A Case Study – WhatsApp Records Capture

Jingwen Yang is Records Management Officer for the United Nations Framework Convention on Climate Change (UNFCCC) in Bonn, Germany

Digital technologies are radically transforming business practices in the workplace as organizations become more mobile and virtual. Led by the increased prevalence of smartphones and BYOD (Bring Your Own Device) in organizations, more and more employees are turning to consumer messaging apps to collaborate with their colleagues and customers. Although an organization can benefit from this adoption, this also generates a huge amount of unstructured data outside of the technical platform managed by the organization, creating new challenges in digital records management, information security and information privacy protection.

Among a diverse landscape of messaging apps, WhatsApp stands out as one of the most popular: in 2018, WhatsApp reported more than 450 million daily active users, and it has been downloaded and installed by over 1.2 billion people worldwide. WhatsApp provides fast, simple, and secure services at no cost, allowing users to send text messages, voice messages, pictures, documents and other files as well as place voice calls and video calls to other WhatsApp users, all for free. It is expected that the unstructured data generated by WhatsApp alone will double in volume within the next 4 years.

Though useful for private communications, WhatsApp is also being used by employees, and by even some organizations for business related communications. Part of WhatsApp’s popularity may be attributed to its meticulous design; it delivers an intuitive user experience where things “just work.” Users are able to send messages and manage complex communications with speed and ease. When integrated into the workplace, WhatsApp can enhance employee productivity.

However, it also brings many challenges to records management professionals to manage information residing in the application and to meet compliance requirements, for it is not designed with compliance in mind. It takes time before a recordkeeping solution vendor can catch up with the fast development of technologies and make a proper solution available in the market to manage WhatsApp records.

For most users, their concern is probably how to make the best use of technical tools to support their business efficiency and effectiveness. They are less concerned about the compliance issues and risks the use of the application might bring. They may focus on achieving their goals on behalf of the organization, but they may not be aware that in the process of doing so, they risk compromising the recordkeeping, accountability and sensitive information protection of their organization that may bring irreversible reputational damage to the organization.

The experience shared here is based on testing a pilot with a selected user of WhatsApp. Working closely with the ICT department to identify a solution to manage WhatsApp records, we conducted market research to look for a readily available technical solution. Unfortunately, we were unable to find any suitable products. The most challenging issues are related to managing WhatsApp chat records and contact information without compromising sensitive and private information, especially during the process of transferring data from smartphones to a centralized recordkeeping system. Hence, we decided to develop our own process for secured records capture and manage it in our electronic recordkeeping system.

Records Management Considerations for WhatsApp Data Processing

In this project, what we found the most critical and challenging were the following: risks in compliance, capturing the chat messages from WhatsApp to the recordkeeping system, maintaining content and contextual information, and making the records understandable and useful. Below are some experience gained in the pilot testing which we would like to share with you in the hopes that it will help you avoid some of the pitfalls we encountered:

1. Develop policy and procedures

Careful consideration shall be exercised when utilizing the WhatsApp for business purposes due to its lack of recordkeeping features and the risks it may bring to the organization. It is important to develop a policy to guide the employees on its application to ensure consistency and information security within your organisation. The policy shall cover the following elements:

• Describe the scope of official use of the application
• Define the records appraisal criteria
• Outline the process for capturing records in the recordkeeping system
• Define the roles and responsibilities in managing the chat messages and records
• Emphasize the importance to pay special attention to the security and privacy of information on mobile devices

2. Configure the recordkeeping system and transitory storage

To allow the consistent and coherent management of WhatsApp records throughout their lifecycle, it is necessary to conduct an analysis of the business functions and activities WhatsApp chats or group chats are associated with, to classify the information sensitivity level of each, and to set security access rights accordingly. The information obtained from the business unit will enable the proper configuration of transitory storage and recordkeeping system to accommodate and manage the records.

3. Appraise the content in the WhatsApp Chats

Not all chat messages have records value. The review and assessment shall be carried out to determine the value of messages based on the information contained in the text message and the context in which it was sent or received in accordance with to the organization’s records management policy. Delete messages irrelevant to official business or the ones which are informal, transitory or have trivial value.  Records that have administrative, financial, legal, information value or historic value shall be identified for export. The content appraisal could be done either on the smartphone before exporting messages, or in the transitory storage once WhatsApp chats have been transferred there.

4. Install the organization’s data storage system on the smartphone

WhatsApp chats can be transferred seamlessly from the smartphone to the organization’s recordkeeping system by integrating with the smartphone app. Install the organization’s data storage and sharing system on the smartphone, such as Microsoft One Drive, configure the security access controls on the storage according to predefined rules from WhatsApp recordkeeping requirements and export WhatsApp chats related to official business to storage.

5. Export chat contents

Capture the WhatsApp chat messages by exporting WhatsApp chat history on smartphones with media into the data storage and applying a consistent naming convention. The export of chat messages should be performed on regular basis and the old content may be deleted from the mobile device, if necessary, to save the storage space.

Organize files, conduct records appraisal to determine the messages with continuing value and delete the ones irrelevant to official business or the ones which have trivial value if necessary. Further transfer records to the recordkeeping system.

6. Capture participant contact information

Chat history records would not be complete or meaningful without identity information on the sender of the text message. It is important to compile and maintain a comprehensive and up-to-date contact information of all participants of WhatsApp chats and store in the recordkeeping system, linking to the chat records, to preserve the contextual information of the records.

7. Export chat group member information

While chat messages are shared within the group, information about all members in the group must be captured alongside the chat records, to complete the record about who are the recipients of the information, even if they are not actively participating in the chat.

In summary, contemporary consumer messaging applications are increasingly being used by organizations and employees as communication tools. The records management professional shall not only advocate the recordkeeping compliance requirements and risks, but also to engage in developing processes and devising solutions to integrate the application into the organization’s recordkeeping system. This is to ensure the management of the organization’s key information assets of discussions, deliberations and decision making on mobile devices to the best it can, while waiting for the availability of a mature recordkeeping tool. The records management professional shall take pro-active actions to support the organization to harness the information from the application, to mitigate as much risks as possible and to achieve the organization’s overall objectives.