{"id":8586,"date":"2023-03-30T19:01:57","date_gmt":"2023-03-30T19:01:57","guid":{"rendered":"https:\/\/www.americanconference.com\/fcpa-dc\/?page_id=8586"},"modified":"2023-08-08T18:57:26","modified_gmt":"2023-08-08T18:57:26","slug":"the-role-of-artificial-intelligence-in-ephemeral-messaging","status":"publish","type":"page","link":"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/the-role-of-artificial-intelligence-in-ephemeral-messaging\/","title":{"rendered":"The Role of Artificial Intelligence in Ephemeral Messaging"},"content":{"rendered":"
\r\n

By Jaclyn Jaeger<\/p>\r\n

Thursday, March 30, 2023<\/p>\r\n<\/div>\r\n

In recent months, U.S. regulators and enforcement authorities alike have signaled through enforcement actions and pronouncements that they are paying closer attention to companies\u2019 oversight practices regarding employees\u2019 permitted use of third-party messaging applications, including ephemeral messaging. <\/p>\r\n\r\n

Ephemeral messaging has increasingly become a bane to legal and compliance teams, because by the very nature of its functionality, chat messages expire after a short period of time or can be self-destructed immediately by the individual users, after which time such communications are deleted permanently.<\/p>\r\n\r\n

\u201cClearly, it\u2019s very problematic if companies are allowing employees to use them for business communications, because then you don\u2019t have any record retained either for litigation holds or any type of regulatory oversight,\u201d said April Goff, a partner at Perkins Coie.<\/p>\r\n\r\n

Despite the challenges posed by ephemeral messaging, the U.S. Securities and Exchange Commission and the Department of Justice have warned companies they must make efforts to preserve such communications, nonetheless.<\/p>\r\n\r\n

In public remarks<\/a>, Assistant Attorney General Kenneth Polite said companies should be prepared to demonstrate to prosecutors their \u201cpreservation and deletion settings\u201d regarding business-related electronic data and communications, as well as its policies around any bring-your-own-device (BYOD) program the company might have in place.<\/p>\r\n\r\n\"\"<\/a>\r\n\r\n

\u201cIf people are using these tools to communicate on behalf of your business, and you don\u2019t have the ability to preserve or produce a historical record of what was discussed, you\u2019re limiting your defense if something goes wrong,\u201d said Robert Cruz, vice president of information governance at Smarsh.<\/p>\r\n\r\n

Indeed, Polite warned that prosecutors will not accept at face value a company\u2019s failure to produce such communications. \u201cA company\u2019s answers \u2013 or lack of answers \u2013 may very well affect the offer it receives to resolve criminal liability. So, when crisis hits, let this be top of mind,\u201d he said.<\/p>\r\n\r\n

BYOD Policy<\/h5>\r\n\r\n

Given the increasing regulatory attention being placed on oversight practices of ephemeral messaging for business purposes, those in heavily regulated industries \u201cshould first consider their information-governance policies and protocols with regards to data retention and deletion,\u201d said Al Park, senior managing director at FTI Technology.<\/p> \r\n\r\n

Goff similarly stressed that an acceptable use policy is a company\u2019s first level of defense, and the primary way of managing the challenges posed by ephemeral messaging. However, just having an ephemeral messaging policy on its own is not enough, she said. \u201cIt has to be practical, enforced, and have some teeth behind it.\u201d<\/p>\r\n\r\n

Polite stressed this point further in his remarks: \u201cOur prosecutors will also consider how companies communicate the policies to employees, and whether they enforce them on a consistent basis.\u201d<\/p>\r\n\r\n

Technology Considerations<\/h5>\r\n\r\n

BYOD policies should be complemented by robust data preservation controls\u2014for example, \u201cdata archiving and storage settings that cannot be altered by the employee or the end user,\u201d Park said. \u201cIf organizations have implemented centrally administrated messaging applications such as Slack or Microsoft Teams, those platforms offer built-in governance and compliance controls that can be aligned to specific data retention parameters.\u201d<\/p>\r\n\r\n

Furthermore, Park added, companies should make clear through a BYOD program that they have the right \u201cto enforce the use of company-wide messaging applications over which IT and legal have administrative control for the purposes of communications monitoring and data preservation.\u201d<\/p> \r\n\r\n

