FOIA Compliance in Encrypted Messaging: What Agencies Need to Know
Encrypted messaging apps like Signal are popular communication tools among government agencies because of their secure features. However, their lack of room for call monitoring has raised significant concerns about compliance with the Freedom of Information Act (FOIA) and open record laws. While these apps offer enhanced privacy and security, they also present challenges for transparency and record-keeping requirements.
Challenges of Monitoring Signal Calls
Under FOIA and various state-level open record laws, government agencies must preserve and disclose records of official communications upon request. However, when officials use encrypted apps like Signal, messages and call logs may not be stored, making it difficult—if not impossible—to retrieve these records when requested.
Lack of Automatic Record Retention
Unlike traditional email systems that automatically store messages, Signal allows users to delete messages permanently. Even agencies themselves may not have access to these communications unless users voluntarily retain records. Without proactive measures, agencies may lose records required for FOIA compliance.
Legal Ambiguities
Some states have ruled that messages on personal devices are subject to FOIA if they pertain to official business. This is complicated by the fact that officials who use personal devices for work-related communications may not monitor calls on Signal.
Best Practices for FOIA Compliance
Agencies should consider the following to ensure compliance with FOIA and open records laws while still benefiting from encrypted communication.
Clear Communication Policies
Agencies can define which messaging apps employees can use for official business and outline retention requirements. This policy can be strengthened by educating officials on their responsibilities under FOIA and the risks of using encrypted apps without proper record-keeping.
Use Archiving Solutions
An encrypted messaging app like Signal is hard to let go of. As a compromise, agencies should consider using third-party archiving tools that can capture and store messages from encrypted apps where legally possible. This way, they would not have to change their communication tool while maintaining compliance with relevant laws.
Conclusion
Encrypted messaging apps are only a challenge if agencies refuse to think outside the box to ensure their responsibilities are met. By implementing clear policies and using archiving solutions, agencies can strike a balance between privacy and the public’s right to access government communications.
