You Should Be Paranoid About Your Company Monitoring Slack

Common business advice is to never write when you can talk. In 2017, you can add "never Slack" to that refrain.

Employees should have no expectation of privacy at work, and that's doubly true for company-hosted programs like Slack and other messaging systems, says Paul Bischoff, a privacy advocate at Comparitech.com. They're under the complete control of the administrator, probably your employer.

"That means all communications can be logged and monitored," says Bischoff. "Even messages sent to other employees in Slack's private channels can be accessed via a bulk archive by the boss, although this is not exactly easy to do." (For more on why that is, Bischoff suggests reading this explainer.)

Beyond your boss, courts can access your messages should you or your company ever get in legal hot water. The infamous Gawker trial demonstrates how badly things could turn out if a court ever got hold of internal messages, even if they were sent in jest. When Gawker was sued by Terry Bollea, a.k.a. Hulk Hogan, because the site posted his sex tape, Bollea's lawyers were able to use Gawker's (inappropriate) internal messages about the wrestler and his tape in court. Gawker ultimately closed down after Bollea was awarded $140 million.

There's also always the chance that other employees can take screen shots of your messages, or that you could be hacked. In Rhode Island, three high school teachers resigned last year after their Slack messages, in which they disparaged and made fun of students, were leaked to the press.

Those are obviously worst-case scenarios, but instructive nonetheless. Nothing on the internet is ever truly private. Chat and messaging systems may seem casual, but it's important to remember you're still in a professional setting. Slack is good for real-time conversations, but that doesn't mean you need to send your real-time thoughts and opinions.

As Slack details on its website, each company determines how long its messages will be retained. For example, if your company sets its retention duration for one month, messages or files older than that are deleted. The administrator of your company's channel can also opt to delete messages at any time. If that happens, Slack hard deletes all information after 24 hours, and destroys all backup information within 14 days.

Your employer can also review access logs maintained by Slack that detail account sign ins and the IP address of each connection.

Still, if you wouldn't want your boss (or a courtroom) to read what you're writing, just don't write it.