7 ms·

My wife’s Slack account was closed yesterday. She created the account while traveling in Cuba (legally) years ago and hasn’t been back to Cuba or any other san

My wife’s Slack account was closed yesterday. She created the account while traveling in Cuba (legally) years ago and hasn’t been back to Cuba or any other sanctioned country since. She is a cofounder of an org that uses Slack heavily and has now lost access to all her messages and files from the past couple years of work. There appears to be no appeal process here.

sneak 8y ago
The appeal process is filing a lawsuit against Slack, provided the person wronged didn’t already agree to give up that right when accepting Slack’s TOS.
- icebraining 8y ago
  Even if it wasn't given up, what would the lawsuit complain be, and what would one gain from it if it succeeds? Isn't Slack legally entitled to shut down any accounts at any time?
  - gaius 8y ago
    GDPR holds that you own your data and are entitled to be provided a download of it. Not sure what the Canadian equivalent is, if any.
    - saryant 8y ago
      Even if the GDPR applied in this situation, Slack is trying to obey US sanctions. I’d wager a guess GDPR can’t force a company to violate those laws.
      - taejo 8y ago
        GDPR has the force of law in its area of jurisdiction. If Slack can't comply with it, then they'd better not do business in that jurisdiction. That's how the law works; there isn't some hierarchy of one country's laws overriding others'.
        hartator 8y ago
        /s Exactly. It’s why we never saw two countries going to war.
        taejo 8y ago
        Are you suggesting the US go to war with the EU to force them to repeal the GDPR, so that Slack can do business in the EU? I know HN typically takes a pro-business angle politically, but that seems beyond even the most rabid line that I usually see here. If not, I am totally confused about how your response connects to what I wrote.
        794CD01 8y ago
        Other way around. The EU is the one who bears the burden of forcing American companies like slack to comply with their laws. Though jumping straight to a shooting war feels like an overreaction. Maybe start with a fine and ban the company if they don't pay.
      - icebraining 8y ago
        Do the US sanctions prevent them from giving the user a copy of their data?
    - zmk_ 8y ago
      And it applies to people who are in the EU. So all these people have to do to get their data is to book a plane ticket into any EU country.
  - niea_11 8y ago
    (Maybe this a stupid question) Why should they be entitled if you are a paying customer? Do they give you a backup of your activity on their platform before closing the account?
  - bgarbiak 8y ago
    IANAL but cutting you off your everyday job and crucial documents (causing stress, money problems, hopefully not: unemployment) only because you happened to open an account in a random country seems like a reason good enough for a lawsuit. What to gain: compensation, and that damn' account.
    - spacehome 8y ago
      You are not entitled to Slack's infrastructure, no matter how much you came to depend on it for your day-to-day life.
      - corebit 8y ago
        Well that's not strictly true. Presumably there is a contract of some sort, and Slack must abide by it, entitling users to Slack's infrastructure to some degree. It's not completely arbitrary. Plus there're notions of estoppel potentially at play.
        paulcole 8y ago
        Pretty sure the contract is going to be in Slack’s favor. They had all the leverage when somebody agreed to it. https://slack.com/terms https://slack.com/terms
        adventured 8y ago
        I'd pretty much guarantee their terms of service stipulate they can terminate an account at any time for any reason. It's how most Internet services operate. The only likely addition to that, is a monetary refund if warranted based on the account context.
        deleted 8y ago
        [deleted]
  - geofft 8y ago
    One, no, you are not legally entitled to shut down accounts on the basis of race or national origin, if that's what they're doing. Two, they may have to at least return the data: if I let you use a desk at my place and you start doing business there, I am pretty sure I cannot legally refuse you entry and hold on to your papers. Three, even if they are, we're also legally entitled to call Slack incompetent losers, and to tell our employers that we should not switch to Slack if we wish to continue being co-workers with Iranians. I will be telling my employer that shortly. (One fascinating aide effect of using Slack is thst the entire company must conform to Slack's policies. You cannot hire someone whom Slack won't create an account for, nor someone who won't agree to Slack's ToS, because if they're not on Slack they can't get work done.)
