Guide to Slack import and export tools

https://get.slack.help/hc/en-us/articles/204897248-guide-to-slack-data-exports

by larrik • 8 years ago

635 506 8 years ago

get.slack.help

larrik6• 8 years ago

Previously, you could only see employee DMs if you turned on Compliance Exports, at which point you could download all of them going forward. Now it sounds like everything you've ever written could be downloaded at any time without notice.

So, all of those communications you had with co-workers based on the promise they would be private until you were notified future ones wouldn't be anymore? Now it's ALL available to your employer.

Surprise!

(This is presumably due to GDPR)

mindcrime3• 8 years ago

Meh. Nobody should be surprised by any of this in the slightest. If your employer provides / pays for any kind of communications tool, the only sane position is to assume that they can - and probably do - monitor every single byte you send.

asimpletune• 8 years ago

Yup

nerdponx• 8 years ago

Exactly. I'm surprised they couldn't before.

domevent• 8 years ago

The smart people will have anticipated this, and their message logs will paint them as good for the company.

freehunter3• 8 years ago

Honestly I didn't realize my Slack DMs on my work account weren't private until I saw this. I assumed that since my employer pays for the account, any message I sent was being monitored.

ajross• 8 years ago

That's what I'm thinking. I mean... of course employers expect to be able to have access to communication done by employees in the course of doing their jobs. They've been able to do this with every (archivable) communication medium since the invention of writing. Where is the news here?

If you want privacy use a private channel. Your employer's work tools don't qualify.

QasimK2• 8 years ago

I think the EU would have something to say about that: https://www.telegraph.co.uk/news/2017/09/05/landmark-eu-ruli...

froindt3• 8 years ago

I think there's some middle ground, some grey area where whether it's alright is murky. It's kind of pulling the rug out from under people when the policy of a 3rd party provider abruptly changes and suddenly tons of messages become available to the company.

There are a number of things I might mention to a coworker over a private IM which wouldn't necessarily put my employment at risk, but would be awkward for management to suddenly have access to.

A couple made up examples:

"I'm super sick, but $boss is really pushing me to get the report out. I just want to go home and be sick all alone."

"I hate management's decision to reduce vacation days. No wonder we can't keep people around here."

"Did you see Tom's email? It's kinda awkward that he thinks he's a strong contributor to the group..."

joshenglish5• 8 years ago

This is not completely true. Been able to pull DMs via the Discovery API.

larrik6• 8 years ago

I actually didn't know this. Why did they have the big alert when turning on the Compliance Exports then?

bryanrasmussen• 8 years ago

why presumably due to GDPR? I would think it was a possible GDPR problem for them in the future. Specifically, you wrote it based on expectation it was private and now it is not, when did you give permission for sharing that data?

larrik6• 8 years ago

GDPR was mentioned in the announcement email (though not for this line item).

freehunter3• 8 years ago

If it's your company's asset, you gave permission for sharing that data when you signed the e-handbook at orientation, the same document that gives them the right to monitor your work emails, put MDM on your work-issued phone, and log your work machine's network traffic into their SIEM.

You have no right to privacy when you're inside your company's office using your company's computers to access your company's network. They own it all, you just have permission to use it within the guidelines they set and you signed off on when you were hired.

timblair• 8 years ago

An employee's use of a company-provided communication channel like Slack isn't covered by GDPR, but the company is liable for the content that's stored in their Slack account. Under GDPR, I, as a customer of Company X, have a right to know about and request a copy of any data stored about me by that company, which includes Slack conversations, in both open and "private" channels. GDPR also applies retroactively, so the old compliance export process wouldn't cover it.

whyever• 8 years ago

You should not assume your communications are private if there is no end-to-end encryption. Also, the employers are often required to do this because of regulations. (I think those are silly regulations given that end-to-end encryption is so easily available nowadays, but the companies don't really have a choice here.)

larrik6• 8 years ago

Ah, I work remotely, so I normally don't worry about that sort of thing.

caymanjim2• 8 years ago

You shouldn't assume they're private just because they're encrypted. Employers can and will install SSL certs on your desktop machine so that they can decrypt and scan/archive everything at the gateway. This is standard practice in financial companies, and is easily done anywhere.

They can also install screen capture and key logging software if they want, but that's less common and without disclosure is a lot shadier (although certainly legal in the US). I wouldn't expect it most places; it's a more extreme step.

But never trust encryption at work unless you know your company's policies.

bigtunacan• 8 years ago

This is to be expected from Big Brother. These days one should assume the telescreen is always watching and so should be very cautious as to not commit a thoughtcrime.

---- Edit ----

To clarify; my comment is referring to the novel 1984. While a bit tongue in cheek, it was not meant entirely as a joke.

This is a forum visited mostly by IT workers. I would assume most of us here know enough (or should know enough) to realize that any of our communications at work can be read by someone else and so you may want to treat it a bit as such.

In my personal programming working experience I have seen data captured in all of the following forms, reviewed, and then used to fire or prevent firing individuals.

Email, Instant messaging, Phone calls (audio recordings), Computer monitor (video recordings)

gumby3• 8 years ago

I doubt this has anything to do with GDPR which is about personal information of customers and users. In this case the customer is the company and I don't think GDPR applies.

larrik6• 8 years ago

The announcement email says "As part of our growth and in support of upcoming changes to EU data protection law, we’re launching new tools and features and updating our Privacy Policy and User Terms."

snowwolf• 8 years ago

Actually GDPR also applies to your personal information that a company holds about you as an employee. However GDPR doesn’t apply if there are other laws that also apply to the data, which will be the case in a lot of circumstances for employees.

EpicEng4• 8 years ago

Then your mistake was having conversations you wouldn't like your boss to read using your company's internal messaging system. How is this any different than e.g. emails?

wglb2• 8 years ago

It also could be other compliance requirements.

mnm12• 8 years ago

Why would you have such conversations or expectations when using company chat? That's unprofessional and, frankly, stupid because it puts one's job in danger (as could an in person conversion heard by the wrong people at work). If you want to talk in private, there's dozens of other chat programs out there you can run on your own devices.

bbarn3• 8 years ago

You're missing the point. Slack was one of those programs until this retroactive privacy policy change.

nedt• 8 years ago

Following GDPR could be much easier. Simply delete messages ASAP. Best protection of private data is not storing them.

astro_robot• 8 years ago

Do employers have the same tools with email?

joshenglish5• 8 years ago

Yes. You can access Outlook365 and Exchange via APIs as well as Google Apps for Business.

Plus Calendars, etc. Anything that uses LDAP locally and now through the 365 APIs.

mistermann• 8 years ago

How does it work, an outlook 365 admin(?) Can read anyone's email that they want? Do they essentially just log onto the normal Hi as that user?

markstos• 8 years ago

You mean like with Google's G-Suite? Admins can always change your password to one that they know and log in with it. Even with a 2FA policy, they can generate backup codes to use. Generally assume that yes, corporations can read their corporate email accounts. However, they may have policies that prevent their staff from accessing other employees email accounts without a specific need.

lawnchair_larry• 8 years ago

Password change/login is not necessary to pull email in from G Suite.

yoz-y• 8 years ago

With Google G-Suite you can also set up the Vault so every e-mail ever is stored indefinitely even after deletion. Same goes for Drive and Groups.

codezero• 8 years ago

Google Apps admins can read all the incoming and outgoing emails.

kerkeslager2• 8 years ago

This should not be surprising to anyone. You're giving your data to a corporation who has every incentive to give it to your employer. The only real surprise here is that they weren't doing this earlier.

fjsolwmv2• 8 years ago

That's backwards. You're working for an employer who has every responsibility to monitor business communication. Slack can't "give" something they were never supposed to control in the first place and only have by accident of architecture. This fixes an old bug.

kerkeslager2• 8 years ago

You're working for an employer who has every responsibility to monitor business communication.

Setting aside for a second the unusual ethics being proposed here: it's trivial to bypass official channels if you want to say something you don't want your employer to see. It's fairly standard practice to not put anything you don't want someone else to read in text at all, but rather to pick up the phone--it's too easy for someone to copy/paste a Slack message or Forward an email. This can't be a responsibility of employers because very few employers can live up to that responsibility.

taylorcooney• 8 years ago

Slack...the big brother you never asked for!

tvanantwerp4• 8 years ago

As head of IT for a company using Slack: FINALLY.

Don't get me wrong--it's not like I want to read your messages and very likely won't. But there are times when I have no choice. A few years back, a group of interns started privately harassing other interns via Slack. Only way to see it was to boot an offending intern from his work station and go into his Slack to see what was happening. We had to make all intern accounts into multi-channel guests after that. Compare that to our email, where I can go into anyone's messages immediately if need-be. This is all very standard corporate IT stuff that you need for HR and legal reasons.

