Slack's New Arbitration Policy | Hacker News Reader

Slack's New Arbitration Policy

konklone.com

193 pointsetjossem113 comments

There are two separate issues here. Requiring arbitration is one. Disallowing class action is another. You cannot conflate these two things.

Disallowing class action is absolutely in-favor of Slack and companies in general. Class action suits are a powerful pro-consumer force. They allow consumers to seek redress without cost - as the legal costs are paid for by the plaintiffs attorneys. Sometime consumers don't get much out of these suits while the attorneys make a lot. But their threat is a strong check on powerful companies.

Forcing arbitration is a murkier matter. The first google result on arbitration vs trial (http://www.nolo.com/legal-encyclopedia/arbitration-pros-cons...) provides a decent analysis. Frequently arbitration is less expensive for both sides because the process is simplified. You also avoid shenanigans like fighting for 6 months about jurisdiction and venue (which either side can do to seek a more favorable court).

The article states that arbitration is bad because consumers don't have legal representation. This is flat out wrong. Consumers can and should have legal representation in an arbitration. Just like in a trial, consumers need to pay for this legal representation themselves, and it would be foolish not to have it.

The article also says that arbitration is bad because companies have more legal resources than consumers. This is a fallacious argument. Companies will also have more legal resources in a trial. If anything, the simplified process of arbitration makes this less of an advantage. So arbitration may be slightly better for consumers in that respect.

> Class action suits are a powerful pro-consumer force. They allow consumers to seek redress without cost - as the legal costs are paid for by the plaintiffs attorneys.

Keep in mind that Slack is a B2B service, though; its clients are companies, not individuals. Would a class-action suit really make sense here, given that most of the "consumers" involved should already have access to legal representation?

The article quotes Consumerist in giving this reason for class actions:

> companies can harm large groups of customers but get away with only paying out to those people who are willing to arbitrate.

Class action isn't just about big guy vs little guy, or corporation vs individual. It's also about discouraging practices that are illegal, and valuable in aggregate for the defendant, but too small to warrant a court case for any single plaintiff.

> Keep in mind that Slack is a B2B service, though; its clients are companies, not individuals.

Class actions really exist for economy of justice, particularly with diffuse harms across a large group (regardless of the resources of the individual members of the group), not specifically to deal with access-to-counsel issues.

Any time the number of similarly situated parties (customers, in this case) is large on one side, its conceivable that a class action makes sense.

This is "pro-consumer" only in that in that it addresses an essential asymmetry of resources-at-stake that disfavors action by the "many" side in any many to one transaction. "Consumers" are an example of this, but not a unique example.

> Would a class-action suit really make sense here

Definitely. Their low-end plans are relatively cheap. That means that even if you have legal representation, it often wouldn't be worth suing them. But a class action spreads the legal cost across many plaintiffs.

Simple example. Suppose BadCo has 10,000 customers who each pay $1000 per year, for annual revenues of $10m. If they can cheat each customer out of an additional $100 (say by overbilling), then they'll make $1m, which is enough money to be tempting. But very few people will go to the time and trouble of a lawsuit just to get $100 back. But a class action lawyer might happily take the suit thinking they could make 25% of that million.

Who chooses and compensates the arbitrator?

I'll give you a hint, it's not the consumer.

False. If you and your opponent can't agree on an arbitrator, you each pick one, and the two of then together agree on a third, who performs the actual arbitration.

The knee-jerk answer isn't welcome here. Arbitration agreements (slack's included) usually state that both parties must agree on an arbitrator. If they don't agree, each party picks its own

The way I understand the agreement, if you accept it you are bound to use JAMS as the arbitration company -- you may have choice of a specific arbiter inside that company but you have to use that company. Is my understanding correct?

What's the problem? Send these guys a private offer to arbitrate, according to your terms. Put your concerns on an affidavit concluded with your offer, and give them an opportunity to respond within 10-15 days. If they go silent (they will), send a notice of default next, and then file your lawsuit in civil court. You will have satisfied the private arbitration clause (arbitration went nowhere), and with your options exhausted, you now must file in court.

