When the Needles Aren’t in the Haystack: Off-Channel Communications
-min.avif)
Matthew Verga is an attorney, consultant, and eDiscovery expert proficient at leveraging his legal experience, his technical knowledge, and his communication skills to make complex eDiscovery topics accessible to diverse audiences. A fifteen-year industry veteran, Matthew has worked across every phase of the EDRM and at every level, from the project trenches to enterprise program design. As Director of Education for Consilio, he leverages this background to produce engaging educational content to empower practitioners at all levels with knowledge they can use to improve their projects, their careers, and their organizations.
Never have there been so many communication devices, apps, and services available for use by employees, and employees helping themselves to these options can create significant identification, preservation, and collection challenges
Never have there been so many communication devices, apps, and services available for use by employees – more than any company can evaluate and implement. When a company’s employees choose to help themselves to these options and use communication channels beyond those approved for their use, those communications are known as off-channel communications, and they can present significant identification, preservation, and collection challenges.
Off-Channel Communications
Off-channel communications occur in three main ways:
- First, employees may utilize unapproved apps or services on company-owned devices.
- For example, an employee might download Slack or sign up for Signal using their company-issued laptop or smartphone, despite them being prohibited.
- Second, employees may utilize approved personal devices in unapproved ways.
- For example, using a personal smartphone approved under a BYOD program to engage in business communications via text message, which is not permitted by company policy.
- Third, employees may utilize unapproved personal devices.
- For example, an employee with a work-issued smartphone might choose to engage in business communications using their personal smartphone instead.
Growing Importance
Whenever a reasonable anticipation of litigation arises, parties have a common law duty to preserve1 any unique, potentially-relevant documents in their possession, custody, or control.2 The existence of unknown unknowns like off-channel communications can make it difficult for companies to fulfill this duty – as well as to fulfill the compliance obligations applicable to regulated companies, such as those in the financial services industry.3
Failure to address off-channel communications in discovery projects and compliance plans risks significant costs and complications. In civil litigation, the risks range from expensive motion practice and supplementary discovery to actual spoliation sanctions. In regulatory compliance, the risks have grown dramatically as federal agencies have made this a recent focus.
Over the past year, federal agencies have begun making examples of regulated companies that did not adequately address their employees’ use of off-channel communications, with total fines exceeding $1.2 billion.4 Since then, the Department of Justice has also revised its guidance on “Evaluation of Corporate Compliance Programs” to emphasize the importance of addressing off-channel communications.5 In announcing the new policy, the Assistant Attorney General for the Criminal Division said that, “[d]uring the investigation if a company has not produced communications from those third-party messaging applications, our prosecutors will not accept that representation purely at face value.”6
Logistical and Technical Challenges
As noted above, off-channel communications can present significant identification, preservation, and collection challenges:
- Identification
- First and foremost is the challenge of identifying such communications. Since they are unknown unknowns, occurring in channels not approved and preserved by the company, investigative steps must be taken to check for them. Employee surveys and custodian interviews are commonly used to gather this sort of information and eliminate blind spots.
- Preservation
- Since these communications are on apps, services, or devices the company doesn’t administer, its preservation options may be limited. For example, it cannot control retention settings on a personal account on a third-party service, and it cannot simply swap out an employee’s personal smartphone to lock away the current one. Preservation through collection is often the only safe option.
- Collection
- Collection itself may also be complicated for the same reasons. Employees may be uncomfortable with granting the company access to their communication accounts or allowing the company to collect the data on their phone. Even when employees are cooperative, companies will still face the technical challenges always associated with collections from smartphones and communication apps, including access and export limitations, encryption, ephemerality, and more.
Legal Complications
One legal complication created by the growth of off-channel communications, is uncertainty around how hard and how proactively companies must look for such communications. FRCP 37(e) requires that, before the application of curative measures or spoliation sanctions, there must be a showing that “a party failed to take reasonable steps to preserve” evidence it should have preserved. Once a party is on notice such materials exist, the reasonable steps are clear, but what about reasonable steps to look for off-channel communications in the first place?
