Corporate Communications and Ephemeral Data

So as you mentioned, I'm a partner with the labor and employment law firm of Fisher Phillips. We have. Probably more than thirty five offices around the country. I am centered in the Philadelphia office.

I have been with the firm almost two years. So I started April twenty twenty one. Prior to that, I had worked with a more local firm with a national practice that's surprisingly a number, I would say, of attorneys in my Philadelphia office at Fisher Phillips used to work at. And so My practice historically in the area of eDiscovery focused sort of centralized on an eDiscovery and not really a litigator's practice has been we are largely in the area of employment defense law, as well as enforcement of restrictive covenants post employment.

So the firm that I worked at prior to Fisher Phillips focused on that. And, you know, I brought that skill set to Fisher Phillips. We do the same kind of work just on a larger, more national scale, and we also do labor work as well. I've been focused on eDiscovery specifically.

Probably since around two thousand and nine, and that was just, you know, purely out of necessity needing to map it and understand it, and it eventually just became my sole focus at some point.

This is Don't we geek out every day though, really, on some level compared to the rest of the population?

Yeah. So clearly, I think everyone realizes if you're working from home, you have to use some sort of, well, you don't have to, but there's been a huge expansion in the use of collaboration tools. Right? They don't really necessarily come under what we would think of as ephemeral data or messaging, but clearly we all have not all, but a large percentage of us have moved to something like Teams or Slack, Google Workspace, things like that where you know, we're hosting a lot of video conferences, we're chatting instead of emailing.

I know that my chat messages have increased probably exponentially since I've been working from home rather than using emails as I have in the past. And so, you know, that has changed the scope of our e to discovery project. So it's expanded really the volume that we have to look at. And there's other things that we have to consider.

Right? So There are chats within, you know, these different applications.

Data can be stored in different locations. So for instance, in teams, you know, the attachments can be stored in the cloud. There might be, you know, issues involving modern day attachments like, links, versus, you know, true attachments. There's issues that, you know, we encounter with, like, slack in terms of being able to properly preserved data.

It's not always as easy as preserving something in Microsoft Outlook. A lot of it depends on what your enterprise subscription levels are. So, you know, I find Slack can be more challenging than teams. So there are all these additional considerations.

It's not just emails. People are using chat messages, features.

People are recording videos, and those could be implicated in a particular matter. I have to say that I have not seen a huge increase or prevalence in the ephemeral messaging in our cases. I sort of took an informal survey with our a discovery project managers, and they said the same that they're not really seeing that as much, but we are seeing collaboration data all over the place. So Yeah. We've definitely changed the, you know, there are some pretty extraordinary usage metrics out there about pre pandemic and post pandemic use of collaboration and, you know, that's reflected in our cases.

And, you know, maybe didn't have all the right data governance in place and just kind of, you know, certain putting these repositories out there and now stuff is all over the place. Yeah. That's the thing. Right?

So If you're not providing your employees with the tools to do their jobs, they're gonna find the tools to do them. Right? And that can include uses of personal devices that may not necessarily be sanctioned by the company. That can include use of these third party messaging apps that we're gonna talk about today that might be, you know, consumer level and not enterprise level.

So there's not a lot of controls over them administratively by the employer. And You know, also it gets to not only just sort of the what you describe, which is, you know, a larger variety of storage locations, but it also gets to some critical analysis under certainly the federal rules about whether an employer has control over a particular device or has control over a particular storage location. If it's the employee's personal device or personal cloud account, personal application. So not only is there more difficulty in scoping and figuring out where all the, you know, identifying all the data storage locations, but it also can provide some, perhaps, frustrating analysis of whether or not those devices and those personal accounts are actually within the control of the employer In the event, the employer has to preserve that information or produce it in litigation.

Clearly, you can't control everything. Right? You can do the best that you can in developing a robust BYOD and compliance program and this, you know, the steps that I'm about to discuss are in the article that we you mentioned earlier. And I think the guidelines we provided were in the context of, you know, a memo that was released by the DOJ in terms of what prosecuting attorneys are gonna be looking at if they are investigating your company And, you know, whether or not you really, you have a robust compliance program around employees' use of personal devices in these third party messaging apps that companies don't really, you know, have control over and don't have the ability to monitor.

