Secure Messaging

Secure Texting, Uber, Wickr and the Whole Enchilada…

secure textingIt has been reported that Uber employees and management used Wickr, a secure messaging tool known for disappearing text, to communicate and those communications are now “gone” forever. These texts may have contained relevant information to the case now on the books, however they cannot be presented in court and therefore cannot be used as evidence.

According to Reuters:

Top executives at Uber used the encrypted chat app Wickr to hold secret conversations, current and former workers testified in court this week, setting up what could be the first major legal test of the issues raised by the use of encrypted apps inside companies.

The revelations Tuesday and Wednesday about the extensive use of Wickr inside Uber upended the high-stakes legal showdown with Alphabet’s Waymo unit, which accuses the ride-hailing firm of stealing its self-driving car secrets.

The issue of course is not whether using Wickr or apps like it, including Vaporstream, is acceptable. The issue is when, where and how to use the application and what legitimate use indeed looks like.

There is nothing inherently unlawful about instructing employees to use disappearing messaging apps, said Timothy Heaphy, a lawyer at and a former U.S. Attorney in Virginia.

Indeed, there is nothing wrong with picking up a phone, or for that matter using ephemeral texting. Timing and industry are really the crux of the matter. If the organization is in a regulated industry, ephemerality in and of itself may be viewed as central to compliance. For example, sending healthcare information by disappearing text, which does not remain on smart phones after the issues has been handled helps keep the information confidential. Similarly, sending out credit card numbers, or other sensitive financial information in a similar manner is likewise beneficial. However, it is also clear that in both of these examples, a record of these conversations must be preserved for compliance in the organization’s official archive. Applications such as Vaporstream have been built with security, privacy and compliance in mind from the get go. Most of the other apps have not. Collecting a single copy of record makes eDiscovery and compliance much easier by not requiring collection from the many mobile points.

If applications like Vaporstream or Wickr make it into the organization due to shadow IT and BYOD, there is an obvious need for a policy to deal with such a case. Whether it is disallowing such apps, buying their corporate versions that offer compliance, monitoring usage, or a combination of IT and policy solutions, it is absolutely necessary for the organizations to be aware and to take action.

So, what about a case where the application is used for executive communication, which is not subject to specific compliance regulations? What is the problem there? From the above legal opinion, we see that the application itself is not the issue. The issue is in the timing. It is clear from the federal rules of civil procedure that once there is an on-going or an anticipated litigation, any information that can be perceived to be relevant to the litigation must be preserved. So even if the employees at Uber started using Wickr before the litigation, once they were notified of the possibility, all text messages sent over Wickr had to be recorded. Of course, the issue of anticipated litigation is always tricky. When should they have reasonably started recording? Of course, that is up to their legal council to determine, and ultimately up to the court. It will all come down to the timing, the procedures and usual practices both for texting and for legal hold preservation and notification at Uber. It will certainly be very interesting to see how all this plays out.

I think the real moral of the story is that the use of encrypted, ephemeral messaging for business is not a problem – so long as there is a way to stay compliant, and to preserve information for legal hold when necessary. In fact, the additional confidentiality and privacy protections afforded by applications such as Vaporstream are priceless, hence the reason for their growth in popularity. As with anything it comes down to policies and proper use. People + Process + Technology. It takes all three.

Contributor : Galina Datskovsky