An Update to the Growing Regulatory Risk of Off-Channel and Ephemeral Communications

In November 2022, RANE published an Advisory on the growing challenges companies face in complying with expanding regulations concerning employees’ communications. Since then, there have been multiple developments that warrant an update. The original Advisory referenced a September 2022
speech in which Deputy U.S. Attorney General (DAG) Lisa Monaco announced significant policy changes to the U.S. Department of Justice (DOJ) corporate enforcement strategy, which included an intensified focus on personal device policies and controls and proper document preservation policies and
procedures. The policy changes were announced in tandem with a memorandum released the same day, which detailed the changes.

On March 3, 2023, Assistant Attorney General (AAG) Kenneth Polite announced noteworthy revisions to the DOJ’s Evaluation of Corporate Compliance Programs (ECCP) guidance. The revisions expand on DAG Monaco’s September 2022 comments and introduce new guidance for assessing companies’ compliance
efforts to monitor employees’ use of personal devices and communication platforms. On May 11, federal regulators then illustrated their heightened scrutiny of companies’ communications practices by fining two prominent broker-dealers. To review these developments and provide guidance for companies,
RANE again spoke with Matthew Bernstein, Founder and Information Governance Strategist at Bernstein Data.

What to Know

In a September 15, 2022 speech, DAG Monaco conveyed the DOJ’s increasing concern about the prolific use of certain messaging applications — including encrypted and ephemeral messaging applications such as WhatsApp, Signal and Telegram — by company employees for business purposes. The DOJ
explicitly noted that these types of communications are often conducted through personal devices rather than company-provided or -monitored programs. The rise in remote work and Bring Your Own Device (BYOD) programs has resulted in an environment that may be inconsistent with an effective
compliance program, especially with regard to the potential need to access necessary data and information for audits, reviews or investigations.

In response to these concerns, in March 2023, the DOJ announced revisions to its ECCP to specifically address corporations’ approaches to the use of personal devices and messaging applications. Due to the growing prevalence of these messaging applications and corporate BYOD policies, the DOJ now “expects companies to update their policies and practices accordingly.” Although the ECCP is intended to guide federal prosecutors, it nevertheless serves as a key reference for organizations, and the DOJ will expect organizations to be familiar with its evaluation criteria. To Bernstein, it is clear that the DOJ did not issue the updated evaluation merely as a reminder of the status quo but rather as a pointed notice about the issues it will be most concerned about going forward.