Edit: I'll say this is still not an ideal solution. I don't go into private communications unless I have to, and I'd rather have the option to review specific DMs / private channels than dump everything. I really don't want everything; that's more than I care to see. Also, to clarify, I'm in the US and our employees are well aware that communications on company-operated platforms should not be considered private. I want them to be careful how they communicate in writing, not because they should be worried about me, but because they should be worried about Slack getting hacked/leaked. With the recent Facebook news, I should have thought that sort of concern was obvious.

fjsolwmv2• 8 years ago

Why can't the recipient save a copy of logs?

sliken• 8 years ago

Because they typically can be easily falsified.

IncRnd3• 8 years ago

You need non-repudiation of changes to log contents.

jerf2• 8 years ago

Provenance. I can doctor my local logs just about as quickly as I can type. True, it's a bit harder than some people estimate to keep the whole thing coherent, but that just means that you hear about the people who get caught, but not the ones who do it successfully. If I am capable of doctoring Slack's copy of the logs with sufficient effort, it is certainly orders of magnitude harder and much legally riskier (as I would be committing many felonies in the process).

dsacco11• 8 years ago

What is the material difference between having employees save DM logs in an auditable, authenticated way and being able to view employee DMs?

If any employee can ostensibly be compelled to provide their logs when asked by their employer, you are getting just as much information as if IT can view them directly. The only way IT doesn't get as much information is if the system doesn't work, for example because employees can alter their logs or simply refuse to provide them. In that scenario having employees saving their own logs gives you more privacy, but doesn't solve the essential problem.

The tradeoff here is convenience of access versus friction. When you are reviewing an auditable log of information related to an employee, you don't necessarily want to have to ask the employee for that information, nor do you necessarily want them to know you're reviewing it.

ramblerman• 8 years ago

Only way to see it was to boot an offending intern from his work station and go into his Slack to see what was happening.

Why couldn't you just ask the recipient to look on his station?

We had to make all intern accounts into multi-channel guests after that

Are 2 interns ever allowed to be alone together? I mean it's essentially the same, you are saying they can't be trusted so either you always need them in groups of 3, or you should put cameras everywhere with microphones...

I am glad that you are serious about tackling abuse, but more monitoring and rules about congregation are not the right solution imo.

softawre3• 8 years ago

Not to be contrarian here, but could you offer a solution given that you've thought about this?

castlecrasher2• 8 years ago

You have to ask why they wouldn't want to talk to an individual suspected of wrongdoing? Why look at security footage, when you can "just ask" the suspect?

theobon• 8 years ago

You are assuming that harassment was direct, sending messages to the accusers. My impression is that this was a group chatting privately about the accusers either making fun of them or coordinating actions.

While this can be done through other channels (in person or private cellphone) allowing it on corporate infrastructure without monitoring is not acceptable.

freyir• 8 years ago

> Only way to see it was to boot an offending intern from his work station and go into his Slack to see what was happening.
Why couldn't you just ask the recipient to look on his station?

This is probably exactly what happened? I'm guessing they didn't physically pry the unwilling intern from his seat like he was passenger on United.

random43692• 8 years ago

There's an infinite space of solutions to your particular problem, but your chosen solution is totalitarian surveillance in the workplace because an intern got offended?

I avoid workplaces which force shit like this. So do all the good developers I know, because they're people who can afford to be choosy.

Bullies are pretty adept at functioning in these environments. Instead of harassing on monitored DMs, they'll make verbal comments with double meanings, use their leverage to put their targets in unpleasant situations, undercut their targets at meetings etc. Totalitarian surveillance doesn't stop bullies. It just makes your workplace a soul-destroying shithole for the employees who are forced to work in it.

personjerry• 8 years ago

Would you provide a small list of solutions as examples?

bruhbruhbruh• 8 years ago

Infinite space of solutions? I think not. If the harassment was in any way sexual, the company had a legal responsibility to investigate. It may have been a timely matter and the best and/or only solution was to read the messages at the offending intern's workstation.

mfringel• 8 years ago

No, he chose it because a group of interns was harassing other interns.

Words matter.

chrischen• 8 years ago

Totalitarian surveilance? While you’re at removing that from the workplace don’t forget to instigate democratic revolution in your company as well.

calcifer• 8 years ago

totalitarian surveillance
got offended
Bullies
soul-destroying shithole

It's funny how these sort of comments always come from recently created throwaway accounts.

cechmaster• 8 years ago

I think you're mixing up the way businesses run and how society should run. Two different things.

spelunker• 8 years ago

I avoid workplaces which force shit like this. So do all the good developers I know, because they're people who can afford to be choosy.

So you and your choosy developer friends work at a place where IT can't access your corporate email?

dsacco11• 8 years ago

but your chosen solution is totalitarian surveillance in the workplace because an intern got offended?

Sigh

Totalitarianism is a socio-political paradigm, not a stand-in word to describe things you think constitute surveillance in the context of a business. Companies require the capability to maintain auditable records of employee activity on the information channels they own and manage. Your company is not recording your activity in the privacy of your home or on the street, it's protecting itself and other employees from potentially problematic abuse scenarios. These requirements are also directly imposed by a variety of regulations in various countries.

When you twist the meaning of loaded words like this to describe things you don't like, you make it very difficult for people to get past the hyperbole and take you seriously. You're conflating assaults on personal rights with the routine and mundane business practice of keeping auditable logs.

I avoid workplaces which force shit like this. So do all the good developers I know, because they're people who can afford to be choosy.

I'm not sure what you're getting at here, because almost all the good developers I know work in environments like this. So where does trading these anecdotes leave us? Do you really believe most competent software engineers don't work in companies that do this? In most cases, that means the company is actively breaking the law, or at best making adherence with the law very difficult and error-prone.

twunde• 8 years ago

If you've worked anywhere with more than 50 employees, your emails are available for an admin to look at. This is required for legal discovery whenever a company is sued. For companies in regulated industries (healthcare, finance, etc) they may actually be required to keep all your communications for a period of time so that they can track if you leaked sensitive data (PHI, PII, trade secrets, etc)

ABCLAW• 8 years ago

Reading someone's workplace messages to resolve a workplace investigation into a workplace dispute between co-workers isn't totalitarian.

There is no reasonable expectation of privacy on a corporate slack account.

jamespo• 8 years ago

nice nirvana fallacy

s3nnyy2• 8 years ago

"Compare that to our email, where I can go into anyone's messages immediately if need-be. This is all very standard corporate IT stuff that you need for HR and legal reasons."

Wow, THAT is highly illegal in Europe.

irishsultan• 8 years ago

Given his username he may well be from europe.

tikkabhuna• 8 years ago

In the UK they're allowed to monitor work email[0]. I'm not sure how that compares to the rest of Europe.

In financial services they monitor all kind of chat rooms, especially after the LIBOR scandal. Every chat I open gives me a disclaimer saying that chats will be monitored.

[0] https://www.citizensadvice.org.uk/work/rights-at-work/basic-...

stedaniels3• 8 years ago

Please state the relevant law that it'd be breaking, I'm genuinely curious. Compliance tools are built into most cloud and enterprise offerings that allow this. Do you not have experience of enterprise/cloud email offerings?

Tyrannosaur2• 8 years ago

Really? I like to consider myself much more privacy-minded than most, but I would expect an email assigned to an employee to be used for official business purposes should definitely have a paper trail that higher-ups can audit if necessary.

ChuckMcM• 8 years ago

I was under the impression it WAS legal in Europe as well after being litigated to the Court of Human Rights[1]. The requirement is simply that they inform you ahead of time that they can (and will) monitor your email.

In the US there is usually a form you sign at your hiring that says you understand the company may monitor your email. It is couched in terms like "to ensure compliance with laws and company policy" but the actionable part is that they assert the right to monitor it and you agree to that (or you don't work for them).

[1] https://www.nytimes.com/2017/09/05/business/european-court-e...

bipson• 8 years ago

I don't think so. The employer has all the rights to look at company emails, there is no right to privacy when using the company's email addresses. There are quite recent verdicts in Germany IIRC, considering if it was unlawful termination if your employer uses information gathered from your emails as reason for the firing. Looking at the emails in the first place was totally lawful, IIRC.

kryptiskt• 8 years ago

Europe consists of plenty of countries, all of them different. It seems like statements on HN about how it is "in Europe" is usually Americans writing fan fiction about some never-never land.

Piskvorrr9• 8 years ago

Well...most work contracts I've signed said something like "working here is not mandatory and we may need access to the mailbox (which we're providing to you for your work duties), such access cases are logged and externally audited. Sign here to agree, take that door to disagree." As long as this is agreed beforehand, I'm not aware of a European state banning it - this is somewhat different from "let's go digging around the computers out of curiosity". (I am in GMT+1, for the reference)

I've seen a situation where this was invoked - employee was fired for an unrelated issue, only kept some documentation in their inbox for whatever reason. Without such a provision, our options would have been a) legally questionable, b) up shit creek sans paddle.

mdekkers• 8 years ago

Wow, THAT is highly illegal in Europe

No, it isn't. https://www.nytimes.com/2017/09/05/business/european-court-e...

