Encrypted & Ephemeral Messaging: The eDiscovery Risk You’re Underestimating

It’s critical to understand the risks associated with encrypted and ephemeral messages. This is especially important, as communication is evolving faster than most organizations’ discovery and preservation strategies keep up with.

Business conversations no longer occur primarily through email, the system that traditionally served as the central record of corporate communication. Instead, employees increasingly rely on encrypted and ephemeral messaging platforms such as Slack, Microsoft Teams, WhatsApp, Signal, and text messaging to collaborate and make decisions in real time.

Many of these platforms now include end-to-end encryption and disappearing message features that automatically delete content after a set period. This can result in the erosion of discoverable evidence, even during litigation holds.

This shift is not marginal or experimental. It reflects a fundamental change in modern communication behavior across enterprises. In fact, 65-70% of large enterprises use some form of ephemeral messaging. As communication becomes more fragmented, mobile, and transient, traditional eDiscovery, legal hold, and preservation practices are becoming increasingly difficult to enforce effectively.

For legal, compliance, and investigative teams, this creates a growing challenge: critical business evidence may no longer exist in systems designed for long-term retention or defensible collection. In some cases, relevant communications may disappear before organizations even recognize a preservation obligation. The result is a rapidly widening gap between how organizations communicate and how they manage discovery risk.

These messages represent a significant shift in how business communication occurs, and organizations that fail to adapt their governance, preservation, and eDiscovery strategies risk losing visibility into critical evidence when it matters most.

Litigation Holds: The Shift Away from Traditional Communication

For decades, email served as the backbone of corporate communication. It was structured, archivable, and relatively easy to preserve and search during litigation. eDiscovery processes evolved around this predictability.

That paradigm has shifted. Modern communication is now:

• Decentralized across multiple platforms
• Informal and conversational in tone
• Real-time and continuous, rather than discrete
• Often mobile-first, occurring outside traditional I.T. infrastructure

More importantly, many of these platforms now prioritize privacy and control, giving users the ability to encrypt messages or set them to disappear automatically. While these features are valuable from a user perspective, they complicate an organization’s legal obligations.

Understanding Encrypted and Ephemeral Messaging

Encrypted messages

Encrypted messages are digital communications that are converted from readable text, also called plaintext, into scrambled, unreadable code, called ciphertext. This is done using cryptographic algorithms. Only authorized users with a specific digital key or password can decode and read them.

They protect sensitive data from interception by hackers, service providers, and authorities. Essentially, this messaging ensures that only two parties can read the content: the sender and recipient. This means that even the platform provider may not have access.

Encrypted data challenges legal teams because critical communications may be inaccessible, difficult to preserve, or impossible to collect and review during litigation, investigations, or regulatory requests.

Examples include:

• Signal, Threema, WhatsApp, Session, and Wire

Ephemeral messages

Ephemeral messaging is a form of digital communication (texts, images, or video) that automatically deletes messages after a defined period. This can sometimes be seconds after being read. They often feature end-to-end encryption and screenshot protection, leaving no permanent record of the conversation.

Examples include:

• WhatsApp, Signal, Telegram, Snapchat, and Wickr

The primary eDiscovery risk is the destruction of potentially relevant evidence before a legal hold can be implemented. Unlike traditional email systems, ephemeral platforms may leave little or no recoverable record once deletion occurs.

When combined, these features create a scenario where communications are both inaccessible and non-persistent.

Why Encrypted and Ephemeral Messages are an Issue for eDiscovery

Organizations have a legal duty to preserve relevant information when litigation is reasonably anticipated. This includes not only formal documents but also informal communications that may contain critical evidence.

Encrypted and ephemeral messaging can undermine this obligation in the following ways:

1. Data That No Longer Exists

If messages are set to auto-delete, they may be gone before a legal hold can be implemented. Unlike emails stored on servers, ephemeral messages may leave no recoverable trace.

2. Inaccessibility of Content

End-to-end encryption means that even if data is technically stored somewhere, it may not be accessible to the organization. Without access to message content, preservation becomes meaningless.

3. Shadow IT and BYOD Risks

Employees often use personal devices and unauthorized apps for work communication. This creates blind spots where sensitive or relevant data exists outside corporate oversight.