Source: I'm an ex aequo et bono arbitrator.

To say nothing of the fact that large companies are not agreeing to these terms, they will have custom MSAs which dictate jurisdiction, etc.

I may be a bit dense, but your comment doesn't seem to relate to the article I just read. Is this the wrong thread or am I missing something?

EDIT: I have to be missing something. Half the comments here talk about arbitration, but that word doesn't appear once in the blog post. Was it edited?

The changes to the Terms of Service (linked from the blog post) include a new binding arbitration clause.

Looks like another thread was merged here.

Yes. If you Google "slack ycombinator", you'll see the original title in the results (as of 12:26 PST). Edit: also, as another commenter said, it was merged.

You're not missing anything. Two posts were merged. This is the Privacy policy blog post by Slack. There was another blog post (third-party) that talked about changes in their TOS to include arbitration.

https://konklone.com/post/slack-is-now-forcing-users-into-ar...

The problem is that they have suspended their service until we agree to their terms. Their service enables much of our company communication, so basically they've maimed our internal communication until our lawyer has had a chance to review these new terms, which could take any amount of time.

You as a jurist might look at this and go "meh, it's fine", but if you're the CEO of a small company this sort of thing really fucks with you.

their CEO gave his ideas on this situation:

https://twitter.com/stewart/status/537007282811195392?t=1&cn...

Then agree under duress. You have 72 hours to modify any contract you enter (which becomes 10 days by snail mail), so agree quickly with your adversary, so as to get out of his way. Once you have access to your account, immediately begin arbitration whilst looking for another safe place.

don't know what you're smoking, but this is not the law in California -- which is what Slack chose (unilaterally) as the governing law of this document.

I believe that's a federal rule governed by the FTC, not the state.

the FTC does not have plenary power over all contracts. There are certain "cooling off" periods for specific purchases (cell phone service and automobiles come to mind) but as a general rule? No way. And really really no way in this context.

  > don't know what you're smoking,

Silver Skunk, actually. :)

As to the law in California, which Slack chose, I'll just take from page 12 of Contracts: Examples And Explanations (Fourth Edition), a book I got in first-year:

"It would be remiss not to at least draw to your attention that courts do not mechanically apply rules of law. Judges and juries are sensitive to the equities of individual cases and the circumstance of the parties, and where a mechanical application of rules achieves a result that seems to be unjust, there is likely to be some adjustment or even manipulation of the rule to avoid it."

So, with the above in mind, let's say that, while they really want the governing law to be based in California, if one party decides to keep this contract squarely governed within Article 33 of the United Nations Commission on International Trade Law's Arbitration Rules (after all, isn't California law in harmony with international law?), then the court would necessarily understand why filing in California, or even only recognizing the limited rights that exist in California law, might not be prudent in all circumstances.

That only applies to certain types of contracts and/or in certain states. Please don't dispense legal advice when you're not qualified, you're not certain, or your advice is about specific facts and could be misconstrued as more general. You could lead people into making expensive mistakes.

The onus on you is to provide evidence that I am unqualified to provide legal advice now. You didn't disprove anything I said, merely asterisk'ed it, as if that somehow made it irrelevant.

I'm curious as to what types of contracts it doesn't apply to, and what states it doesn't apply in. As you mentioned they exist, perhaps you can let me know which contracts and which states you were talking about?

The funniest part about the downvotes, is that a bunch of people uneducated in law decided to make a judgement based on something they are in fact ignorant of. They merely liked the replies better.

I wish I could send this thread to dang, as an example of the hivemind that HN metamoderation needs to address.

First, this isn't "exhaustion" of remedies. Second, there is no recourse to court in the event of a default. The TOS (did you read them before offering legal advice?) requires a claimant to first try informal resolution then open a claim with JAMS. There is no ability to go to court, unless it's small claims court (under $7,500 in California).

