Discovery from Slack: It’s Complicated

Slack has started to become a common source for the discovery of relevant communications and other materials, but with new data sources, come new challenges

For several years now, use of the workplace collaboration and messaging tool Slack has been growing exponentially, first augmenting and then starting to supplant email usage within many organizations. Less than a year after its 2013 launch, Slack became the fastest-growing workplace software ever, and by January 2019, Slack had surpassed 10,000,000 daily active users and was used by 65 of the Fortune 100.  Slack’s immense popularity has even led to a variety of new, competing offerings from Microsoft (Teams), Google (Chat), and others (e.g., Trello).

With such widespread usage, Slack has started to become a common source for the discovery of relevant materials.  So, just what sorts of materials are in Slack?  How can those materials be preserved and collected?  What special challenges does Slack data present?

What’s in Slack? 

Slack is a chat and messaging tool that also incorporates a range of additional collaboration functions – both native functions and functions added through custom applications.  Slack is used for rapid-firem, day-to-day communications.  Teams that use Slack tend to stay on Slack all day, using it for many of the short messages that might have previously been sent via email.

Within an organization’s “workspace” (or multiple workspaces for larger organizations) there are a series of “channels,” which are essentially chat rooms.  Channels may be public and open to anyone in the organization or private and invite only.  Within these channels colleagues can engage in text-based chat, communicate with emoji and images, share files, and more.  Slack also facilitates direct messaging between individuals and designated recipients.

Among the materials stored by Slack are the countless text communications between users, plus emoji, images, document files, links to files on other services (e.g., Dropbox, Drive, etc.), metadata (including likes, mentions, etc.), user data, and more.  Slack stores most of this data in the JSON format (JavaScript Object Notation), which is an ideal format for efficiently passing a variety of data types back and forth between browsers and servers, but which is not ideal for discovery as it typically requires custom processing work to handle.

Challenges of Slack Discovery 

Discovery from Slack presents a number of challenges, beginning with preservation and collection.  Because Slack is a cloud-based application, organizations are limited in their options for retention and collection to the features and connections provided by Slack.  Those features and options are dependent on which of four subscription levels is in use:

  1. Free
    • Only retains the most-recent 10,000 messages
    • Standard Export” can only export text and links, only from public channels, and only all materials (no targeted exports)
  1. Standard
    • Retains all messages and allows for custom retention policies
    • Standard Export” can only export text and links, only from public channels, and only all materials (no targeted exports)
  1. Plus
    • Retains all messages and allows for custom retention policies
    • Can export all messages and materials from public channels, private channels, and direct messages using “Corporate Export” feature, but only all materials (no targeted exports)
  1. Enterprise Grid
    • Retains all messages and allows for custom retention policies
    • Allows access to the Slack Discovery API, which facilitates preservation and collection through third-party applications (e.g., Onna, Hanzo, Smarsh, Global Relay, etc.)

Even once retention and collection are accomplished within these restrictions, additional challenges await that require custom processing and presentation solutions:

  • Even smaller organizations can easily have workspaces with tens of thousands of discrete JSON files, including new ones for each ongoing conversation each day. All of those records must be organized (and integrated with ESI from other sources) in a way that makes it possible to review the conversations chronologically and understand them in context (e., in sequence with related emails, voicemails, etc.).
  • Beyond volume, the multiplicity of content and file types that can be included in messages creates display challenges for review and production. Most review platforms are not equipped to natively display messages with integrated emoji, bitmoji, images, files, file links, likes, mentions, and other unique metadata.  Decisions must be made about what to display and how to display it, and custom work must typically be done to implement those decisions.

Additionally, Slack – like most cloud-based applications – is subject to frequent updates, feature changes, and API changes, which can make keeping up a real challenge for discovery solution developers and forensic service providers.

Slack Cases

In 2019, discussions of discovery issues involving Slack began to appear in case orders and opinions.  For example, in the case of Calendar Research, LLC v. Stubhub, Inc., et al., No. CV 17-4062 SVW (SSx) (C.D. Cal. Mar. 14, 2019), the plaintiff sought production of relevant Slack messages from the defendants, but the defendant encountered some challenges acquiring the materials and preparing them for production.