And so, really, I think what you have to do is a few things. So first, I think you need to sort of take an inventory of what you do have. And are these tools really meeting your employees' needs on a day to day basis.

You know, if they are, make sure that you're taking measures that you can properly administer those tools. In other words, have a good retention policy, make sure you're able to preserve data when you need to. In the event there is anticipated litigation or investigation.

And if you don't think your tools provide the kind of practical communication that your employees seem to need, and you would know that, you know, you may know that by learning that there is you know, employees are going off grid and using their own personal applications, just research and figure out what you can use on an enterprise level to try to suede employees from using, you know, the consumer level of an application, because if you can find something that is practical and easy to use. It's even okay if it's an ephemeral messaging app as long as you don't, you know, there's no pending litigation. You wanna make sure you have the ability to have robust administrative controls around them. So you can set retention periods.

You can suspend auto delete functions or if needed for regulatory purposes or, you know, if there's a duty to preserve. And then you wanna have a written policy around the use of employees' personal devices at work and the messaging and collaboration platforms that can be used. And I think those corporate policies should, you know, you should consider having some kind of provision that would allow for the company to review the personal devices upon request. That helps with being able to monitor the use of those devices and those applications. And if you need to perhaps collect the devices in the future for preservation or imaging or something like that.

I wanna make sure that part of, you know, your policy considers the company's retention obligations under regulatory or statutory provisions. So if you're in the broker dealer industry, you're gonna have SCC regulations that are gonna dictate how long you have to retain certain communications.

Other things you might wanna consider are whether there are any privacy laws that you have to adhere to. So you wanna keep that in mind as well. And then you wanna make sure that you're training your employees. Right?

So You wanna have a training program that advises employees about risks associated with using unauthorized devices or communication platforms for work and trains them on what the company policies are in regard to that usage. And I think that the training should have a self attestation component to it as well. Right? So that There's some record or audit trail that the training has occurred and the employee agrees to adhere to.

The company's policies on BYOD and use of collaboration or messaging platforms. And then finally, you have to have some type of monitoring or enforced employee compliance. So, like I said, you'd wanna be able to have some ability to monitor employees personal devices to assess compliance. You might wanna even monitor, you know, employees' usage of the applications you're providing to them because if you're finding that some employees' usage is really low, that might be a notice trigger that, hey, that person is maybe using some unauthorized unsanctioned tool, and we need to do a little follow-up here.

And then finally, you have to have an enforcement component. Right? So you have to enforce violations with appropriate discipline, and it should really be something that is enforced evenly across the board. So it would apply to senior level executives as well as to, lower level workers at the company.

You know, there's gonna be some of that. There has to be some of that. Right? Or your workplace isn't going to be an enjoyable place to be because you do develop beyond professional relationships.

You have personal relationships with the people that you work with. You know, you have, you know, your work buddies, and it's important to foster that kind of interaction. To have a healthy happy workplace. I have seen something recently in the last month or so on how some companies are scaling back on employees' ability to use collaboration tools.

I don't know if you've seen that. There was a company in Canada that the name escapes me, but they were having days where you couldn't have video conferences. People were having too many video conferences, and they were scaling back on the ability of employees to use the video conferencing tools. It wasn't an isolated company.

There were a few. And so there must be some type of concern among employers that those video meetings were being abused on some level. So I don't know what that's about, but I remember reading an article about that. I think and I think it was in January because I was actually doing some prep work for another presentation.

So You know, I haven't seen that personally. We don't really use a video chat tool just to chit chat, you know, you know, like a webinar or video conferencing just to chit chat. I guess there is some concern out there that employees might be abusing it and using it excessively, which kind of surprised me, frankly.

Well, Jared brings up an interesting point. Right? We had a, a wonderful guest also on a podcast a few, episodes ago. Christine Payne, who was talking a lot about wellness.

There's definitely a business case to be made for using these tools. Right? So There's an information governance sort of benefit to using these tools, right? The, you know, if you're using the, you know, quickly delete function, you know, then you have less data.

So you have less storage costs. So there's the benefit to that. And they have retention settings in them too. So, you know, there is an ability to meet certain, you know, data disposition requirements under your information governance policy, but it can reduce storage costs.

