Hacker News Reader

This is just Google up to their old tricks again. They used to have an internal practice to add company lawyers to emails in order to try and make them privileged and undiscoverable: https://archive.is/1Bwgs

I don't know what the aftermath of the DoJ action mentioned in the link was, but I hope they were sanctioned in some way for it, just like I hope they get sanctioned for what they're trying to do here.

There was a recent supreme court case where they discussed this exact practice:

https://www.oyez.org/cases/2022/21-1397

From listening to the oral arguments, the court didn't seem to think that just CC'ing a lawyer automatically made the full communication privileged.

Yup, as per my note in another thread this does not work and it's pretty dumb to think it will work. Privilege covers you providing facts so they can give advice and them giving advice. It doesn't cover anything else and adding a lawyer to a thread like that is just sketchy and looks evasive.

“If simply having a lawyer present made a conversation privileged, then every mobster would pay one to follow them everywhere and sit in the corner of the room.” ~ Opening Arguments

I get the idea that if Google was delivering drugs to someone they would start off the conversation: "Are you a cop? Cause you have to tell me if you are!"

You should be a bit wary of reading oral arguments as definitive, because the judges have a history of applying the more aggressive questioning to the side they ultimately agree with, just to make sure it's solid.

https://www.stroock.com/news-and-insights/u-s-supreme-court-... provides some more context - and speculates as to why the court declined to take the opportunity to definitively establish a standard here. It seems to still be an open question what the standard is!

At that point I’d be arguing it’s a criminal conspiracy involving the lawyer so anything with that lawyer no longer has privileges due to being evidence of crime

The loophole for face-to-face and telephone conversations is sort of interesting. I wonder if it remains because it historically wasn't historically practical to record...or solely because of eavesdropping/consent laws. Or some combination of the two? What if you were using a 3rd party chat with no history capability at all...where does that fall?

AFAIK you have an obligation to retain records if under a legal hold, but you do not have an obligation to create records. So if your company policy is to record all phone calls, then yes, you would need to retain and provide those records as part of discovery. However, you cannot be obligated to start recording phone calls in order to make them discoverable.

> What if you were using a 3rd party chat with no history capability at all...where does that fall?

This somewhat gets to the heart of what Google was doing. There's two parts to this:

  1. There's always some amount of history with chat software as it's a async communication mechanism. Maybe it's minutes, hours, or days. But let's say there's no feature to retain messages for longer. If you're under a legal hold, are you obligated to retain these?
  2. Now let's say the software does also have a history feature but it's optional that you can switch on, but you default it to off for everyone. If you're under a legal hold, are you now obligated to turn it on? Or this is analogous to being forced to start recording phone calls.

Regardless of why Google was doing this, it's an interesting legal question and one that I'm not sure has much case law on.

> The loophole for face-to-face and telephone conversations is sort of interesting. I wonder if it remains because it historically wasn't historically practical to record...or solely because of eavesdropping/consent laws.

I think it's largely because you had to go out of your way to record a phone call. You generally needed to get an extra device, wire it up, get tapes, etc. In the modern era of video calls this is a built-in feature available at the click of a button. Which raises the question: if you're under a legal hold are you compelled to enable that by default?

>Which raises the question: if you're under a legal hold are you compelled to enable that by default?

Right...similar for plain old telephone calls now too. That is, many VOIP PBX systems have a simple way to enable recordings.

Pretty much any data transmitted on a network is going to spend some time in buffers before being sent off to the next hop. While extending that argument to 24 hours is obviously malicious there is obviously some threshold where something being stored shouldn't be considered stored for this purpose.

Remote recording of PBX systems is built-in. Congress made that a requirement because law enforcement claimed they needed it.

That's a dangerous path. It implies that anything that so much as touches a computer must be preserved for the government. There absolutely should be a category for data to be transmitted with the understanding that it will not be preserved. Otherwise, you will just push people to use analog communication channels (or legal arguments around "what is a record", "what about E2E encrypted", "do debug logs count", etc), and for what? No one wins.

FRCP 37

...

(e) Failure to Preserve Electronically Stored Information. If electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery, the court:

(1) upon finding prejudice to another party from loss of the information, may order measures no greater than necessary to cure the prejudice; or

(2) only upon finding that the party acted with the intent to deprive another party of the information's use in the litigation may:

(A) presume that the lost information was unfavorable to the party;

(B) instruct the jury that it may or must presume the information was unfavorable to the party; or

(C) dismiss the action or enter a default judgment.