Well, you could try to dispute the arbitration clause in court. That would almost definitely be unproductive, but you could go to court.

I'm not a lawyer, this is not legal advice, don't take legal advice from unknown Internet people, and all that.

Lawsuits are incredibly painful. The emotional and time tax to be in one, regardless of what side you are on, is immense.

I hear what this guy is saying. However, having been in three lawsuits, one of which I initiated, I would do the same thing as Slack. I would generally try to do anything reasonable I could to avoid a lawsuit.

Arbitration or mediation (very different things) is almost always required anyways, by the courts, if you file a lawsuit. They make you try. At least they try to force a mediator.

If you force arbitration, it's the same thing as forcing a lawsuit and would result in my immediate desire to resolve your issue without continued legal maneuvers.

Anecdotally, and as I think most litigation attorneys would tell you -- People settle lawsuits because they are either out of time, or money. They almost never settle because they think they've lost the case. The merits of the case rarely matter once you are knee-deep in the litigation, but the toll a lawsuit takes does factor into a settlement decision quite often.

Compared to Hipchat, Slack has handled this compliance issue much better. I am personally uncomfortable with the idea of managers seeing employees communications, and Hipchat didn't put any consideration into this when they released that feature. Slack on the other hand seems quite aware of this issue and done things which make me much more comfortable, at least short-term. It goes to show what careful and empathetic product thinking can do to enhance your customer's experience.

What is the difference between the situations? All I remember of HipChat's change was the same thing: conversations would only be logged moving forward after a particular date (rather than a switch being flipped).

It was my understanding that HipChat would make private logs easily available to any administrator of the company account in the same way that public chat logs were available. It was also made clear that this was not something which could be disabled, otherwise impeded, or a user would be notified of. (somebody correct me on this if things are different)

On Slack, from what they describe, the feature is only available with a certain type of account, you can only export logs in bulk (i.e. it's not something easy to do, it has been made for a specific purpose), and employees will be notified if the feature is enabled/used.

You could say they just learnt from the Hipchat announcement and remebered to address the issue head-on which makes it seem like they really care. But in the end the problem is exactly the same and your company will now have access to whatever you write including private chats. Personally that means I'll ensure to avoid private chat on Slack and use external tools again on top of everything I already use which is clearly annoying.

It is absolutely ridiculous to be uncomfortable with managers seeing employee communications. First off, any time you log in to a machine at most corporations you're told that ALL network activities are monitored. It's not a joke. They are monitored. Every packet you send out and every packet you receive CAN BE RETRIEVED. This isn't new. I'm 30 and have seen this since I was in high school. I'm sure older folk have seen it for even longer.

Next off, you are owed NO privacy on services that your company is paying for for interoffice communication. You never have been. The fact that people bitched and moaned over Hipchat allowing history to be viewed is just ignorant and stupid.

You know why managers have the ability to view these things? Harassment. Sexual, physical, altercations, etc. If your company has more than 5 people these things WILL come up and the INABILITY to retrieve this data is BAD.

We have ALWAYS been able to retrieve this data via XMPP (Openfire), MSOffice Communicator/Lync, etc.

This is NOT some mind blowing new development.

This kind of monitoring may be normal in BigCorps but it's definitely not part of startup culture.

I'm also irritated by the mindset that considers this kind of institutionalized snooping a good thing ("INABILITY to retrieve this data is BAD").

I've been a network administrator and had control of everything.

That did NOT mean that I was actively viewing everything and sitting in a tower somewhere cackling at all of the deep dirty news I had. I had to pull data a handful of times during lawsuits or sexual harassment complaints.

You should not be delving into deep personal/sexual conversations on any work tool without having in the back of your mind that it may come up at some point, whether you're at a startup or not. I'm on my 3rd startup and while I know nobody has been monitoring (because I pay for the tools) I still keep the tools somewhat professional. To the point that I couldn't care less if someone looked into my conversations. If we're going to bitch about that, then the fact that my data is on some unknown server at Hipchat is FAR more worrisome to me than my COO looking at my conversations.

