LOCALIZE IT: Government transparency is eroding with increased use of encrypted messaging apps
By REBECCA BOONE and CLAUDIA LAUER
Associated Press
EDITORS/NEWS DIRECTORS:
Public officials and private citizens are consistently warned about hacking and data-leaks, and messaging apps that use end-to-end encryption are one popular way to reduce those risks.
But those privacy-increasing technologies are also decreasing government transparency. That’s because messaging apps like Signal, Confide, WhatsApp, Telegram and others use encryption to scramble messages so that only the intended end-user can read them, and they typically aren’t stored on government servers. Some automatically delete messages, and some prevent users from taking screenshots or sharing messages.
If public servants or elected officials use the apps to discuss contracts, policies or other government work, they essentially lock what should be public information behind closed doors.
It’s hard to know how often they are used because without special archiving software the messages often aren’t returned under public information requests. But improper use of the apps have been leaked or reported over the last decade in places like Missouri, New Mexico, Michigan, Utah, Oregon, California, Oklahoma, Kentucky, Arizona, Texas and Maryland.
An Associated Press review in all 50 states found accounts on encrypted platforms registered to cellphone numbers for more than 1,100 government workers and elected officials. The accounts included officials at the state, local and federal levels of government, including legislators and their staff, but also staff for governors, state attorneys general, education departments and school board members.
The AP is not naming the officials because having an account is not against the rules in most states, nor is it proof that they are using the apps for government business. While many of those accounts were registered to government cellphone numbers, some were registered to personal numbers. The AP’s list is likely incomplete because users can make accounts unsearchable.
Some experts say that while some cities and states are grappling with how to stay transparent, public record laws aren’t evolving as quickly as technology. They say such laws need to be more clear and robust.
Here are some resources for reporting on the issue in your area.
___
READ AP’S STORY
Encrypted messaging apps promise privacy. Government transparency is often the price
___
DO PUBLIC RECORD LAWS IN YOUR STATE ADDRESS USE OF THESE APPS?
Public record laws vary widely from state to state, and they generally aren’t changed frequently enough to keep up with evolving technology. Very few states have laws that specifically mention digital or encrypted communications.
Still, most state laws make it clear that it’s the content of the message — not the manner in which it is conveyed — that determines whether something is a public method, says David Cuillier, director of the Brechner Freedom of Information Project at the University of Florida.
Some ways to add local context:
— Take a look at the laws in your state and see if they specifically address whether public officials are allowed to use encrypted messaging apps, whether those messages must be archived, and whether there is any mechanism for punishing violations of the law.
— You also might want to look into when your public record laws were last updated to get a sense of what kind of technology people were most commonly using at that time. While end-to-end encryption technology has been around for decades, the use of such apps became popular for the general public around 2010.
— Ask the people tasked with responding to your public records requests whether they routinely check text messages, encrypted or not, for responsive records.
— Ask state or local procurement officers if they have contracts with archiving services, or if they have consulted with companies that archive digital messages.
— Ask information technology departments if public employees or officials are asked to sign agreements when they are issued state-owned electronic devices. If so, see if those agreements include any prohibitions against downloading or using encrypted messaging apps, or any clarification of how such apps should be used.
— Find out if your state or local governments have cybersecurity departments or agencies. If so, find out if they have developed any guidance or rules about when or when not to use end-to-end encrypted messaging.
___
ESTIMATE THE NUMBER OF PUBLIC WORKERS WITH ENCRYPTED MESSAGING APP ACCOUNTS
The AP found more than 1,100 public workers and officials by asking AP statehouse reporters to run their own contact lists through apps like Signal, Confide and WhatsApp to see which sources already had accounts.
The easiest way to do this is to download the app to your work phone, and then give it access to your existing contact list. Then open the app and scan the contact list to see which names and numbers show up. For instance, if someone in your phone contact list already has an account in Signal, their name or phone number will show up as an option when you select the “draft chat” icon in the app.
The apps also often give the option of “inviting friends” or contacts to join the application. AP did not do this, because the goal was to find out who already had an existing account, not to entice more users to the apps.
For a more comprehensive check, you could file a public record request for all government-paid-for mobile phone numbers at a specific government department or entity, and check those numbers for any accounts on encrypted messaging apps. You could also ask the relevant information technology division if there is a way to see how many government-issued phones have specific apps on them.
It’s important to note a couple of things: Many of these apps give users the option to hide from searches, so people who have apps may not show up as having accounts even if they are in your phone’s contact list. Also, there is nothing illegal about having an account on an encrypted messaging service, and having one can even be a valuable tool for increasing personal security.
Simply having an account does not mean that officials or government employees are using the apps to skirt transparency laws — it only means the possibility exists.
___
NEXT STEPS: PUBLIC RECORD REQUESTS AND INTERVIEWS
If you identify groups of people with accounts who normally work closely in the course of their government roles, you might decide to file a public record request specifically seeking any communication on that platform.
If the request results in copies of their communications, you can deduce that they are using the messaging app for government work and also that they are archiving or saving the messages in some form to comply with public record laws. You might decide to interview them about when they started thinking about how to handle use of the messaging apps within their government entity, and whether they ran into any challenges when figuring out how to keep the records.
If the public record request results in no records, you might interview the subjects to ask whether they ever use the apps for work, and if so, if they have thought about how to archive those records for compliance with public records laws.
You could also ask for any policies at government entities that address digital communications including encrypted messaging apps, as well as any policies on how long employees and officials are expected to retain digital and encrypted records. Even if your state public record law does not address archive and retention rules, individual government organizations might have their own policies detailing expectations.
___
OTHER RESOURCES
There are lots of organizations dedicated to advocating for government transparency and local records. They can often help connect you with experts or may provide templates for creating your own public record requests.
The National Freedom of Information Coalition is a nonpartisan coalition of state and regional affiliates in 39 states, commonwealths, territories and districts. Local, regional and state press clubs can also be a great resource for understanding the local public records landscape. Among other things, the coalition contains sample letters for submitting records requests in each state.
The Reporters Committee for Freedom of the Press has an Open Government Guide that includes summaries of public records laws in each state, as well as a FOIA Wiki that covers the federal government.
The National Press Club Journalism Institute has many resources, including various trainings. Go to their homepage to view Sunshine Week trainings and posts for this year. As part of their Sunshine Week offerings last year, they hosted various free trainings, including The Appeals Process — Steps to take when your FOIA requests are denied, which is available to view.
___
Localize It is a reporting resource produced by The Associated Press for its customers’ use. Questions can be directed to Katie Oyan at koyan@ap.org.