So that's one. It can reduce the amount of data that you have that may be subject to a cyber security threat. So, you know, the less you have, the less, you know, arguably your risk for losing, you know, business data to, incident threat. And also, there can be some benefit, under the GDPR, right, that you're minimizing the amount of data that you maintain.

And the GDPR, you know, other privacy rules have some of those, you know, components where you have to minimize the amount of data, personal data. You keep about consumers or you keep about your employees. So there's definitely a business case to be made in favor of ephemeral messaging, and I don't think there's anything wrong with femoral messaging per se, right? Just generally.

Right? You can use it. You can there's nothing wrong with using it. Like I said, I think you should have some policy written around it.

And the appropriate uses of it, but that would be for any type of tool you offer your your employees to use. And I think folks get in trouble when there is you know, a regulatory or statutory obligation to retain data for a certain period of time or if you're under a duty to preserve, but that's true for any data. Right? Any ESI that might need to be retained for a statutory regulatory reason if you, you know, anticipate lit it reasonably anticipate litigation, you have to preserve it.

So I think of several data messaging data may have some unconscious bias against it because of its nature. It's meant to disappear. And so folks may you know, attribute a nefarious intent just out of that fact because we're used to email sort of being around. Right?

You know, it depends on your company's retention policy, but You know, if I wanna find an email from two years ago, I can find it, right, with a little search on my on my desktop. I think that courts and maybe lawyers to some degree have been slow to adopt some legal tech and just, you know, some of the new data types like, femoral messaging it's slow to warm up to it. Like, in the beginning before we all started using active learning more regularly, there, you know, we treated that whole workflows, something different than if I were reviewing hard copy documents. So there were some cases that required to producing party to turn over not responsive documents in the context of a predictive, you know, coding project, but we would never require that and, you know, and I'm old enough to remember when it was only hard copy discovery.

Right? You would never require that unless there was some kind of foundational, you know, evidentiary foundation that, you know, the producing party didn't, you know, meet their discovery obligations. Right? There's something.

Some kind of misconduct. Potential misconduct going on. But so I think that courts, you know, and some lawyers are slow to warm up to certain new legal tech and new data types. And I think that, you know, there was a sort of a gut instinct that this ephemeral messaging only be for nefarious purposes, right?

Like, why would you need something to disappear? But I think that, you know, the more popular it be comes, the more widely it becomes used, the more these issues get litigated, I think that, you know, that'll wear off a little bit. And just like now, we're using active learning all the time. We are, you know, and other practicing attorneys are in this field are know, it's certainly more widely adopted than it was, say, one, you know, in two thousand nine or so.

I think that as people become more comfortable with the you know, the business case that I just made for the use of this data, then I think some of the sort of gut instinct to you know, not trust it, you know, will diminish.

If a company has uses ephemeral messaging, has the policy written around it, You know, isn't something where they just started using it to evade a duty to preserve, but, you know, you've been using it for some period of time. You have policies around it. You're acting responsibly. With it.

You're retaining what you need when you need it. You know, that can go a long way if you ever the company ever finds itself, you know, trying to defend some discovery motion or trying to maybe answer the questions of maybe the DOJ in a government investigation. So I think the distrust of this messaging apps will will start to dwindle the more and more popular they become. And the more courts have to resolve issues related to them.

And I didn't know what a dictaphone was, by the way.

It's enforceable.

Exactly. So is it any different principles. Yeah. Right. So talk about how that really is.

The end of the day, it nefarious is nefarious. It doesn't matter if it's Slack. It doesn't matter if it's teams. It doesn't matter if it's Snapchat or it doesn't matter if it's email or even a file.

It's the same, isn't it? Correct. It's the same legal principles that are applied. Right? If you're using these applications and you're under a duty to preserve.

You have to change the auto delete settings. You have to take other measures to preserve data, you know, on these platforms You issue litigation holds, you collect to preserve if you have to. So, you know, there's the same sort of control issues. If it's not an enterprise messaging application, then you may have control issues.

It really depends on the jurisdiction you're in. It depends on whether there's any, you know, legal obligation for the employee to turn over their devices or their personal apps. So it's the same analysis.

Some of those cases like the FTC v. Noland case.