To wit: “Today’s ruling is fairly clear in how it outlines the parameters of monitoring employees,” said Stephen Ravenscroft, a London-based partner specializing in employment law at White & Case, a law firm. “It won’t be sufficient for employers to have a general policy permitting monitoring — the policy will need to be much more detailed, outlining why, how and where employees may be monitored and explaining how any information gathered through monitoring may be used.”

SomeHacker44• 8 years ago

LOL. I was about to write a post with this exact first line. Thank you for beating me to it.

yiiii2• 8 years ago

As I do not know which country you are from I really hope you checked before if what you did complies with the legislation as for example in many european countries this would be very illegal.

brazzledazzle2• 8 years ago

I wish a compromise between willy-nilly dumps of private DMs and their Compliance Exports could have been found. As a user who is not the head of IT this is frustrating. Now frank discussions have to go back to out-of-band channels.

If anyone thinks this won't get abused, think again. I've worked with IT folks of all shapes and sizes over many years and a tiny percentage do abuse the privilege. Including heads of IT. And those are just the ones I know about.

tvanantwerp4• 8 years ago

I'll agree that a whole dump of data is not the ideal solution to the problem here.

dcow• 8 years ago

Unfortunately the US is a surveillance state.

Cacti13• 8 years ago

I mean, how do you think your email is handled? Your internet traffic? This stuff has been monitored and recorded by companies for decades, why would Slack be any different?

peterkelly2• 8 years ago

If two people want to have a private conversation, they'll just find another means by which to do it. In the long run, abusing your privileged access to conversations intended to be private (however justified you may consider it to be) will just breed mistrust among employees. I would quit a job that treated me as a child which must be supervised in such a manner.

Spooky23• 8 years ago

You had better work for yourself then. EDiscovery is a thing, and employee preference will never trump a judge’s order.

JshWright• 8 years ago

I would quit a job that treated me as a child which must be supervised in such a manner.

Are you replying to the right comment? From the example given, it seems no action was taken until the parties involved proved such supervision was necessary.

protomyth4• 8 years ago

abusing your privileged access to conversations intended to be private (however justified you may consider it to be) will just breed mistrust among employees

Abusing your privileged access?!? You do realize some of us are required to access those communications for a variety of reasons especially because a threat is happening? Also, I don't get a choice when the lawyer shows up and says we need to look at X's account.

I would quit a job that treated me as a child which must be supervised in such a manner.

Well, that might save me a bit of trouble, but at the point I am asked to look at your account, I get the feeling you are on your way out anyway or will shortly have a lawyer or the police contacting you.

The communication systems you use as an employee are not yours.

eli• 8 years ago

If you're required to be on Slack to do your job, then your employer is obligated to make sure going on Slack is safe and free from harassment. You can't just sign off or block other employees.

tedivm4• 8 years ago

I hate to tell you this but if you would quit a job for this reason you probably can't work in the US. The US has laws about corporate compliance, and it has requirements for things like dealing with sexual harassment. There is no such thing as a "private conversation" that takes place over a corporate network.

For example, in the US sexual harassment is taken seriously. If a company gets a complaint of sexual harassment on Slack they are legally obligated to look into it, and if they refuse to the individual managers could personally be held liable for it. This includes situations where the person being harassed isn't directly in the conversation- the above example of harassment over slack could have evidence of coordination in a different private channel than the ones the harassment target is in.

Cacti13• 8 years ago

Hey, don't let the door hit yourself on the way out. There are very valid legal reasons for a business to need at least the option for discovery, e.g., legal suits, fraud, violation of trade secret or export controls, serious employee harassment, etc. This goes for chat just as much as email or anything else electronic. If you think this is "treating you like a child", well, perhaps you are the child.

hvass• 8 years ago

Hope this doesn't sound too harsh but your reply comes off as extremely self-centered. What about looking—at the very least—at it from a legal perspective? It's not like lawsuits and aspects related to discovery haven't been in the tech news lately.

prewett• 8 years ago

So what would your solution to the OP's problem be? If harassment is happening, I expect the company has some legal requirement to act. I also expect that you support the company making a safe workplace. How does the company do that if it cannot verify that something is actually going on? Just blindly believe the accuser without confirming if it's true? Just disbelieve the accuser? Tell them to work it out themselves?

stale20022• 8 years ago

Well, that's only if the person actually knows that the conversation isn't private.

I would also like to point out that the person you were responding was talking about interns, so were arguably 'actually' children.

balls187• 8 years ago

I would quit a job that treated me as a child which must be supervised in such a manner.

Agreed this can lead to abuse. But investigating employee behavior while using employer provided communication platforms doesn't immediately fall under abuse. No more than police subpoenaing phone records during a criminal investigation would.

probinso• 8 years ago

The company should not provide funding for a channel used to harass people.

You're being a shit if you trivialize harassment in the workplace, but you are being an idiot if you are paying for the tools used to hide it.

dspillett2• 8 years ago

If two people want to have a private conversation

You response is based on a false fact: that anything you use official company communication channels for should be considered private.

HR functions can and will access such communication to investigate complaints about behaviour and similar. Compliance and legal functions can and will access such communication to investigate complaints relevant to them. They can, will, and often must provide access to such communication to relevant external bodies (legal authorities, regulators) under some circumstances too. Heck, in some regulated environments compliance functions are required not just to view your communications for specific reasons but to actively monitor them for certain activity (if they fail to do so they could be liable for punishments for a due diligence failing). For instance our email is monitored to block distribution of client data, accidental or otherwise.

If you want a private conversation, use a truly private channel not an employer provided/related one.

they'll just find another means by which to do it

The fact that people will find away around rules, restrictions, and monitoring, is not a good reason for not implementing such rules, restrictions, and monitoring in the first place.

If the private conversation is in no way a problem then, well, there isn't a problem.

If it is something that would cause the participants trouble if performed over an official channel then when/if the matter does come to light it shows malice of forethought and planning (i.e. that the participants knew they were in the wrong and took specific action to hide their behaviour rather than correct it).

I would quit a job

In many (most?) industries you would not even get a job without explicitly agreeing to the fact that your communications using employer provided/related services can be accessed by some functions of the organisation and distributed to external authorities, so you would not be in a position to need to quit.

Skunkleton• 8 years ago

If two people want to have a private conversation,

Emphasis is mine. If one person can have a private conversation with an unwilling participant, that is entirely different. I have worked in places with heavy logging requirements, and for sure we created ways to have private conversations. The point is that everyone in these private chats was a willing participant, and could leave if they wanted.

hennsen• 8 years ago

Sure, but then the communication doesn’t happen in the space where your boss is partially responsible for what's happening there.

It’s very simple: use your employers tools and networks only for business stuff, do personal stuff unrelated to work in your own networks and software...

Besides that, just in case you didn’t notice, the original poster did not say hes reading employee private messages for fun, but only to act as law prescribes.

staticassertion2• 8 years ago

No one is watching you or treating you like a child. This is important for security and legal reasons.

Insider threat is a serious, real world problem - consider employee harassment, exfiltrating data, sharing secret information, a compromised slack account DM'ing people malware, etc.

No one wants to read your messages, and it's probably a small set of people that even can.

misakwa• 8 years ago

I think one of the side-effects of this is that there are other slack teams created to help keep communications among colleagues private-ish. This leads to cliques and tends to isolate new employees who may not yet be in those "teams".

evrydayhustling• 8 years ago

Nobody can or should stop you from finding private spaces to talk to fellow employees -- but you have to provide the space yourself. Slack is part of the work environment being set up for you by your employer, so they're responsible for being able to make sure that it's free of harassment and illegal activity.

buttcoinslol• 8 years ago

I would quit a job that treated me as a child which must be supervised in such a manner.

Did you miss the part where the interns were acting like children?

A few years back, a group of interns started privately harassing other interns via Slack.

We're all proud of you for making this top comment thread about your own ethical stand, let's give peterkelly a big round of applause!!

plussed_reader• 8 years ago

Where are you getting abuse of access from the prior comment?

s73v3r_2• 8 years ago

I mean, if you're using that capability to harass other employees, as the interns in the story were, then yeah, you deserve to be treated as a child, because you basically are.

urda• 8 years ago

would quit a job that treated me as a child which must be supervised in such a manner.

Then you should be prepared to be permanently out of work.

You are NOT entitled to private communications on company-sanctioned channels. Full Stop. End of story. This isn't an issue of "trust" or having faith in your employees, but this is how business is done.

petermcneeley2• 8 years ago

So long as they can go through your chat history it seems very reasonable and is not simply a further entrenchment of the structure of power.

Information is power: https://news.ycombinator.com/threads?id=tvanantwerp

tvanantwerp4• 8 years ago

Uh, ok? Never really posted on HN under the illusion it was private, so not sure what you're going for here...

flurdy• 8 years ago

This is all very standard corporate IT stuff that you need for HR and legal reasons.

I doubt that, but it is country dependant. In some of the countries I have worked in it is quite the opposite. You get drilled for legal purposes you are not to look at people's personal emails and if possible DMs. Mostly as it is potentially illegal. I have not worked in the US though.