The defendants in that case were eventually able to make a production of some relevant Slack messages, but that initial production was incomplete, due to a series of issues.  These issues led to delays, which led to the plaintiff filing a motion to compel production of the delayed messages and to seek sanctions against the defendants for inaccurately certifying the completeness of their initial productions.  The court summarized the issues the defendants encountered:

According to Defendants’ counsel, certain Slack folders were not retrievable at the time of the . . . production because Block & Tackle had used a free account, and full access to the database required a premium account, which Defendants have now obtained.  After the upgrade, Slack informed Defendants that it would not allow full corporate export of the entire account without the consent of all parties who used the account.  However, it provided a utility tool that allowed Defendants to extract private channels used by Gray and Efremidze.  After extracting those files, Defendants were told by StubHub that certain files contained communications subject to its attorney-client privilege.  StubHub identified the privileged files, and Defendants have asked their vendor to remove them from the remaining files to be produced.  [emphasis added; internal citations omitted]

Finding no evidence of bad faith on the part of the defendants, and given the defendants’ efforts to supplement the initial productions as needed, the court granted the motion to compel production but declined to award the requested adverse inference sanctions and monetary sanctions.

In the case of Leon D. Milbeck v. Truecar, Inc., et al., No. CV 18-02612-SVW (AGRx) (C.D. Cal. May 2, 2019), the plaintiffs requested the production of relevant Slack messages late in the discovery process and eventually pursued a motion to compel the production.  The defendants worked with their eDiscovery services provider to offer a detailed explanation of the technical burdens and the time that would be required:

Defendants present a declaration from their eDiscovery provider, which has received 1.67 gigabytes of compressed data from Slack (“Slack data”).  “There is no way to isolate any specific information, such as particular channels or users and limit the collection to only that data.”  The entire Slack data must be processed before any information can be extracted.  Although it is not possible to know the volume without processing, Ms. Anderson relates that, in another unrelated matter, 100 megabytes of Slack data resulted in 1.7 million messages.  Applying the same metrics, 1.67 gigabytes of Slack data could generate up to 17 million messages.  Ms. Anderson estimates that the initial conversion process could take three to four weeks, followed by another two or more weeks of processing time to address any conversion anomalies.  The format of Slack data as extracted text means that a reviewer must scroll through the extracted text to identify the start and end of relevant conversations.  [emphasis added; internal citations omitted]

Based on this explanation, and on the “compressed discovery and trial schedule,” the court concluded that it would be impossible for the work to be completed in time for depositions, trial preparation, etc., and declined to compel the production or find fault with the defendants’ efforts: “The parties promptly and diligently began discovery negotiations, and have completed a tremendous amount of discovery in a short period. No one is to blame.”  The court did leave open, however, the option for the plaintiff to seek “a continuance of the trial date so that production of Slack data could be accomplished in time to be used in depositions and expert discovery.”

Finally, in the case of Rondevoo Technologies, LLC. v. HTC America, Inc., No. 2:18-CV-01625-TSZ (W.D. Wash. Apr. 8, 2019), the parties preemptively stipulated as part of their “Agreement Regarding Discovery of Electronically Stored Information” that they would forego Slack discovery: “Absent a showing of good cause by the requesting party, the following categories of ESI need not be preserved . . . h. Voicemails, Slack, or chat transmissions.”

For Assistance or More Information

Xact Data Discovery (XDD) is a leading international provider of eDiscovery, data management and managed review services for law firms and corporations.  XDD helps clients optimize their eDiscovery matters by orchestrating precision communication between people, processes, technology and data.  XDD services include forensicseDiscovery processingRelativity hosting and managed review.

XDD offers exceptional customer service with a commitment to responsive, transparent and timely communication to ensure clients remain informed throughout the entire discovery life cycle.  At XDD, communication is everything – because you need to know.  Engage with XDD, we’re ready to listen.

About the Author

Matthew Verga

Director of Education

Matthew Verga is an electronic discovery expert proficient at leveraging his legal experience as an attorney, his technical knowledge as a practitioner, and his skills as a communicator to make complex eDiscovery topics accessible to diverse audiences. A fourteen-year industry veteran, Matthew has worked across every phase of the EDRM and at every level from the project trenches to enterprise program design. He leverages this background to produce engaging educational content to empower practitioners at all levels with knowledge they can use to improve their projects, their careers, and their organizations.

Whether you prefer email, text or carrier pigeons, we’re always available.

Discovery starts with listening.

(877) 545-XACT / or / Email Us