You SHOULD trust your employees and if you don't trust one replace them. You should also TRUST your management to not spy on you. But you should also assume that they have the ability, if not, you're daft.

this kind of monitoring is often required by law. when the shit hits the fan, it is bad to not be able to get all the data on _company_ channels. But, if you want to own your communication, use _your_ cell phone.

I know what you describe is how it has been at some companies, but that is not how I think it ought to be. While I am at work, it is my opinion that I am not only owed privacy, I think it should be the default expectation (except for exceptional legal circumstances, of course). I would be hesitant to work at any place which does not share my values regarding these types of things, simply because it demonstrates a lack of trust and lack of autonomy within the organization.

Also legally speaking, a company is not allowed to listen in on/record phone calls I make on a company phone and I doubt they are allowed to open snail mail addressed to me. Thus my expectations of privacy is not something inconsistent with the status quo.

Your last point is completely untrue. I've programmed Asterisk systems for large call centers that specifically had supervisor modes where the supervisor could monitor calls to make sure employees were keeping customer service up to par. If this had been illegal the state Workforce Commission would have had a field day each time an unfair termination case came up.

I'm going to assume that's purely state based, but it definitely is legal in some jurisdictions. I'd imagine moreso than not.

I agree that I don't want to work somewhere where you're monitored. I think we'll all agree to that.

But I've actually saved someones skin before by providing logs when a sexual harassment lawsuit came up and an employee was fired unjustly (manager fired them, but his advances were blatant in the logs).

It protects the employee if you use the communications properly.

Wiretap laws vary state-by-state, but most require at least one party to consent to a wiretap. Some require both parties to consent, which means turning on call recording is a felony in some states, unless both parties are aware. (Which is probably why every call center starts with "This call may be recorded...").

You consented in your employment contract.

Yet another company that is opting out of complying with any legal system by forcing an arbitration clause on its customers. I switched from Hipchat when it changed its TOS to include mandatory arbitration and now it looks like I'll have to ditch Slack, too.

Pity. It's a good service.

(kind of hilariously, the arbitration provisions are not well drafted and are almost certainly unenforceable.)

Kind of a two-faced approach:

  - please trust us with your data
  - you have no recourse if we do screw up though

> opting out of complying with any legal system by forcing an arbitration clause on its customers.

I don't fully understand the context. Can you explain the arbitration clause they are forcing?

Edit: Found this, also on the front page right now: https://konklone.com/post/slack-is-now-forcing-users-into-ar...

Companies often choose arbitration when doing agreements between themselves, even large companies. The reason for this is, if, say, Nike and Apple did a deal and it went sour enough to have a lawsuit, they can resolve it much more quickly and cheaply than if they had to go to court.

The US court system is very slow, and requires significant resources in terms of lawyers that are not required with arbitration.

This should also be to the benefit of individuals as well, as the bar for suing a company as a consumer is much higher than picking a mutually agreed arbiter and getting the case heard.

IF the clause is fair (e.g.: mutually agreed arbiter certified by a national arbiter certification organization) then I tend to see these clauses as consumer friendly.

Without the clause, arbitration is still available if it is agreed by both parties.

In practice the arbiters that do not side with the companies are not chosen again in the future.

Bias, what about bias? I've always wondered if my software license should contain a thrid-party arbitration, and I've always chosen not to, because I have no control on the arbitration's neutrality.

They could charge customers a fee for settling "in favor of", or settle based on their membership time or random dice, and it would still be enforceable in court.

Note that my business is located in France so a US arbitrator could have a national preference for arbitraging in favor of a US citizen, and there would be nothing illegal in that.

Sometimes. Depending on the source, it's like 10% of B2B contracts include arbitration clauses, versus the vast majority of B2C contracts. I think there are advantages to arbitration in B2B settings, but a significant use of the procedure is to hammer away at consumers. The problem, though is more contracts of adhesion than arbitration clauses per se.

Legitimately, what would you propose instead if you were running Slack, or a company like Slack?

