Collection Best Practices - How Multifaceted Software Has Changed E-Discovery

As our work force has shifted to mobile and remote working practices (a trend in place before COVID, which only accelerated during the pandemic), businesses have turned to collaborative messaging tools such as Slack and various versions of Teams to manage communications. On the positive side, by using these messaging tools, organizations are able to more efficiently discuss ideas and brainstorm solutions. However, when an organization becomes involved in a dispute and those communications are potentially relevant to the dispute and need to be preserved and collected, the process may not be as straightforward as a simple email collection.

My colleague, Dave Welch, previously wrote a blog about structured data and messaging platforms in e-discovery, called “The Growing Source of ESI: Structured Data and Messaging Platforms.” I highly recommend that you read his blog as well. In this blog, we’ll take a deeper dive into how best to collect from Slack and Teams.

What is Slack?

Slack is an intricate, multifaceted tool that essentially serves as a company-wide chat room. It allows you to communicate in real-time rather than through the delayed back and forth of email chains. Slack’s website indicates that since September of 2019 over 12 million people have been actively using the tool every day.

There are three primary ways to communicate using Slack:

• Workspaces - This is the company’s Slack environment. Typically a small to mid-sized organization may have one workspace although larger organizations might have the Enterprise Slack Grid option, which allows for more multiple workspaces.

• Channels - These are public or private forums. All members of an organization may have access to certain public channels and a specific department, such as Human Resources, may have its own private channel for communications.

• Direct Messaging - Individuals or groups of individuals may communicate using direct messaging.

Slack also allows for integration with 2,000+ third party applications.

What is Microsoft Teams?

Microsoft’s website indicates that in 2020, the user base for Teams grew from 40 million to 145 million daily active users.

Microsoft Teams also has several means of communication:

• Chat Features - Teams allows for chatting between one or more parties. It also allows users to search and save those chats for future reference.

• Call - Teams supports conference call technology.

• Meetings - Teams allows for video conferencing across multiple parties.

• Collaboration - Teams integrates with Dropbox and OneDrive to allow for seamless sharing of information.

What are Best Practices for Collecting Slack and Teams Data?

Although Slack and Microsoft Teams applications present new challenges to both organizations and e-discovery professionals, the standard e-discovery practices still apply: work with IT to ensure potentially relevant data is preserved; communicate with stakeholders to understand how they utilize the platforms and identify potentially relevant data for collection; develop a collection plan; and document your steps throughout.

Step 1:  Meet with the client’s IT resources and ask some of the following questions:

• What messaging applications are used by employees working on this project/issue? If Slack, what Slack plan is utilized at the company (Pro, Business + or Enterprise Grid)?
• What is the company’s policy regarding retention of Slack and Teams data?  Can employees delete messages or communication strings? Are attachments retained as well? 
• Is there any third party integration in place in the Slack and Team environments? Data deleted from the front end may still exist in these third party tools and thus collection from those may be key.
• What are the users’ rights in the Slack utility? Owners, Admins, Members or Guests. What are the users’ rights in the Teams application? Owners or Members.

Step 2:  Determine your custodians for collection and gather the following information from them:

• How do they utilize Slack and Teams?
• Do they use Private or Public channels?
• Do they utilize the collaboration features of Team or just video and calling?

Step 3:  Determine your method of collection:

Slack has varying types of exports. 

• Standard/Corporate exports will export all public channel content. 
• Corporate exports will export all public and private channels and direct messages. 
• Both of these exports will produce a .json file (JavaScript Object Notation, sample shown below).

As you can see, the export is not in any kind of format that can be readily reviewed by a legal team. Most of the time, .json files can be re-formatted but there is another option.

• Collection via the Discovery API is a much better solution. This is a third party application that will collect all resources in multiple workspaces in the environment. Using this collection method and utilizing trusted e-discovery review tools will allow for the processing and review of Slack data in a way that is meaningful for the case team.

Microsoft Teams also has various methods for exporting data. 

• Content Searching: Content searching is the basic Teams e-discovery tool and allows simple searching by keywords and various queries; however, data in Teams is stored in various applications such as Sharepoint and OneDrive so searching the Azure backend of the product can present some indexing and exporting limitations. 
• Core eDiscovery: Core eD in Microsoft 365 allows the user to run more detailed searches  and export content.
• Advanced eDiscovery: Microsoft’s Advanced e-discovery collection tool allows the user to target the data collection to specific applications and custodians and then export the data in a format that is compatible with e-discovery processing tools..

Step 4:  Document the process:

• While conducting steps 1-3, the e-discovery professional will gather very valuable information that should all be documented, including custodian names, interview notes, organizational practices, collection channels and third party applications. It is important to track all of this information from start to finish so that you have a reliable reference for the process you followed to identify and collect the relevant information.

This is a very exciting time in the workforce. Need will continue to drive ingenuity and we will continue to see new tools be used in the marketplace.  he e-discovery world will certainly  continue to learn ways to efficiently collect and manage this data to meet ever growing client needs.