Federal judges and litigants have recognized that corporate chat platforms like Slack can be repositories of relevant information in disputes. Because collecting collaborative data is more complex than running a search for emails, litigants should exercise caution when it comes to electronic communications. If, for example, a litigation team treats dynamic chat threads like “flat” PDFs or standalone emails, they risk metadata spoliation and judicial sanctions. They may also find it difficult to present an accurate story at trial. The list below identifies general considerations that legal teams and vendors may find useful when thinking about data assessment and the preservation of chat threads in connection with a litigation hold.[1]
1: Map the Governance Architecture
Before clicking “export,” stakeholders may wish to take the below steps to help understand how a client’s specific platform workspace is built. Administrative settings dictate what data exists.
- Identify the License Tier: Determine the subscription level. For Slack, is it Pro, Business+, or Enterprise Grid? License tiers dictate native export capabilities and retention access.
- Audit Corporate Retention Policies: Uncover the background data-purging schedules. Are channels set to delete messages after 30 days, 90 days, or never?
- Map Out Third-Party Integrations: Document which applications connect to the workspace. Are users pushing Salesforce data, Jira tickets, or Trello boards into the chat? These integrations generate discoverable data within the thread.
2: Implement Technical Legal Holds
Legal teams should not rely only on a paper or email legal hold memo asking employees not to delete chats. Accordingly, stakeholders may wish to consider implementing programmatic holds at the administrator level.
- Deploy Legal Holds Globally/Targeted:
- With Slack, for example, stakeholders may wish to consider using the Legal Hold feature (available in Enterprise Grid) to preserve messages and files from specific custodians indefinitely, overriding standard retention policies.
- Halt “Edit and Delete” Permissions: Turn off the administrative setting that allows users to edit or delete their own sent messages or historical posts.
- Preserve “Direct Messages” (DMs) Separately: Ensure the hold covers private 1:1 and group DMs, not just public channels.
3: Capture the Structural Context (The Thread)
A single message line pulled out of a chat database may not be useful if it lacks appropriate context. When implementing a collection tool, one should consider maintaining the “thread architecture.”
- Preserve Parent-Child Relationships: Confirm that export functions link main-channel messages (parent) to their corresponding replies (child) in proper chronological order.
- Log Channel “Edits” Separately: If a user edited a message prior to the hold, ensure the underlying JSON payload or metadata logs both the original text and the altered text.
- Account for Channel Transformations: Verify whether users altered public channels by renaming, archiving, or converting them into private rooms during the relevant timeframe.
4: Track Hyperlinked Files & Linked Attachments
Some modern chat interfaces do not use traditional attachments. Instead, users drop cloud hyperlinks into the text. Accordingly, organizations should consider the following:
- Capture Point-in-Time Cloud Assets: When a user links a document from a cloud storage or document management platform in a thread, organizations should consider preserving the actual version of the file as it existed at the moment it was linked, rather than only preserving the live, evolving version.
- Download Inline Images and GIFs: Confirm that the relevant collection engine downloads emojis, reactions, pasted screenshots, and animated GIFs, as these may provide important emotional or affirmative context (e.g., a “thumbs up” emoji indicating agreement to a contract change).
5: Execute and Validate the Technical Export
Do not try to manually screenshot or copy-paste long chat threads. Instead, consider:
- Utilizing Native Format Exports: Export data using the platform’s proprietary structure (typically structured JSON files for Slack, for example).
- Retaining Crucial Metadata Fields: Assuming you entered an electronically stored information protocol that governs, among other things, production formats, search parameters, and metadata fields, verify that the export package contains the fields agreed upon, such as:
- User_ID (to map anonymous handles to actual names)
- Timestamp (normalized to UTC)
- Channel_Type (Public, Private, or DM)
- Reaction_Type (Emojis)
- Generate Cryptographic Hashes: Practical strategies may include running MD5 or SHA-256 hash algorithms on exported database files to foster data integrity and confirm chain of custody for trial admissibility.
[1] More information on litigation holds can be found on the following posts: eDiscovery Workflows Part I and But What About the Text Messages? Part II