Google has been accused of violating FRCP 37(e). USA and State AGs have moved for sanctions in another case against Google in DDC:

https://ia802501.us.archive.org/21/items/gov.uscourts.dcd.22...

In the Epic case the court did not believe that the steps taken to preserve chats were reasonable.

"Consequently, on the record as a whole, the Court concludes that Google did not take reasonable steps to preserve electronically stored information that should have been preserved in the anticipation or conduct of litigation. Fed. R. Civ. P. 37(e)."

https://archive.org/download/gov.uscourts.cand.364325/gov.us...

> a party failed to take reasonable steps to preserve it

There is nothing reasonable about turning an existing system that was never designed to keep chats at all, to do on a whim, where would cause irreparable damage to the common offering both internally and externally.

Once is a pass, but 24 hours is not nearly an established window that a medium can/should be made arbitrarily compliant. It would be a large precedent.

But it’s been years?

“OTR” has been around for way longer. Not sure internally.

There is nothing reasonable about an existing system that was designed from the very start to shield monopolistic corporations from scrutiny. More so when it's illegal.

So what you're saying is that it's evidence of illegal intent to use these systems for any conversations that a company could reasonably be expected to keep more permanent records of otherwise? Because as far as I'm aware the usual answer to "we can't make this technology comply with the laws and regulations for doing these things" is "then you can't use that technology for doing those things".

"Because as far as I'm aware the usual answer to "we can't make this technology comply with the laws and regulations for doing these things" is "then you can't use that technology for doing those things"."

Tell this to the crypto people.

Crypto: (Knowing they cannot comply with SEC regulations) "We are unclear whether SEC regulations apply to us."

SEC: "The regulations apply."

Crypto: "Unfair. We were not given advance notice."

SEC: "This constitutes notice."

Crypto: "SEC regulations do not apply to crypto." (Apparently they did know whether regulations applied to them.)

It's like the crypto people are 11 years old.

That does seem like the obvious argument, but...

Technically, storing chat history from 24 hours isn't really any different than storing it for 30 days. Or 30 years. Either it's on disk somewhere or it isn't, and if it is, then you can just...not delete it. The option to not delete it may not be exposed in the 24 hour option, while it is in the 30 day option, but courts tend to be skeptical of arguments of the form "we have carefully engineered this machine not to have a button to make it follow the law, thus we are blameless".

And of course, even if it really is difficult (obviously it's not impossible given Google's resources and that this is a Google created tool!) to stop deleting the 24 hour chats, Google had other options. For example, they could make a good faith effort to ensure that critical chats took place in channels or group chats where the history setting was enabled. But instead it seems they made an effort to move chats away from there.

> where would cause irreparable damage to the common offering both internally and externally.

I think you'll find that "being able to comply with the law" is generally seen as a positive. It's actually a feature that Google touts quite highly in the contrext of Google Workspace. :)

Also note that this is something that was totally supported by their chat platform when history was enabled, and if you read the PDF, a constant theme is people upset because they were being forced to avoid newer features (like threads) because you couldn't make it delete chats that should be preserved if you were using threads. So rather than the legal system asking Google to damage their offering by adding a feature to it, we see Google asking staff to use a less capable offering because it was lacking the feature.

It is certainly possible that a court may find that what Google did here is okay; that they didn't have an obligation to either not delete relevant conversations that took place in the channels with extended history disabled or hold those conversations in channels with extended history enabled.

But...I wouldn't bet on it. And note that this also came up with the Musk/Twitter saga:

> In McCormick’s letter today, she says she believes Musk did use Signal. “I am forced to conclude that it is likely Defendant’s custodians permitted the automatic deletion of responsive Signal communications between them and possibly others, and that those communications are irretrievably lost,” she writes. Twitter has requested sanctions against Musk, but McCormick hasn’t decided on whether she’ll sanction him yet.

(Source: https://www.theverge.com/2022/10/5/23389568/musk-twitter-sig...)

Musk responded by folding and aggreeing to purchase Twitter after all. And although there were a number of factors there (his case was horrible) a decent chunk was his usage of automatically deleting Signal chats for communications he had an obligation to retain. And whether or not this was okay wasn't ever really an open question; the questions were whether it happened, and if so, what sort of penalties Musk would have to suffer.

> It would be a large precedent.

Not so much.

