10 ms·
US agencies warn companies: Don’t delete Slack or Signal chats
- AlexandrB 3y agoFor Slack, this seems like it should be a checkbox you set somewhere that causes Slack to archive everything instead of deleting it. And if you want to be ISO 9001 (or whatever) compliant you have to set the checkbox.
- rilindo 3y agoIIRC, slack archive by default, you don't have access to previous messages after a certain point unless you pay for the service.
- lxgr 3y agoMessages older than 90 days are only hidden in the free plan, not deleted: https://slack.com/help/articles/7050776459923-Pricing-changes-for-the-Pro-plan-and-updates-to-the-free-plan https://slack.com/help/articles/7050776459923-Pricing-change... As soon as you start/resume paying, you can access them again.
- FooBarBizBazz 3y agoThis will encourage RTO. If off-site workers can't engage in illegal and anticompetitive behavior without it being documented, then they'll be shut out of the important roles.
- kayodelycaon 3y agoUnlikely. Video and phone calls aren’t recorded. I’ve used them tons of times to discuss things with coworkers I don’t want seen by management.
- SoftTalker 3y agoThat's a throwback to a time when it wasn't possible or practical to record them. There's no technical reason that lets you keep Slack, chat, or email and prevents keeping phone calls and video. It's all just digital data. I'd expect we'll see the requirements change to include these.
- kayodelycaon 3y agoSure, it could change in the future. It's not the reality now, so data retention rules on chat programs isn't likely to cause a return to office. Management have been using phones to bypass record keeping for well over half a century.
- rightbyte 3y agoIts just a matter of time before some LLM will transcribe them and log your calls though. It might allready be happening.
- vel0city 3y agoIts already an optional feature of a lot of chat platforms. https://support.microsoft.com/en-us/office/view-live-transcription-in-microsoft-teams-meetings-dc1a8f23-2e20-4684-885e-2152e06a4a8b https://support.microsoft.com/en-us/office/view-live-transcr... https://www.microsoft.com/en-us/microsoft-365-life-hacks/organization/using-chatgpt-creating-meeting-agendas-minutes-notes#:~:text=To%20use%20this%20AI%20to%20create%20a%20summary,to%20generate%20your%20summary.%205%20Check%20the%20work https://www.microsoft.com/en-us/microsoft-365-life-hacks/org....
- rightbyte 3y agoOh ... Well I wonder when "Facebook-scale" can do untargeted spying? Like, record and transcribe your Whatsapp calls without knowing that you are a high value product or dissident. I guess it would be to expansive to do right now, compute wise? I am seriously thinking about making my own VOIP app for the phone to try to mitigate these kinds of attacks.
- taeric 3y agoI suspect this will almost certainly lead to more companies that have policies against these tools. I'm also assuming data retention policies would be the same as email? Such that you can delete them, but it has to be a stated policy with legally applicable timelines.
- ryandrake 3y agoThis doesn't seem much different than what companies must do with E-mail when they are under investigation or getting sued. Surely these chat applications have a configuration to allow for messages to not be deleted when under "litigation hold". No company that I know of has a policy against E-mail.
- taeric 3y agoMost policies regarding email are that some topics are off limits for email. Certainly speculative business conversations should not be done on email, largely because context matters a lot for those discussions. Though, you are right that most places ignore email until you get going pretty well, and then by that point the cat is out of the bag. It used to be that only official communications where important. And that was largely managed by you only kept official communications archived. Now that we can archive anything, it is getting kind of silly.
- otoburb 3y agoReviewing the actual FTC announcement: "Companies that allow or provide applications with ephemeral messaging capabilities must continue to retain all relevant documents during government investigations and enforcement actions."[1] Looks like this is only (especially) applicable once the company in question has been officially notified of an active ongoing government investigation. [1] https://www.ftc.gov/enforcement/competition-matters/2024/01/slack-google-chats-other-collaborative-messaging-platforms-have-always-been-will-continue-be-subject https://www.ftc.gov/enforcement/competition-matters/2024/01/...
- eschneider 3y agoWhat they mean is _don't delete chats after an investigation has started._ What sensible people do is have a retention policy of not keeping chats longer than, say seven days. I know what you're thinking, "Slack is our project archive." If that's actually true, .gov investigations are the LEAST of your problems.
- jgalt212 3y ago> What sensible people do is have a retention policy of not keeping chats longer than, say seven days. or seven years if the SEC is watching over you.