I was however unaware that in Norway then can access your email in exceptional circumstances: https://www.datatilsynet.no/en/privacy-and-society/personver... It seems in case of gross breach of duty, the employee has to be notified, then they can access their work email.

fogzen• 8 years ago

So employees can read your private slack right? F it’s really just about creating a safe space, I don’t see why management is exempt.

praneshp2• 8 years ago

Typically management is not exempt. If management == admin, then there'll be a user mode in which management uses the app normally, and an admin mode where you do admin-y stuff.

xori• 8 years ago

Totally agree. If harassment is a problem they'll find other ways, but that doesn't mean an employer has to provide an outlet for them to harass on.

arez• 8 years ago

It's called "private" for a reason. If someone harasses me on Slack, I have proof of that, because they wrote me a message. If people have private conversations about anything, it should be of no one's concern. Same goes for Signal or Whatsapp, it's a private conversation. It's like putting microphones everywhere and then fire people who have a bad day and say something stupid once in a while, would you like that? This is not a world I wanna live in and it's a serious move against privacy and freedom of speech.

zenhack• 8 years ago

Yeah, and there's a reason some places have laws against bugging offices. One key thing is that everyone should be clear on what's recorded and what's not, and "if it's written down" at least has the virtue of relative simplicity. Probably if it's not supposed to be fair game for later investigation it shouldn't be logged at all.

I think part of the trouble is that we spend too much time at work for most people to actually be productive the whole time -- if you buy the notion that it's reasonable for people to be at work to work, and they shouldn't be socializing whathaveyou, then logging everything seems more reasonable than if you recognize that no one can actually be a drone 40/hr a week, then the surveillance starts to look like de facto surveillance of stuff other than the job, which is more worrying.

I am in the privileged position of doing freelance work, on my own machine, mostly remote. As such, if I'm using a client's communication systems it is essentially guaranteed to be work related, so having it logged doesn't bother me; if I'm not working I'm using something else. But being monitored for half your waking hours five days a week feels much more onerous.

I suspect some of a this is tension with reasonable expectations of levels of monitoring from when less of our communication was via the network.

asow923• 8 years ago

Maybe you should start at the root of the issue and vet your interns before bringing them on.

DoreenMichele• 8 years ago

With the recent Facebook news, I should have thought that sort of concern was obvious.

It's always going to be Eternal September somewhere on the internet.

lostlogin• 8 years ago

Only way to see it was to boot an offending intern from his work station and go into his Slack to see what was happening.

Couldn’t the complainant show their history or screenshots? Going through peoples messages is a bit yuck, even if they are horrible individuals.

luk32• 8 years ago

If they harassed them in toilet would you install cameras there? =P

Sorry, but that's the same kind of argument for invading someone's privacy and justifying surveillance.

I doubt that anyone would agree even if you said you'll watch the videos only when necessary.

I_am_tiberius• 8 years ago

Instant messaging is used to express instant thoughts. Instant thoughts can be used against you if accessible by the employer. So why using instant messages over email if you anyway need to think through your instant messages in Slack like you do with emails? Let's use emails then.

I think most people will only learn the importance of privacy after having been affected personally.

dalbasal• 8 years ago

One might argue that this is exactly the reason why slack should not have made this decision.

Inevitably, some communications channels are audit-able and some are not. Modern employees (being modern people) use a lot of channels. They call eachother, SMS, Whatsapp, Slack, email ...sometimes people even talk. Companies have only partial control.

Anyway, harassment or other misbehavior can happen on any of these. In some cases (like your intern case) companies have to audit, if they can.

Can Audit = Must Audit

If slack gives employers the option to read messages, they've given employers the responsibility to do it.

It's not cut and dry. You could argue that companies won't/can't use slack unless they can read messages. This is doubtless true in some cases and I imagine slack has it's eye on these cases right now. But, I think it's hard-ish to argue the magnitude is all that big today.

Companies did use slack before this feature existed, including yours.

wrs3• 8 years ago

You didn't have compliance exports turned on already?

clairity• 8 years ago

"This is all very standard corporate IT stuff that you need for HR and legal reasons."

there's the problem right there.

(1) need =/= want. you want those things to cover your butt. you're not entitled to them. do you really want to live in a surveillance/nanny state?

(2) the legal system can't save every person from negative consequences, nor can it truly compensate for negative consequences without other negative actions. stuff happens. let's be adults and sort them out ourselves rather than hoping some (imperfect) higher power can do it for us.

ashwinaj• 8 years ago

I reluctantly agree with you. Employees are smart, especially the ones that harass others and they need to be exposed.

swat535• 8 years ago

You are exactly why we should all be extremely careful with what we communicate on the work network.

By "you" I don't mean you personally of course, what I mean is IT in general.

You might be ethical enough to not abuse your new found privilege but who is to say that the next guy won't?

I believe all employees should restrain from posting personal and private things on a company network or any related device for that matter.

You never know how this data can be misused.

rocho• 8 years ago

This is ridiculous. If one is harassed in private they have all the evidence they need to expose the harassment to whomever they want.

So now they are not private messages and shouldn't be called as such.

DanBlake• 8 years ago

Technically this was possible before this.

Since the email to each slack user is an @company.com address all you need to do is take control of the employees email address, reset the slack password and login as the target user.

reustle• 8 years ago

Since the email to each slack user is an @company.com address

Not necessarily

gburt2• 8 years ago

It turns out administrators could change the email address anyway. :)

heedlessly2• 8 years ago

for most companies slack channel, you would need the @company.com to get approved for slack access.

Very rare and unprofessional to allow someone's personal email access

dugluak8• 8 years ago

with or without my consent?

darkstar9994• 8 years ago

Without.

dugluak8• 8 years ago

how is it legal. Even the law enforcement needs to provide a warrant in case they want to search my apartment.

larrik6• 8 years ago

Without consent OR notification.

Mtinie• 8 years ago

Every employee agreement in the US I’ve ever signed includes a section where you’ve given your consent.

decebalus1• 8 years ago

I was always under the impression this was already going on. I don't see the surprise here: there shouldn't be any expectation of privacy with regards to conversations between employees happening on company virtual grounds.

Heck, in my previous company when we wanted to talk about something off-the-record, we'd even physically go off campus due to the sheer amount of walls equipped with 'ears'.

Piskvorrr9• 8 years ago

Never mind the walls: what about the people equipped with literal ears?

duxup4• 8 years ago

I think if the employer provides the tool, it is their data.

I know there are different traditions in other places where they consider something like work email to be more of an employee owned or privacy issues. I always thought that was a bit wonky and it is easier to identify who owns what by ... who owns it.

IAmEveryone• 8 years ago

I may agree with result regarding Slack. But your argument doesn’t really work if you consider who owns a rented apartment, leased car, or company phone officially allowed to be used for personal matters.

duxup4• 8 years ago

My statement isn't meant to be a rule for all things in life, the difference between an apartment and Slack are kinda huge.

dugluak8• 8 years ago

what if your cafeteria conversation is recorded on a camera without your consent and used as an evidence against you? is it legal or invasion of privacy?

softawre3• 8 years ago

Did you have the expectation of privacy (probably not). These are not new issues and there is existing law around them.

golergka• 8 years ago

Slack seems more like an official meeting room than a cafeteria. Cafeteria is a messenger on my personal phone.

6d6b73• 8 years ago

I think if the employer provides the tool, it is their data.

Not really. Just because the employer pays for the office building doesn't give them access to my private conversations with other members of the team.

duxup4• 8 years ago

I guess it depends on where and lots of details and such as to what exactly you're talking, but provided you're all employed by the same person... it's their team too.

darkstar9994• 8 years ago

I had a toxic manager who would screenshot DMs and post them publicly.

Just consider any work communication of any form to be public.

cirgue2• 8 years ago

If someone is determined to be an ass, technology isn't a barrier.

drngdds• 8 years ago

Technology helps asses act like asses more effectively.

gumby3• 8 years ago

It's hard to see how this is bad -- they have/should be able to have access to your other work-related communication and work product (modulo the weird rules around things like salespersons' "rolodex"es).

It's so easy to have private channels these days it's hard to see how this should even inconvenience anyone.

yiiii2• 8 years ago

Because it is illegal in many countries to access somebody's personal communication even if it uses eg. a corporate email address?

Jenssen1234• 8 years ago

It's not, not in Europe, not anywhere. Saying it a couple of times doesnt make it true. Your boss can read your emails and most likely already does. This is exactly the same with any internal messaging and it's perfectly legal in the workspace.

MisterBastahrd• 8 years ago

This is the greatest advertisement for IRC ever.

Ascetik• 8 years ago

I still prefer IRC, it irked me when my favorite sysadmin channel moved from freenode to slack.

lwhalen2• 8 years ago

Come hang out in #lopsa on Freenode, we never left ;-)

darkstar9994• 8 years ago

No it isn't. They would own the IRC server and see everything.

ben5096• 8 years ago

I think Off the Record encryption on IRC is done entirely by the clients, so the server can only store an encrypted blob. It also has forward secrecy.

There's no reason you couldn't do the same with a slack client, of course, but your employer could see you had encrypted chats.