    - TomMarius 8y ago
      Digital data is not paper.
    - dahart 8y ago
      > no, you are not legally entitled to shut down accounts on the basis of race or national origin, if that’s what they’re doing. That’s not what the parent comment said, you’re twisting it with an assumption. Slack is not legally obligated to provide Slack accounts to anyone, that was the point. > they may have to at least return the data: if I let you use a desk at my place and you start doing business there, I am pretty sure I cannot legally refuse you entry and hold on to your papers. Your analogy is rather confused. The data Slack has isn’t equivalent to your papers that you dropped on their desk. When you sign up for Slack, you enter into a contract outlined in their Terms of Service that detail explicitly what they agree to be responsible for. In particular, here’s the agreement relating to your data: “Following termination or expiration of a workspace’s subscriptions, we will have no obligation to maintain or provide any Customer Data and may thereafter, unless legally prohibited, delete all Customer Data in our systems or otherwise in our possession or under our control.” https://slack.com/terms-of-service https://slack.com/terms-of-service
      - lukeschlather 8y ago
        > Slack is not legally obligated to provide Slack accounts to anyone Slack is legally obligated to provide Slack accounts to people who pay, with 30 days notice for termination in most cases. There is this stipulation: > We may terminate the Contract immediately on notice to Customer if we reasonably believe that the Services are being used by Customer or its Authorized Users in violation of applicable law. However, if they are terminating accounts based on ethnicity that doesn't seem like a reasonable belief they can use to justify applying export controls.
  - gnulinux 8y ago
    Honest question: if I go to McDonalds and pay for a burger can they refuse to serve me? I understand that they can refuse to serve me before paying, but after I pay their service and goods too?
jeromegv 8y ago
Cuba is one of the most popular destination for Canadians, can't ever imagine what would happen if they actually ban everyone that had their IP over there at some point in the last few years.
- macspoofing 8y ago
  I suspect the fact that the account was created in Cuba is what triggered the action.
mbesto 8y ago
So, uhh, just stop using Slack then? There are plenty of alternatives now.
- purerandomness 8y ago
  I don't think this is about Slack.
  - brianpgordon 8y ago
    Huh? This seems about Slack.
walterbell 8y ago
How do people export/backup messages from Slack?
- PakG1 8y ago
  Migrating to Mattermost from Slack and transitioning all the data is easy. My team at work transitioned to Mattermost a few years ago. https://docs.mattermost.com/administration/migrating.html#migrating-from-slack https://docs.mattermost.com/administration/migrating.html#mi...
  - walterbell 8y ago
    Thanks. This seems to be the important part: > Generate a Slack “Export” file from Slack > Administration > Workspace settings > Import/Export Data > Export > Start Export.
  - jorgelbg 8y ago
    If the account is already closed, this is not possible. And this is a major problem.
natch 8y ago
So is it related to her ethnicity as this guy is claiming it is in his case? If not maybe everyone can consider that maybe Slack’s actions for the Iranian guy have some basis other than “his ethnicity.”
- jordank 8y ago
  It appears we are talking about place of origin of accounts, at least in my wife’s case.
xenophonf 8y ago
While it's perfectly legal for your wife, a Canadian, to go to Cuba, it's still embargoed by the U.S., and Slack as a U.S. company must comply with the embargo (even though your wife has done nothing wrong per Canadian law).
- thumb 8y ago
  That's true, but why does that mean they need to shut down her account just because she visited Cuba? Would that mean a grocery store would then have to refuse to sell you their goods because you visited the country once?
  - yamazaki 8y ago