- gherkinnn 3y agoRetaining messages for no longer than a week or two would act as a forcing function to keep project management and comms sane.
- wharvle 3y agoTrue in theory. In practice, I’ve never seen a “more-correct” system actually replace the value of long-lived chat channels and a culture of discussing things out in the open on those channels. Long-lived chats don’t replace documentation and project management, but I’ve yet to see those replace the value of long-lived chats. Now, it probably could be replaced by companies putting project management in a non-hellish tool that’s close to the code and has a pleasant chatting-about-issues experience and low structure so you don’t feel like you’re knocking over some PM’s sand castle if you mess with it (so NOT jira, asana, et c) but I’ve never experienced a company that does that. Communicating in the PM tools is always terrible.
- ParetoOptimal 3y agoEven though I commented up thread that not having logs for more than 7 days would be horrible for an employee, I don't necessarily disagree fully with this statement. It would ideally force employees to take notes and keep comms/project management sane, however I'm more likely to believe people would just get used to finding an easier workaround or guessing.
- cpersona 3y agoThis is not surprising. When an investigation gets underway, the company being investigated will notify employees that any assets relating to the subject of the investigation should be retained. Typically, this covers all physical and digital documents and communications.
- varispeed 3y agoWhich some employees may interpret as wink wink destroy everything...
- bluGill 3y agoThey might, but HR will (or at least should) fire anyone who does that - that is guards escort you from your desk to the door. Then to add insult to your bad day, you get summoned to court for your contempt of court hearing. It is to the companies advantage to turn in anyone who attempts to destroy everything - it shows the court they are serious about saving everything which might be useful if they need to claim something was an oversight. Of course if you are the subject of that wink wink thing - assume they are trying to make you take the blame for the company. Not that they are likely to be able to do much. My company first presses the button in exchange to lock everything electronic I have so I cannot delete it, before they let me know that I need to save everything (or so they claim...). Thus I cannot really delete anything. I might be able to shred something, but who keeps paper records of anything (and if by chance I do have one, odds are it is a printout of something where there is still an electronic copy). While I don't know what company you work for, it they have any size at all they should have similar processes in place so there is nothing you can delete - but the act of attempting it will be noted and brought to court.
- varispeed 3y agoVery good points!
- legitster 3y agoThere are already companies in this space that specialize in archival tools for old messages - Smarsh or Global Relay. Matt Levine has written about this a lot - back in the day when these rules were made, the only writing that were meant to be preserved were handwritten letters and memos. Today, regulators have a treasure trove of communication on which to build a case - their only limitation is the ability to process it. It's funny to me how many of these cases end up getting built on an email that turns up in a search where someone says "gee - I really think we are doing a crime here! Are we doing a crime? I really hope we aren't doing a crime." Like, the person might have had the most innocent intentions, but they end up manifesting the charges they are complicit in. Meanwhile, companies who do some real evil stuff get off scot-free because no one had the moral thought to have their doubts in writing.
- paulddraper 3y ago> Meanwhile, companies who do some real evil stuff get off scot-free because no one had the moral thought to have their doubts in writing. No, belief or doubts has absolutely nothing to do with whether you committed a crime or not. It has to do with whether it was with malice/intention.
- nightowl_games 3y agoYour speaking with too much absolutism. It doesn't matter whether you committed a crime or not, it matters if you can be convicted. That distinction illuminates the ambiguity and uncertainty that is it inherent in the justice system.
- lazide 3y agoIntent is a required element in many crimes (mens rea), and proving so is often hard. Unless someone writes one of these emails, like they noted. Fraud, for instance. Or murder vs manslaughter vs ‘an accident’. Smoking gun emails can totally sink a case or get people convicted.
- paulddraper 3y ago
- andix 3y agoGood thing that it's not (easily) possible to back up Signal chats. Lose the devices and the history is gone.
- lanstin 3y agoEnterprise signal lets you enforce retention times /s
- andix 3y agoIs that some kind of fork of the open source client big companies use?
- Kon-Peki 3y agoEnjoy your bankruptcy and/or jail time when they decide you lost it on purpose.
- xxpor 3y agoIf only that were true. Jenny Durkan would be in jail right now. (Background: https://www.seattletimes.com/seattle-news/law-justice/no-charges-over-former-seattle-mayor-durkans-deleted-texts-prosecutors-say/ https://www.seattletimes.com/seattle-news/law-justice/no-cha...)