089723645897236• 8 years ago

This is a good thing. People need to realize work chat is a paper trail...

ben5096• 8 years ago

As a society, we're having a very hard time adjusting to all kinds of social media.

alexandercrohde2• 8 years ago

A one-way paper trail in favor of the company. If a boss tells me I'm fired for being "too black" and then deletes my slack (and I don't have a screenshot), I'm not going to have any leverage to get proof unless I can get a subpoena (which I wouldn't be able to, most likely)

bdowling• 8 years ago

I think you’re wrong. A subpoena would probably be granted for a situation where you know that the relevant evidence exists and exactly where it is. But it might not come to that in the scenario you describe, since the employer would also know that a third party has this incredibly damning evidence and would likely try to settle.

moduspol2• 8 years ago

If it helps, the company is the one paying for that paper trail.

nkcmr• 8 years ago

I have never really understood the notion of needing communication privacy in the workplace. To be honest, without having seen this story, I would have assumed this was a feature of Slack already!

I can't remember where/when I heard this advice but it seems relevant and helpful for this matter:

"Write/speak all communication in the workplace as if the CEO themselves were CCd on the email."

It has served me well.

ben5096• 8 years ago

Work is stressful and communication can reach straight into your brain. People go through periods where they're not handling stress very well, and they will often express ideas that, divorced from the context of the stress and bad feelings they have at that point, don't reflect what they really believe or intend to say in public.

moduspol2• 8 years ago

I think that part's easy to understand. The tougher part is why one would put that communication in text, enter it into a company-provided system, and then be offended / dumbfounded when it's accessed by one's superiors at that company.

We all get stressed sometimes, but we don't all do that.

dumbfounder• 8 years ago

Let's clarify a bit, this is for the employer owned Slack workspace. If you have the client and have your employer workspace and then another random workspace that is not owned by your employer, then they can only see the messages on the workspace owned by the company.

And this is meant for backups really, it's not going to be easy to just follow random conversations of yours on a daily basis. If they want to go back and dig up some dirt they can though.

That said, if you are worried about it, and working on a computer owned by your employer, you should just assume everything you do is logged. Because some do that.

jrs95• 8 years ago

It seems like this requires Slack Plus and not just the Standard plan. It's not clear to me if you can access all historical data immediately after upgrading to Plus, though.

cirgue2• 8 years ago

Let's clarify a bit, this is for the employer owned Slack workspace.

My company doesn't use slack, but it is a little crazy to me that this wasn't already the case for employer-owned workspaces.

Overtonwindow• 8 years ago

Is this available for Gsuite as well? My former office had employees mocking others for their age, gender, etc. No way to show management without revealing I'd found a way to spy on them.

jgh• 8 years ago

I'm glad that this isn't going to affect the free tier users (rather, they'll need to provide legal reasoning for it and consent) since there are a bunch of communities on slack.

neposesame• 8 years ago

Could this be backdated upon upgrade to enterprise i.e the admin is able to access private conversations prior to upgrade from free tier?

Dirlewanger• 8 years ago

I dislike Slack as much as the next guy, but I honestly thought this was already the case. It was in general for work emails, why would it be any different for another office communication tool? Shouldn't be a surprise for anyone.

Arubis• 8 years ago

For companies, yeah, this makes sense. It was nice when this wasn't true, but never really expected nor required.

Unfortunately, Slack also gets used for a lot of OSS communities. Arguably this was already a poor fit, but now it's even more obviously a mismatched relationship; it's unclear whether one could just start paying for a Slack account and immediately pull all DM history for something that didn't come with the expectation of corporate ownership.

#freenodeforlyfe, I suppose.

zifnab06• 8 years ago

Rocket Chat is something I've been looking into. It's...well pretty amazing so far. Open source, self hosted, bridges to slack fairly reasonably, and gives IRC style permissions. Slightly nicer for the "I'm not always logged in"/"We need a log bot" issues IRC has had.

ianmiers• 8 years ago

If it's self hosted, then DMs cannot be private from the company/organization since they literally have root on the box.

er0k• 8 years ago

it's unclear whether one could just start paying for a Slack account and immediately pull all DM history for something that didn't come with the expectation of corporate ownership

I've tried. In my experience, Slack will not approve your compliance export application without articles of incorporation.

Avery3R• 8 years ago

some projects are moving over to discord

brokentone• 8 years ago

As a basic user of the platform (where my employer has Slack Enterprise Grid), I've always expected this is the case and planned my communication accordingly.

drinchev• 8 years ago

Looking at all positive comments here, this is generally a bad news.

Not sure how much compliant this is with the law, but in this case the law should be more protective towards employees.

I imagine the following situation

I write on a company-owned piece of paper - "My boss is an idiot". Then take this piece of paper put it in an envelope ( owned by the company as well ), write the name of my colleague and seal the envelope. Then put the envelope on the recipient's desk.

I bet it would be illegal for my boss to take that letter, open it and read it.

P.S.

Looks like with e-mails the law is more protective towards employees :

[1] https://www.reuters.com/article/us-privacy-emails-echr/europ...

[2] http://www.internationallawoffice.com/Newsletters/Employment...

[3] https://www.womblebonddickinson.com/uk/insights/articles-and...

dsacco11• 8 years ago

Not sure how much compliant this is with the law, but in this case the law should be more protective towards employees.

This change is precisely because of regulations like GDPR, among others.

kuschku3• 8 years ago

The ECHR said that the employer has no right to access any private employee communication, even if it happened at work.

That contradicts what you’re saying quite a bit.

kolbe• 8 years ago

In broker-dealer finance, it is illegal to not log and audit all business communications. Additionally, you have to contract with a government-approved agency to save the logs in a manner that cannot be tampered with. I think we even have to save it in a format that is easy for government agencies to review and search if necessary.

imglorp• 8 years ago

Ah, Europe might be different. In the US, if your employer owns the platform, they have the right to all the messages for compliance. We view this as "if you have something private, don't do it on corp channels." This is usually fine unless you're harassing someone or engaging in something against corp ethics.

https://www.privacyrights.org/consumer-guides/workplace-priv...

thomasz2• 8 years ago

It really depends on national legislation, as well as individual contracts with unions or work councils. At least here, as a rule of thumb, as long as private internet use is permitted, the employer can't legally monitor traffic outside of very specific circumstances. AFAIK you can't get around that by prohibiting personal internet usage without generally enforcing that prohibition.

jlarocco• 8 years ago

It's funny how much hedging and how many implausible hypothetical scenarios there are in some of these comments.

raldi• 8 years ago

Your boss is absolutely allowed to open an envelope on your desk if it's clearly a business-related piece of mail, and your employee handbook almost certainly says that your corporate Slack account is only to be used for business purposes.

In fact, your boss is allowed to open any mail sent to your work address.

https://www.azcentral.com/story/money/business/abg/2015/07/1...

http://www.askamanager.org/2010/08/is-it-legal-for-my-boss-t...

http://employment.findlaw.com/workplace-privacy/privacy-at-w...

duxup4• 8 years ago

I'm lost on the employees needing protection concept here.

If you're going to call your boss an idiot, don't do it with the company tools. That seems like a pretty reasonable boundary to maintain.

I've never thought of much of anything that was my employer's as mine. If I wanted a private email conversation, I'd use my email, same with chatting and etc... that's just smart no matter what the local legal traditions are.

The volume of negativity surprises me if only because there are all sorts of ways to obtain some private channel communication.

Do people need to talk shit about their boss THAT often, but they feel they should use a work provided tool to do it?

billions• 8 years ago

Controlling thoughts reduces creativity

anotheryou• 8 years ago

Does this affect the basic plan?

If upgrading to Plus, does it include past messages?

alexandercrohde2• 8 years ago

Jesus, nobody here has any clue what they're talking about.

Slack has allowed companies to read private messages for well over a year. It has been called "compliance exports" and you as a slack user could always see if you had them turned on, as well as which individuals had access to read your private messages. Source: CTO of a unicorn confirmed he had used this feature to read private communications (private rooms and DMs), source 2 - used this page myself at multiple companies

Employers had to pay for this privilege. It's super unclear to me what the new policy is-- it looks like there's still no privacy but it happens via API.

froindt3• 8 years ago

Previously if compliance exports were turned off, then later turned on, users would receive a notification that all future DM's would be available for export by their employer.

My understanding is that now the entire archive is readily available for download, including the content from before compliance exports was turned on.

hjnilsson2• 8 years ago

How fine-grained is the tool? Do you select a channel and export only the contents of that? Can you select only two users and only get messages between them? Or is it blunt and you simple download all data (the text makes it seem that way)?

I ask, because if it's the latter it borders on illegal to click on that button (and get ALL private conversations), at the very least it needs to be heavily regulated within the firm who can click it and how the downloaded data is stored / accessed.

wrs3• 8 years ago

It is incredibly blunt, at least for compliance exports — all you can do is export the whole workspace — and once exported it's just a ZIP of thousands of JSON files. There is no tool to look at it with. When I had to do an export I found a PHP script somebody had written to turn the JSON into thousands of HTML files, but otherwise it was grep and jq.

