Slack attack

How a start-up got companies like Apple, Amazon and Google to trust it with their office secrets

CREDIT: Illustration by Slack, Fusion

It was Anne Toth’s first week at Slack, and she already had a crisis on her hands. “TeamNameGate,” she now calls the episode.

Last October, a blogger pointed out that Slack, a workplace chat platform that is popular with companies from Google to Nordstroms, was bleeding potentially sensitive information. Entering an e-mail address with a company’s domain into the Slack welcome screen showed the names of all of the company’s “teams,” which in some cases reflected what their employees were working on. It included boring, obvious stuff like “Corporate Revenue Group” but also, potentially, secret projects or unannounced acquisitions. Google’s Slack group, for example, contained a room devoted to Tribe Wearables, a small start-up making tech-embedded clothes that track activity. “Does that mean they acquired this company?” asked tech gossip blog Valleywag.

Toth, who had worked on privacy and user trust at Yahoo for 13 years and headed privacy for Google+, had been hired to help Slack avoid privacy mistakes or smooth things over if they were made. Start-ups of Slack’s size, with just 97 employees, usually outsource such things to an outside law firm, but Slack decided it needed a full-time privacy pro.

The stakes are high, after all. In less than a year, Slack has become the caretaker of workplace conversations of huge companies, media organizations, and non-profits. Now valued at over a billion dollars, Slack has convinced 365,000 people to start using its platform for workplace chatter, moving their discussions of gripes, mistakes, industry gossip, future plans, and confidential data out of their e-mail accounts and into Slack’s cloud. Imagine the secrets of BuzzFeed, Apple, Amazon, Uber, Gawker, HBO and the Wall Street Journal all spilling into public view tomorrow. (Not to mention Fusion’s—we use Slack, too.) Slack’s privacy and security team is responsible for making sure all these companies don’t find out how Sony Pictures feels.

Anne Toth, at the Slack office

Anne Toth, at the Slack office

Slack said the team name exposure was a feature—making it easier for a new user to sign up—not a bug, but the company quickly changed it. “Before I could finish a blog post about it,” said Toth. “An engineer had already fixed it. The nice thing about being at a company Slack’s size is how nimble it is.”

Slack is an awesome workplace collaboration tool. It has experienced rapid growth in its first year because its ease-of-use is addictive, and because chatting with colleagues in groups in real time is so much better and less overwhelming than the oppressive onslaught of e-mail. But as Slack lures employees away from email—which companies often host on their own servers—their sensitive, confidential data is resting instead in the Slack cloud.

The summer before Toth was hired, Slack decided to analyze the messages in that cloud for a frivolous reason. It wanted to see how often its hundreds of thousands of users were using emoji, and which ones they were using. It found emoji had been used over 16 million times by Slack users, and that the least-loved emoji was a plain white square (◽️), which appeared in workplace conversations just 35 times. Slack tweeted about it:

In November, during the height of the craze over the true crime podcast “Serial,” Slack considered doing another customer data dive to reveal the number of teams that had created a dedicated channel for “Did Adnan do it or not?” discussions. But Slack decided against it.

“We didn’t want to set a precedent or make people feel icky about our scanning their messages,” says Slack CEO Stewart Butterfield. Slack doesn’t even scan for uploads of copyrighted material or child porn, despite the fact that many communication platforms such as Google and Facebook do. Toth says that pro-active screening of content is “tricky, costly and controversial.” “We’re not planning on any kind of message review,” says Butterfield. “We don’t want to be in the business of reading people’s messages.”

“We don’t want to be in the business of reading people’s messages.”

While Slack doesn’t read customers’ messages, it does monitor their activity. For example, one customer had a Slack room filling up with a million messages daily. The customer had set up an auto-import of certain tweets. “The storage space they were using cost more than they were paying us, so we asked them to disable it,” says Butterfield. Sometimes that monitoring can benefit customers; Slack issued more than a million dollars in refunds last year for users who went inactive for two or more weeks.

Slack is well aware that its continued growth is dependent on hackers and snoopers not getting access to its customers’ chatter. Messages sent via Slack are encrypted in transit. The company has regular security audits and gives bounties to white-hat hackers who find vulnerabilities in the product. (So far, those hackers have mostly found ways that a malicious member of a customer’s team could get access to colleagues’ messages he’s not supposed to be able to see.) Butterfield promises that two-factor authentication — where log-in requires both a password and a code sent to a user’s phone — is in the pipeline, though the company doesn’t have a delivery date yet. Slack itself, like some of its customers, now forces its employees to sign into Slack with Google ‘Single Sign-on,’ which does have two-factor authentication. The company hasn’t had a major security crisis yet. “The primary security concern from customers is that a 15-year-old contractor set up their Slack account and now they need to change ownership,” Toth says.