In regulated industries, the regulations and enforcement guidance provide clarity around the high level of proactivity and efficacy that is expected and around the risks of noncompliance.7 Things are less clear in civil litigation, however, where courts are still wrestling with when companies can safely assume their policies are being followed and when they must be more proactively investigatory in their approach.8 Ignorance of the law is famously no defense, but ignorance of extant off-channel communications might be, in some situations.
Another legal complication that has arisen relates to possession, custody, or control. FRCP 34(a)(1) specifies that the scope of discovery and preservation extends not just to materials a company physically or electronically possesses, but also to any that it legally controls. But to what extent do employers “control” the messages and other data in their employees’ personal accounts or on their personal smartphones and laptops?
Courts are still wrestling with this question as well. In 2022, one widely-discussed case9 applied a multi-factor analysis that looked at the language of the applicable company policies, the technical realities of the company’s BYOD program, and the general practices in the work relationship between employees and the company. That court found that the factors did not establish the defendant had “control over text messages on the personally-owned phones of its employees.” That court also argued that a company should not be compelled to extort its employees, through the threat of termination, into surrendering personal devices for collection.
Please note that the resolution of possession, custody, or control questions may also depend on the jurisdiction, as there are multiple standards for how far it extends.10
Key Takeaways
Never have there been so many communication devices, apps, and services available for use by employees, and employees helping themselves to these options can create significant identification, preservation, and collection challenges. Failure to meet those challenges can result in expensive motion practice and supplementary discovery, in actual spoliation sanctions, and in enforcement actions and fines from regulatory agencies. To minimize these risks, companies should carefully consider their policies and practices surrounding communication channels and become more proactive in checking for employee compliance with them.
1 See Margaret M Koesel & Tracey L Turnbull, Spoliation of Evidence: Sanctions and Remedies for Destruction of Evidence in Civil Litigation 1-6 (3rd Ed. 2013), available at https://www.americanbar.org/content/dam/aba-cms-dotorg/products/inv/book/214612/Chapter%201.pdf.
2 See Fed R. Civ. P. 26, Fed. R. Evid. 401, and Fed. R. Civ. P. 34.
3 See, e.g., Securities Exchange Act Rule 17a-4(b)(4), Investment Advisers Act Rule 204-2(a)(7), Financial Industry Regulatory Authority Rule 4511.
4 Neil T. Smith, Hayley Trahan-Liptak, Christopher F. Warner, Peter W. Shanley, “Message Received: SEC Zeros in on Off-Channel Communication,” K&L Gates HUB (Feb. 14, 2023), available at https://www.klgates.com/Message-Received-SEC-Zeros-In-On-Off-Channel-Communication-2-14-2023.
5 U.S. Department of Justice, “Evaluation of Corporate Compliance Programs (Updated March 2023)” 17-18 (Mar. 3, 2023), available at https://www.justice.gov/criminal-fraud/page/file/937501/download.
6Ben Penn, “DOJ Getting Tougher with Companies on Messaging App Evidence,” Bloomberg Law (Mar. 3, 2023), available at https://news.bloomberglaw.com/us-law-week/doj-gets-tougher-with-corporations-on-messaging-app-evidence.
7 See, e.g., U.S. Department of Justice, “Evaluation of Corporate Compliance Programs (Updated March 2023)” 17-18 (Mar. 3, 2023), available at https://www.justice.gov/criminal-fraud/page/file/937501/download.
8 See, e.g., La Belle v. Barclays Capital Inc., 340 F.R.D. 74, 84 (S.D.N.Y. Jan. 13, 2022).
9 In re Pork Antitrust Litigation, 2022 WL 972401 (D. Minn. Mar. 31, 2022), available at https://casetext.com/case/in-re-pork-antitrust-litig-5.