Peroni• 8 years ago

The fact that they specify that consent is required on the free plan but not on the Plus or Enterprise plan suggests that the old compliance export requirements have changed. The old compliance export process required consent AND it only allowed you to access data from that point forward. The changes introduced today seem to suggest that historic data is now available by default.

ljubo_opaki• 8 years ago

https://gph.is/1maiw0M

This sucks so much.

Does anybody know if deleted messages get deleted for real? Or only just marked as deleted in the database?

This couldn't be an early April Fools joke, could it?

colemorrison• 8 years ago

Wow. Ya know, for every case this might "help" solve (workplace harassment and the like), I just can't help but say ultimately it will hurt far more.

"But employers/managers/execs will operate more responsibly with more data about their employees!"

Will they really? I think they'll be able to operate more "powerfully" with respect to controlling employees... but with that power I wouldn't be surprised if the abuse outweighs the positive utility.

Additionally... this is going to kind of kill the culture between people (ESPECIALLY REMOTE) using slack. Do you really want to talk about your weekend, or forge any type of bond over chat now? Why would anyone every do anything rapport building over slack now?

Yeah yeah "but managers/employers won't be that extreme, you're being extreme." There's a lot of cases in the past where I've thought "sure an exec or manager wouldn't do X" and then sure enough, there it is at the top of HN, and the company is going under.

So...someone else on here speculated correctly. It's clearly a selling point for employers since they're the main target to increase revenue. Unfortunately I guess that means using it for interest groups goes out the window though.

always_good• 8 years ago

If this is what finally makes you behave appropriately on work comms and start communicating out of band, then they are doing your future a favor. It should have been common sense.

vernie• 8 years ago

I'm surprised that Slack was so widely adopted without this capability already available.

reificator• 8 years ago

Like everyone else I'm more shocked that this wasn't available by default.

I'm not sure if this applies to the last (work) Slack I was part of. The company blocked it over a year ago and presumably deleted it shortly after. I just checked and it is deleted now.

As far as I know, since it was setup by a middle manager (who lasted two weeks) and then blocked, it was probably on the free plan as well.

I'm not really concerned for myself, as I always assume all my interactions on a work machine are monitored, but people did occasionally send me things that they probably wanted to be off the record. Not sure if I should warn them that there's a (small) chance that their messages could now be read.

akerro• 8 years ago

*can access.

In some countries it's illegal for employer to read employees private messages.

iamdave2• 8 years ago

I'm finding myself in a situation where this is actually kind of welcome news involving a workplace bully who operates via DM.

I'm moving on very soon, but I've shared many of our interactions with management, management has even seen first hand how he openly insults other engineers.

Instead of doing anything about it, management announced we had been acquired and over the course of about 12 days slowly resigned leaving us with the new company.

New company promoted the bully.

Hopefully others speak up as I have and this new feature can help some people get relief from the guy.

bspn• 8 years ago

I don't understand how this feature changes anything? If he operates via DM them you and his other victims can pretty easily share the evidence with management today. I don't think this feature is going to a be a magic cure-all where management pro-actively monitors communications for this type of behavior - it will still require individual(s) to escalate a complaint that management can then investigate.

iamdave2• 8 years ago

In our unique case, it would have meant we could have exported old DMs from users who have since left the company after a recent merger.

I'm using my example to think forward: an employee leaves due to workplace conflicts, and later (not to intimate this is the path I'm taking, I'm merely walking out the door, as my issue was a mere personality conflict not something that I can seek damages over) pursues civil action, a responsible export and archive policy from HR the way IT departments may sometimes be required to retain email messages for a period of time can be a benefit if the departed employee cites their interactions with an abusive manager for their departure and subsequent litigation.

Other commenters have referenced this as well.

BLanen• 8 years ago

I don't know why people assumed they couldn't.

Before this, they would've been behind, at max, a subpoena, right?

technological• 8 years ago

I think this holds true for all slack teams I joined online. Online i mean, like golang slack or any other community created slack team I joined. Is this correct ?

brazzledazzle2• 8 years ago

They had compliance exports and I wish they'd stuck with that since turning them on notified everyone that your employer could now see everything and prevented them from exporting anything private prior to that.

I know why they did this but a compromise could have been found. With this ability someone can dump everything and just read through it with users none-the-wiser. If users read the previous documentation they'd even believe they were safe from snooping and would be notified when it started. At least with compliance exports the users were informed and had privacy.

jcims• 8 years ago

This will open up Slack to industries that frown upon creating communication channels between employees that cannot be recorded.

http://bizblog.blackberry.com/2015/07/chatrooms-in-finance-w...

thefifthsetpin4• 8 years ago

Nah. Slack was already open to them. You just had to enable the compliance audits. This is mostly interesting only because it's retroactive. A fact which of course wouldn't matter for anyone that wasn't already using slack.

baxtr• 8 years ago

That’s probably a very good reason to fall back to WhatsApp or whatever else for things I don’t want my employer to read.

benatkin• 8 years ago

It's an email replacement. Seems like an obvious choice to me.

phillipwills• 8 years ago

Always assume any communication on your work network can and will be monitored... If you want a private discussion, best to do it in person or on your own devices, not using any company resources.

acangiano• 8 years ago

Traveling all the way to Lanchasire seems excessive. Surely you can just have the conversation in person. ;)

kawsper• 8 years ago

This might break EU law, at least e-mails marked private are considered private, so your employer can't snoop in those.

dep_b• 8 years ago

I always assumed they could. As I always assume that basically everything I trust to a computer system could be public.

intopieces• 8 years ago

I thought this was a feature all along. From an HR and legal perspective, this is necessary, right? My emails on the company server are subject to discovery. I was coached at onboarding on what I could and could not say in an email. Down to, "when it doubt, schedule a call."

crescentfresh• 8 years ago

On a semi-side topic: Canadian dev here, I always immediately hard delete e-mail correspondence (both inbox and sent) with HR on anything that I feel private about, as I don't want the guys in IT reading it. I know they don't, but I also know they can.

For example, I might trust the head of IT but I might not trust that new intern or "new guy" they just hired.

What do you guys do when it comes to HR correspondence at your places of work?

bpicolo• 8 years ago

What do you mean "hard delete"? If your place of work is using any of the big cloud email services, they should be able to get at those emails regardless of whether you've deleted them.

unit91• 8 years ago

Well, there's nothing I can really do about it. When I hit "delete", my company email doesn't actually get deleted. It just disappears from my view. I believe the stated policy is they delete after 3 years post "delete".

If I worked in or near the office, I'd walk over to HR and request printouts instead of emails, but since I work remotely, I'm stuck.

zcrackerz• 8 years ago

Are you certain that IT can't read deleted emails? I would think there would be backups and logs in the email server.

bradyd• 8 years ago

This does not necessarily prevent them from being able to read these emails. If the email system has journaling enabled then a copy of every email sent and received is retained.

joosters• 8 years ago

With most corporate email systems, I'm pretty sure you can't hard delete any message. Sure, it may no longer show up in your inbox but it won't be vanishing off of the compliance logs.

pcora• 8 years ago

companies that care about that have email gateways that will store all messages, regardless of you saving/deleting them. this is not something they do at individuals inbox, to prevent what you do with the HR emails.

xstephen95x• 8 years ago

So then employees just switch to Signal for DMs...

mayneack• 8 years ago

I read the message retention policy as a true delete for anyone not wanting to get their previously private messages grandfathered into a newly non-private policy.

Slack warns you for a channel that setting the retention policy is "truly, permanently deleted. These messages can't be restored or recovered, even by Slack"

https://i.imgur.com/63x2oee.png

https://get.slack.help/hc/en-us/articles/203457187-Customize...

keeler• 8 years ago

Use slack-cleaner[1] to nuke messages you've sent. You need to generate a legacy token[2].

[1] https://github.com/kfei/slack-cleaner

[2] https://api.slack.com/custom-integrations/legacy-tokens

redblacktree• 8 years ago

Does this actually delete anything or just flag it as deleted?

Spoom• 8 years ago

I suspect that if they allow admins to download DMs, they also probably soft-delete messages, so deleted messages would still show up in the exports. Can anyone confirm?

wrs3• 8 years ago

For compliance exports at least, preserving deletes and edits is an option you can set.

neves• 8 years ago

If you publicize that you can read the messages, no problem.

I had a boss that liked to spy in the private messages of the employees without their knowledge. A bunch of interns started to privately create offensive nicknames for a fat employee. They didn't used the name in public. The read and started to use to use the nicknames in his conversation.

Well, this guy also publish jobs ads for our old tech stack with a false company name to see if any of his employees were applying.

Talk to me about lack of ethic.

EGreg• 8 years ago

I think Gitter is architected differently and doesn't allow this. Your private chats aren't in the context of some company, but the network.

Again, look at this everybody! We are relying on some third parties merely to facilitate our conversations! And they are relying on the "SAAS" developer who hosts all the conversations (not open source) to determine one-size-fits-all rules.

