Article PDF

Lately, multiple law enforcement agencies have made the news for their use of encrypted phone messaging apps such as Signal, which uses the open source Signal Protocol to encrypt messages end-to-end. In fact, Signal boasts of this on their website:

State-of-the-art end-to-end encryption (powered by the open source Signal Protocol) keeps your conversations secure…Privacy isn’t an optional mode — it’s just the way that Signal works. Every message, every call, every time.” – Signal

Messages are stored locally and by default are set to delete after a brief period of time automatically. Users can also manually delete a message, and this deletes the message not just on the device that sent the message but on all devices that received the message too. Signal warns that messages are unable to be restored (even by Signal itself) after deletion.

Messages as a Public Record

The idea that any government agency uses such an app for routine communications flies in the face of public transparency and records retention laws nationwide. While states’ exact definitions of a public record vary slightly, it is generally agreed upon that any recorded communication (record) regarding the conduct of government that is created, used, received, or stored by a government agency is a record which must be maintained appropriately.

In other recent news, police officers were using these apps on their personal cell phones to message other officers with real-time updates on a police matter. This speaks to a fundamental lack of understanding of public records as it is the content of the record that determines whether it is a public record, not the method of communication. Simply using your personal cell phone to communicate information relating to the conduct of government does not suddenly make the message private and exempt from public records laws.

It is the fundamental responsibility of the agency to not only preserve its records but to make them accessible when needed. Such is the point of records management laws and records retention schedules, to ensure that agencies are keeping records for an appropriate amount of time, and only destroy them upon approval.

Policy Needed

The use of appropriate communications tools should be governed by agency policy, including explicit reference to what types of tools are not appropriate. In addition, agencies should specifically forbid the use of personally-owned devices for agency communications. Users should not be allowed to install unauthorized apps on agency devices.

Detailed records management plans covering the entire lifecycle of a record, including its creation, use, maintenance, and disposition, can supplement policy and provide personnel with clear guidance.

Training Needs

Regardless of their position in the organization, all employees should be made aware of their responsibilities when it comes to handling government records through adequate training, policy, and procedure. Most employees create records at some point, sometimes daily. Their proper retention and release is a matter of risk management and compliance.

Technology Needs

Beyond training, agencies should leverage technology for both the automatic retention/disposition of records and to manage agency devices properly. A plethora of records management tools exist across platforms and operating systems, allowing agencies to control the storage location, retention period, and disposition of records. User permissions can be adjusted so that most users are not able to delete records by default. This includes mobile device management, and records retention applications.

Agency devices, including cell phones, should be centrally managed so that the phones’ settings are centrally controlled by the agency. This allows the agency to set retention periods, and restriction of deletion rights. Users should not be allowed to install new apps unless they are agency-approved. These simple steps can help ensure that an agency is maintaining their records in a legally compliant way.

How PRI Can Help

PRI specializes in government and public safety records and information management operations. As a highly-specialized professional services firm, we provide consulting solutions centered around the procurement and implementation of technology and the proper management of agency records. Contact us for help with our expert services including needs assessments, RFPs, records management, and technology integration.