    They didn't shut down their account because she visited Cuba, but because her account was created _from_ Cuba. It's unfortunate but I guess it's the only way Slack has to "know" where an account is from.
    - TeMPOraL 8y ago
      It's the laziest possible way. They could've looked at most frequent login IPs instead.
      - true_religion 8y ago
        They should never have allowed the account to be created from Cuba in the first place. Slack when it was younger, didn't have good policies in place to actually follow US law. As such, now that they are reviewing their old records they realized they committed illegal actions that they need to clean up. Yes, it harms their customers, but that harm and the resulting damages to Slack' reputation (and maybe legal costs), is what they must pay for being negligent in the past.
  - 794CD01 8y ago
    Not a great analogy since you normally can't shop at an American grocery store from Cuba, but you can use an American web site from there.
mfer 8y ago
If Slack did this because of her trip to Cuba years ago it means they have kept records of her IP going back years. This causes me to think about the metadata records they have held onto in addition to all the data.
- jordank 8y ago
  Right, which should also indicate that this trip to Cuba wasn’t part of a pattern but rather an anomaly. I understand the complex legal frames that this exists in, but they appear to have the data to be way more precise here.
  - TeMPOraL 8y ago
    They may have the data, but they have no incentive to care whether or not their inferences are correct. This is a common problem with ostensibly data-driven companies.
- tzs 8y ago
  > If Slack did this because of her trip to Cuba years ago it means they have kept records of her IP going back years Or they did an IP to country lookup back then and kept the result of that rather than keeping the IP.
- Zopieux 8y ago
  And yet some people are wondering why GDPR has a data retention policy that aims at keeping personal data around for the least amount of time necessary. Companies should be made accountable for such blatant abuse of user data.
bjoli 8y ago
i am starting to become scared that my accounts with different companies will be closed retroactively. I have, through work, toured most of the free and some parts of the non-free world (including Iran, Cuba and sudan). That apparently makes me fair game to have my US accounts closed. Had I been a slack user I, by the look of it, probably would have had my account closed today, even though I have lived within the EU for all my life. I am pretty certain I have logged into my mail, PayPal account and Digital Ocean account from countries embargoed in the regions my providers operate. PayPal I could lose without much fuzz, but jeez how I'd hate to lose access to my email.
- swozey 8y ago
  I worked in webhosting forever and I've never heard of a company until this post actively digging through a users access to services to block them. What we'd do is use products like Maxmind where if you tried to sign up and pay from Iran, etc, you'd be automatically denied. I've never, ever heard of audits to SSH logs to track this stuff down. We'd audit ssh logs if there was a server that was hacked, etc, usually to see if they hacked other servers so we could take them all down at once or find out (they'd often have irc running) what groups they were in to get more info on how they did it, etc. This is absolutely ridiculous. I've opened up Slack while in Cuba to check on work things at my American company who does no business there. I don't have anything to do with our Slack bill and I'm a US citizen. So if someone goes to see their family in Iran/etc and just happens to open Slack they'll get banned? That's hamfisted as all hell.
arsinux 8y ago
Was her account the owner of the workspace? What has happened to the whole workspace?
avip 8y ago
I've just opened all my slack workspaces from an IP Geolocated in Tehran to test that hypothesis. Let's see how it unfolds. [EDIT] to be on the safe side, I've also created a new workspace from said IP.
alexlavrww 8y ago
Slack could just block access to IPs from banned countries. Why are they retroactively blocking accounts? Sounds like Slack is punishing regular people who visited those countries.
painlord2k 8y ago
If the data is worth something, get a lawyer to write a letter to them and request the data back. Lesson: keep backup of everything in multiple jurisdictions even if you are innocent like Jesus. You know what happened to him.

