US agencies warn companies: Don’t delete Slack or Signal chats

https://news.bloomberglaw.com/antitrust/dont-delete-slack-or-signal-chats-us-agencies-warn-companies

by hhs • 2 years ago

131 128 2 years ago

news.bloomberglaw.com

AlexandrB• 2 years ago

For Slack, this seems like it should be a checkbox you set somewhere that causes Slack to archive everything instead of deleting it. And if you want to be ISO 9001 (or whatever) compliant you have to set the checkbox.

rilindo• 2 years ago

IIRC, slack archive by default, you don't have access to previous messages after a certain point unless you pay for the service.

lxgr3• 2 years ago

Messages older than 90 days are only hidden in the free plan, not deleted: https://slack.com/help/articles/7050776459923-Pricing-change...

As soon as you start/resume paying, you can access them again.

FooBarBizBazz• 2 years ago

This will encourage RTO. If off-site workers can't engage in illegal and anticompetitive behavior without it being documented, then they'll be shut out of the important roles.

kayodelycaon3• 2 years ago

Unlikely. Video and phone calls aren’t recorded. I’ve used them tons of times to discuss things with coworkers I don’t want seen by management.

SoftTalker• 2 years ago

That's a throwback to a time when it wasn't possible or practical to record them.

There's no technical reason that lets you keep Slack, chat, or email and prevents keeping phone calls and video. It's all just digital data.

I'd expect we'll see the requirements change to include these.

rightbyte2• 2 years ago

Its just a matter of time before some LLM will transcribe them and log your calls though. It might allready be happening.

jprete• 2 years ago

Technological infeasibility is not necessarily an excuse for skipping record-keeping. I've heard that financial organizations, which often have strong compliance requirements, do in fact record phone calls and video chats - possibly even face-to-face meetings. And they will actively discourage you from using a line not controlled by the company, because otherwise they could have compliance violations.

taeric3• 2 years ago

I suspect this will almost certainly lead to more companies that have policies against these tools. I'm also assuming data retention policies would be the same as email? Such that you can delete them, but it has to be a stated policy with legally applicable timelines.

ryandrake• 2 years ago

This doesn't seem much different than what companies must do with E-mail when they are under investigation or getting sued. Surely these chat applications have a configuration to allow for messages to not be deleted when under "litigation hold". No company that I know of has a policy against E-mail.

taeric3• 2 years ago

Most policies regarding email are that some topics are off limits for email. Certainly speculative business conversations should not be done on email, largely because context matters a lot for those discussions.

Though, you are right that most places ignore email until you get going pretty well, and then by that point the cat is out of the bag. It used to be that only official communications where important. And that was largely managed by you only kept official communications archived. Now that we can archive anything, it is getting kind of silly.

otoburb• 2 years ago

Reviewing the actual FTC announcement: "Companies that allow or provide applications with ephemeral messaging capabilities must continue to retain all relevant documents during government investigations and enforcement actions."[1]

Looks like this is only (especially) applicable once the company in question has been officially notified of an active ongoing government investigation.

[1] https://www.ftc.gov/enforcement/competition-matters/2024/01/...

eschneider3• 2 years ago

What they mean is _don't delete chats after an investigation has started._ What sensible people do is have a retention policy of not keeping chats longer than, say seven days.

I know what you're thinking, "Slack is our project archive." If that's actually true, .gov investigations are the LEAST of your problems.

jgalt212• 2 years ago

What sensible people do is have a retention policy of not keeping chats longer than, say seven days.

or seven years if the SEC is watching over you.

gherkinnn• 2 years ago

Retaining messages for no longer than a week or two would act as a forcing function to keep project management and comms sane.

wharvle3• 2 years ago

True in theory.

In practice, I’ve never seen a “more-correct” system actually replace the value of long-lived chat channels and a culture of discussing things out in the open on those channels.

Long-lived chats don’t replace documentation and project management, but I’ve yet to see those replace the value of long-lived chats.

