Companies were embracing the use of alternative communications platforms like Slack long before COVID-19, but the onset of the pandemic has made those tools even more central to day-to-day operations. Hanzo's "Internal Investigations in the Age of Collaboration and Remote Work" panel held Thursday delved into implications for corporate investigations and examined how corporate legal departments were adapting.

The good news is that the process of launching an investigation doesn't appear to have changed much from a process standpoint, however, Slack and other collaboration platforms have introduced significantly more surface area to cover. Whereas random groupings of employees may have once been using Slack of their own accord, some organizations are now formalizing the practice organization-wide.

Panelist Stacey Blaustein, counsel at IBM, indicated that the company rolled out the mandatory use of Slack in January 2020 as a way to supplement email. "Over the last few months that we've all been working remotely there's been a huge increase in these collaborative environments and the way people communicate and collaborate has shown tremendous expansion across the enterprise," Blaustein said.

She called the use of collaboration tools "business as usual" and it does seem like IBM and other companies have figured out ways to fold Slack and its ilk into their investigation process, even finding new opportunities to collect relevant data. Kimberly Quan, global head of e-discovery and digital forensics at Juniper Networks, said the company is focused on leveraging intelligence from the myriad tools it is already paying for and possibly detecting risky behavior before it becomes a problem.

For example, employees unaware that they may be exfiltrating data on Slack can be alerted and retrained. "I would say that has been a big catalyst lately in really trying to use the tools and technology to be the eyes and ears and put the intelligence together using AI or other applications of technology," Quan said.

Such intelligence can also prove useful during an investigation, with Slack potentially opening up some data points that can't be leveraged in email. For example, Slack has audit logs that can show who posted or deleted certain comments and at what time, which Blaustein noted is useful for piecing together context.

She recommended that investigators gather as much information as possible by cross-checking different data sources—if a Slack message was sent by laptop or phone, for instance—in an attempt to derive the author's intent.

"It's not just content, it's the actions you are looking for to create a story," she said.

Of course, some Slack messages are easier to make sense of than others. Kyle Kelly, senior e-discovery and litigation specialist at Coinbase, pointed to the difficulties that investigators face in trying to derive the meaning behind various Slack emojis in real time. "Does your metadata say that it's like a smiley face wink or does it say [somebody] is something that is not nice?" he said.