The following are some additional measures to consider:<\/p>\r\n\r\n

Choose the right tool.<\/strong> From an investigative and e-discovery standpoint, capturing and storing data is easier said than done, as each of these various applications provide a different set of information-sharing features and different ways for users to interact with one another, creating oceans of unstructured data\u2014social media posts, documents, videos, audio files, and more.<\/p> \r\n\r\n

\u201cYou need a system that enables the business to preserve all the unique metadata elements,\u201d Cruz added. \u201cOther third-party messaging applications\u2014WhatsApp, WeChat, Telegram, Signal, and Discord, for example\u2014all include a unique set of features, methods of access, and a variety of technologies to encrypt data.\u201d<\/p> \r\n\r\n

For these types of technologies, there are third-party tools that enable businesses to capture communications and data for preservation purposes. \u201cMany ephemeral messaging platforms allow users to disable the auto-delete function within the application,\u201d Park said. This, too, can be enforced by a BYOD policy.<\/p>\r\n\r\n

Similarly, when messages are encrypted, a BYOD policy can require that employees provide the organization with their encryption keys, \u201cso those messages can be recovered and accessed if the need arises for compliance or legal purposes,\u201d Park added.<\/p>\r\n\r\n

But, again, each organization must first decide what data it needs to capture in order to meet its regulatory or compliance obligations, after which time it can then figure out what technology has the capabilities to \u201ctalk to\u201d the company\u2019s API software in order to provide a complete and accurate record of business communications, Cruz said. \u201cQuestion number one is, \u2018Are you comfortable as a business that if you let your employees use a [third-party messaging application] that you have the appropriate technologies to know how it is being used?\u201d he said.<\/p>\r\n\r\n

Make sense of the data.<\/strong> Ultimately, during an internal investigation or e-discovery, it\u2019s critical to understand the context of the conversation. The key question there is, \u201cWhat activity took place on that platform?\u201d Cruz said.<\/p>\r\n\r\n

\u201cIt\u2019s important to segment and render these messages in a meaningful way, so they can be reviewed in context,\u201d said Tim Anderson, senior managing director at FTI Technology. \u201cOur teams use contextual and density analysis to group related and relevant chat messages together into a single view so that they can be understood in the broader context of a conversation, but not muddled with irrelevant noise. Similarly, we are working to standardize the rendering of emojis and reactions across platforms so they can be searched and analyzed for additional context and nuance in conversations of interest.\u201d<\/p>\r\n\r\n

A cross-platform analysis can also be conducted \u201cto maximize efficiency in gaining insight from the available data and connect the dots between messages and users that have hopped across multiple channels,\u201d Anderson added. Granular historical user activity can also be leveraged \u201cto understand when participants joined, left, posted or reacted to messages, all of which can be used to enrich the known facts of a matter.\u201d<\/p> \r\n\r\n

Considering enlisting a digital forensic expert. Particularly during a corruption investigation, the company may want to enlist the help of a digital forensics expert with the expertise to know where to look for pertinent data, what to look for, and how to retrieve it. \u201cThere are some digital forensics methods that make it possible to recover deleted data in some instances,\u201d Anderson said.<\/p> \r\n\r\n

\u201cIn other cases, digital forensics experts can, at times, find evidence of deleted messages, use of prohibited applications or channel-hopping, which helps tell a story about a user\u2019s activity, or offer new clues to follow, even when data has been deleted,\u201d Anderson added.<\/p>\r\n\r\n

If a company chooses to work with a digital forensic expert, however, Goff stressed the importance of having a non-disclosure agreement or contractual procedures in place as it relates to the disclosure of any sensitive or confidential information.<\/p>\r\n\r\n\"National<\/a>\r\n\r\n

BYOD Program Elements<\/h5>\r\n\r\n

The DoJ\u2019s newly revised \u201cEvaluation of Corporate Compliance Programs<\/a>\u201d (ECCP), issued in March 2023, provides further guidance for companies on how prosecutors will evaluate a BYOD program. The ECCP directs prosecutors to consider the following specific questions\u2014which means companies should be thinking about such questions too:<\/p>\r\n\r\n