That was the case where they started using ephemeral messages to specifically avoid their duty to preserve. The company just found out that they were being investigated by the TC. And almost immediately, they abandoned their normal business communication platforms and started using, I forget which one it was. But started using signal. Started using ephemeral messages that deleted.

They were using ProtonMail. Exactly. Right. Exactly. You know, and a lot of these cases, there was a lot going on in terms of egregious discovery shenanigans.

Right? There was a lack of candor to the other side and to the court. There wasn't transparency. They weren't taking reasonable measures to preserve.

Certainly, if you, think that you might get in the DOJ's crosshairs, you know, in the criminal division, you'd wanna do that. And so part of monitoring it is not only monitoring the activity of alternative sanctioned, you know, the emails and things like that. You wanna if an employee is not using the tools that you've provided to them, they're using something else. So I think your duty bound if you're on notice that if you see the in part, the monitoring is, you know, checking that, auditing that.

And if you're finding that certain employees are not using the tool that you've provided, they're using something, and I think your duty bound to figure out what that is. And, you know, if you have a policy in place that allows you to request or demand the use of a personal device as part of that monitoring program, then, you know, you always have to give notice. You can't just request it. And make it a part of your policy and have the employee sign off on it.

You know, you can check to see perhaps what other kinds of tools they might be using. But, yeah, I think your duty balance, you just can't have these policies and not, you know, make sure that they're not being adhered to, particularly if you have a regulatory or statutory obligation to retain these messages. And that brings up some recent settlements that a number of around ten or twelve or something like that companies in financial services industry.

I think it was last year. They were not retaining the text messages and chat messages used by their employees. And so they had settlements with the SEC and with the commodities future trading commission about settlement consent orders about their failure to preserve and supervise employee business communications on employee personal devices and third party, messaging applications.

You know, you really can't mess around with that. You could, you know, you could have, you know, awful fines And it's just not worth it. Wendy, you know, I'd be remiss if if we didn't bring up on the show here. So everything that the three of us are talking about, like, we're really obviously into this topic.

Right? That can include hiring someone who knows better. Right? So if you don't have the competence to navigate legal tech issues or eDiscovery issues or forensic issues, in your representation of your client, then your duty bound to either find someone in your firm who does or engage a vendor who does or decline the representation.

So the responsibility doesn't end there though. Right? So in order to be competent, you can retain a vendor who does. Right?

But you can't just check a box there. It it you still have to supervise. Correct? Outside litigation counsel, you do.

But, you know, there are instances where you are just going to need someone who has the technical skill set that you're probably never gonna have. Right? You're never, never gonna know how to forensically collect or image a phone. I may, but it's highly doubtful.

But yeah. You do our duty bound is outside the mitigation council to be able to adequately supervise those that you've engaged in the area of eDiscovery, including outside contract manage review teams.

And and if you need to bring someone, for instance, someone in information technology from your client to assist with that, to make it a more thoughtful and effective conference, then you should do that. And sometimes judges are gonna want you to do that.

There was a great case, and it's funny that this was twenty twenty one, but there was a case DR distribution LLC versus a twenty first century smoking. And, Judge Johnson says it is no longer amateur hour, and it's way too late in the day for lawyers to expect to catch a break on eDiscovery compliance.

Because it's technically complex or resource demanding. And I think Wendy, if there's anything that you've taught us thus far in this podcast, it's that it is our responsibility as lawyers to know it, to advise our clients, to help them set up this, and not just help when that reactively when a matter comes up, but to be able to help clients proactively in ensuring that their house in order and that their employees are doing all the right thing. Is that's what I've gotten at. Is that about right? Yeah. I think that's absolutely right.

And, you know, there are a lot of resources out there. Right? To, you know, hone your skill set. If you're a new young lawyer or you're a practicing lawyer who feels like you need to brush up and at least be able to identify issues where you might need additional support, you know, the Sedona conference publications are out there.

They're fantastic, and they cover a wide variety of topics, including the one we're talking about today of femoral messaging. There's a lot of free good content out there, including webinars that are provided like service providers by like BDO law firm terms, ASEDs, EDRM, a number of legal tech conferences every year that you can go to legal, legal week is coming up. There's the Georgetown Advanced eDiscovery Institute. So there is no shortage of content to better understand issues you might encounter in eDiscovery or forensic matters.