DOJ and FTC Crack Down on Ephemeral Message Retention: Key Takeaways from the Monaco Memo

In 2022, the Department of Justice (DOJ) introduced the Monaco Memo, a significant development in regulatory enforcement aimed at strengthening corporate compliance and accountability. This memo marked a broader push toward enhancing transparency and documentation in business communications. It set out general guidelines for retaining and preserving electronically stored information, underscoring the need for companies to adopt rigorous internal controls. 

Fast forward to January 2024, and the DOJ, along with the Federal Trade Commission (FTC), announced updates to their standard preservation letters and specifications to explicitly address ephemeral messages and collaboration tools, such as Slack, Microsoft Teams, and Signal. The new guidance requires companies to disclose and regulate their use of these tools and platforms and provide detailed data retention and preservation policies.  

This targeted approach highlights the growing concern over ephemeral messaging’s potential to obscure evidence and evade regulatory oversight. This blog takes a closer look at the Monaco Memo along with these most recent updated guidelines, exploring ephemeral messaging, their implications, and practices for their effective governance.  

Understanding Ephemeral Messages 

Ephemeral messages are digital communications designed to disappear after a certain period. Unlike traditional messages that are stored indefinitely, ephemeral messages are temporary, vanishing either after being viewed or after a set amount of time. Examples of ephemeral messaging can be found on platforms like WhatsApp, which offers disappearing messages, Snapchat, which pioneered the concept of self-destructing photos and videos, and Signal, known for its secure disappearing message options. 

The popularity of ephemeral messaging has soared in recent years, driven by increasing concerns over privacy and data security. Users appreciate the ability to communicate without leaving a lasting digital footprint, which can be particularly appealing in personal conversations and sensitive business communications. Communication and collaboration tools have integrated these features to meet the growing demand for private and secure messaging options. 

So What is the Big Deal With Ephemeral Messaging? 

While ephemeral messaging offers users the benefits of enhanced privacy and reduced data clutter, it poses several risks, particularly in regulatory and legal contexts: 

• Regulatory Risks: Businesses using ephemeral messaging platforms must follow regulations that mandate the retention of certain communications. The inability to produce these messages during audits or investigations can lead to severe penalties and legal consequences.  

• Risks Related to Fraudulent or Illegal Behavior: Ephemeral messaging can be exploited for illicit activities due to its temporary nature. This potential for misuse has heightened regulatory scrutiny and led to the crackdown by the DOJ and FTC. 

• Gaps in Organizational Knowledge: Important decisions, agreements, or discussions conducted via disappearing messages may not be recorded, leading to a lack of accountability and transparency.  

• Data Recovery Challenges: Recovering deleted ephemeral messages can be technically challenging, if not impossible. In scenarios where legal discovery is required, the inability to retrieve these communications can obstruct justice or complicate litigation processes.  

• Security Vulnerabilities: Although ephemeral messages are designed to enhance privacy, they can also introduce security vulnerabilities. Users might assume that their messages are entirely secure and temporary, overlooking the potential for screenshots or other capture methods that preserve the content. This false sense of security can lead to the sharing of sensitive information that could be exploited if captured and shared maliciously. 

• Operational Inefficiencies: Teams might lose important context or details that are not preserved, leading to misunderstandings and miscommunications. This can affect project management, customer service, and other business functions that rely on accurate and comprehensive information sharing. 

While ephemeral messaging provides significant privacy advantages, it is easy to understand why regulators such as the DOJ and FTC would be concerned about their proliferation in business transactions and dealings, and their subsequent efforts to bring them under control. 

The Monaco Memo: An Overview 

The Monaco Memo, issued by Deputy Attorney General Lisa Monaco, marks a significant development in corporate regulatory enforcement. It outlines the DOJ’s enhanced focus on corporate compliance and accountability, emphasizing that companies must uphold rigorous standards of transparency and documentation. The memo arose from concerns about the adequacy of corporate compliance programs, particularly in the context of emerging digital communication practices. 

The memo calls for stronger internal controls and more rigorous enforcement of corporate accountability. It represents a broader effort to ensure that businesses meet their legal obligations and maintain integrity in their communications and practices. It also focuses specifically on the use of personal devices and third-party messaging platforms, providing clear guidelines for their use.  

The Use Of Personal Devices And Third-Party Messaging Platforms 

The memo highlights the growing use of personal devices and third-party messaging platforms (e.g., WhatsApp, Signal, Telegram) for conducting business communications. It notes that while these platforms can enhance communication and efficiency, they also pose significant risks for compliance and enforcement efforts. The risks include the potential loss of important business records, difficulty in monitoring and preserving communications, and increased opportunities for misconduct to go undetected. 

The memo puts in place the following standards for the use of such devices and platforms:  

• Corporations are encouraged to develop and enforce policies and procedures that address the use of personal devices and third-party applications for business communications. 

• These policies should ensure that all business-related data and communications, regardless of the device or platform used, are properly preserved and accessible for compliance purposes. 