Now, it probably could be replaced by companies putting project management in a non-hellish tool that’s close to the code and has a pleasant chatting-about-issues experience and low structure so you don’t feel like you’re knocking over some PM’s sand castle if you mess with it (so NOT jira, asana, et c) but I’ve never experienced a company that does that. Communicating in the PM tools is always terrible.

ParetoOptimal2• 2 years ago

Even though I commented up thread that not having logs for more than 7 days would be horrible for an employee, I don't necessarily disagree fully with this statement.

It would ideally force employees to take notes and keep comms/project management sane, however I'm more likely to believe people would just get used to finding an easier workaround or guessing.

dylan604• 2 years ago

Wouldn't any chance to retention policies be a bit of a possible canary trap?

eschneider3• 2 years ago

Not really an issue. When you're in a situation where you need to retain data for legal reasons, You TELL people that, so they don't inadvertently destroy the data. It's the opposite of a secret.

lxgr3• 2 years ago

It's still bizarre to me that this has become the industry standard in the US.

Sure, it's all legal and perfectly reasonable at the micro level considering that every stored email increases the legal fees (due to making discovery more expensive during any hypothetical future lawsuit), but at a macro level, the outcome "companies legally delete all written communications as soon as feasible" seems baffling.

At the opposite end of the spectrum is the financial industry, where regulators effectively require recording every single bit of business communication (by taking a very liberal interpretation of some quite old law, as far as I understand), written or spoken (unless it was in person, of course), and under threat of massive fines.

It seems to me like there should be some pragmatic middle ground somewhere between these two extremes?

eschneider3• 2 years ago

The "companies legally delete all written communications as soon as feasible" outcome isn't (mostly) because companies are trying to hide illegal shit. It's because when you get sued for whatever, and your email/chat/whatever get subpoenaed, there's going to be who-knows-how-much embarrassing personal gossip in there, too and that just makes folks look bad. The easiest way to avoid that (and other forms of embarrassment) is to just not keep that stuff around.

If it's policy, it's legal. You can't go around and delete the stuff after the fact.

judge2020• 2 years ago

Although you'll get in trouble if you make that a policy after being told to keep stuff: https://www.fastcompany.com/90955785/google-deleted-chats-in...

rpaddock• 2 years ago

"...at a macro level, the outcome 'companies legally delete all written communications as soon as feasible' seems baffling."

That leads us to directly to "2028 – A Dystopian Story" By Jack Ganssle:

http://www.ganssle.com/articles/2028adystopianstory.htm

That explains why no records are to be kept, and this is the real law:

Known as ’The Rule of 26’, which is sometimes given as a reason NOT to keep engineering notebooks etc. By Federal Rule 26 you are guilty if you did not volunteer the records before they are requested. Including any backups.

From Cornel Law:

LII Federal Rules of Civil Procedure Rule 26. Duty to Disclose; General Provisions Governing Discovery

Rule 26. Duty to Disclose; General Provisions Governing Discovery

(a) Required Disclosures.

(1) Initial Disclosure.

(A) In General. Except as exempted by Rule 26(a)(1)(B) or as otherwise stipulated or ordered by the court, a party must, without awaiting a discovery request, provide to the other parties:

(i) the name and, if known, the address and telephone number of each individual likely to have discoverable information—along with the subjects of that information—that the disclosing party may use to support its claims or defenses, unless the use would be solely for impeachment;

(ii) a copy—or a description by category and location—of all documents, electronically stored information, and tangible things that the disclosing party has in its possession, custody, or control and may use to support its claims or defenses, unless the use would be solely for impeachment; …

https://www.law.cornell.edu/rules/frcp/rule_26

Longlius• 2 years ago

It's not simply deleted for legal reasons - hacks and other data breaches can turn excessive retention policies into massive liabilities.

nullc3• 2 years ago

It should be personal policy too, the costs of dealing with it in discovery are all the more ruinous personally.

paulddraper4• 2 years ago

I know what you're thinking, "Slack is our project archive." If that's actually true, .gov investigations are the LEAST of your problems.