I hope the lawyers involved emphatically remind the judge that "reasonable" in the case of Google, the self-described organizer of the world's information, would have been the perfect preservation of 100% of all evidence. That is the standard they applied to us mortals when they unleashed their surveillance capitalism upon us. Anything less than that is obviously a ploy to evade the consequences of whatever it is that they did.

Not familiar with the details in this case, but it makes total sense to me that an "off the record" chat doesn't need to be preserved, even by a court order to keep all records. Let's assume there is a chat app that is officially designed to be off-the-record, and everyone who uses it assumes it is off-the-record. Let's assume technology-wise, there are indeed no records kept, everything is ephemeral. Should the court order then apply to those chats? I don't think so, just as a court order doesn't apply to a live conversation which isn't recorded. Now assume that the programmer of the app made an error, and accidentally records are kept for 24 hours. Should the court order now apply to those records? Doesn't seem to be a clear-cut case to me.

It's very clear-cut. The topic is about deleting data.

There's a massive difference in deleting records that did exists vs. records that never existed in the first place.

The former is deleting data, the second case isn't.

I think I explained why it isn't that clear-cut, even when it is about deleting data. I guess that's why there are courts, and not only HN opinions.

It is clear cut.

Let's give you a concrete exemple we have had rulings on without any computer involved, which are almost a 1:1 situation: you are on litigation hold, and aren't allowed to destroy any records. You do an oral meeting, with no plans to put it on paper.

Unknown to you, someone took notes during the meeting, say your secretary because she didn't feel well that day and wanted to be sure to remember it the next day.

Although those notes were not planned to exist, once they do destroying them is destroying records, and you're in violation of the litigation hold.

You may not notice her take note, and then see her pull the notes our of her bag the next day and at that point it's illegal for you to ask her to destroy them.

What if she used the notes, and then destroyed them herself, without me ever noticing anything?

It's still a violation by the company. For obvious reason, otherwise you find a "fall guy" to do just that and "oh I was not aware I shouldn't delete this stack of documents".

I'm not sure that's a comparable situation as someone explicitly took an action to make a record. In the case of Chat it's all software automation. No one is explicitly taking an action to make a record or destroy a record.

There is the whole situation of people asking to switch to the no history mode, but that's not retroactively applied and it's really no different than sending an email that says "let's talk about this over the phone".

The real open question is whether Chats can have a temporary nature to them as they are inherently a written record. But there's also other situations where you can have a written record, for example, if someone uses auto-captions on a video call. They're very short-lived, but they did exist for some duration.

> I'm not sure that's a comparable situation as someone explicitly took an action to make a record. In the case of Chat it's all software automation. No one is explicitly taking an action to make a record or destroy a record.

I am not sure why you are making this distinction when it doesn't exists.

Litigation hold also means stop all software automation that would result in destruction of record, doesn't matter how many people know about it. Case in point: that is what happens to their 30 days old chat. This is the same thing if you trigger a litigation hold on your office365 account or whatever.

And for the rest of your point: not only does the law not accept the "oh but I didn't know", for the obvious reason that then it's an easy out, but even if they did tolerate extreme exemple of it Google cannot in good faith claim lack of knowledge about THEIR OWN system, the litigation hold was not for those specific people who may or may not know it, it was for the company who is then in charge of ensuring their IT team does what the court ordered.

I don't see where I stated that anyone was claiming ignorance. My point still holds: users had the option to create a record, but it was not the default. From that perspective the comparison provided does not hold.

The real debate is about whether "off the record" text can exist at all, and if so, under what conditions/duration? Are captions on a video call a text record? Do those need to be retained?

Is this maybe a case where you may be mistakenly confusing record in the technical / computer sense, as opposed to record as meant in the legal sense ? Because your three last questions do not make sense in the legal view.

> The real debate is about whether "off the record" text can exist at all, and if so, under what conditions/duration

This question makes no sense, as you what you are asking is "can i not make a record, when i make a record of something to transmit it to someone else"

> Are captions on a video call a text record? Do those need to be retained?

Yes and yes, of course. It's legally a record. Again, this questions makes very little sense legally.

You are answering your own question yourself. Read carefully and notice how you use the world record in your post.

> Let's assume technology-wise, there are indeed no records kept, everything is ephemeral. Should the court order then apply to those chats?

No, there is no record to be kept.

> Now assume that the programmer of the app made an error, and accidentally records are kept for 24 hours. Should the court order now apply to those records?

Yes, the court order applies indiscriminately to all records no matter why or how they were made.

