90+ orgs tell Slack to stop slacking when it comes to full encryption
(2023/05/31)
- Reference: 1685487198
- News link: https://www.theregister.co.uk/2023/05/30/slack_e2ee_protest/
- Source link:
A coalition of 90-plus groups, including Fight for the Future and Mozilla, will descend upon Slack's offices in San Francisco and Denver on Wednesday to ask on the collaboration app to protect users' conversations via end-to-end encryption (E2EE).
The groups include digital and racial justice organizations, pro-abortion lobbyists, and security-focused businesses. Protestors will carry — and sometimes drive — mobile billboards and digital signs while wearing " [1]Make Slack Safe " tee-shirts.
According to the rally's organizers, in [2]post-Roe America , the communication app is not safe. And it won't be until Slack offers E2EE as well as blocking and reporting features to help protect users from harassment, they claim.
[3]
"Millions of people use Slack every day to do their work, volunteer, and connect with communities online — including abortion funds and reproductive rights groups that are being targeted by anti-abortion efforts," Caitlin Seeley George, Fight for the Future's campaigns and managing director, told The Register .
[4]
[5]
"And the company has shrugged off questions about offering end-to-end encryption in the past, saying they don't think their users want it," she added.
Last week, Fight for the Future organized an open [6]letter signed by the 90-plus organizations participating in the protest. The document urges Slack to implement these security and privacy features to prevent governments from using the service for evil.
[7]
"In the US and around the world, governments are using data and digital communications to target human rights defenders and people exposing human rights violations, including political nonprofits, activist networks, journalists," the letter states. "For many of these groups and individuals, Slack is an absolutely vital communication tool, but it could also become the basis of government targeting, repression, censorship."
These issues become especially pressing in the USA, as following the Supreme Court's reversal of Roe v Wade private communications can be used to [8]criminalize abortion seekers , Seeley George added.
"Every day that Slack fails to offer end-to-end encryption it puts abortion seekers, providers, and facilitators in danger, which is why we're making a major push to get the company to address this security issue and protect its users," she said.
Slack slacks back
Slack, for its part, says despite the lack of E2EE, "we take the privacy and confidentiality of our customer's data very seriously. Our policies, practices, and default settings are aligned with the business uses of our product," a spokesperson told The Register .
In an emailed statement, the spokesperson described Slack's policies thus:
"By default, Slack encrypts data at rest and data in transit for all of our customers. All our plans offer customizable retention settings, where customers can automatically delete messages and files after set periods of time. We also offer EKM (Enterprise Key Management), a security add-on for Slack Enterprise Grid that allows organizations to manage their own encryption keys using Amazon Key Management Service (KMS).
Slack will not share customer data with government entities or third parties unless we're legally obligated to do so – and we make it our practice to challenge any unclear, overbroad, or inappropriate requests.
We're always evaluating our security practices and the best options to protect data on Slack so that we meet our customers' needs and provide an excellent product experience."
Slack declined to answer specific questions about its plans — or lack thereof — to enable E2EE.
[9]Meta, Twitter, Apple, Google urged to up encryption game in post-Roe America
[10]International cops urge Meta not to implement secure encryption for all
[11]US bill to protect reproductive health data is dead. Here's why you should care anyway
[12]Google sued over 'interception' of abortion data on Planned Parenthood website
E2EE, when properly implemented, prevents anyone other than the parties to a private conversation from accessing its content. This includes the platform provider, which means that even if Slack were served with a subpoena to hand over messages, the content of these communications would remain encoded.
Fight for the Future and other digital privacy advocates have been beating this drum for years, and it's [13]become louder since the 2022 [14]Dobbs decision that the US Constitution does not include a right to abortion.
[15]
Some messaging platforms seem to be listening. Both [16]Apple and Meta have promised to provide more E2EE this year: Apple for most of its iCloud services globally (offer unlikely to apply in China,) and Meta has committed to default E2EE on both Messenger and Instagram — despite [17]strong objections from the FBI and other international law enforcement agencies.
Meta's WhatsApp platform, for the record, has long used E2EE by default. Signal always has.
Google has also [18]expanded its end-to-end encryption for Messages and [19]client-side encryption for some Gmail and Calendar users.
"A lot of these platforms are making progress," Seeley George said.
And then there's Slack. By name, and currently by choice, too. ®
Get our [20]Tech Resources
[1] https://www.makeslacksafe.com/
[2] https://www.theregister.com/2023/05/28/my_body_my_data_act/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZHbGVWz8aihX5Y3vemRZ1QAAAAk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZHbGVWz8aihX5Y3vemRZ1QAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZHbGVWz8aihX5Y3vemRZ1QAAAAk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.fightforthefuture.org/news/2023-05-23-make-slack-safe-letter
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZHbGVWz8aihX5Y3vemRZ1QAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2022/08/10/meta_abortion_charges/
[9] https://www.theregister.com/2022/09/20/encryption_abortion_data/
[10] https://www.theregister.com/2023/04/21/meta_encryption_police/
[11] https://www.theregister.com/2023/05/28/my_body_my_data_act/
[12] https://www.theregister.com/2023/05/16/google_abortion_tracking_suit/
[13] https://www.theregister.com/2022/09/20/encryption_abortion_data/
[14] https://www.theregister.com/2022/06/24/big_tech_post_roe_wade
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZHbGVWz8aihX5Y3vemRZ1QAAAAk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://www.theregister.com/2022/12/08/apple_encryption_icloud/
[17] https://www.theregister.com/2023/04/21/meta_encryption_police/
[18] https://support.google.com/messages/answer/10262381?hl=en
[19] https://www.theregister.com/2023/03/01/google_client_side_encryption/
[20] https://whitepapers.theregister.com/
The groups include digital and racial justice organizations, pro-abortion lobbyists, and security-focused businesses. Protestors will carry — and sometimes drive — mobile billboards and digital signs while wearing " [1]Make Slack Safe " tee-shirts.