- HeatrayEnjoyer 3y ago[dead]
- olejorgenb 3y agoI was about to question this statement, but then I remembered that it's actually a few steps you need to go through. Enabling backup, remember to transfer the backup file regularly, and keep track of the passphrase. I wouldn't say it's hard though. A bit cumbersome, but not hard.
- andix 3y agoI think it depends on the platform. On iOS I'm not sure if it's even possible to get to the messages without a jailbreak.
- kkfx 3y agoA small side question: what if Slack or Signal do delete or alter them instead? Not necessarily the parent company, just some rogue employee inside them. Oh, that's MIGHT happen with emails as well IF they are left on someone else server or some internal admin decide to do nasty things, but emails can be stored locally on ANY system, it should be used grabbing messages with the classic fetchmail and keep them locally, shared maildirs as well, just mirrored. A local approach to locally work and sync against the remote. Instead we keep choosing a SPOF after another with some that even state "that's for safety"... Try to imaging why we chose for instance to switch from classic cvs/svn systems to dCVS ones. Try to realize how simple is design desktops that works like desktops, of course you do not sync a copy of a multi-TB database locally but most stuff, docs, sources, mails and so can perfectly be local+sync issueless. Of course on a FDE storage. Why keeping modern desktops used as dumb terminals since they are far more capable than a classic dumb terminal and they cost as well because of that?
- deleted 3y ago[deleted]
- CaffeinatedDev 3y ago[flagged]
- cryptonector 3y ago"But how did they know he used it, huh huh?"
- x86x87 3y agothey know he used Signal. Not sure you can know what he used it for. https://www.wikihow.com/Know-if-a-Contact-Is-Using-Signal https://www.wikihow.com/Know-if-a-Contact-Is-Using-Signal also there are some conspiracy theories that Signal is actually CIA's puppet: https://kitklarenberg.substack.com/p/signal-facing-collapse-after-cia https://kitklarenberg.substack.com/p/signal-facing-collapse-...
- cryptonector 3y agoI was referencing those conspiracy theories, yes. Note my use of quotes.
- x86x87 3y agoi missed the "quotes". sorry :) now it makes more sense
- deleted 3y ago[deleted]
- siliconc0w 3y agoWhen this interesting is when they start requiring any LLMs trained on your internal data be handed over for interrogation.
- justinclift 3y agoFor Slack specifically, the US agencies could probably also ask Slack themselves to enforce the "don't delete stuff for company XYZ". Signal though would be a different matter entirely.
- 0xy 3y agoA previous employer who shall not be named had a policy that all Slack DMs older than 2 weeks were immediately deleted. Can't find any smoking guns if the gun has been incinerated.
- colinmorelli 3y agoWe did this at a previous startup and it had nothing to do with smoking guns. We were in healthcare and, although we had a strict policy against posting any PHI in slack, we still purged history in the off chance that it did end up somewhere. It’s just another layer to privacy protections. It also had the nice benefit of forcing people to store actual knowledge in Notion where it could be organized and more easily discoverable. Anyway, all this to say - there are many reasons to purge slack history that aren’t nefarious (even if the practice is ill advised by some)
- pylua 3y agoCompanies really shouldn’t be required to keep messages unless they are legally bound to do so. It’s very intrusive and very costly to keep. I don’t really have an issue with bezos using it unless he was under investigation. If they want to get access maybe they should try some sort of wiretap law to get access to messages before they are deleted ? Place bugs in the board rooms ? Maybe there needs to be a modern way to capture the crime in progress the same way they bugged gotti?
- unstatusthequo 3y agoAh this. Meanwhile, a face to face meeting is ultimately much more secure and avoids any ability of investigators to get a neat, clean transcript without bugging a cafe table with a mic. I routinely collect signal messages for my job. Not LE either! So be wary of what you trust. The capabilities of your adversary probably exceeds yours.
- apapapa 3y agoSo creepy
- Aeolun 3y agoI mean, they say that, but if I have incriminating messages I’m fairly certain I’m better off deleting them and being dinged for obstruction of justice (assuming the main charge doesn’t stick).
- HackerThemAll 3y agoThe fact that these tools do not have the default setting of keeping chat messages for no more than 30 days is ridiculous. On each and every conversation I can, I'm always changing (where possible) to not leave the digital stench eternally.
- leros 3y agoI worked at a company that changed the retention policy for email and other communication to 12 months. I instantly lost tons of old notes. I started saving important emails to Google Docs so I could still reference. It was very annoying.