4. Inconsistent Retention Policies

Many organizations have robust email retention policies but lack equivalent controls for messaging platforms. This inconsistency can be a problem whether employees act deliberately or not.

5. Judicial and Regulatory Consequences

Courts and regulators are increasingly aware of these technologies. Failure to preserve relevant communications, whether due to negligence or inadequate policies, can result in sanctions, adverse inference instructions, or reputational damage.

Real-World Cases Concerning Encrypted and Ephemeral Messaging

There have been recent enforcement actions and court decisions that highlight the seriousness of this issue. Regulators have penalized organizations for failing to retain business-related communications conducted via messaging apps.

Courts have also shown little sympathy for organizations that fail to control their communication environments. The expectation is clear: if employees are using a platform for business purposes, the organization is responsible for ensuring that those communications are preserved and produced when required.

In 2024, the U.S. Securities and Exchange Commission (SEC) charged 26 broker-dealers and investment advisers for widespread failures to retain and preserve business-related electronic communications. Employees, including senior personnel, conducted firm business through personal devices and encrypted messaging applications such as WhatsApp, creating significant recordkeeping gaps and limiting regulators’ ability to conduct investigations. The firms collectively agreed to pay more than $390 million in penalties and implement enhanced compliance and monitoring controls.

The case underscores the growing legal and regulatory risks associated with encrypted and ephemeral messaging. While these platforms offer convenience and privacy, organizations remain responsible for preserving business communications when required by law or regulation. Regulators have made clear that the inability to capture and retain messages does not excuse compliance failures. This includes whether it is due to encryption, auto-deletion settings, or use of unauthorized channels. The SEC's actions demonstrate how inadequate governance of modern communication tools can lead to substantial financial penalties, reputational damage, and increased regulatory scrutiny.

Courts have also increasingly focused on spoliation risks tied to disappearing communications, also known as ephemeral messaging. In Herzig v. Arkansas Foundation for Medical Care, the court examined the use of Signal’s disappearing-message functionality during discovery, reinforcing judicial concerns around the intentional loss of potentially relevant evidence.

The message from regulators and courts is becoming increasingly geared towards the preservation of data on communications platforms. If employees use a communication platform for business purposes, organizations are expected to maintain reasonable preservation and oversight capabilities.

The False Sense of Security

One of the biggest misconceptions is that encryption and ephemeral messaging reduce risk. From a cybersecurity perspective, they may indeed protect against data breaches. But from a legal and compliance standpoint, they can significantly increase exposure.

Organizations may assume that if data is deleted, it cannot be used against them. In reality, the absence of data can be just as damaging as its presence. Courts may interpret missing communications as evidence of spoliation, especially if there is reason to believe that relevant information once existed.

Mitigating the Risk

Despite these misconceptions and potential issues, organizations are not powerless. With the right strategy, policies, and technology, the risks associated with encrypted and ephemeral messaging can be managed effectively.

The following presents vital ways to reduce the risks associated with encrypted and ephemeral messaging:

1. Configure Retention Before Issues Arise

Many organizations discover too late that disappearing message settings were enabled by default or activated at the user level. Legal and IT teams should proactively disable disappearing message functionality where business communications occur, restrict the use of consumer-grade applications that lack administrative retention controls, and configure enterprise retention policies within platforms such as Microsoft Teams and Slack before disputes arise. Once messages are deleted from certain platforms, recovery may be impossible.

2. Preserve Data at the Device Level When Necessary

In some matters, relevant communications may exist only on employee mobile devices. Organizations should establish clear procedures for rapid device identification, mobile forensic preservation, BYOD consent management, and escalation when custodians use unauthorized applications. Waiting until formal discovery begins may result in permanent evidence loss.

3. Align Legal Holds with Modern Communication Channels

Traditional legal hold processes often focus heavily on email and shared drives while overlooking messaging applications. Legal hold notices should explicitly address modern communication methods, including:

• Text messages
• WhatsApp and Signal communications
• Collaboration platforms
• Personal-device business communications
• Auto-delete settings

Custodians should also be instructed to suspend deletion functions immediately upon notice.

