Do text messages disappear? Only sort of

BY TOM HENDERSON

CRAIN’S DETROIT BUSINESS

Download the Crain's Detroit Business article (PDF)

Don’t send any text messages or e-mails you don’t want to see in the newspaper was a lesson Detroit Mayor Kwame Kilpatrick learned last week, and one repeated by area attorneys and business consultants.

“I advise everyone and practice it absolutely. I don’t send anything I don’t want public,” said Mark Malven, leader of the technology transaction practice in the Bloomfield Hills office of Dykema Gossett P.L.L.C. “I don’t put anything sensitive into an email or a text message that I wouldn’t want to see in the newspaper. Executives have come crashing to the ground. Companies get ruined.”

Service providers say they erase text messages from their servers — AT&T deletes messages after 72 hours, according to spokesperson Howard Riefs, and others do so in times ranging up to two weeks — but you shouldn’t rely on that, say industry professionals.

“Though officially deleted by official policy, my suspicion is that they archive them longer than public communication dictates, and legislation on e-discovery is making it easier and easier for these types of communications to be used in civil and criminal proceedings,” said Steve Barone, CEO of Creative Breakthroughs in Troy, an IT staffing, consulting and managed-services firm and the No. 1 provider of Symantec services in the Midwest.

“Don’t rely on word the messages are gone,” said Malven. “Providers want people to keep using it (text messaging) and not be worried. They may delete it on the server, but backups may be out there.”

“Service providers back up constantly, as a matter of course. Just assume it will be stored somewhere and accessible either intentionally or by accident,” said Jose Nazario, a senior security researcher in the Ann Arbor office of Massachusetts-based Arbor Networks Inc., which provides Internet security by monitoring Web sites for assaults by hackers and helping fight them.

Even if private text messages are deleted, companies and governments may have contracts with communications providers spelling out retention policies that require much longer storage, which was the case with the city of Detroit’s contract with Mississippi-based SkyTel, whose BlackBerry-like SkyWriter was the tool of choice for the mayor and his chief of staff, Christine Beatty.

Kilpatrick and Beatty are public figures with fewer rights of privacy than most citizens. But once even private citizens start using company equipment in their communications — whether it’s e-mail from the office computer or text messages from the company cell phone or BlackBerry — expectations of privacy disappear. “There is no right of privacy then. An employer can do anything he wants,” said Malven, including monitoring e-mails and Internet use and getting copies of text messages.

In 2005, a survey by the American Management Association showed that three-fourths of employers monitor employees’ Web-site visits, and 65 percent use software to block connections to inappropriate sites. About half review and retain e-mail messages, and a third track keystrokes.

Henry Cendrowski, president of Bloomfield Hills-based Cendrowski Corporate Advisors L.L.C., which advises companies on technology issues and fraud avoidance, said text-message security remains an issue even after messages are deleted from the provider’s server. A text message sent by cell phone, for example, remains both in the phone’s memory card and the phone’s internal memory. Most people think pulling out the memory card protects their sensitive information, but it doesn’t.

Phone manuals describe the complicated reset commands to delete information from the internal memory, but that assumes people don’t lose their instruction manuals, know they need to delete sensitive information before they turn their phones in or recycle them, and are willing to take the time.

Federal authorities have prosecuted child molesters by getting search warrants to find text messages stored in phones after they were supposedly deleted.

Cendrowski said he advises clients to be particularly careful not to text message or use wireless e-mail to discuss such things as business intelligence or trade secrets. Savvy snoops with the right equipment within broadcast range can easily capture those messages.

Kilpatrick wasn’t just at risk from future lawsuits when he and Beatty traded messages about their dalliances, he was at risk from political enemies and potential blackmailers.

“Wireless, in particular, can be eavesdropped on. Anyone with the appropriate software can watch messages come and go into your phone, and malicious software can hijack your computer,” said Nazario. “The equipment is available off the shelf and the knowledge is out there.”

Tom Henderson: (313) 446-0337, thenderson@crain.com