I'm thinking Slack is my conversation archive.

scruple• 2 years ago

We must not have the same employer. Our private message retention rate must be 30 days. It's fucking infuriating but I also believe it's directly correlated to TFA.

Karellen• 2 years ago

Why do you have a "conversation archive"?

Wouldn't you consider it really fucking weird if every time you had an informal, in-person discussion with a friend, or maybe a partner, or even a co-worker, that they insisted on writing everything both of you said in a notebook to keep a permanent record of it, in case they wanted to call you out on something you kind of blurted out without too much thought ten years from now, or to be able to turn it over to the authorities if they ever (incorrectly?) thought you might be implicated in something dodgy? Or for it to be available for someone to steal and/or make copies of?

They can never just have a chat with you? Shoot the shit and put the world to rights, without you keeping meticulous records of every goddamn word they said off the cuff?

You don't think that, maybe, the more our real lives move online, the more that that kind of friendly, informal, ephemeral conversation ought to be able to move online?

bigstrat2003• 2 years ago

That is what unethical people do. Sensible people have a retention policy that balances storage cost with need to look at the archives, rather than "we have to make sure we don't get caught doing illegal shit".

lazide10• 2 years ago

It’s often not that anyone is doing illegal shit or not, it’s that archives can be mined for out of context quotes that will ruin the company or people involved regardless.

And large archives also dramatically increase costs of complying with civil discovery, which already can make the most ridiculous lawsuit costs millions just to ‘deal with’.

williamcotton• 2 years ago

Don’t think illegal, think ammunition for the opposition.

deciduously• 2 years ago

It's right there in the name, Searchable Log of All Company Knowledge.

kevindamm• 2 years ago

now that's a good backronym

anticensor• 2 years ago

Searchable Log of All Communication and Knowledge, actually.

Ringz• 2 years ago

Saved for the next junior pm, who tries to add Slack to the stack.

bsimpson• 2 years ago

The thing Google got chastised for is having a short retention policy.

ParetoOptimal2• 2 years ago

What sensible people do is have a retention policy of not keeping chats longer than, say seven days.

Maybe that's good from a company perspective, but from an employee perspective not being able to search old conversations is abysmal.

bitmasher9• 2 years ago

Most tech companies shut down or slow down for 1-2weeks around Christmas. Imagine coming back to an empty Slack.

taeric3• 2 years ago

Seven is almost certainly too short of a timeline for this? I'd expect the retention policy to be at least months, if not longer. Certainly for top level employees.

NotSammyHagar2• 2 years ago

But that is exactly how corporations work. When I worked at Microsoft more than 10 years ago, they set everyone's exchange storage to a small amount and they auto-deleted old email, but the storage per person was too small, with lots of messages with embedded docs, etc. So every developer was wasting time deleting messages, trying to get under the storage limit so you could send and receive new email. And they were auto-deleting chats after a time. I was in some random group of people that were supposed to preserve material for a lawsuit, but they wouldn't give me more storage, I think what I did was store appropriate emails locally on my desk top.

In later jobs we were using slack and they auto-deleted them after a week or two. We were allowed to create persistent slack channels that were private. This whole area is a waste of time, where the lawyers reduced the legal risk of the company from lawsuits, they transferred the cost to their dev teams wasting time managing this. At this company "our developers are our most important resource" but we weren't that important. I told my manager that all the devs were wasting time with this, probably a few hours a week figuring out if they should "preserve something" to remember decisions that were made. He agree it was a huge waste of time.

foofie• 2 years ago

When I worked at Microsoft more than 10 years ago, they set everyone's exchange storage to a small amount and they auto-deleted old email, but the storage per person was too small, with lots of messages with embedded docs, etc. So every developer was wasting time deleting messages, trying to get under the storage limit so you could send and receive new email.