Would you prefer to run a company that maintains a retainer for quality legal counsel in every nation (and potentially every state/province) where a user purchases your software? Would you want to welcome lawsuits from any user, regardless of if they pay you as little as $6/month?

no, I'd have insurance with a $10 million umbrella policy and a duty to defend that kicks in at $50,000.

No one with a brain "welcomes lawsuits" but this is a fool's errand. If Slack really messes up, they'll get hit with a lawsuit no matter what. And defending it will likely be just as expensive.

Funny. My legal system did not allow class action lawsuits to begin with. Has very little impact :)

They're holding our chats hostage, we can't even look at our chat history without accepting the terms. And to think that we chose Slack over HipChat solely for their better ToS. This makes no sense at all, why would you force something like this onto your customers so aggressively? They're killing all of their good will with us in one fell swoop.

I don't see binding arbitration as a bad thing as long as both parties are allowed to agree on an arbiter (I may have missed something, but I imagine that's always the case, and also the case here(?). ...Hell, maybe you could end up on Judge Judy).

I hate to say it, but HipChat is really flawed (IRC, please). Slack is far superior technically. I'd still pick Slack. People may be blowing this out of proportion.

If both sides can agree on an arbitrator, you don't need to have anything be binding, they can just agree to arbitration.

Binding arbitration clauses that just say both sides have to agree on an arbitrator aren't really a thing. That would be an 'agreement to agree' which in some jurisdictions is even void, because it's impossible to sue anyone over a breach of it. (Whose breach is it when two parties couldn't agree an arbitrator? Well, both, and neither).

So binding arbitration clauses either specify an arbitrator in the contract or allow one of the parties (guess which) to choose at runtime. The slack one is the former, it specifies one called 'JAMS ADR'.

you have to do it with JAMS according to the TOS and the list of arbitrators with JAMS is finite. You can go off-list if both parties agree, but that doesn't happen absent significant experience between counsel for both sides. The JAMS folks in SF Bay Area is not at all pro-consumer, btw.

People may be blowing this out of proportion.

No they're not.

While I don't care about this change (I'm not based in the US, so we were never going to be in a position to take slack to court), changing TOS to suit the drafter and offering no options, no ability to get to your data and no time for your customers to properly review the changes is a bullsh*t move and they deserve to be called on it.

It's a business tool, paid for by the employer. You shouldn't expect anything you do on there to remain private, just like you should expect your company mailbox to be private.

To be fair, the features in question are called "private groups" and "direct messages." There's bound to be some expectation that they are private and/or one-to-one.

Only for the technically naive. Anyone who understands that e-mailing a colleague within your company's email server can be read by someone with the appropriate admin privileges, will also understand that a "direct message" on Slack is still being stored on Slack servers, not going P2P.

Would you expect emails via company mail servers from yourself to a coworker to be private? How about chats using some intranet based tool like MS Lync?

Private and direct messages within a company should be thought of as not involving your coworkers, but IT and legal a might be monitoring.

You, apetresc, and I are all unusual users - we're thinking about this in terms of network connections. Our first instinct is to figure out which parties in the chain could have stored a copy of the message. The typical user will probably just rely on clues like "private" or "direct" and make assumptions from there.

The privacy level of these features can and will be misinterpreted. Read a few legal cases where employee communications are exhibited; you'd be surprised what people say on internal platforms.

Any employee is a fool for thinking making permanent records of things using company resources will remain private.

You're on holiday or otherwise unavailable and someone needs some details for some obscure project you're working on? Crack open their email!

Those accounts and everything else belong to your employer and if it suits their purposes to go poking around your email or IMs, then they will.

Legally, I like the fact that my employer can pull up all my communications. If there are any HR-level disputes between employees, just pull up the record and look.

This isn't necessarily what I want from a personal service, though.

I personally would feel very uncomfortable reading any employee messages... BUT here's why I think it's OK in principle to have the ability to snoop enterprise IM: we require everyone to use this chat system. It's part of your job to be on it and work is conducted over it, so we have some plausible responsibility in making sure it's being used properly and that people are doing what they're supposed to be doing.

