The hackers who broke into Sony Pictures' computer systems and leaked sensitive communications had one simple rule working in their favor. At most large companies, every email that gets sent is archived and stored forever. As personal and professional lives bleed together on our mobile devices, Sony executives intermingled nasty industry gossip and racist Obama jokes with the day-to-day conversations concerning actual work. Teens have already learned that ephemeral messaging can help avoid embarrassment. But is Snapchat for business a viable solution to corporations' privacy woes, or just a rush to cash in on a buzzy trend?
Confide, a New York startup, is one of several companies that believes there is a big opportunity to bring this new communication paradigm to the suit-and-tie set. The app, launched in December of 2013, lets users send screenshot-proof self-destructing messages. Today it’s announcing a new feature that allows you to share images and documents. "We built this to address the gap in today’s communications, to give adults a way to use email and texts messages that was safe and ephemeral." says CEO Jon Brod.
A crowded market for secure work chat
The new feature is a precursor to the launch of Confide’s enterprise version, which Brod says will arrive in the next few months. So far the service has been free, but with its business class, Confide hopes to charge an annual licensing fee. It’s not alone. Digify, which sells a similar self-destructing service, is planning to launch its enterprise version in the first half of this year. They join companies like Vaporstream, Tigertext, and Gryphn's ArmorText, all of which pitch themselves to professionals as secure alternatives to your typical chat app.
When users send text on Confide, the words are covered up like the redacted sections of a classified document. You swipe your finger across the screen to read the message a few words at a time. With documents and images, most of the message is blurred out, and you scroll up and down to see just a small section at once. On top of this visual obstacle, the app kicks out and reports users who try to screenshot a message, while also deleting that item from their inbox.
Confide says it never stores any user data on its servers. Instead it relies on end-to-end encryption, the same technique used by services like iMessage and WhatsApp. "How do we make sure the message is really gone?" asks Confide co-founder and CTO Howard Lerman. "The answer is you never have it in the first place." Confide messages that arrive on users' phones are briefly stored locally in flash memory and erased after they've been viewed. "I think of the cloud as a drunken copier machine spewing out replicas of your data," says Lerman. "And people don’t really have control over it."
"I think of the cloud as a drunken copier machine."
To employees, an app that deletes their questionable jokes may seem like an ideal solution. But for large corporations, there are legal concerns. "Most companies want to create a paper trail," says Chris Camejo, director of assessment for NTT Com Security. "Email doesn’t have to be permanent. From a security perspective, impermanent is better. But ephemeral is incompatible with the way most businesses want to operate."
Confide says that for now it's targeting industries which aren’t heavily regulated. By sticking with tech, media, and sports, it can avoid any issues around data retention. Other apps, like ArmorText and TigerText, work with companies in the worlds of finance, health care, and government. They delete messages from your mobile device, but archive an encrypted audit trail for a number of years to ensure companies don’t violate any laws.
Digify, a startup headquartered in Redwood City, California, says clients are often looking to send blueprints, designs, and other intellectual property that is not yet public. "What our users want is control," says founder and CEO Augustine Lim. "Traditionally when you send stuff to someone, the receiving party can do what they like. With our service the sender can lend out files for a limited amount of time."
"I’m worried companies like this are making promises that are impossible to keep."
But as NTT’s Camejo points out, no matter how good your technology is, there are still simple, low-tech loopholes. "What is stopping someone from recording a video of their screen as they scroll through a message or document?" Camejo asks. "I’m worried companies like this are making promises that are impossible to keep."
Lim acknowledges that no digital communication is truly safe from being recorded and shared. While his service prevents the device from creating a digital copy, screenshot, or screen recording, it can’t stop recipients from simply taking a photo or video with an external camera. "People call this the analog hole. Hollywood has been trying to solve it for a long time." The best Digify can offer is a way to track your files, so you know exactly who made and distributed any copies.
Spared a costly apology tour
"Of course you can 'cheat' and do that, just like you can secretly record a private conversation or a phone call," says Brod, when asked about video recordings. "What Confide does is simply turn the default digital modality to off the record instead of on the record." Since watercooler gossip has already moved to text and email, he argues, why not do it more safely? These services wouldn’t have prevented the Sony hack or the leak of unreleased films. But if executives had used self-destructing services for their nasty gossip and ill-advised jokes, they would likely have been spared their costly apology tour.
Eventually, say Confide’s founders, they hope it will evolve beyond an app to become a platform, so that any email or chat service can offer a "confidential" option that piggybacks on their technology. The company may prove to be the best test case for how well its service really works. "I scream at people in the office. I tell them, ‘You fucked up!’ That’s what running a company is like," says Lerman. "There is no way I would put that in an email because later they would send it to someone and say, ‘Look what an asshole this guy is.’ Now with Confide I can scream at my employees all day long."