By Lauren Zimmerman, partner and Vinita Davey, associate
Among the many revelations that emerged from the FTX collapse was the hoard of Signal and text messages that Sam Bankman-Fried and his colleagues used to conduct their business (and fraud). These messages, often sent through personal devices, were key evidence in the U.S. Attorney for the Southern District of New York’s successful criminal prosecution of Bankman-Fried.
While it is easy to chalk up FTX’s meltdown to the naivete of a few young executives, employees across industries are increasingly using an array of instant messaging platforms, as well as text messaging, as a means to engage in business-related communications. From discussing the content of team meetings to complaining about client or management issues, employees are just as likely, if not more likely, to turn to Signal, Slack, or WhatsApp messaging as they are to using their company email accounts when exchanging information related to their work – particularly when they are looking to carry on a conversation in real time. This approach can pose a unique set of risks for companies undergoing investigations by major regulatory agencies, which have signaled an awareness of the new instant messaging normal.
For example, the SEC and FINRA now require financial firms who permit employees to communicate about business through text or other instant messaging platforms to ensure they can retain records of those communications, even when carried out on employees’ personal devices. Firms that have failed to retain work-related messages sent on their employees’ personal phones – either because management is unaware that their employees utilize non-company communication channels or because of the employees’ use of auto deletion mechanisms – can face serious penalties. In February 2024 alone, the SEC announced charges against 16 financial firms related to their failure to preserve text and instant messages exchanged by their employees – resulting in a combined total of almost $81 million in fines.
Similarly, earlier this year, the Department of Justice and Federal Trade Commission (FTC) announced updates to their standard preservation letters and notices. These updates included a new reference to “ephemeral messaging platforms” such as Slack, Microsoft Teams, text messages, and iMessages – signaling their understanding that off-channel messaging, including on personal devices, may contain evidence of corporate wrongdoing and a shifting expectation that companies preserve them. The FTC has made clear that failure to preserve instant messages that are potentially relevant to an FTC investigation may lead to civil spoliation sanctions or criminal liability.
While employees’ use of instant messaging to conduct business may be somewhat unavoidable in the post-pandemic work-from-home landscape, companies should consider developing policies and trainings that (i) impart best practices for digital communications; (ii) convey that employees’ use of instant messaging on their personal devices may be discoverable, and (iii) ensure their ability to preserve relevant messages.