I'm solidly against reading employee's personal email or gchat or IRC messages even though I think legally we probably could.

In the US, document discovery for litigation typically falls on the defendant. So a company that's being sued is required under the law to produce relevant business records and communications. If it's hard to access such "documents" en masse and export them for legal review, then businesses which must deal with nontrivial litigation requirements (the threshold is often right around the $1B/annual revenue mark) will not use the system.

In the EU, things are a bit different and employees have a limited right to privacy when using corporate systems. Not so much in the US, though.

Fun fact: according to law in the Netherlands, companies can not restrict their terms to law of another country of the customer is Dutch[1], and binding arbitration clauses involving 'normal' customers are void[2].

No clue how easy it is to sue a company on the other side of the world, though.

All sources are in Dutch, unfortunately.

    [1] http://wetten.overheid.nl/BWBR0005289/Boek6/Titel5/Afdeling3/Artikel247/geldigheidsdatum_22-09-2014 (part 4)
    [2] http://wetten.overheid.nl/BWBR0005289/Boek6/Titel5/Afdeling3/Artikel236/geldigheidsdatum_22-09-2014 (part n)
    [*] IANAL-but-this-guy-is: http://www.iusmentis.com/contracten/algemenevoorwaarden/#zwartelijst

It's hard to justify not putting a mandatory arbitration clause into a contract, even if it is unethical. It's an incredible boon for companies and most users don't appreciate what they're losing.

I'm always worried when I see sentences with the structure "It's hard to justify [doing/not doing] X even if it's [unethical/illegal]". What type of justification do you need?

Why are you worried? From the suits' perspective:

1. Arbitration is going to potentially save hundreds of thousands of dollars down the line if there's a legal issue.

2. Arbitration incredibly favors the company over the customer.

3. Most customers don't understand the value of their right to civil action.

So while an arbitration clause is, in my mind, equivalent to telling your customers you don't actually care about being reliable, many companies are putting them into place just because they can.

#1 is false. Ask Google or Apple or JPMorgan Chase -- who get sued frequently, yet don't bother with arb clauses

#2 is true in most instances, but in order to find out you have to actually go through the entire arbitration and pay your lawyers' bills

#3 is very true, but that only adds to the idea that it's unethical.

Companies put them in because the corporate defense bar thinks this is the new hotness -- and few of those folks have ever actually litigated any of these clauses.

I worry when people brush aside ethics concerns without deep concern about the consequences. I'm not arguing for or against arbitration, I'm not well enough informed. I'm arguing against claiming you have to take an action you believe to be unethical simply because of the gain involved.

Why not just make two policies: one for bigcorps where there is a big (but friendly) "your boss can read your messages and we'll tell you when it happens" at first sign up, and one for normal, sane, organizations where the old TOS simply remains?

That's almost assuredly what's happening in practice. Large companies/orders have the leeway to reasonably negotiate with Slack. In cases like that, the standard policies set the framework for where that negotiation begins.

Thats basically what they described isn't it? This compliance export feature is the only thing that allows reading private messages, and it is disabled by default and requires significant hoop-jumping to enable. So for most companies the original privacy policy will apply effectively.

Nothing's indispensible, particularly on the Internet. So why complain? Just go and find another environment. If you can't, build one.

I used to complain about Delicious and after a while I stopped complaining and decided to use another service. As simple as that.

> why complain

Because it offers a non-zero chance of the best outcome: a low cost, high benefit outcome where the world changes to fall in line with your expectations. If you do not say anything then the world has little chance of changing. It is a rational result of cost benefit analysis. (Consider that moving to another service is costly, and building a new one more costly still.)

Additionally, I would point out that complaining about things that we don't like is a universal human trait, which you yourself demonstrate. :)

Hey dude I'm on your side on this issue, I wholeheartedly see everything you say. By saying "why complain" my target was those dictatorship-practising web instances and the thing is to remind them that nothing's irreplecable, particularly on the Internet.