sneak 8y ago

The appeal process is filing a lawsuit against Slack, provided the person wronged didn’t already agree to give up that right when accepting Slack’s TOS.

icebraining 8y ago
Even if it wasn't given up, what would the lawsuit complain be, and what would one gain from it if it succeeds? Isn't Slack legally entitled to shut down any accounts at any time?
- gaius 8y ago
  GDPR holds that you own your data and are entitled to be provided a download of it. Not sure what the Canadian equivalent is, if any.
  - saryant 8y ago
    Even if the GDPR applied in this situation, Slack is trying to obey US sanctions. I’d wager a guess GDPR can’t force a company to violate those laws.
    - taejo 8y ago
      GDPR has the force of law in its area of jurisdiction. If Slack can't comply with it, then they'd better not do business in that jurisdiction. That's how the law works; there isn't some hierarchy of one country's laws overriding others'.
      - hartator 8y ago
        /s Exactly. It’s why we never saw two countries going to war.
        taejo 8y ago
        Are you suggesting the US go to war with the EU to force them to repeal the GDPR, so that Slack can do business in the EU? I know HN typically takes a pro-business angle politically, but that seems beyond even the most rabid line that I usually see here. If not, I am totally confused about how your response connects to what I wrote.
        794CD01 8y ago
        Other way around. The EU is the one who bears the burden of forcing American companies like slack to comply with their laws. Though jumping straight to a shooting war feels like an overreaction. Maybe start with a fine and ban the company if they don't pay.
    - icebraining 8y ago
      Do the US sanctions prevent them from giving the user a copy of their data?
  - zmk_ 8y ago
    And it applies to people who are in the EU. So all these people have to do to get their data is to book a plane ticket into any EU country.
- niea_11 8y ago
  (Maybe this a stupid question) Why should they be entitled if you are a paying customer? Do they give you a backup of your activity on their platform before closing the account?
- bgarbiak 8y ago
  IANAL but cutting you off your everyday job and crucial documents (causing stress, money problems, hopefully not: unemployment) only because you happened to open an account in a random country seems like a reason good enough for a lawsuit. What to gain: compensation, and that damn' account.
  - spacehome 8y ago
    You are not entitled to Slack's infrastructure, no matter how much you came to depend on it for your day-to-day life.
    - corebit 8y ago
      Well that's not strictly true. Presumably there is a contract of some sort, and Slack must abide by it, entitling users to Slack's infrastructure to some degree. It's not completely arbitrary. Plus there're notions of estoppel potentially at play.
      - paulcole 8y ago
        Pretty sure the contract is going to be in Slack’s favor. They had all the leverage when somebody agreed to it. https://slack.com/terms https://slack.com/terms
      - adventured 8y ago
        I'd pretty much guarantee their terms of service stipulate they can terminate an account at any time for any reason. It's how most Internet services operate. The only likely addition to that, is a monetary refund if warranted based on the account context.
      - deleted 8y ago
        [deleted]
- geofft 8y ago
  One, no, you are not legally entitled to shut down accounts on the basis of race or national origin, if that's what they're doing. Two, they may have to at least return the data: if I let you use a desk at my place and you start doing business there, I am pretty sure I cannot legally refuse you entry and hold on to your papers. Three, even if they are, we're also legally entitled to call Slack incompetent losers, and to tell our employers that we should not switch to Slack if we wish to continue being co-workers with Iranians. I will be telling my employer that shortly. (One fascinating aide effect of using Slack is thst the entire company must conform to Slack's policies. You cannot hire someone whom Slack won't create an account for, nor someone who won't agree to Slack's ToS, because if they're not on Slack they can't get work done.)
  - TomMarius 8y ago
    Digital data is not paper.
  - dahart 8y ago
    > no, you are not legally entitled to shut down accounts on the basis of race or national origin, if that’s what they’re doing. That’s not what the parent comment said, you’re twisting it with an assumption. Slack is not legally obligated to provide Slack accounts to anyone, that was the point. > they may have to at least return the data: if I let you use a desk at my place and you start doing business there, I am pretty sure I cannot legally refuse you entry and hold on to your papers. Your analogy is rather confused. The data Slack has isn’t equivalent to your papers that you dropped on their desk. When you sign up for Slack, you enter into a contract outlined in their Terms of Service that detail explicitly what they agree to be responsible for. In particular, here’s the agreement relating to your data: “Following termination or expiration of a workspace’s subscriptions, we will have no obligation to maintain or provide any Customer Data and may thereafter, unless legally prohibited, delete all Customer Data in our systems or otherwise in our possession or under our control.” https://slack.com/terms-of-service https://slack.com/terms-of-service
    - lukeschlather 8y ago
      > Slack is not legally obligated to provide Slack accounts to anyone Slack is legally obligated to provide Slack accounts to people who pay, with 30 days notice for termination in most cases. There is this stipulation: > We may terminate the Contract immediately on notice to Customer if we reasonably believe that the Services are being used by Customer or its Authorized Users in violation of applicable law. However, if they are terminating accounts based on ethnicity that doesn't seem like a reasonable belief they can use to justify applying export controls.
- gnulinux 8y ago
  Honest question: if I go to McDonalds and pay for a burger can they refuse to serve me? I understand that they can refuse to serve me before paying, but after I pay their service and goods too?

jeromegv 8y ago

Cuba is one of the most popular destination for Canadians, can't ever imagine what would happen if they actually ban everyone that had their IP over there at some point in the last few years.

macspoofing 8y ago
I suspect the fact that the account was created in Cuba is what triggered the action.

mbesto 8y ago

So, uhh, just stop using Slack then? There are plenty of alternatives now.

purerandomness 8y ago
I don't think this is about Slack.
- brianpgordon 8y ago
  Huh? This seems about Slack.

walterbell 8y ago

How do people export/backup messages from Slack?

