I don’t understand the value proposition of TeleMessage. Uses Signal but defeats the point of using Signal. Why not use a proper centralized chat with actual retention and encryption?
Now, such a system could be set up to route those copied messages in a separately E2E-encrypted way to the client's in-house/on-prem archival systems, and have the client be responsible for implementing decryption and secure storage at rest. But it's far easier to just sell a centralized cloud-based archival/retrieval system - which must necessarily be able to decrypt messages, and thus makes for an incredibly juicy target.
Given the supply-chain risks of the provider offering the customized clients anyways, one would expect them to have a strong security focus... but it certainly seems this was not the case.
My firm requires screenshots. If the concern is that someone would bypass that, well, someone could bypass TeleMessage, too.
It certainly wouldn’t hold up to the “beyond a reasonable doubt” standard for US criminal prosecution.
I’ve been exposed to “lit holds” for various document management system before and usually a third party such as Box or Microsoft can attest to the immutability of files placed under lit hold, and/or there is an audit trail to make sure the chain of custody is intact.
Typically between commercially reasonable and best efforts.
> been exposed to “lit holds” for various document management system before
I think these are held to a higher standard than run-of-the-mill securities compliance.
Like it might legitimately be the case that you personally have expended more brainpower trying to understand the decision than they put into making it.
Or there might be an issue with trusting their own IT departments. With Signal they don't even have to trust Signal (haha, but they might think that you know).
There's another possibility: NSA told them to use Signal w/ TeleMessage so that NSA could see everything because they have an agreement with TeleMessage or because NSA knows about all these vulns in TeleMessage.
There's other possibilities too.
At the end of they day you need to trust who you are talking to and never over share.
Signal is essentially iMessage that works in Android for all intents. Supporting it lets you communicate with outside entities. Otherwise the only mechanism to do so is email, which is problematic at best.
Government and finance are required by law to archive and audit communications. Some companies do anyway to keep tabs on staff.
This is the right question to ask. It might be that such a thing doesn't quite exist in the way that the customers want (doubtful; Slack should work just fine), or more likely it might be a cultural issue (that Signal is ingrained in some of these executives' minds as _the_ secure system to use, and/or that they don't want Slack/Whatever to be the service provider for IM _and_ the service provider for retention, or that they don't want Slack/Whatever with on-prem services because they don't trust their own IT, etc.).
Obviously TeleMessage's value add is to add retention to Signal, which defeats the point of Signal. That leads me to think that the motivation is cultural.
I kind of feel the same way about Signal itself due to its reliance on phone numbers.
The actual implementation here is atrocious though.