10 See The Sedona Conference, The Sedona Conference Commentary on Rule 34 and Rule 45 “Possession, Custody, or Control,” 17 Sedona Conf. J. 468, 482 (2016), available at https://thesedonaconference.org/publication/Commentary_on_Rule_34_and_Rule_45_Possession_Custody_
or_Control.
Never have there been so many communication devices, apps, and services available for use by employees, and employees helping themselves to these options can create significant identification, preservation, and collection challenges
Never have there been so many communication devices, apps, and services available for use by employees – more than any company can evaluate and implement. When a company’s employees choose to help themselves to these options and use communication channels beyond those approved for their use, those communications are known as off-channel communications, and they can present significant identification, preservation, and collection challenges.
Off-Channel Communications
Off-channel communications occur in three main ways:
- First, employees may utilize unapproved apps or services on company-owned devices.
- For example, an employee might download Slack or sign up for Signal using their company-issued laptop or smartphone, despite them being prohibited.
- Second, employees may utilize approved personal devices in unapproved ways.
- For example, using a personal smartphone approved under a BYOD program to engage in business communications via text message, which is not permitted by company policy.
- Third, employees may utilize unapproved personal devices.
- For example, an employee with a work-issued smartphone might choose to engage in business communications using their personal smartphone instead.
Growing Importance
Whenever a reasonable anticipation of litigation arises, parties have a common law duty to preserve1 any unique, potentially-relevant documents in their possession, custody, or control.2 The existence of unknown unknowns like off-channel communications can make it difficult for companies to fulfill this duty – as well as to fulfill the compliance obligations applicable to regulated companies, such as those in the financial services industry.3
Failure to address off-channel communications in discovery projects and compliance plans risks significant costs and complications. In civil litigation, the risks range from expensive motion practice and supplementary discovery to actual spoliation sanctions. In regulatory compliance, the risks have grown dramatically as federal agencies have made this a recent focus.
Over the past year, federal agencies have begun making examples of regulated companies that did not adequately address their employees’ use of off-channel communications, with total fines exceeding $1.2 billion.4 Since then, the Department of Justice has also revised its guidance on “Evaluation of Corporate Compliance Programs” to emphasize the importance of addressing off-channel communications.5 In announcing the new policy, the Assistant Attorney General for the Criminal Division said that, “[d]uring the investigation if a company has not produced communications from those third-party messaging applications, our prosecutors will not accept that representation purely at face value.”6
Logistical and Technical Challenges
As noted above, off-channel communications can present significant identification, preservation, and collection challenges:
- Identification
- First and foremost is the challenge of identifying such communications. Since they are unknown unknowns, occurring in channels not approved and preserved by the company, investigative steps must be taken to check for them. Employee surveys and custodian interviews are commonly used to gather this sort of information and eliminate blind spots.
- Preservation
- Since these communications are on apps, services, or devices the company doesn’t administer, its preservation options may be limited. For example, it cannot control retention settings on a personal account on a third-party service, and it cannot simply swap out an employee’s personal smartphone to lock away the current one. Preservation through collection is often the only safe option.
- Collection
- Collection itself may also be complicated for the same reasons. Employees may be uncomfortable with granting the company access to their communication accounts or allowing the company to collect the data on their phone. Even when employees are cooperative, companies will still face the technical challenges always associated with collections from smartphones and communication apps, including access and export limitations, encryption, ephemerality, and more.
Legal Complications
One legal complication created by the growth of off-channel communications, is uncertainty around how hard and how proactively companies must look for such communications. FRCP 37(e) requires that, before the application of curative measures or spoliation sanctions, there must be a showing that “a party failed to take reasonable steps to preserve” evidence it should have preserved. Once a party is on notice such materials exist, the reasonable steps are clear, but what about reasonable steps to look for off-channel communications in the first place?
