Slacking off? ICO probe throws up concerns over instant messaging

GDS using insecure shadow IT that doesn't comply with their own rules?

Colour me shocked. Shocked I tell you.

I see Sir Humphrey is still at work

"The Cabinet Office might argue that the data that cannot be extracted is not actually 'required', and so there is no need to access it."

I am quite certain that a judge would not be impressed by that argument.

aaaand ..... there's the reason we don't persist any of our instant chat

We have to suffer being branded a "behind the times" IT dept that won't support free Slack and thus restricting the collaboration and innovation in the business. We tend to ask awkward questions like "when can we have our data back to archive?" and "where on the globe are our data stored at rest?"

Of course everyone in the business wants Slack right up until you give them the £400,000 per annum bill to run the Enterprise version, "....but surely we can do without compliance exports and two-factor authentication, can't we ?"

Now this might come as a surprise but people in offices - all offices, not just in government - regularly talk to each other. They even talk to each other about business. Hardly any of this is written down except when it involves formally taking decisions. The rest of it just dissipates into thin air. So why should there be any expectation that such talk, extended to cover people who are geographically separated, be any different?

Yes, I know there are those who want to be able to comb through records looking for whatever form of wrong-doing they suspect. They're unlikely to find it because if there's any expectation of a particular communication channel being recorded anyone seeking to set out on some nefarious has the option of just plain face-to-face conversation. And the official decision taking will be formally recorded just as it always has been.

Presumably telephone calls fall into this category too. Are all internal telephone calls recorded and transcribed? Are there microphones by the water cooler? If not, why should Slack be any different?

Surely any formal decision is made at a minuted meeting anyway.

speak and be recorded :O

I'm not going to say that all IM shouldn't be recorded. If it's an official form of communication; ant that's very clearly established in a workplace to be the case - it should be logged like anything else.

If IM is meant for casual or informal discussions (just the same as a normal voiced conversations in real life) but through an alternate medium - it should be specifically exempt from official logging.

I've seen Microsoft's OCS product used in a monitored and unmonitored state, in the same public sector environment (even with two OCS systems running side-by-side and in the IT department). I can tell you, it's a no-brainer. The monitored chat is hardly ever used at all. Literally, in 2 years of use; the only messages we ever put over it, were jokes about testing it). The unmonitored system, which used to be partially 'grey' monitored until a change of management; was used as the default. And even this was largely abandoned after the new management discovered the existence of it. Now the chats have moved into whatsapp, so completely out of band.

This clearly illustrates that ther's a distinction in the use of IMs. If you're going to bother using this style of communicating, at all - you need to respect the privacy of casual, informal discussion.