Again highlighting the unrecognized liability companies are taking on by logging every scrap of internal communication, no matter how informal or ill-conceived it may be.
For example, the financial companies I used to work for had a “standard practice” of archiving all e-mails and internal chats for 7-8 years. Not sure if phone calls on company equipment were recorded or retained though (may be a YMMV case).
This is why I separate work and personal assets. I never do work on personal devices nor do I use work devices for personal activities (ie, social media, e-commerce, shit posting). Also if I’m shit talking the boss’s boss. It’s never using work devices.
Have been asked a few times to use personal devices for work but absolutely refused. I would be asked to install their invasive spyware and root kits so they can abide by their draconian corporate policies. So far, they haven’t forced me otherwise I would have quit those companies long ago.
Banks are (or were) required, in America, to use write-once offline media for records [1].
Do you move all old files, emails, internal knowledge articles, code repos, chat messages, etc etc to cold storage? You can’t search for anything you’re looking for in OneDrive, Outlook or Slack if the data is in cold storage so are you going to develop custom applications to support the same search filters as each original source application, but which searches your cold storage?
Once a user finds something in cold storage, you have to load it back into the SaaS app to display it. Why? A variation of the following applies to all enterprise data: A Slack message has tons of important metadata tied to it besides the text content. For example Slack user Id of the message sender, channel ID it was in, file ids of any file attachments in the message, and so on. How do you load that back into Slack from your cold storage?
You can put any data in cold storage. In the real world, that often makes the data almost useless for employees.
It's wild that some don't get this. A couple years back some employees at my company were fired for doing just this over the same IM system we used to coordinate everything else.
For a front office role - archiving of; emails, internal chats, external chats, phone calls / squawk lines, browser history, pc screenshot every X interval, same for work laptop at home. Office cctv, room microphones, mobile phone calls + text messages + device monitoring to ensure no other apps.
> I never do work on personal devices nor do I use work devices for personal activities
This is now the way.
The shining poster boy for this would be Google, who told staff to disable logging when discussing sensitive topics:
https://www.techspot.com/news/102874-doj-alleges-google-dest...
They also told employees to never use certain keywords, so that records of conversations would not be found by legal teams using search tools, but also they wouldn't be shown talking like monopolists:
https://arstechnica.com/tech-policy/2023/09/google-hid-evide...
A tape sitting in Iron mountain would have a smaller attack surface and be compliant.
Potentially this breach will allow litigation that was financially infeesable for some people.
As a former WDIG employee I am not even suggesting anything concrete or that I have any knowledge of unlawful activity.
But as someone who also worked in the electronic evidence discovery field, the cost of blind discovery has a chilling effect on lawsuits.
Now that targeted discovery is possible, it will be within the budgets of more potential cases.
The forever retention was a marketing differentiator for Slack, so this type of events were a risk you have to accept.
But all about convenience and not compliance.
Conversely, offline doesn't mean unhackable/unleakable.
Why use passwords at all under that line of thinking.
That is why we talk about reducing attack surfaces.
Do any large companies not delete everything at the first opportunity?
I know a lot of these types of entertainment companies employ things like keyloggers or remote screen viewers in case an employee is working on a writing project or drawing/painting a picture during their lunch hour, because if they are, everything they make, write, sketch or even jot down belongs to disney exclusively... and if they, say, bring that script to prospective publishers outside the company a year later, or try to sell a print of the artwork they created, they can intervene and stop you.
if you take a shit in their staff bathrooms, that turd belongs to them too.
Yeah. That’s how we got Cars 4.
0. https://news.bloomberglaw.com/antitrust/google-chat-deletion...