Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

Regulators and courts are cracking down on businesses and their employees’ use of “ephemeral” messaging—e.g., WeChat, Slack, Signal, WhatsApp, Snapchat—to conduct business activities. The SEC and <a>CFTC</a> have levied billions of dollars in fines against financial institutions that failed to preserve ephemeral messaging communications. In 2021, the FTC <a href="https://www.ftc.gov/system/files/documents/cases/order_granting_spoliation_sanctions.pdf" target="_blank" rel="noreferrer noopener">obtained spoliation sanctions</a> related to the use of Signal communications, and more recently the agency <a href="https://www.ftc.gov/enforcement/competition-matters/2024/01/slack-google-chats-other-collaborative-messaging-platforms-have-always-been-will-continue-be-subject" target="_blank" rel="noreferrer noopener">said it may refer cases to DOJ for potential criminal prosecution</a> when documents are not preserved. In January 2024, the FTC and DOJ <a href="https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-doj-update-guidance-reinforces-parties-preservation-obligations-collaboration-tools-ephemeral" target="_blank" rel="noreferrer noopener">announced a hard line</a>: Document preservation obligations require preservation of data from ephemeral messaging platforms and a failure to do so will be treated as <a>spoliation </a>or even criminal obstruction of justice. That is unsurprising given DOJ’s view that “ephemeral messaging applications” are “designed to hide evidence.” Indeed, the FTC has said that complying with document preservation obligations may require “stopping use of certain applications altogether.” Moreover, several courts have imposed hefty discovery sanctions in civil litigation, including dismissal of claims, for failing to identify and preserve ephemeral messaging data.

core/paragraph

Given this environment, it is self-evident why companies need to mitigate the risks of ephemeral messaging. But that begs the question of how to mitigate, a question this article will attempt to answer, at least in part.

First, though, what is “ephemeral messaging”? Ephemeral messaging generally refers to communications applications that allow for end-to-end encryption, disappearing messages, or short-term auto-delete capabilities. Because auto-deletion is a hallmark feature of these applications, their use makes it all but certain that some data will be destroyed, perhaps without anyone even pressing a “Delete” key. A party may be found to have intentionally spoliated evidence in bad faith simply because employees used ephemeral messaging tools. However, employees at all levels, including C-suite executives and supervisory compliance personnel—including those charged with enforcing firm policies prohibiting the use of “off-channel” communications platforms—continue to use ephemeral messaging both for personal reasons and to engage in business-related activities. The fact that employees may use these platforms for personal use also invites new risk for businesses that rely on “bring your own device” (BYOD) policies.

Facing the risk of stiff civil penalties or even criminal prosecution, what can businesses do to get out in front of the ephemeral messaging enforcement tidal wave?

Assess the Risk. Businesses should assess the scope of ephemeral messaging use within their organizations to better understand the risks. This might take the form of an annual assessment, surveying employees for information on whether they use the applications (in their personal life or for business-related communications) and whether customers have communicated or requested communications on ephemeral messaging platforms. With this assessment, organizations can revisit their policies and procedures and consider new or revised practices.

Evaluate Policies and Procedures. Policies and procedures must be clearly articulated and disseminated across the organization, consistent with practical considerations and the organization’s appetite for risk. For example, an organization could prohibit employees from communicating about business other than by firm email or firm-specified applications or devices, or it could permit use of certain ephemeral platforms under circumstances that are warranted based on business needs and risk profile. If off-channel communications are permitted, the relevant policy should articulate the rationale and justification—DOJ prosecutors, for example, will weigh these explanations in considering how to proceed against a company that has lost relevant data. One specific consideration might be to revisit policies related to business-related communications, including BYOD policies. BYOD policies grew in popularity as firms confronted the significant investment needed to supply employees with mobile devices, but the substantial civil and criminal risks presented by these policies may warrant a second look at the cost of that upfront investment. BYOD policies limit organizational control and oversight, and the organization may not have access to the data at all. Organizations may be stymied, especially in internal investigations, if they need to quickly preserve communications or data located on an uncooperative employee’s personal device. By contrast, if the firm owns the device and controls the software and applications that run on it, there are technological solutions to eliminate these risks. This is particularly important for highly regulated industries, such as financial services, where the relevant statutes and regulations impose clear directives for firms to maintain business-related records and require firms to implement policies to ensure recordkeeping occurs.

Implementation and Training. Policies are important but only a starting point – companies must implement and train employees on the policies. As the settled regulatory actions show, the mere existence of a policy accompanied by rote annual training is unlikely to affect employee conduct or satisfy a firm’s preservation obligations in the eyes of conspiracy-minded regulators. Rather, supervisory personnel and company leadership must foster a culture of compliance by following these policies and enforcing them in meaningful ways. This might include quarterly training sessions and employee attestations, as well as actively monitoring employees’ business communications and doling out appropriate penalties for violations of the policies. Both SEC and DOJ have rewarded firms that proactively identify and punish individuals who violate these policies.

Data Preservation. Organizations must act swiftly to preserve data. A party’s obligation to preserve potential evidence (separate from regulatory requirements) arises when the party knows or should have known that information is relevant to litigation or a government investigation (e.g., upon receipt of a subpoena). But knowing when to preserve is only a first step. The organization must understand its technology and how to counteract features, such as auto-delete functions, that would thwart document preservation. This means specifically providing for the preservation of text messages and ephemeral messages as part of a litigation hold and taking steps to disable any deletion features. It also means continued monitoring for compliance with the hold.

Ephemeral messaging applications are here to stay, and regulators are increasingly aware of potential pitfalls and the leverage that may be gained through company missteps. If businesses are not proactive in understanding how ephemeral messaging affects their organizations and implementing strategies to manage its usage, they may well find themselves in the uncomfortable position of defending their actions before a court or a regulator.

https://admin.thompsonhine.com/wp-content/uploads/2024/03/Business-Law-Update-March-2024.pdf

core/file

This client update may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgement of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

Cutting No “Slack”: Ephemeral Messaging Creates Significant Enforcement Risk

Services