In regulated industries, the regulations and enforcement guidance provide clarity around the high level of proactivity and efficacy that is expected and around the risks of noncompliance.7 Things are less clear in civil litigation, however, where courts are still wrestling with when companies can safely assume their policies are being followed and when they must be more proactively investigatory in their approach.8 Ignorance of the law is famously no defense, but ignorance of extant off-channel communications might be, in some situations.
Another legal complication that has arisen relates to possession, custody, or control. FRCP 34(a)(1) specifies that the scope of discovery and preservation extends not just to materials a company physically or electronically possesses, but also to any that it legally controls. But to what extent do employers “control” the messages and other data in their employees’ personal accounts or on their personal smartphones and laptops?
Courts are still wrestling with this question as well. In 2022, one widely-discussed case9 applied a multi-factor analysis that looked at the language of the applicable company policies, the technical realities of the company’s BYOD program, and the general practices in the work relationship between employees and the company. That court found that the factors did not establish the defendant had “control over text messages on the personally-owned phones of its employees.” That court also argued that a company should not be compelled to extort its employees, through the threat of termination, into surrendering personal devices for collection.
Please note that the resolution of possession, custody, or control questions may also depend on the jurisdiction, as there are multiple standards for how far it extends.10
Key Takeaways
Never have there been so many communication devices, apps, and services available for use by employees, and employees helping themselves to these options can create significant identification, preservation, and collection challenges. Failure to meet those challenges can result in expensive motion practice and supplementary discovery, in actual spoliation sanctions, and in enforcement actions and fines from regulatory agencies. To minimize these risks, companies should carefully consider their policies and practices surrounding communication channels and become more proactive in checking for employee compliance with them.
1 See Margaret M Koesel & Tracey L Turnbull, Spoliation of Evidence: Sanctions and Remedies for Destruction of Evidence in Civil Litigation 1-6 (3rd Ed. 2013), available at https://www.americanbar.org/content/dam/aba-cms-dotorg/products/inv/book/214612/Chapter%201.pdf.
2 See Fed R. Civ. P. 26, Fed. R. Evid. 401, and Fed. R. Civ. P. 34.
3 See, e.g., Securities Exchange Act Rule 17a-4(b)(4), Investment Advisers Act Rule 204-2(a)(7), Financial Industry Regulatory Authority Rule 4511.
4 Neil T. Smith, Hayley Trahan-Liptak, Christopher F. Warner, Peter W. Shanley, “Message Received: SEC Zeros in on Off-Channel Communication,” K&L Gates HUB (Feb. 14, 2023), available at https://www.klgates.com/Message-Received-SEC-Zeros-In-On-Off-Channel-Communication-2-14-2023.
5 U.S. Department of Justice, “Evaluation of Corporate Compliance Programs (Updated March 2023)” 17-18 (Mar. 3, 2023), available at https://www.justice.gov/criminal-fraud/page/file/937501/download.
6Ben Penn, “DOJ Getting Tougher with Companies on Messaging App Evidence,” Bloomberg Law (Mar. 3, 2023), available at https://news.bloomberglaw.com/us-law-week/doj-gets-tougher-with-corporations-on-messaging-app-evidence.
7 See, e.g., U.S. Department of Justice, “Evaluation of Corporate Compliance Programs (Updated March 2023)” 17-18 (Mar. 3, 2023), available at https://www.justice.gov/criminal-fraud/page/file/937501/download.
8 See, e.g., La Belle v. Barclays Capital Inc., 340 F.R.D. 74, 84 (S.D.N.Y. Jan. 13, 2022).
9 In re Pork Antitrust Litigation, 2022 WL 972401 (D. Minn. Mar. 31, 2022), available at https://casetext.com/case/in-re-pork-antitrust-litig-5.
10 See The Sedona Conference, The Sedona Conference Commentary on Rule 34 and Rule 45 “Possession, Custody, or Control,” 17 Sedona Conf. J. 468, 482 (2016), available at https://thesedonaconference.org/publication/Commentary_on_Rule_34_and_Rule_45_Possession_Custody_
or_Control.