Slack also has controls to protect customers from its own employees—a concern made painfully evident last year by the uproar over an Uber employee looking at a journalist’s ride history. A tiered access system means that a small number of employees are able to access the message database. Most employees have access only to a tool that shows user names, names of teams and names of channels. Any engineer who wants to deploy new code—code that could effect the privacy of a particular account for example—needs to get sign-off from someone else on the team. “When employees do access customer information, everything is logged and audited,” says Butterfield. Toth adds: “It’s a combination of technical limitations and policy restrictions. All the big companies ask the same security questions. We’re getting pretty good at answering them.”

Slack’s economic model has a privacy downside for those not paying for the product. Only paying customers have access to their archives and the ability to delete old conversations. Non-paying users (who make up the majority using Slack) only have access to their last 10,000 messages. All the messages over that count are archived by Slack, but exist in an inaccessible limbo. To delete an old message, a non-paying team on Slack would need to fork over a credit card or close — and delete — their entire account. It’s confusing, so Slack set up a “Team Settings” page that any user can check to see what happens to their messages. “It’s hard for people to keep all this privacy nuance clear in their minds so we wanted to lay it out very clearly,” says Butterfield.

Slack has a "pay for privacy" model

Slack has a “pay for privacy” model

Ironically, given that she was a privacy hire, Toth’s biggest project since joining Slack has been to prepare users for a less-private version of Slack. Historically, those who started a private channel or had a one-on-one conversation to bitch about their workplace, and co-workers didn’t have to worry about their colleagues—or the boss—reading what they’d written. Administrators of a Slack account couldn’t read private messages or access messages in channels they didn’t belong to. “We use Slack ourselves,” says Butterfield. “We always had the expectation we could send messages that other people couldn’t see. I wanted to be able to talk to a co-founder without another co-founder seeing it.”

Now, though, premium users have the ability to export all of the messages from an account, including messages that were edited or deleted. Some of Slack’s potential customers—such as banks—needed this power for compliance and regulatory reasons. “We had to overhaul the privacy and security policies because we were offering features that were inconsistent with the terms in place,” says Toth. “Private conversations that weren’t accessible needed to be stored by some companies. You’re taking something that was a right of a user and diluting it. We wanted to be really upfront and clear about that.”

The move wasn’t popular with bloggers, inspiring headlines like, “Slack alters privacy policy to let bosses read your messages.” “I didn’t like that it led to headlines like that,” said Butterfield. It will not apply retroactively, he points out, or allow for real-time monitoring, and the Slackbot—a programmable virtual assistant available to everyone on the platform—will tell users if their administrator has enabled the feature. “We want employees to be aware that ‘compliance export’ is on so we will warn them,” says Toth. “Slack is a water cooler. We want them to know who’s at the cooler.”

“Slack is a water cooler. We want them to know who’s at the cooler.”

Toth’s career in privacy started as a fluke. When Yahoo first got into the webmail business in the late 90s, it hired Toth — who had experience in economic research — as a data miner. But in 1998, the year she started, regulators started flipping out about tech companies’ data collection — such as online games asking kids mid-play what their family’s worth was — so Yahoo’s general counsel asked her instead to look at what the company wasn’t allowed to do with the data. She wound up managing privacy and user trust at Yahoo. “I didn’t expect it would be my job for the rest of my career,” she says.

She and Butterfield first worked together in 2005 when Yahoo bought his Canada-based company Flickr and needed to migrate all of its data into the U.S. “It was kind of a big deal because Canadians were (rightfully) concerned about the US government poking through their photos ,” says Toth. She left Yahoo in 2011 to join Google to manage privacy at Plus, a social network with elaborate privacy controls, but stayed for only a year. “I needed to leave to take care of my mother,” she says. She began consulting with start-ups. “Usually, companies would come to me when something horrible had happened and they were in a world of pain,” she says. After she saw the Wired profile of Butterfield last summer that talked about how fast Slack was growing, she reached out to let him know she was available if they wanted a privacy consultant before a crisis hit. “He surprised me by saying, ‘Come work for me full-time,'” says Toth. “He wanted me to create a culture of awareness of privacy and security.”

Toth makes sure she’s at the Slack water cooler every time colleagues talk about something that should concern her. She gets an alert anytime her colleagues use words like “privacy” or “policy” in Slack. “I pop into the channel and say hey,” she says. “It makes my job a lot easier.”

Even with reassurances that their data is safe in Slack’s hands, some customers have asked whether Slack would let them store the content of their accounts on their own servers, rather than on Slack’s cloud. “It’s possible that we’d do this in the future, but we have no specific plans at this point,” says Butterfield.

That issue hasn’t come to a head yet, because Slack hasn’t had an intruder break into its system yet nor fought a legal battle to protect what’s in its cloud. The company hasn’t received any government requests for data. “We know it’s likely to happen at some point,” says Toth. She says Slack’s plan is to notify clients if law enforcement asks for their messages—if there’s not a gag attached to the order—and let them handle the request.

As she packed up her belongings to head off to teach a spin class, Toth pointed to a black “come back with a warrant” sticker on her desk and laughed. “We’re ready.”