Last year, then Gawker Media executive editor John Cook found himself in the unsavory position of explaining in front of a jury why he posted a picture of an uncircumcised penis to his colleagues. The picture had been shared on Campfire, the internal messaging software Gawker used at the time. In a videotaped deposition shown in a Florida courtroom, a lawyer asked Cook, “Was it common at Gawker to share pictures of penises with colleagues?”

advertisement

advertisement

The image, inserted into a discussion about the Hulk Hogan sex video that Gawker had published, was part of a long-running joke between editors and reporters. Cook couldn’t have imagined at the time that three years later, he would have to explain and defend it to a court of law after Hogan filed a multimillion-dollar lawsuit. The jury ruled in favor of the wrestler, Gawker is over, and Cook is now an editor for a retooled entity under Univision, the Gizmodo Media Group. But Cook’s messages did underscore a new reality for anyone who uses digital chatrooms to communicate with their colleagues: Chats that seem to be more ephemeral than email are still being recorded on a server somewhere. Gawker Campfire log Still: via David Bixenspan (@davidbix) Amid concerns by a battered but determined press about privacy and the Trump administration’s quest to stop leaks, a growing number of journalists and editors are being forced to think carefully about how they communicate with each other. Newsrooms still use chatroom apps like Campfire and HipChat, but neither has been embraced by the tech and media industries quite like Slack has. In just a few years, the company has rocketed up to 4 million daily users, with 1.25 million of them paying for extra features. You’d be hard pressed to find a media organization that doesn’t have at least some Slack interactions; many companies use it as their primary way of communicating. “There are several dangers that I think journalists need to be aware of when they’re putting so much of their communications on Slack,” says Trevor Timm, executive director of the Freedom of the Press Foundation. Slack “has access to all of your chats,” he tells me, “[as well as] any internal communication you may not want in public,” including private conversations. The reminder extends beyond journalism too, to organizations like Timm’s, he notes: Indeed, even Freedom of the Press uses Slack. Slack’s ease of use is great for a busy newsroom. Reporters and staff can post links they’ve found online, leads they’ve uncovered, public records they want to request, or edits, in real-time and in one place. (Most of Fast Company‘s staff relies heavily on Slack.) New chatrooms or “channels”—either public or private ones—can be created on the fly. The app’s ease of use also means the virtual newsroom is a sort of digital watercooler, where reporters share the sort of gossip they would never want associated with their bylines. A release of this data—either by a court’s subpoena or a hacker’s intrusion—wouldn’t only require the public explanation of private jokes. It could risk compromising an already delicate trust between journalists and their audiences, and lead to the inadvertent disclosure of the identities of anonymous sources. This last part is of the utmost importance to reporters. The relationship between a source and an investigative journalist hangs on trust: Sources provide sensitive information under the assumption that writers will protect their identities. Despite the best of intentions, reporters using Slack and other digital platforms may be inadvertently breaking this pact. Sources like John Kiriakou, the first CIA officer to speak openly on waterboarding—and whose disclosure of classified information to investigative journalists helped send him to prison—serve as an example of how high the stakes can be. The Risk Of Disclosing Information Beyond Gawker’s “penis-gate,” another recent incident highlights the risks of seemingly “private” chatrooms. This month, police in Washington, D.C., subpoenaed information from Facebook regarding users in the area who protested President Trump’s inauguration. The subpoena, uncovered by CityLab, asks Facebook to appear in court and provide specific user information, including names and addresses of people who use the social network and were recently arrested by the Washington, D.C., police department during the protest.

advertisement

Facebook and Slack are not the same thing, but as communication and organizing tools, they serve similar functions. Facebook was used as a tool for protesters to share information. Slack serves a similar purpose for journalists who might use it to keep information about sources and material. Timm emphasizes that reporters’ fear of inadvertent disclosure isn’t new. In recent years, the Obama administration took steps to either indict journalists for withholding sources and whistleblowers or to have them subpoenaed to give information before a court of law. Timm has written about the groundwork that President Obama laid for Trump in this regard, using the Espionage Act–a World War I-era law intended to target spies–as a means to stem leaks and out sources. If authorities ask Slack for data about journalists, the company may be forced to comply. In its Data Request Policy, the company says, “Except as expressly permitted by the Contract or in cases of emergency to avoid death or physical harm to individuals, Slack will not disclose Customer Data, unless it is compelled by law to do so or is subject to a valid and binding order of a governmental or regulatory body.” It also says it will notify a customer before disclosing any of their data, “unless Slack is prohibited from doing so” or if the data is associated with “illegal conduct” or the risk of harm to people or property. As of last April, Slack said it had received four requests for user data, one from the government and three from third parties, but had responded to none of them. The company wouldn’t offer further information about these requests. Slack does not offer a warrant canary, a web page that some tech firms use to alert users to government data requests that are intended to be kept secret through gag orders. “A Big Juicy Target” Part of the problem, as Timm sees it, is the allure of Slack and its slick interface. “Slack does make things so easy and enjoyable,” he says. “Often the people who are using Slack let their guard down.” Which is to say that they’ll assume the digital space is completely secure. “There really needs to be an increased awareness within news organizations,” he says, “about when it’s appropriate to discuss things on Slack or when you should go to a more secure channel.” To Adrianne Jeffries, senior editor of The Outline, “Slack is best for coordination and brainstorming,” she writes in an email. “Using it for editorial conversations can lead to hasty judgments, but sometimes you have to for expediency.”

advertisement

advertisement

Additionally, there are things Slack can do to make its product better for journalists. For one, it could end-to-end encrypt its messages, better ensuring that the contents won’t be intercepted by a nefarious third party. A Slack spokesperson says the company may evaluate end-to-end encryption in the future. Slack could also offer the option for organizations to host their data on their own servers, something the company says it has no plans to do. (Slack currently hosts data on Amazon Web Services servers.) If it did allow self-hosting, individual organizations could be in charge of their own security and wouldn’t be in peril if Slack itself were to receive a subpoena, court order, or warrant—or if the company’s security was somehow compromised. Timm adds that either of these solutions could fit within Slack’s business model, provided it was not interested in mining user conversations for data. Slack’s rules on customer data are similar to many other digital platforms: It won’t share information with third parties unless given explicit consent from the user (this often means the corporate account holder, not the individual user). But the company also keeps track of all metadata, which it calls “other information”–including log data and well as device and geolocation information–to “research and analyze trends.” And last month, Slack announced it was using artificial intelligence to help users and managers “analyze content to address information overload.” As groups increasingly rely on software to communicate with each other, it will be up to managers and editors to figure out how best to protect themselves and their sources. As Jeffries wrote, “I think it has to be a mix of things, and staying on top of that balance is the thankless task of the managing editor.”