Slack in Discovery: A Challenge and An Opportunity
This is a Guest Post by Andy Wilson, Founder and CEO, Logikcull, the eDiscovery platform.
A series of emojis. A funny photo. This isn’t just Facebook. It’s how millions of corporate professionals are communicating today. It’s Slack.
Slack is the popular messaging system meant to make workplace collaboration easy. It is one of the fastest growing apps, with more than eight million daily users, and is used by 65% of Fortune 100 companies, including its top two customers, IBM and Oracle.
For legal professionals, however, Slack represents a painful and disruptive discovery challenge and an incredible opportunity.
In the past, legal teams involved in discovery and investigations sifted through emails, Office documents, PDFs, and images. Then came text, Facebook and Instagram. Now, apps such as Slack, HipChat and Google Hangouts are moving business communication from the inbox to the chat room.
The good news is that Slack data can be extremely rich and voluminous—a treasure trove for discovery, nothing less than a searchable log of conversation and knowledge. Legal professionals who are not dealing with Slack in discovery, may be letting potentially game-changing evidence go undiscovered. But reviewing Slack data can be virtually impossible without the right tools.
Slack 101
What is Slack? Slack is a messaging, chat and collaboration app that allows for fast paced communication, all logged in a highly searchable environment called a “workspace.” Slack lets work teams gather in the app to compose messages, share files, integrate information from third-party apps, and even make phone calls.
These workspaces can be incredibly rich in information. A Slack integration, for instance, can create a notification every time a spreadsheet is updated. Information can also be pulled from outside sources into Slack. A single Slack message log contains information on text, attachments, response types, edits, and more. Users can create and delete communication channels, edit individual messages, add and remove files, create, modify, or remove integrations—creating even more information tracked in the app.
In short, Slack gathers a massive amount of data, all stored in one place—and its default retention setting is to keep everything. However, users can set their own retention and deletion policies. That complicates consistent information governance—and discovery.
Key challenges of Slack for attorneys and discovery include:
– Embracing It. Apps like Slack are growing in use and number, becoming an increasingly necessary part of discovery and investigations. To integrate Slack into a regular discovery process, discuss Slack retention and governance policies with clients. Add Slack data to preservation letters, requests for production, and custodian interviews. Also, watch for indications that Slack might be an issue by, for example, noting for email notifications to active Slack users.
– Exporting Slack for Discovery. The type of Slack plan a company has will impact how easily Slack data can be retrieved. Typically, Slack allows all workspace owners and administrators to easily export data from public channels. That includes public messages, public files, archived channels, and integration activity logs. To obtain data on editing and deletion, or to access records from direct messages or private channels, the process may be more difficult. Slack supplies step by step information on how to export Slack data.
– Making Sense of Slack Data.Slack exports come in JSON format. JSON stands for the JavaScript Object Notation file format. It makes exchanging data between machines easy, but it also makes the data unreadable to nearly anyone but a computer programmer. Here’s what a record of a user joining a Slack chatroom, or “channel,” looks like when exported:
“user”: “U6NJNUGSH”,
“inviter”: “U5KTXUGSW”,
“text”: “ has joined the channel”,
“type”: “message”,
“subtype”: “channel_join”,
“ts”: “1502749986.378906
Got that? And that’s just for a simple message. For more complicated communications, a single message record can stretch over several pages, almost all of it nearly undecipherable.
Slack communication can also be very informal. Executives don’t often respond in corporate meetings with smiling or frowning emojis; in chat, everyone does. Attorneys, judges and juries will increasingly have to interpret these communication signals.
– Determining Custodians.The Electronic Discovery Reference Model’s glossary defines “data custodian” as a person “having administrative control of a document or electronic file.” It identifies the owner of an email account as the prototypical example.
With Slack data, determining custodians is more complicated. Individuals with administrative access to a workspace can export public information. But they may not have easy access to private channels, direct messages, and change logs. Individual users, who can see their own private communications, cannot export that data without administrative access.
– Spoliation Attempts.The control Slack allows over an individual’s messages creates significant risks of spoliation attempts. A Slack user may delete or edit messages in an attempt to remove potential evidence—and they may think they’ve succeeded. That’s because there’s no way to see original messages once they’re edited in Slack. Only an (edited) note marks the change. When messages are deleted, they appear, in the user’s eyes, to just disappear. Yet, unless the underlying workspace data is destroyed, many of these attempts at spoliation will fail. Slack records all messages, edits, and deletions. With the right software, finding such hidden information in Slack is easy.
Slack: The Treasure Trove
Data in Slack is immense, shifting, not easily accessible or easy to interpret. It is also continuously growing. Because Slack is cloud-based, it can be accessed from any device. This feeds the 24/7 discussions that can make Slack so valuable in discovery and investigations. To access Slack data, however, legal professionals need the right tools..
Today, modern discovery solutions, are starting to make Slack data accessible. The best can easily and quickly render and index Slack text, extract metadata to protect against spoliation, display deleted information, and reveal altered versions.
Most importantly, today’s leading technologies can turn Slack data from this:
“user”: “U6NJNUGSH”,
“inviter”: “U5KTXUGSW”,
“text”: “ has joined the channel”,
“type”: “message”,
“subtype”: “channel_join”,
“ts”: “1502749986.378906”
Into this:
As Slack continues to change the way businesses communicate, the ability to find and review that data will become increasingly necessary. In some organizations, Slack supplements existing communications, reducing email use while increasing chat. In others, Slack may exist as technology that is used without official sanction. Whatever the situation, discovery tools need to be robust and modern enough to handle this growing wealth of data.
By making Slack discovery easy and straightforward, and by revealing information revealing changes to messages and records of deleted conversations that would otherwise be hidden, new tools are allowing legal professionals to do just that.
[ Andy Wilson is Chief Executive Officer & Co-founder at Logikcull, which he launched in 2004 with CTO and cofounder, Sheng Yang. For more information about Logikcull and how it approaches Slack discovery, see here. ]