• Effective training programs should be implemented to educate employees about the importance of preserving business-related communications and the specific policies and procedures in place. 

• Monitoring and auditing mechanisms should be established to ensure adherence to these policies and to identify any lapses in compliance. 

• The memo underscores the need for corporations to enforce these policies rigorously, with clear consequences for non-compliance. 

Recent DOJ and FTC Updates on Ephemeral Messaging 

The FTC and DOJ recently issued updated guidance focusing on the preservation of electronically stored information from ephemeral messaging tools and collaboration platforms. This new guidance underscores that in future enforcement actions, both agencies will require detailed information about the messaging applications used within companies—whether ephemeral or not—and will scrutinize company policies related to data retention and storage.  

The updates were driven by concerns that some parties, including attorneys and clients, have been avoiding their discovery preservation obligations, as highlighted in recent cases like the Google antitrust litigation. This shift reflects a broader effort to address frustrations with inadequate data preservation practices and to ensure that companies maintain robust mechanisms for preserving electronic evidence. Companies are advised to review and update their data preservation policies and technical capabilities in light of these new requirements which include: 

• Retention of Communications: All relevant communications, including ephemeral messages, must be retained for a specified period as outlined by regulatory bodies. This means businesses need to implement systems and processes to capture and archive messages that were intended to disappear. 

• Robust Documentation: Companies are required to maintain detailed records of all communications, including logs and metadata associated with ephemeral messages. This documentation must be readily accessible for audits and regulatory reviews. 

• Employee Training: Businesses must educate their employees about the legal and regulatory implications of using ephemeral messaging platforms. Training programs should cover the importance of message retention, the potential risks of non-compliance, and the proper use of messaging tools. 

• Policy Development: Companies must develop and enforce communication policies that outline acceptable use of ephemeral messaging, retention requirements, and procedures for monitoring and auditing communications. 

The FTC and DOJ warned that non-compliance with these guidelines could result in severe consequences, including spoliation sanctions or obstruction of justice charges.   

Challenges in Preserving Ephemeral Messages 

Preserving ephemeral messages presents numerous technical and logistical challenges for businesses. These include: 

• Integration with Existing Systems: Many organizations use a variety of communication platforms, each with its own set of features and data formats. Integrating ephemeral messaging platforms with existing archival and compliance systems can be complex and costly. 

• Capturing Disappearing Data: Ephemeral messages are designed to disappear after a short period, making it difficult to capture and retain them. Businesses need to deploy advanced technology solutions that can intercept and archive these messages in real-time before they vanish. 

• Employee Privacy Concerns: Employees may have concerns about their privacy being compromised if all their communications are monitored and archived. Businesses must navigate the delicate balance between ensuring compliance and respecting employee privacy. 

• Data Protection Regulations: Various data protection regulations, such as GDPR in Europe, impose strict requirements on how personal data should be handled. Businesses must ensure that their retention policies comply with these regulations, which can sometimes conflict with the need to archive ephemeral messages. 

Strategies for Effective Retention of Ephemeral Messages 

Organizations have to tackle these challenges head-on as the DOJ and FTC have made it clear that there can be no excuse for non-compliance. Some critical strategies for managing ephemeral messages include: 

• Clear Policy Definitions: Define clear policies regarding the use of ephemeral messaging platforms. Specify which platforms are approved for use, the types of messages that must be retained, and the retention period for different categories of communications. 

• Implement Real-Time Capture Solutions: Utilize technologies that can capture ephemeral messages in real-time before they disappear. These solutions should integrate seamlessly with existing communication platforms to ensure that all messages are archived promptly and accurately. 

• Centralized Archiving System: Develop a centralized archiving system that consolidates messages from various platforms into a single, secure repository. This approach simplifies data management and retrieval processes, ensuring compliance with retention policies. 

• Regular Audits and Monitoring: Conduct regular audits and monitoring of communication practices to ensure compliance with retention requirements. Establishing a routine for audits helps identify potential gaps in the archiving process and ensures adherence to regulatory standards. 

• Detailed Logging and Documentation: Maintain detailed logs and documentation of all communications, including metadata such as timestamps, sender and recipient information, and message content. Comprehensive records are essential for compliance audits and legal investigations. 

• Data Encryption and Security Measures: Implement robust data encryption and security measures to protect archived messages from unauthorized access and tampering. Ensuring the confidentiality and integrity of stored communications is crucial for compliance and trust. 

With LeapXpert Nothing Disappears 

The DoJ and FTC’s strict recordkeeping requirements challenge organizations to tighten their grip on communications compliance. The LeapXpert Communications Platform provides a secure and efficient way to manage the complex web of digital conversations that are key to your business operations. It maintains a complete record of all conversations between employees and clients, including ephemeral messages, capturing them before they disappear.  

With LeapXpert, no communication is invisible, allowing organizations to embrace ephemeral messages while maintaining control and oversight.  

The LeapXpert Communications Platform can also be easily integrated with leading third-party archiving, surveillance, and analytics platforms, making it an essential part of any compliance tech stack.   

Book a demo now.