According to the rally's organizers, in [2]post-Roe America , the communication app is not safe. And it won't be until Slack offers E2EE as well as blocking and reporting features to help protect users from harassment, they claim.
[3]
"Millions of people use Slack every day to do their work, volunteer, and connect with communities online — including abortion funds and reproductive rights groups that are being targeted by anti-abortion efforts," Caitlin Seeley George, Fight for the Future's campaigns and managing director, told The Register .
[4]
[5]
"And the company has shrugged off questions about offering end-to-end encryption in the past, saying they don't think their users want it," she added.
Last week, Fight for the Future organized an open [6]letter signed by the 90-plus organizations participating in the protest. The document urges Slack to implement these security and privacy features to prevent governments from using the service for evil.
[7]
"In the US and around the world, governments are using data and digital communications to target human rights defenders and people exposing human rights violations, including political nonprofits, activist networks, journalists," the letter states. "For many of these groups and individuals, Slack is an absolutely vital communication tool, but it could also become the basis of government targeting, repression, censorship."
These issues become especially pressing in the USA, as following the Supreme Court's reversal of Roe v Wade private communications can be used to [8]criminalize abortion seekers , Seeley George added.
"Every day that Slack fails to offer end-to-end encryption it puts abortion seekers, providers, and facilitators in danger, which is why we're making a major push to get the company to address this security issue and protect its users," she said.
Slack slacks back
Slack, for its part, says despite the lack of E2EE, "we take the privacy and confidentiality of our customer's data very seriously. Our policies, practices, and default settings are aligned with the business uses of our product," a spokesperson told The Register .
In an emailed statement, the spokesperson described Slack's policies thus:
"By default, Slack encrypts data at rest and data in transit for all of our customers. All our plans offer customizable retention settings, where customers can automatically delete messages and files after set periods of time. We also offer EKM (Enterprise Key Management), a security add-on for Slack Enterprise Grid that allows organizations to manage their own encryption keys using Amazon Key Management Service (KMS).
Slack will not share customer data with government entities or third parties unless we're legally obligated to do so – and we make it our practice to challenge any unclear, overbroad, or inappropriate requests.
We're always evaluating our security practices and the best options to protect data on Slack so that we meet our customers' needs and provide an excellent product experience."
Slack declined to answer specific questions about its plans — or lack thereof — to enable E2EE.
[9]Meta, Twitter, Apple, Google urged to up encryption game in post-Roe America
[10]International cops urge Meta not to implement secure encryption for all
[11]US bill to protect reproductive health data is dead. Here's why you should care anyway
[12]Google sued over 'interception' of abortion data on Planned Parenthood website
E2EE, when properly implemented, prevents anyone other than the parties to a private conversation from accessing its content. This includes the platform provider, which means that even if Slack were served with a subpoena to hand over messages, the content of these communications would remain encoded.
Fight for the Future and other digital privacy advocates have been beating this drum for years, and it's [13]become louder since the 2022 [14]Dobbs decision that the US Constitution does not include a right to abortion.
[15]
Some messaging platforms seem to be listening. Both [16]Apple and Meta have promised to provide more E2EE this year: Apple for most of its iCloud services globally (offer unlikely to apply in China,) and Meta has committed to default E2EE on both Messenger and Instagram — despite [17]strong objections from the FBI and other international law enforcement agencies.
Meta's WhatsApp platform, for the record, has long used E2EE by default. Signal always has.
Google has also [18]expanded its end-to-end encryption for Messages and [19]client-side encryption for some Gmail and Calendar users.
"A lot of these platforms are making progress," Seeley George said.
And then there's Slack. By name, and currently by choice, too. ®
Get our [20]Tech Resources
[1] https://www.makeslacksafe.com/
[2] https://www.theregister.com/2023/05/28/my_body_my_data_act/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZHbGVWz8aihX5Y3vemRZ1QAAAAk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZHbGVWz8aihX5Y3vemRZ1QAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZHbGVWz8aihX5Y3vemRZ1QAAAAk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.fightforthefuture.org/news/2023-05-23-make-slack-safe-letter
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZHbGVWz8aihX5Y3vemRZ1QAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2022/08/10/meta_abortion_charges/
[9] https://www.theregister.com/2022/09/20/encryption_abortion_data/
[10] https://www.theregister.com/2023/04/21/meta_encryption_police/
[11] https://www.theregister.com/2023/05/28/my_body_my_data_act/
[12] https://www.theregister.com/2023/05/16/google_abortion_tracking_suit/
[13] https://www.theregister.com/2022/09/20/encryption_abortion_data/
[14] https://www.theregister.com/2022/06/24/big_tech_post_roe_wade
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZHbGVWz8aihX5Y3vemRZ1QAAAAk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://www.theregister.com/2022/12/08/apple_encryption_icloud/
[17] https://www.theregister.com/2023/04/21/meta_encryption_police/
[18] https://support.google.com/messages/answer/10262381?hl=en
[19] https://www.theregister.com/2023/03/01/google_client_side_encryption/
[20] https://whitepapers.theregister.com/
It's an enterprise chat app
Have the protestors considered that perhaps they've chosen the wrong platform? There are dozens of others that provide the things they want.
It's an enterprise chat app, designed and marketed to be used internally within enterprises. There's no ability to block users to prevent harassment, because that's what the HR department is meant to be for.