The wrong person in the channel

“Hi all, I don’t think I’m meant to be in here?”

That message arrived in one of our private Slack channels at 9:20 on a Wednesday morning a few weeks ago, from a freelance writer who was helping our marketing team with the website. The channel was the one our leadership team uses for difficult customer situations. At that moment it had about eleven months of history in it, including a renewal negotiation with one of our largest customers: their contract value, the discount we were and weren’t willing to give, and a few comments about their procurement team that were candid in the way people are when they think only four colleagues will read them.

I’ve been thinking about it again this week because of the story everyone’s passing around, about a journalist who was added to the wrong group chat by mistake and read along for days before anybody noticed. Ours was much smaller and much less dramatic, but the shape is identical, and I suspect most companies have a version of it they haven’t found out about yet.

How he got in

On the Tuesday afternoon our CFO wanted to bring someone from her team into the channel to help with the renewal numbers. She typed the first few letters of a first name into the add-people box, and Slack offered two matches with the same first name. One was her colleague. The other was the writer, who’d been in a lot of channels that week and was probably ranked higher for that reason. She picked the first one in the list, which was the writer. His profile photo was a cartoon, which didn’t help, and the guest badge next to his name is a small thing at the end of a line that you don’t look at when you’re in a hurry.

That shouldn’t have been possible in the first place, and that part was on us. He was a multi-channel guest, because marketing had him in three channels, and nothing in our setup stopped any full member adding him to any channel they were in, private channels included. Nobody had ever looked at that setting. When we set up guests a few years ago, we were thinking about who could invite a guest into the workspace, which was locked down to admins. We never thought about who could move one around once they were in.

Then nothing happened for nineteen hours. Nobody in the channel posted on Tuesday evening, so nobody saw the “joined” line. The writer had notifications off for channels he wasn’t actively working in, and he only noticed the next morning when he was scrolling his sidebar. To his credit, he said so straight away instead of quietly leaving.

The first hour

Our CFO removed him within a couple of minutes of his message. I called him, and he was decent about the whole thing. He said he’d seen the channel name and the last few messages, realized what it was, and posted. I believe him. I also know that “I didn’t scroll up” is exactly what anyone would say, honest or not, and that nobody can verify it.

That’s the thing I hadn’t appreciated before this. Slack doesn’t tell a workspace admin which messages someone has read. We could see when he was added and when he was removed. We couldn’t see whether he’d scrolled back through eleven months of history, or opened any of the files in it, which included a spreadsheet of renewal scenarios. The audit trail ends at the door.

So we treated it as if he’d read everything. His agency contract had a confidentiality clause, which our legal advisor reviewed, and he signed a short statement that he hadn’t kept or shared anything. Legal’s view was that nothing in the channel was personal data and nothing needed to be reported to anyone. Commercially, it was awkward, but it wasn’t a breach. The customer was never told, and I’m honestly still not sure that was the right call, since their name and their procurement team were the subject of most of the messages.

Guest settings, since

The changes were small and took an afternoon:

• Adding a guest to a channel now goes through an admin, the same as inviting one to the workspace. It’s an extra step for marketing, who use guests the most, and they’ve asked for an exception about once a week since. The answer is still no.
• Every guest account has an expiry date when it’s created, ninety days by default. The writer’s account would have expired anyway in about a month. We had four guests from projects that ended last year who were still active, which is the lesson of the ex-employee whose VPN account still worked in 2015, accounts outliving the reason for them, and I’m a little annoyed we had to learn it again for a different kind of account.
• The handful of private channels where we discuss customers, people or money now start with sensitive- in the name and have a line in their description that says so, so that the add-people dialog at least shows you where you are.
• Those channels also have a much shorter message retention than the rest of the workspace. Eleven months of history was nobody’s decision. It was just what accumulated.

None of these would have stopped someone picking the wrong person out of a list of two. They make it harder for the wrong person to be a guest, and they make it so that if it happens again there’s less to read.

What he saw

I think he probably saw the last screen of messages, posted, and that’s it. But I’m planning for “probably”, and if the renewal goes badly, a part of me will always wonder whether a spreadsheet got opened on a Tuesday night. The tools we use for the most sensitive conversations we have don’t keep the one record that would settle it, and I don’t know of a setting that changes that.