This is nearly 2020, why is it still the norm?

kingnight• 8 years ago

As an owner of a free slack that has thousands of historical and unaccessible messages by the users, how can I delete these stored but not unaccessible messages to protect them?

It seems unconscionable that Slack retains messages but provides no way to remove them without paying.

thanatropism• 8 years ago

My employment contract says something to the effect of "using internet facilities for work only". I mean, duh. I have a cellphone with a 4G signal that I pay for.

What next, employers are going to be able to choose the color of elevator buttons. Tyranny!

tptacek2• 8 years ago

How is this possibly news? Besides the fact than Slack has let owners read DMs through compliance export since forever, most company Slacks authenticate via mail (usually Google mail), which your employer controls.

This is no different than company emails, which (I hope this isn't surprising) your employer can also read.

Don't have personal conversations on your company Slack!

kuschku3• 8 years ago

Don't have personal conversations on your company Slack!

You may be discussing unionization on your company Slack, though, and the employer may now use that against you. There’s a lot more than strictly work-related content, and strictly private content. A huge grey area is inbetween, and the employer shouldn’t be able to access any of them (and as the ECHR ruled, the employer may now)

tptacek2• 8 years ago

If you’re worried about that, don’t use company Slack. But you should know that federal law protects employee organizing, especially for unions; if your employer retaliates, you can bring a claim against them.

guelo• 8 years ago

Based on experience I have somewhat related advice for employees: don't connect your personal phone to the office wifi.

ggregoire2• 8 years ago

I'm always surprised by the amount of DMs people send in Slack. I've worked in 2 companies using Slack and, in both, about 80% of the total messages were DMs. It seems crazy high to me. I wonder if people just send all day private stuff unrelated to work, or if people have trouble with trust and transparence on the workspace..

simonbw• 8 years ago

I don't find that surprising. Most of the communications I have at work are with a specific person, not with a whole channel. It's not because I don't want other people to know what I'm saying to someone, it's that I don't want to bother them with stuff that isn't relevant to them.

ggregoire2• 8 years ago

How do you know you bother them? Your comment makes me think to daily meetings in SCRUM. Sure most of the stuff people are working on or that blocks them is not relevant to everyone else, but we do it because it's good for the whole team to share and stay up-to-date on what is going on. As a tech lead/manager, I apply the same logic for my communication. I use DMs only for stuff that shouldn't be discussed publicly.

heartbreak• 8 years ago

I use DMs to avoid spamming my entire team with a discussion that only relates to one other member.

sundvor• 8 years ago

Perhaps people don't feel like spamming a number of people with a conversation that only needs two participants.

mbritton72• 8 years ago

Glad this is happening. It's not fair to use DMs to form alliances against colleagues in order to increase one's bottom line. That is exactly what I've observed in agencies that run on Slack. If life is a game, this is a backdoor worth closing.

aquadrop• 8 years ago

Your problem is with people, not slack, they can just go to skype or whatever tool they want.

postit• 8 years ago

In the end that's your responsibility to maintain professional level when using internal company tools.

Not surprisingly the three persons who forwarded me this thread with comments like: "shit", "is this legal or allowed?", or even "I'm screwed if they read my messages" - are the ones who are always trash talking colleagues, pairs and the company itself.

MarcScott2• 8 years ago

I had just assumed this was the case anyway.

I used to be a teacher, and have recommended Slack to an old colleague as a way facilitate staff communication at their school. Additionally my current organization quite often works with children at workshops and the like.

For an admin not to be able to look through DMs is a serious safeguarding issue, so I'm happy this is now possible.

mbrumlow2• 8 years ago

And with that slack is not something I will be using. Way to mess up a good thing.

sergiotapia• 8 years ago

I've always assumed that was the case. Company stuff is company stuff, don't assume otherwise.

sakuronto• 8 years ago

After dropping IRC supoort, this makes two controversial changes in a very short span of time. Did something change at Slack?

emodendroket• 8 years ago

I had assumed they already did this.

gaius• 8 years ago

Whenever I’ve been a SA I wouldn’t let a manager access an employee’s email without written authorisation from HR. How does that work here, what are the safeguards?

iamleppert• 8 years ago

Part of the reason why Slack has been so successful vs. other corporate messaging solutions is that it encourages employees to bring their “whole self” to work.

It’s perhaps the most important thing at work to feel like you can communicate easily and without fear of reprisal from managers and in my opinion had a lot to do with my extensive use of Slack.

It felt like, for the first time, the communications platform wasn’t “owned” by the strict hierarchy of the company. I created my own channels, and felt no fear when I communicated with co-workers. I wasn’t doing anything “wrong” ever in my communications, but, let’s face it: there are things that you don’t want your boss to know, especially if like the majority of people, you’re working for a bad boss that has to be “managed” himself.

If Slack continues in this manner, while it may make sense from a liability and business perspective, employees aren’t going to trust the platform anymore the first time a manager reads a private conversation and uses it against someone. And generally I’ve found it’s not hard to figure out you’re being spied upon.

I’m not sure what the solution is, but definitely if Slack allows managers private access (without a court order or similar serious situation where such access would be warranted), they can no longer claim they want employees to “bring their whole self” to work anymore.

Oh well. It was nice while it lasted.

tapsboy• 8 years ago

I agree. It feels like Slack broke our trust. I don't have any records, but do remember slack in it's earlier days promised of not sharing private communication to the employers and sending the logs directly to govt agencies or 3rd party audit agencies.

savanaly2• 8 years ago

Yep. I work totally remotely and Slack felt fundamentally different to email: my extensive DM's with coworkers felt very analogous to physical contact.

Sometimes, if you're working in an office, you just want to lean back in your chair and whisper to your coworker "what a fuckin awful meeting, what was [boss] thinkin?". And as a full-time remote worker, Slack was the only place for that. I feel this will make 100% remote a lot tougher and more isolating because the life-line that was private contact has been severed.

UncleMeat2• 8 years ago

It’s perhaps the most important thing at work to feel like you can communicate easily and without fear of reprisal from managers and in my opinion had a lot to do with my extensive use of Slack.

This is a problem with your management, not with Slack. If your managers are abusing such a tool to read everything you write then you have much much bigger problems.

xwvvvvwx• 8 years ago

Very surprised to find that this was not already the case.

In general I think you should assume that all communication on a work provided tool are not private.

Private conversations belong on whatsapp / signal.

geggam• 8 years ago

pidgin / adium OTR has been around for a long time.... for a reason

tootie• 8 years ago

There's actually a Slack competitor called Symphony that exists solely because it allows thorough auditing/monitoring/spying on all communications. It's ugly and is missing a ton of features. It's used by a bunch of financial services firms that have a lot of compliance rules they can't enforce with Slack. This move is probably to start getting Slack into that space.

mulmen• 8 years ago

The surprising thing to me is that this was not already a feature of Slack. Isn’t the ability to view employee communication a very basic requirement of corporate communication platforms? Does anyone have an expectation of privacy on any corporate infrastructure? I certainly never have.

thefifthsetpin4• 8 years ago

Yesterday, a private channel existed where your employee Jim may have mentioned to his friend and coworker that he had a date with his male partner. Today, that data became available to you. You were planning to fire Jim, but now there's a risk that it would look discriminatory. Do you risk a wrongful termination lawsuit and dragging your company's name through the mud? You could check his slack messages to assess that risk, but if you do find something then you're in an even worse situation.

This seems like the same minefield as asking an employee to login to his facebook. The main difference is that this time, slack did it to you -- you were not given a chance to opt-out.

jimktrains23• 8 years ago

Wait a month and then do it while making sure you have a clear case. I believe similar advice is given if there is an OSHA check -- since you can't know why you were checked, it's best to wait before firing anyone for non-blatant/egregious, even if it's with cause and evidence.

This seems like the same minefield as asking an employee to login to his facebook.

How is this like facebook? It's a corporate medium, just like email would be, or like a company-run XMPP or IRC server.

thefifthsetpin4• 8 years ago

It's like facebook in that the employees had a guarantee of privacy (insofar as most private communication is private; obviously the recipient can expose the message, or someone can coerce you to login to your account). Some people are waving this away with, "oh, probably the employee signed some contract saying that it wasn't private" but even if that's often true it's of course sometimes not true. Certainly I've never signed a contract with that kind of clause, but I've generally worked for small companies.

I suppose there's nothing preventing a company from using facebook as a corporate communication medium. That'd of course not a good idea since they don't have access to some of what goes on at facebook. The same thing was true for slack. Some companies used slack without considering that the data wasn't really under their control, which was perhaps not a good idea. This change is akin to facebook recognizing that blunder, and "fixing" it by making DMs between employees available to their employer.

thefifthsetpin4• 8 years ago

"Wait a month" if you do that, then slack just cost you thousands of dollars. How mad I'd be at slack would be proportional to how may thousands of dollars they just cost me.

thrillgore• 8 years ago

I'm disappointed, but not surprised. If you are on a company network, assume everything you do is logged.

orbitur• 8 years ago

So my longstanding "never write anything in corporate correspondence that I wouldn't want revealed some day" principle seems like a great one.