Yeah, me too.

I think those that think this is a terrible move on Slack's part should find another chat solution. There are others.

On the other hand, I support Slack's option to do this. I don't think people here appreciate the financial load that class action suits place on consumer service companies.

Yes, class action lawsuits are a useful tool to extract concessions from companies, but they are also abused by litigators who are out to make a buck. Because often the cost of defending a lawsuit is such that early settlement is the best option even when the legal claims of the plaintiff are weak.

Meh. American government/supreme court are the ones who removed your rights.

Slack is a corporation and should try to (within the law) remove as many of your rights as possible to protect investors and shareholders. If you don't like it, you know what to do.

Re: Slack. It looks very nice but it's not very difficult to copy it's product as yet, it's USP as with most of these things is timing. I would suggest there must be a few competitors that you can replace it with already?

And their customers should do anything in their power to protect the interests of their own shareholders. That includes publicly complaining in hopes that the negative publicity will force Slack to change their terms.

Even if you accept that corporations must disregard ethics and legality and act solely to maximize the interests of their shareholders, that doesn't that you can't complain about their actions.

I think that is a reasonable approach. The question my days working on NASD (FINRA) compliance have trained me to ask is how Slack controls employee and vendor write access to the audit log. I now work in a nearly regulation-free environment and we are happy users of Slack, so I'm just asking out of curiosity.

Sounds fine to me, but this has me curious:

"In addition, Compliance Exports may include the edit history for messages that team members have edited as well as messages that team members have marked for deletion."

That makes me curious whether "deleting" a message actually deletes the data, in any circumstances.

If they're archiving everything including edits, then no.

It's possible that they only log edits/deletes for enterprise customers with this feature enabled.

If they're complying with e.g. FINRA, then they can't delete messages; they're required to provide a high-fidelity export.

Oh, sorry.. I understand that. My real question was for those of us on standard plans is hard-deletion a thing, and has it ever been in the past.

In fact, even for folks on plans this covers it's not clear how much of this is "backwards compatible" with regard to data and conversations in Slack prior to these terms.

[Edit: actually I see now "Compliance Exports are not retroactive and do not apply to past private conversations before the feature is enabled" so strike the second paragraph.]

Is there a way for a user to know if their conversations are being logged for compliance?

The post says that compliance is disabled by default and that all users will be notified via slack itself if it were to be enabled for your organization.

The feature is opt-in, requires a somewhat formal process to turn on, and all users will be notified "via Slack that the feature is active and that their private messages are subject to export". They don't make it clear if it'll be made sufficiently obvious to a new user who joins after it's turned on, but I'd guess so.

Also quite nice that "Compliance Exports are not retroactive and do not apply to past private conversations before the feature is enabled"

Looks like this is the standard reaction to something that is akin to parasite infection in biology - abusive scammers that exploit US legal system to rob companies and individuals with money. There's a theory that a lot of features of modern organisms (including sexual reproduction) has evolved as a defense mechanism to parasites. Looks like we're witnessing such evolution right now. I wonder maybe the solution should be sought elsewhere - not trying to shame Slack (or others) into doing something that makes no sense in current environment and suffer from parasites, but try to fix the parasite problem instead or at least make it less severe.

What I don't understand is why not have this be "opt-in". Meaning if your company does not need this feature for real legal reasons they don't enable it and everyone is happy. I've heard a few people saying they did not want this feature in Hipchat and would have to switch to make sure there team was not suspicious. If my company never needs to access private chats for legal reasons, there is no reason it should be enabled today and they can have access to it in 3 years.

I understand specific companies have specific needs and Slack has to meet some of these but there is no reason that this should impact everyone else.

Did you read the article? It explains a very thorough opt-in process which involves mailing a signed letter on company letterhead and manual reviewal.

