLIR task force notes that "fuzzy searches for sensitive topics or knowledge gleaned from combining different data results are much more challenging and complex endeavors," and that checking email for sensitive data before remote release "is difficult to achieve at scale, especially when thousands of third-party rights holders can be represented in any single email account." The practical result is that institutions either appraise only at the collection level, restrict whole accounts for decades, or make full text available solely on-site in mediated reading rooms — the collections are preserved but effectively closed.

Why this matters

Email is now the primary record of how institutions and individuals actually made decisions; the CLIR report warns that without "a significant advance in technologies, such as those related to large-scale data processing as well as automated sensitivity review, and their full integration into email processing work, it seems possible, if not likely, that large sections of the historical record will remain closed indefinitely to research." Six years later the Digital Preservation Coalition still classifies email as Endangered on its Bit List (a preservation-risk rating for email as a whole, not a measure of sensitivity review specifically), with a 2024 interim review reporting "no change" in risk. The people who bear the cost are working archivists — a small profession facing accessions measured in gigabytes — and, downstream, historians, journalists, and citizens seeking accountability records. Because sensitivity review is the gate on access, every other investment in email preservation (format migration, storage, description) yields nothing to users until this step scales.

What’s been tried and why it hasn’t worked

Archivists have adapted a small toolset — ePADD (Stanford), BitCurator and FTK forensic tools — to flag structured identifiers and let curators or donors mark messages for redaction or embargo; ePADD's Discovery module can expose only entity metadata (correspondents, places, organizations) remotely while the text stays on-site. Practice has also tried pushing appraisal onto donors (many of whom "lack the time, inclination, or knowledge to follow through"), keeping only sent-items folders, or forgoing appraisal altogether on the theory that storage is cheap — none of which addresses sensitivity. The obvious import is technology-assisted review (TAR/predictive coding) from legal e-discovery, where studies show it can outperform human reviewers at finding privileged or sensitive material; but the CLIR task force cautions that because these systems are "rather opaque, we cannot directly infer that these technologies will meet the archival community's standards for identifying sensitive or personally identifiable information," and that "the costs of these tools may put them beyond the reach of most cultural heritage institutions." The underlying difficulty is that archival sensitivity is contextual and cumulative — a harmless message becomes sensitive in combination with others — and no public labeled corpus, shared evaluation benchmark, or accepted archival precision/recall release standard exists against which an automated reviewer could be judged acceptable for release decisions (an academic technology-assisted-sensitivity-review line — University of Glasgow with the UK National Archives since ~2014, and U.S. NARA email pilots — exists, but its labeled government-record collections are not public and it has not produced a release standard adopted by cultural-heritage archives).

What would unlock progress

Progress needs an archival-standard for automated sensitivity review — an agreed benchmark task, test corpora with realistic sensitive-content labels, and a defensible workflow (machine triage plus human adjudication of flagged material) that a records officer could cite when opening a collection. Large language models make contextual classification of "sensitive topic" far more approachable than the keyword-and-regex tools of 2018, but the report's core objection — opacity and lack of archival-grade validation — is what a solution must answer. Adjacent precedents: the e-discovery community's published TAR evaluation protocols and public email test sets, medical-records de-identification benchmarks (i2b2/n2c2), and government declassification review pilots.

Entry points for student teams

A team could build and evaluate an open sensitivity-triage prototype on a public email corpus (for example, released government or corporate email test sets used by the e-discovery community), measuring recall on injected and annotated sensitive content and producing the kind of precision/recall/cost curve an archives director could act on. An HCI team could design the adjudication interface — how a reviewer confirms or overrides machine flags at thousands-of-messages-per-hour throughput without missing cumulative-context sensitivity. A policy team could draft the release-decision standard (what recall on which categories justifies remote access) with a university archives partner. Skills: NLP/ML, information science, human-computer interaction, privacy law.