Let's assume I said this instead:

> Now assume that the programmer of the app made an error, and accidentally DATA is kept for 24 hours. As part of the error, the DATA is also automatically deleted after 24 hours.

What now?

Nothing changed. You know it’s a record. That’s why it’s the word you naturally used to describe it. It’s not some kind of complex trick question.

I don't know it's a record, it's just a word I used. Now I use a different word, which is more appropriate in the context of a HN reader trying to misunderstand what I am saying. Because the question is exactly: Does this data constitute a record, or not? Just saying it does is not an answer.

It does constitute a record. You yourself spontaneously used the word record to talk about it. No one is trying to misunderstand what you are saying.

You want there to be some kind of big tricky debate to be had about what kind of data is or isn’t a record. There is none. People know what a record is and when they encounter one. If you are storing something for a time, you have a record of it. It really is that simple.

It's not that simple at all, especially in combination with automation and computing. What you are saying is that it is not possible to have an off-the-record chat app, because the data of the app will ALWAYS be stored somehow, even if it is just in RAM. Would you agree that this is what you are saying?

Maybe the world is just more complicated than you'd like to admit.

> What you are saying is that it is not possible to have an off-the-record chat app

No, it’s not at all what I’m saying.

What I’m saying is that if you are keeping records of what’s said for a time like most chat apps do then these records are indeed records and no amount of hypothetical distorting regarding RAM or amount of time or what not will change the fact that they are records and you will have to keep them if the court tell you to do so.

If you were using a P2P messaging app where no storage was done at all at any point then you would have no record. It’s not that complicated honestly. Just don’t keep records if you don’t want there to be records.

First of all, I think Google deliberately played games and they should get smacked hard for this.

But ... its not that simple any more.

A lot of the time, apps will be hibernated/suspended to disk, and then restored from disk. So talking about ram and storage in context of devices its kind of hard. Even some browsers now "suspend" your tabs to ssd, and then resume when you click back to them. So it's kind of hard to say if something was never on the disk or not.

I guess you could go with intent, that either app intentionally stored something or not, but then again you also design apps with suspend in mind so not sure how this one would play out.

> it makes total sense to me that an "off the record" chat doesn't need to be preserved, even by a court order to keep all records. Let's assume there is a chat app that is officially designed to be off-the-record,

You cannot officially designate anything to be "off the record". That's just not a thing that the legal system recognises - the closest thing might be attorney-client privilege, and that's not relevant here, so none of your analysis applies.

Off the record chat is about encryption and MITM rather than retention. https://en.m.wikipedia.org/wiki/Off-the-Record_Messaging

Interesting, but really not relevant.

One thing that comes to mind is that by the time a judge orders a hold, more than 24 hours will have elapsed since any chats that hold applies to. That is, if such a hold only applies to records created before the hold - do these orders apply to future records as well?

Yes, they apply to future records while the hold is in effect.

The brief answer is that if you know, or can "reasonably anticipate" legal action, you have to take steps to preserve evidence related to it.

So if Google has been sued about, let's say, how they negotiate Revenue Share Agreements (RSAs), then they need to 1) take active steps to ensure any records they have about RSAs are retained, including making sure they aren't caught by any document retention policies and 2) they need to preserve any future records that might be relevant. And they also need to do that if they can "reasonably anticipate" they might be sued, which means (at a minimum) that if someone sends them a formal note telling them that they're planning to sure about RSAs (or whatever) they need to start retaining evidence.

If all your communications are either unrecorded or are deleted after 24 hours, then when you get sued (or receive a notice indicating someone is preparing to sue) then:

1) You likely have almost no retained records you need to prevent being deleted.

2) And in fact you can very likely argue that it took you more than 24 hours to implement the legal hold, so actually all your existing recorded conversations will probably end up deleted.

3) But everything going forward will be covered. And since these lawsuits drag on for years, that's likely to be quite a lot of material. Unless you keep deleting most of them, of course. Which doesn't seem like a good plan, but I suppose we'll see how it works for Google.

"... by the time a judge orders a hold..."

The obligation to preserve electronically stored information, e.g., the Google chats, starts upon reasonable anticipation of litigation, e.g., when the DoJ announces it has initiated an investigation of the company and dozens of state AGs publicly announce plans to sue. That can be before a suit is filed and before a judge is assigned. No court order needed.

Same thing that happened to Hillary Clinton’s emails. In fact, ”a computer technician” introduced the email deletion policy after a subpoena was issued. Remind me is how Google did something horrific here, must be some dastardly “computer technicians.”