As part of a new eDiscovery effort, we send large amounts of data on encrypted hardware to third parties (outside counsel) that are not very technically proficient (so no key exchange via PGP desktop). Our compliance policy states no passwords in emails but IT Sec team has no great workaround other than voice communication. What other ways can we communicate this password? Is the fact that the email is completely separated from the hardware good enough?
Edited with more info
A little more information after doing some additional digging. There are some third-party tools that appear to be made for this kind of issue: self-destructing password notes, pay utilities, etc... Joel Spolsky mentions using file-sharing sites. That seems like a good compromise, put the password in a file and share the file with the specific email of the person you are sending the drive to. Any further thoughts on these approaches?