Sorry if I wasn't clear enough. What I mean is that if in 3 years my company needs to have access to some logs, they will have to go through the multi-steps process but then have access to whatever they need (starting from today's logs)

What I meant was that the possibility to access private chats should stay not retroactive and only happen once the company has explicitly stated it will need this feature enabled.

EDIT: so that if my company has no legal needs today it won't have access to private chats made today once they decide in the future that they now need the feature

That is how it works. "It’s worth repeating – Compliance Exports are not retroactive and do not apply to past private conversations before the feature is enabled."

I did not understand the sentence that way even after reading multiple times but that seems to make sense now. I must have been too biased when reading it before. Thank you for pointing this out.

If you're on the free version should you still worry? Is there any way chats older than the cap on backlog can be restored?

If you don't want cheap startup hosting TOS, don't use cheap startup hosting.

How can you force anyone to sign away their rights like this? I'm confused. If you want to file a class-action lawsuit, go ahead. No contract can prevent you from doing that.

In a sane legal system, that would be true. Unfortunately, the US Supreme Court has upheld mandatory arbitration clauses, so companies are now allowed to effectively exempt themselves from the law.

Is there oversight on arbitration? What stops the private arbitration system from just saying "Slack's always right"? Or must you come to an acceptable agreement in arbitration else go to court?

That's capitalism for you.

Eric Mill's excellent post about Slack's new arbitration clause was just merged into this thread by the moderators. Here is the URL:

https://konklone.com/post/slack-is-now-forcing-users-into-ar...

The post is titled "Slack is now forcing users into arbitration and that is terrible." I highly recommend reading it, as there's no mention of the arbitration ToS change in Slack's own blog post.

Edit: Also worth reading the ongoing conversation between Stewart Butterfield (Slack CEO) and Konklone on Twitter: https://twitter.com/stewart/status/536975596920635393

Wow, I can't believe these were merged... one is talking about flaws in an arbitration clause and the other is a press release from the company... and they choose the fluff press release.

It makes these comments not make sense, and buries the real issue.

I agree, but the appropriate route is to email hn@ycombinator.com with this sort of feedback.

Contacting the team is great & should happen, but declining to post feedback on an affected thread would be unfortunate for everyone involved.

Context is key in any discussion. Let the voting system sort it out :)

OP here. Two things happened today. Slack adopted new terms of service with a binding arbitration clause, which they linked from this press release. They also announced a new feature, Compliance Export - which allows team owners to inspect direct and private chats under certain circumstances. The blog post talks about that too.

In my opinion, both are pretty serious and not fluff. I'd still advise digging deeper if you're a Slack user.

Update: wow, someone changed both the title and url to point to the konklone article. I originally intended to primarily talk about the privacy implications of Compliance Export. Oh well.

There is a cluster of related stories here. Many users seem to feel that the konklone.com post is the best representative of the set, so we changed to that from http://slackhq.com/post/103473448150/slacks-policy-update, and gave it a neutral title.

We're working on a system for grouping related stories together, but don't know yet when it will be ready. In the meantime, we merge threads manually, and you have to fish through the comments looking for context (like what the previous url was, why it was changed, and so on). That's not great, but see the first sentence of this paragraph.

There were a couple of borderline calls here: first, whether there are two significant stories that deserve to be on the front page, or just one (I'd argue just one, but it's not obvious); second, which of the two urls should be on the front page. Initially we chose the one that had been submitted earlier and had the larger discussion. Based on user feedback, we've flipped to the other.

I'm marking this subthread off-topic now, so it doesn't stay at the top and make the thread be about HN story merging policy.

I think it's worth saying that I appreciate when you give the community greater insight into the decisions you guys make. I know sometimes it's a hard judgement call, due to the risk of fueling an endless argument. I often have to make this call myself, and usually err on the side of leaving out the details. So I appreciate it when details are provided when most, like myself, would opt to leave them out.

Anyway, I thought this might be an encouraging word for whenever you have to face this choice again in the future.

That is indeed encouraging, and I appreciate your taking the time to post it.

Reply on news.ycombinator.com