Seriously. It's not your platform, they are not your emails, they are not your chatlogs, and you should never act as if what you put in will remain private and yours to control.

rsuelzer• 8 years ago

I can't seem find the article where an employer was sued for failing to inform authoritied about a monitored work email that indicated one of their employees was about to commit suicide. I'm not sure what ever happened in that case.

jedberg3• 8 years ago

You can tell who here has worked for a large American company and who hasn't.

If you've ever worked for a large American company, you know that nothing you do on company equipment or with a service the company pays for is ever private, and you should never assume it is.

I'll be honest, I always thought Slack DMs were viewable by the admin. As a Slack admin myself, I always assumed I had that ability. Never used so, I never found out I was wrong, but just always assumed it was there.

To me this is a no-op: Anyone who worked for a large American company should have assumed that this ability was always there or could be there in the future, or at the very least, your employer could have always required you to log in and show them your DMs.

Cacti13• 8 years ago

It is very odd. We've had corporate monitoring of practically all employee electronic activities for decades. It's enshrined in legislation and tested in case law. The capabilities are built into practically every major business software. There are whole industries built up around it. Yet suddenly everyone is losing their mind over some corporate IMs just because it's Slack?

I feel like I'm on Reddit, not a site ostensibly catering to _computer professionals and experts_.

lwhalen2• 8 years ago

I know in general there's the whole "the company pays for it, the company owns it, the company can audit it" corportesse oblige, enshrined in case-law yada yada, but one of the things I always liked about Slack was it seemed to have a bit of that old counter-culture sneer around "yeah, that may be true, but we code for the user anyway". This is very much an anti-user, pro-corporate maneuver, and I think it's a shock to many who took Slack's long-time messaging to the contrary at face-value.

bbarn3• 8 years ago

The difference is their privacy policy has been changed retroactively against the good faith their users had. That's the problem. Of course if it's corporate it's usually monitored, but when Slack championed the user and only catered to the company when forced (via compliance reports which told you they were enabled) and now suddenly switches to a model where past contracts are broken, people have a right to be upset.

shurcooL• 8 years ago

That’s precisely my view on this too.

bbarn3• 8 years ago

Well, on the other hand, some of us checked, read the privacy policy, and found it acceptable. Compliance reports came out, with the caveat that that was from point in time forward, and that was also acceptable.

This is rewriting the privacy policy we agreed to retroactively, and it's not OK in my mind. I don't say anything stupid on company slack, but in principle this is a bad move.

cookiecaper• 8 years ago

Yes, this is what happened with me too. I assumed there was some way for the admin to view DMs, but on inspection, discovered there wasn't without first activating Compliance Exports. While it would be great to say that I was a hardened corporate peon that knew better than to fall for this, it wouldn't be completely true; I actually expected Slack to live up to that and not retroactively disclose DMs.

It's not that I necessarily wrote anything that would be a problem if it was disclosed (as others have pointed out, there were other workarounds to get DMs if the company really wanted them) -- it's just broken trust.

Access to DMs would've been par for the course if it had been the way Slack worked all along, but it's really disappointing to see them change it retroactively, insofar as that's what's actually happening.

The consensus here is of course correct: never trust anything done on company equipment, whether it's owned or rented (as in the case of a Slack channel) to be private, even if the owner of the rented property has given certain assurances. Money makes the world go 'round.

jedberg3• 8 years ago

Yeah, it kinda sucks that they changed the privacy policy, but if you had actually read it, you'd have seen the part that says that they can change it any time for any reason.

And also, all they've done is give the corporation the technical ability to do something they've always been able to do -- read your private chats. It's just that before they had to do more work to do it, but they've always had the right to do it, regardless of what Slack's privacy policy said.

sirmike_• 8 years ago

Bear in mind my opinion is coming from the US ITOps perspective, outside of this my opinion may not travel as far pun intended re:the rest of the world.

There are a lot of out of touch concerns here in regards to privacy. I think this basically shows the diff between INDependent devs and employEE devs.

At any point in time a company who owns and pays for all IT related accounts and services can look, monitor, export disable, enable, delete, log or secure their systems as they need to either by compliance requirements, legal, policy or for any business or nonbusiness reason at anytime.

At the least you do not have a right to privacy to at the best limited privacy when communicating on a company provided communications platform.

Most companies worth their salt have this written down in their company handbook or manual etc. Most companies also have reasonable "you may use company systems for limited private exchanges"

This is even more true when the company has government or gov facing clients or does business in certain market sectors like Finance.

It is good to see the new kid on the block (Slack) is growing up and getting more focused on its core business clients: companies/b2b.

The same goes for company provided laptops, equipment.

I think it is also super important above all that the vast majority of people and companies enter into these things in good faith and reasonableness. We just do not live in a world where the honor system can be the only safeguard for these things. And of course with all things businessey -- the more money is riding on top of something -- the more important it is to be wise in regards to risk in and out of business matters.

deltaprotocol• 8 years ago

Reading the comments it seems nobody is concerned about this broad access leading to sexual harassment of women who are constantly exposed to glances and stronger forms of abuse and may vent in a private channel, or may have discussed intimate concerns with friends (now past conversations are also available). Nobody paints the picture of the boss reading girls logs? This is pathetic. US, land of the well paid slaves.

asow923• 8 years ago

If you don't trust your employees enough maintain private discourse, why would you hire them in the first place?

lolsal• 8 years ago

Some companies have more than 10 employees.

asow923• 8 years ago

what if your company hires more than 1000? Does that mean you should compromise your values and integrity?

eecc• 8 years ago

Illegal in any country with just about decent employee protection. Looking forward to the lawsuits in EU

Cacti13• 8 years ago

Hate to break it to you, but this is not illegal in the EU.

jasonlotito3• 8 years ago

EU court of human rights disagrees with you.

https://www.echr.coe.int/Documents/Press_Q_A_Barbulescu_ENG....

dbalan• 8 years ago

This is going to be a problem for open source communities that use a semi-public slack as the communication platform. I don't think the users expect the DMs to be public to the project admin.

Its not necessarily bad. Bit it might be time for those communities to move.

foobaw• 8 years ago

You should never talk about extremely personal / private stuff via DMs anyway. I don't really care if my employer could read my DMs because they're mostly work-related small talk anyway.

gitpusher• 8 years ago

Good. If you have to say something work-inapproriate, don't use your work communication tools.

MarcScott2• 8 years ago

IMHO I don't think this is a fair title change. What is important here is the fact that access to DMs have changed. Not that the general import/export tools have changed.

If Google changed their TOS to suddenly make everyone's search history public, would the title read "Google changes TOS"?

bgentry• 8 years ago

Agreed, and all the past comments are about this one specific controversial change.

kossae• 8 years ago

This confused me as well, especially after coming back to it after the change. I had assumed some other Slack post went up and received equally or greater activity than the original post.

savanaly2• 8 years ago

I agree, and this is the first time I can ever recall disagreeing with one of HN's admin title corrections that I noticed.

shkkmo• 8 years ago

I thought this was a totally new item, a lot of the comments don't make sense without the old title

isatty4• 8 years ago

Yes, especially because I read the comments when the title was more accurate and came back thinking this was a new submission.

This is a completely irrelevant title.

ravitation7• 8 years ago

Even "Slack changes DM import/export" would be a better title. This current title I find to actually be almost completely unacceptable.

paulie_a• 8 years ago

Personally I assumed that capability was always available. So it was interesting when I received a private SMS about this story from a coworker.

RRRA• 8 years ago

So how does one delete his previous history before he was made aware of this change?!

in other news, I guess this means shadow IT is back in style! :P

amriksohata• 8 years ago

Goodbye slack, time to delete you like Facebook too

reagent• 8 years ago

I have a rudimentary tool (written in Ruby) that can be used to delete your history across channels & DMs that might come in handy: https://gitlab.com/reagent/slack-purge

downer72• 8 years ago

This is basically the end of Slack for me. It's over. I'm done.

I am now anti-slack. I am an opponent of slack.

You had me, but now you lost me.

isatty4• 8 years ago

Why was the title of this submission changed?

jeznag• 8 years ago

Old news

https://www.theverge.com/2014/11/24/7255199/slack-alters-pri...

mbrumlow2• 8 years ago

I am mostly worried about the bait and switch. If this feature was only applied to messages after the announcement then that would be fine. I am sure many of you have had conversations over slack thinking well it was okay because nobody could see them.

forgotmypw• 8 years ago

I've always assumed everything I type on a work machine is property of my employer, and thus can be reviewed, copied, etc.

I find astounding how many companies use a third-party messaging system for all their communications.

Do they not realize that anyone with access to Slack's data can read their stuff? That's over 1,000 people[1] if you only count Slack employees!

Do you really think that competitors or blackhats are above blackmailing or paying one of them for a data dump?

[1] As of March 2018, according to this Mashable article: https://mashable.com/2018/03/10/how-slack-uses-slack/

Guide to Slack import and export tools

Related Stories