PakG1 8y ago
Migrating to Mattermost from Slack and transitioning all the data is easy. My team at work transitioned to Mattermost a few years ago. https://docs.mattermost.com/administration/migrating.html#migrating-from-slack https://docs.mattermost.com/administration/migrating.html#mi...
- walterbell 8y ago
  Thanks. This seems to be the important part: > Generate a Slack “Export” file from Slack > Administration > Workspace settings > Import/Export Data > Export > Start Export.
- jorgelbg 8y ago
  If the account is already closed, this is not possible. And this is a major problem.

natch 8y ago

So is it related to her ethnicity as this guy is claiming it is in his case? If not maybe everyone can consider that maybe Slack’s actions for the Iranian guy have some basis other than “his ethnicity.”

jordank 8y ago
It appears we are talking about place of origin of accounts, at least in my wife’s case.

xenophonf 8y ago

While it's perfectly legal for your wife, a Canadian, to go to Cuba, it's still embargoed by the U.S., and Slack as a U.S. company must comply with the embargo (even though your wife has done nothing wrong per Canadian law).

thumb 8y ago
That's true, but why does that mean they need to shut down her account just because she visited Cuba? Would that mean a grocery store would then have to refuse to sell you their goods because you visited the country once?
- yamazaki 8y ago
  They didn't shut down their account because she visited Cuba, but because her account was created _from_ Cuba. It's unfortunate but I guess it's the only way Slack has to "know" where an account is from.
  - TeMPOraL 8y ago
    It's the laziest possible way. They could've looked at most frequent login IPs instead.
    - true_religion 8y ago
      They should never have allowed the account to be created from Cuba in the first place. Slack when it was younger, didn't have good policies in place to actually follow US law. As such, now that they are reviewing their old records they realized they committed illegal actions that they need to clean up. Yes, it harms their customers, but that harm and the resulting damages to Slack' reputation (and maybe legal costs), is what they must pay for being negligent in the past.
- 794CD01 8y ago
  Not a great analogy since you normally can't shop at an American grocery store from Cuba, but you can use an American web site from there.

mfer 8y ago

If Slack did this because of her trip to Cuba years ago it means they have kept records of her IP going back years. This causes me to think about the metadata records they have held onto in addition to all the data.

jordank 8y ago
Right, which should also indicate that this trip to Cuba wasn’t part of a pattern but rather an anomaly. I understand the complex legal frames that this exists in, but they appear to have the data to be way more precise here.
- TeMPOraL 8y ago
  They may have the data, but they have no incentive to care whether or not their inferences are correct. This is a common problem with ostensibly data-driven companies.
tzs 8y ago
> If Slack did this because of her trip to Cuba years ago it means they have kept records of her IP going back years Or they did an IP to country lookup back then and kept the result of that rather than keeping the IP.
Zopieux 8y ago
And yet some people are wondering why GDPR has a data retention policy that aims at keeping personal data around for the least amount of time necessary. Companies should be made accountable for such blatant abuse of user data.

bjoli 8y ago

i am starting to become scared that my accounts with different companies will be closed retroactively. I have, through work, toured most of the free and some parts of the non-free world (including Iran, Cuba and sudan). That apparently makes me fair game to have my US accounts closed. Had I been a slack user I, by the look of it, probably would have had my account closed today, even though I have lived within the EU for all my life. I am pretty certain I have logged into my mail, PayPal account and Digital Ocean account from countries embargoed in the regions my providers operate. PayPal I could lose without much fuzz, but jeez how I'd hate to lose access to my email.

swozey 8y ago
I worked in webhosting forever and I've never heard of a company until this post actively digging through a users access to services to block them. What we'd do is use products like Maxmind where if you tried to sign up and pay from Iran, etc, you'd be automatically denied. I've never, ever heard of audits to SSH logs to track this stuff down. We'd audit ssh logs if there was a server that was hacked, etc, usually to see if they hacked other servers so we could take them all down at once or find out (they'd often have irc running) what groups they were in to get more info on how they did it, etc. This is absolutely ridiculous. I've opened up Slack while in Cuba to check on work things at my American company who does no business there. I don't have anything to do with our Slack bill and I'm a US citizen. So if someone goes to see their family in Iran/etc and just happens to open Slack they'll get banned? That's hamfisted as all hell.

arsinux 8y ago

Was her account the owner of the workspace? What has happened to the whole workspace?

avip 8y ago

I've just opened all my slack workspaces from an IP Geolocated in Tehran to test that hypothesis. Let's see how it unfolds. [EDIT] to be on the safe side, I've also created a new workspace from said IP.

alexlavrww 8y ago

Slack could just block access to IPs from banned countries. Why are they retroactively blocking accounts? Sounds like Slack is punishing regular people who visited those countries.

painlord2k 8y ago

If the data is worth something, get a lawyer to write a letter to them and request the data back. Lesson: keep backup of everything in multiple jurisdictions even if you are innocent like Jesus. You know what happened to him.