I think Amazon also follows that practice. It assigns something like 2GB of email storage for everyone, and also has a policy in place to ask to increment storage by 250MB bumps. At each request, users are gently nudged to just delete emails.

llm_nerd• 2 years ago

This goes without saying, but those in the financial industry should be aware that there are stringent record keeping requirements that apply to things like text messaging, Slack, etc. Quite recently a set of firms were fined $1.1 billion for not retaining text messages, for instance.

mlhpdx2• 2 years ago

It’s not after an investigation begins, it’s the moment that it’s likely or foreseeable that an legal action may come. Basically, if you think you might be in trouble and you delete stuff, you definitely are.

Edit: illegal -> a legal

cpersona• 2 years ago

This is not surprising. When an investigation gets underway, the company being investigated will notify employees that any assets relating to the subject of the investigation should be retained. Typically, this covers all physical and digital documents and communications.

varispeed2• 2 years ago

Which some employees may interpret as wink wink destroy everything...

bluGill2• 2 years ago

They might, but HR will (or at least should) fire anyone who does that - that is guards escort you from your desk to the door. Then to add insult to your bad day, you get summoned to court for your contempt of court hearing. It is to the companies advantage to turn in anyone who attempts to destroy everything - it shows the court they are serious about saving everything which might be useful if they need to claim something was an oversight. Of course if you are the subject of that wink wink thing - assume they are trying to make you take the blame for the company.

Not that they are likely to be able to do much. My company first presses the button in exchange to lock everything electronic I have so I cannot delete it, before they let me know that I need to save everything (or so they claim...). Thus I cannot really delete anything. I might be able to shred something, but who keeps paper records of anything (and if by chance I do have one, odds are it is a printout of something where there is still an electronic copy). While I don't know what company you work for, it they have any size at all they should have similar processes in place so there is nothing you can delete - but the act of attempting it will be noted and brought to court.

legitster• 2 years ago

There are already companies in this space that specialize in archival tools for old messages - Smarsh or Global Relay.

Matt Levine has written about this a lot - back in the day when these rules were made, the only writing that were meant to be preserved were handwritten letters and memos. Today, regulators have a treasure trove of communication on which to build a case - their only limitation is the ability to process it.

It's funny to me how many of these cases end up getting built on an email that turns up in a search where someone says "gee - I really think we are doing a crime here! Are we doing a crime? I really hope we aren't doing a crime."

Like, the person might have had the most innocent intentions, but they end up manifesting the charges they are complicit in. Meanwhile, companies who do some real evil stuff get off scot-free because no one had the moral thought to have their doubts in writing.

paulddraper4• 2 years ago

Meanwhile, companies who do some real evil stuff get off scot-free because no one had the moral thought to have their doubts in writing.

No, belief or doubts has absolutely nothing to do with whether you committed a crime or not.

It has to do with whether it was with malice/intention.

nightowl_games• 2 years ago

Your speaking with too much absolutism. It doesn't matter whether you committed a crime or not, it matters if you can be convicted. That distinction illuminates the ambiguity and uncertainty that is it inherent in the justice system.

lazide10• 2 years ago

Intent is a required element in many crimes (mens rea), and proving so is often hard. Unless someone writes one of these emails, like they noted.

Fraud, for instance. Or murder vs manslaughter vs ‘an accident’.

Smoking gun emails can totally sink a case or get people convicted.

pixl973• 2 years ago

So, it seems like you don't understand mens rea versus actus reus

andix3• 2 years ago

Good thing that it's not (easily) possible to back up Signal chats. Lose the devices and the history is gone.

Kon-Peki• 2 years ago

Enjoy your bankruptcy and/or jail time when they decide you lost it on purpose.

xxpor2• 2 years ago

If only that were true. Jenny Durkan would be in jail right now.

