Addressing the Problem with Mobile Communications Preservation

John, it’s a common viewpoint that the requirement to capture and archive mobile device communications is confined to the financial services industry or companies subject to an active investigation or litigation. Is that a misconception?

There was certainly a serious urgency for mobile communications monitoring and preservation in the financial services industry in 2022 when the Securities and Exchange Commission began a wave of actions and billions of dollars in fines against broker-dealers for failing to properly capture and retain messages from off-channel communications. Enforcement in that industry has been active for multiple years. 

That said, the requirements are not limited to financial services. The preservation rules set by the FTC and DOJ are similar to those of the SEC and apply to organizations that may face a wide range of regulatory reviews or legal actions. The agencies announced updates to their standard language in 2024, and the FTC Bureau of Competition director stated at the time that the updates reinforce preservation responsibilities for companies and individuals involved in government investigations or litigation. Those responsibilities now extend to newer methods of collaboration and information sharing, including ephemeral messaging applications. As a result, the risks of failing to preserve can extend across numerous industries and legal or compliance matters.

How are you seeing this issue show up for clients? Has there been an uptick in enforcement?

Outside of financial services, where there have been significant actions, we’ve seen clients tackle this proactively. For example, organizations in the energy, health care and manufacturing industries are subject to regulatory scrutiny and have taken steps to prepare for the possibility that they will need to demonstrate compliance with preservation obligations and produce mobile communications in response to an inquiry. They want to have a way to capture messages from WeChat, WhatsApp and SMS so they can be saved directly into the archive, just as email is, according to their retention schedule or upon receiving a new legal hold. 

In terms of enforcement activity, most of what we’ve seen with the DOJ and FTC to date has been rulings or penalties within existing cases. For example, a district court recently granted sanctions against a defendant when communications were not available in response to an FTC subpoena. In that case, the defendant continued to use ephemeral messaging applications even after learning that the subpoena was impending. This case demonstrates how mobile communications preservation failures can create additional legal liabilities or complexities for an organization that is already facing regulatory scrutiny.

Often when an investigation is triggered or a legal hold is issued, custodians must have their devices taken and imaged for evidence collection. Does a proactive mobile communications preservation program eliminate the need for that? 

We’ve heard from top executives at several client organizations about this directly. They must use their mobile devices for work purposes and use communications channels that their customers, partners and clients want to use, which often includes text messages, WhatsApp, etc. At the same time, they don’t want to have their devices held and imaged when an issue arises. It’s inconvenient and disruptive and they may have concerns about personal material being captured.  

We implement preservation solutions that can capture mobile messages by automatically copying them into the email system, so they can be archived just like email and other records. Then, if it must be put on hold, it can be without an employee needing to do anything or give up their device. With this kind of system in place, device imaging for an investigation or litigation becomes the exception, not the rule. It’s a real benefit for high-risk individuals such as C-suite, sales and operations professionals who may otherwise be subject to having their device seized multiple times a year.

Can you share an example of an engagement where we established a mobile communications program?

One of our longstanding health care industry clients recently engaged us to implement a mobile device archiving system. The organization provided Apple devices to its employees and allowed business use of iMessage. It needed to capture those messages within the archive, alongside email and other records. We helped the organization conduct a request for proposals among archive providers and evaluate which system would work best within its environment. Our team facilitated the procurement and contracting process with the technology vendor and oversaw the implementation of the software. From there, we configured the environment and conducted quality assurance testing to ensure the archive worked as designed. We also revised the client’s e-discovery playbooks and procedures to be sure the data captured from the devices was available for legal hold in the Microsoft 365 environment. The result was an integrated and defensible preservation program for mobile devices to ensure the organization could respond adequately in the event of a government investigation or litigation. 

While it’s often tempting for organizations to defer these types of projects until the problem is at their front door, doing so can create exposure to legal sanctions, regulatory fines or subsequent compliance violations. Enforcement trends and guidance related to modern forms of communications and failures to properly preserve, monitor and manage them signal that this will be an area of ongoing focus among regulatory agencies. Organizations that proactively preserve mobile communications as part of their broader retention and information governance program can reduce risk and improve readiness for future discovery obligations. 

Related topics:

The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, its management, its subsidiaries, its affiliates, or its other professionals.