Are your Slack Direct Messages really private? Here's how to find out.
UPDATE: March 21, 2018, 10:59 a.m. PDT:Slack is changing its policies around this, and doing away with Compliance Exports altogether. However, that doesn't mean your DMs are necessarily safe. In fact, the situation could be even worse. Read our follow up story for more details.
The original story below.
Slack, like office gossip, is a part of modern day work life. And so it's only natural to wonder just who, exactly, is privy to all the juicy tidbits you and your coworkers share over direct message. Could your boss be reading those comments about his ugly tie — or, much more seriously, your plans to unionize?
While some will argue that you should never send a message you wouldn't want a manager to see, that level of caution is extremely difficult for many who work remotely or with coworkers spread across the world. It's not like you can have a casual, off the record lunch with your team when your closest coworker is thousands of miles away. Thankfully, there is a way to find out what Slack privacy settings your company has in place.
SEE ALSO:Slack announces a new screen-sharing tool that lets coworkers control your computerFirst, let's cover the basics. Obviously, public channels can be joined by anyone. Their contents are searchable, so even if your boss hasn't joined a channel, it doesn't mean he or she can't see its contents. Second, while Slack says both a private channel (identified with a little lock icon) "and its contents are visible and searchable only to the channel members," your messages there cease being private the second a boss gets wind of the channel and insists someone invite them in.
Where does that leave a corporate dissident? That would be the classic direct message. On Slack, DMs can be between two or more people, and the company explains that "[they're] visible and searchable only to you and the members you DM."
Sounds pretty good, right? But there's a pretty massive catch, and it goes by the name of compliance export.
Credit: giphyCompanies on Slack's Plus plan have the option to enable the benign sounding compliance report. And just what is that, exactly? In a nutshell, it's a way for a Team Owner to export all Slack data.
"In a regulated industry or have legal obligations to archive messages?" asks Slack in an ad for the service. "Team Owners can request access to their entire Slack message history, including private channel messages and direct messages."
Additional reading makes it clear that "Compliance Exports can be enabled so that messages and files from private channels and direct messages are included in Slack data exports."
Essentially, if the head of your company has this feature enabled, he or she can export the contents of your DMs in a searchable form for reading at a leisurely pace — making your private chats suddenly very public. This is not an abstract concern. For example, Splinterreports that this feature was enabled at CNNearlier this year.
What a message looks like in a Slack Compliance Export.Credit: slackSo, how can you tell if your company has Compliance Exports enabled? It's actually incredibly simple. While signed into Slack in your browser, mosey on over to https://[insert your team name here].slack.com/account/team. Scroll to the bottom of the page, and you'll see if that feature is turned on. Fingers crossed it's not.
If it is enabled, than anything you've ever sent over DM — included now deleted messages — can potentially be searched by your company's higher ups. If it's not enabled, then you're good for now as the feature does not log "messages from private channels and direct messages sent before the feature was enabled."
In other words, say your CEO got suspicious and turned this feature on today. They would still not be able to read what you wrote in a DM last week.
That's not all you need to worry about, however. There's also a little thing called the Discovery API. According to Slack, this feature allows "eligible Slack customers (and their Workspace Owners) to integrate their organization with third-party applications in order to export, retain, or archive some or all messages and files submitted to Slack, including all messages and files submitted to workspaces on Free, Standard and Plus plan that the applicable Customers and/or Workspace Owner(s) elect(s) to migrate into a Slack for Enterprise organization."
Essentially, your company can plug third-party software into Slack's API, which then has the ability to archive messages sent over the platform. So, how do you check for that? Buckle up, because this part's a pain.
Head to https://[insert your team name here].slack.com/apps/manageto see all the apps integrated with your Slack's API. There may be none, a few, or a lot. Next, select "Can access messages" from the "Access type" drop-down menu. Scroll through every app's "App Info" and "Settings" sections. You may find that certain named individuals (coworkers or bosses), via integrated apps, have the listed permission to "Access content in user’s direct messages."
Slack confirmed that this does in fact mean that an administrator could theoretically read an entire teams DM's via a whitelisted app plugged into the Discovery API.
If, after diving through your company's Slack settings, you see that your DMs are being exported, consider exchanging cell numbers with your coworkers and using a messaging app like Signal — there's even a group messaging function. Because whether you're planning to unionize, discussing a creepy boss, or just wanting to talk about getting drunk — it's better to be safe than sorry.
This story has been updated with a confirmation from Slack regarding the Discovery API.
- ·Number of COVID
- ·雅望线柏香树大桥预计1月20日恢复通车
- ·立足灾后恢复重建 布局科学长远发展
- ·作家李娟阅读分享活动在喀什举办
- ·How to watch 'Kinds of Kindness': When is it streaming?
- ·图集|锦绣“丰”茂又一年
- ·重建城区道路 提升城市形象
- ·30余名艺术家走进雅安 泼墨挥毫送上新春祝福
- ·DNC 2024 speech: Barack Obama and Michelle Obama have a superpower no other Democrat has.
- ·我市举行第32届元旦环城赛跑活动
- ·13名雅安籍运动员入选国家集训队备战里约热内卢奥运会
- ·用艺术绘制科技:华农艺术赋能从化农业科技现代化先行县建设
- ·Speeding space object triggered a warning. It wasn't an asteroid.
- ·“拼多多杯”第二届科技小院大赛重庆开赛,滇桂渝3地各有1支队伍晋级决赛
- ·我市举行第32届元旦环城赛跑活动
- ·45辆军车穿越“生命通道” 首批18万匹标砖运抵宝兴灾区