4. Identify Shadow Messaging Early in Investigations

Another challenge in modern matters is determining where conversations actually occurred. Investigation teams should assess messaging usage during initial custodian interviews rather than months later during discovery disputes. This includes identifying which platforms were used, whether personal devices were involved, whether disappearing-message settings were enabled, and whether communications shifted between multiple applications over time.

5. Build Cross-Functional Response Procedures

Encrypted and ephemeral messaging issues often escalate quickly because ownership is fragmented across legal, compliance, security, and IT teams. Organizations should establish predefined workflows for preserving messaging data, engaging forensic experts, coordinating with platform administrators, responding to regulator requests, and managing cross-border privacy considerations. In many matters, the speed of response directly determines whether relevant evidence still exists.

The Role of Evolving Technology Now and in the Future

There are technologies that address some of these challenges. Modern eDiscovery tools and compliance solutions can now collect and preserve data from a wider range of communication platforms, including collaboration tools and messaging apps. Solutions can integrate directly with platforms enabling organizations to capture messages, attachments, and associated metadata in near real time before any content is altered or deleted. Through direct integrations, journaling capabilities, and application programming interfaces (APIs), technologies can capture messages, attachments, edits, reactions, and associated metadata before content is altered or deleted.

Advances in artificial intelligence are also helping legal and compliance teams manage growing volumes of communication data. AI-powered tools can assist with identifying potentially relevant conversations, detecting patterns and anomalies, and accelerating the review process during investigations and discovery. Enhanced analytics and centralized archiving capabilities can further improve visibility into communications that historically have been difficult to preserve and monitor. However, technology alone is not a silver bullet. Without clear policies and governance, even the most advanced tools will fall short. Organizations must establish clear expectations regarding the use of messaging applications, retention requirements, and preservation obligations.

As communication technologies continue to evolve, so will the associated risks. Features like disappearing messages and end-to-end encryption are likely to become more prevalent, not less.

Regulators and courts will continue to adapt, raising expectations for how organizations manage and preserve digital communications. Companies that fail to keep pace may find themselves at a significant disadvantage. But the organizations that proactively invest in both technology and governance will be better positioned to meet these evolving demands and reduce legal, regulatory, and compliance risks.

Operational Realities in Modern eDiscovery

Consilio increasingly sees matters where relevant business communications are dispersed across collaboration platforms, mobile devices, encrypted messaging applications, and personal communication channels, each with different retention settings and preservation limitations. In many investigations and litigation matters, the primary challenge is no longer collecting and reviewing data, but determining whether relevant communications still exist and how quickly they can be preserved before auto-delete settings, device turnover, or user-controlled deletion remove them permanently.

In practice, organizations are often unaware of the extent to which employees rely on encrypted or ephemeral messaging tools for business communications until preservation obligations have already attached. By that stage, key communications may already have been deleted through disappearing-message settings, unsupported retention configurations, or the use of unauthorized applications outside standard governance controls. These issues are particularly complex in large-scale or cross-border matters involving multiple platforms, personal devices, and decentralized data environments.

As a result, early communication-source assessment has become a critical part of modern discovery and investigative workflows. Consilio frequently works with clients to identify which platforms custodians used, assess retention and export capabilities, coordinate mobile and cloud-based preservation efforts, and address governance gaps tied to unmanaged messaging applications. These matters often require close coordination across legal, forensic, compliance, cybersecurity, and IT teams to preserve potentially relevant evidence in a defensible manner before additional data is lost.

Managing Encrypted and Ephemeral Messaging for eDiscovery

Encrypted and ephemeral messaging represents one of the most significant and underappreciated risks in modern eDiscovery. What makes it particularly dangerous is its invisibility: organizations may not even realize the extent of their exposure until it is too late.

The key is proactive management. By recognizing the risks, setting strong policies, and using appropriate technology, organizations can strike a balance between enabling modern communication and fulfilling their legal obligations.

Organizations should not question whether their employees are using these tools, as they almost certainly are. The real question is whether organizations are prepared to deal with the consequences.

Care to learn more on this topic? Check out our Consilio Advanced Learning Institute (CALI) webinar: Messaging Challenges: Encrypted, Ephemeral, and Everywhere.

‍