(Background: https://www.seattletimes.com/seattle-news/law-justice/no-cha...)

olejorgenb• 2 years ago

I was about to question this statement, but then I remembered that it's actually a few steps you need to go through. Enabling backup, remember to transfer the backup file regularly, and keep track of the passphrase. I wouldn't say it's hard though. A bit cumbersome, but not hard.

andix3• 2 years ago

I think it depends on the platform. On iOS I'm not sure if it's even possible to get to the messages without a jailbreak.

lanstin2• 2 years ago

Enterprise signal lets you enforce retention times /s

andix3• 2 years ago

Is that some kind of fork of the open source client big companies use?

kkfx• 2 years ago

A small side question: what if Slack or Signal do delete or alter them instead? Not necessarily the parent company, just some rogue employee inside them. Oh, that's MIGHT happen with emails as well IF they are left on someone else server or some internal admin decide to do nasty things, but emails can be stored locally on ANY system, it should be used grabbing messages with the classic fetchmail and keep them locally, shared maildirs as well, just mirrored. A local approach to locally work and sync against the remote.

Instead we keep choosing a SPOF after another with some that even state "that's for safety"...

Try to imaging why we chose for instance to switch from classic cvs/svn systems to dCVS ones. Try to realize how simple is design desktops that works like desktops, of course you do not sync a copy of a multi-TB database locally but most stuff, docs, sources, mails and so can perfectly be local+sync issueless. Of course on a FDE storage.

Why keeping modern desktops used as dumb terminals since they are far more capable than a classic dumb terminal and they cost as well because of that?

siliconc0w• 2 years ago

When this interesting is when they start requiring any LLMs trained on your internal data be handed over for interrogation.

justinclift• 2 years ago

For Slack specifically, the US agencies could probably also ask Slack themselves to enforce the "don't delete stuff for company XYZ".

Signal though would be a different matter entirely.

0xy• 2 years ago

A previous employer who shall not be named had a policy that all Slack DMs older than 2 weeks were immediately deleted. Can't find any smoking guns if the gun has been incinerated.

colinmorelli• 2 years ago

We did this at a previous startup and it had nothing to do with smoking guns. We were in healthcare and, although we had a strict policy against posting any PHI in slack, we still purged history in the off chance that it did end up somewhere. It’s just another layer to privacy protections.

It also had the nice benefit of forcing people to store actual knowledge in Notion where it could be organized and more easily discoverable.

Anyway, all this to say - there are many reasons to purge slack history that aren’t nefarious (even if the practice is ill advised by some)

pylua• 2 years ago

Companies really shouldn’t be required to keep messages unless they are legally bound to do so. It’s very intrusive and very costly to keep.

I don’t really have an issue with bezos using it unless he was under investigation.

If they want to get access maybe they should try some sort of wiretap law to get access to messages before they are deleted ? Place bugs in the board rooms ? Maybe there needs to be a modern way to capture the crime in progress the same way they bugged gotti?

unstatusthequo• 2 years ago

Ah this. Meanwhile, a face to face meeting is ultimately much more secure and avoids any ability of investigators to get a neat, clean transcript without bugging a cafe table with a mic. I routinely collect signal messages for my job. Not LE either! So be wary of what you trust. The capabilities of your adversary probably exceeds yours.

apapapa• 2 years ago

So creepy

Aeolun• 2 years ago

I mean, they say that, but if I have incriminating messages I’m fairly certain I’m better off deleting them and being dinged for obstruction of justice (assuming the main charge doesn’t stick).

HackerThemAll• 2 years ago

The fact that these tools do not have the default setting of keeping chat messages for no more than 30 days is ridiculous. On each and every conversation I can, I'm always changing (where possible) to not leave the digital stench eternally.

leros• 2 years ago

I worked at a company that changed the retention policy for email and other communication to 12 months. I instantly lost tons of old notes. I started saving important emails to Google Docs so I could still reference. It was very annoying.

US agencies warn companies: Don’t delete Slack or Signal chats

Related Stories