The e-mails are clean
Suspected price-fixing between two suppliers. The investigation preserves the sales managers’ mailboxes, searches hundreds of thousands of e-mails – and finds nothing. Formal quotes, polite rejections, correct calculations.
The arrangement itself happened elsewhere: in a WhatsApp group with the harmless name “Lunch”, between photos of meals and football comments. A thumbs-up emoji under a price list. A message deleted two minutes after it was sent. A voice message.
Anyone who investigates only e-mail today is investigating the official version of events – not the events themselves.
Where people communicate today
Business decisions are increasingly prepared and taken in Microsoft Teams, Slack, WhatsApp, Signal or iMessage. E-mail often documents only the outcome. That is true not just of informal arrangements but of ordinary working life.
A case from the US shows how wide the gap is. In the antitrust proceedings over the Play Store, Google argued that its internal chat was used mainly for trivial matters. The court reached the opposite conclusion: substantive business topics were discussed in chat [1]. Precisely those messages had been deleted automatically after 24 hours.
Why chats are different
E-mails are self-contained documents with a sender, recipients, a subject and a date. Chats are not. A single chat message is usually unintelligible without the messages before and after it.
| Feature | Chat | |
|---|---|---|
| Unit | Individual document | Ongoing conversation |
| Length and language | Written out | Short, abbreviations, dialect, emojis, switching languages |
| Changes | Unchanged after sending | Messages can be edited or deleted |
| Reactions | Reply as a new e-mail | Emoji reactions, quotes, forwards |
| Attachments | File attached | Often just a link to a cloud file that changes later |
| Copies | One copy per mailbox | One copy per participant, each with its own metadata |
| Retention | Usually archived centrally | Sometimes self-deleting, sometimes only on the device |
| Media | Text and attachments | Voice messages, images, locations, calls |
Microsoft describes this vividly for Teams: in one-to-one and group chats, a copy of every message sits in each participant’s mailbox, and those copies carry different metadata [2]. Deduplicate naively and you lose information. Do not deduplicate at all and you read the same conversation five times.
In a chat, the evidence is not the message but the thread.
What the US has shown
Regulators: the most expensive chats in the world
In September 2022, 16 financial institutions agreed to pay the US Securities and Exchange Commission (SEC) fines totalling more than 1.1 billion dollars for failing to preserve business communication on private messengers [3]. They included UBS and Credit Suisse, each paying 125 million dollars to the SEC and 75 million dollars to the futures regulator CFTC [4]. The violations involved employees at every level, up to senior management [3]. The SEC continued the sweep; in August 2024 alone, fines of around 393 million dollars were added against 26 further firms [5].
For Swiss institutions with US business this is not a distant episode. It shows that regulators treat chats as business records – with the same expectations on retention and production as for e-mail.
Courts: deleting is not an oversight
In the Play Store proceedings, Judge James Donato sanctioned Google in March 2023 because the company had kept automatic deletion of chats after 24 hours in place despite a litigation hold and had left it to employees to preserve relevant chats themselves [6]. In the subsequent Epic v. Google trial in December 2023, he instructed the jury to assume that the deleted chats would not have been favourable to Google [7].
Guidance: The Sedona Conference
In 2021 the Sedona Conference published a commentary on ephemeral messaging. It recognises legitimate reasons for such tools, such as data minimisation, but expects companies to manage the risks actively, issue clear usage policies and keep their retention and production obligations in view [8].
The view from Switzerland
In Switzerland, too, chats are electronic evidence; the Civil and Criminal Procedure Codes are particularly relevant [9][10]. How convincing a chat is depends in practice largely on whether its sender, timing and context can be traced.
This is the typical weak point: the screenshot. It is an image, not a record. Sender, timestamp and conversational context cannot be verified from it. Schreiber and Kettiger show in the Swiss judges’ journal that printing an e-mail or converting it into a PDF removes exactly the information used to verify sender, server and time [11]. For chats this applies even more, because a screenshot also cuts off the thread.
Then there is the protection of employees’ personality; employment law in the Code of Obligations and data protection law are particularly relevant [12]. Chats often mix business and private matters within the same conversation. In practice this means defining clearly which conversations and time periods are reviewed, and setting aside private content early. Whether and under what conditions private devices may be included, and how a chat is to be introduced in specific proceedings, should be clarified with your law firm in advance.
What helps in practice
During preservation
- Preserve whole conversations, not just hits. For Teams, Microsoft Purview can collect the messages before and after a hit so that the context is retained [2].
- Keep message-level metadata: sender, timestamp with time zone, edits, deletions, reactions.
- For mobile devices, use forensic extraction instead of screenshots or app exports.
- Preserve linked cloud files in the version that was shared at the time of the message.
During review
- Read chats as conversations, not as lists of individual messages.
- Filter by participants, channels and time windows so that relevant threads become visible quickly.
- Be able to tag and redact individual messages without destroying the thread.
- Keep a glossary of abbreviations, code words, emojis and dialect expressions – that is often where it becomes clear what was really being discussed.
At Prism Discovery we process chats on our Farsight review platform with a dedicated chat review. Conversations are displayed as threads, the way the participants saw them; reviewers assess individual messages in context. For production, threads can be exported in traceable excerpts – with the metadata an opposing party or a court needs to check them.
Conclusion: five questions for every investigation
- Are all channels covered through which those involved actually communicated – not only the official ones?
- Were chats preserved in time, before automatic deletion periods took effect?
- Are the chats available as records with metadata – or only as screenshots?
- Is every relevant message assessed in the context of its thread?
- Is it documented which conversations were reviewed and which were set aside as private?
The move from e-mail to chat is not a technical detail. It changes where the truth of a case is to be found. Anyone investigating today must look where people are talking – and preserve the thread so that it holds up in court.
This article is for general information only and does not constitute legal advice. For a legal assessment of your case, please consult a law firm.
Sources
[1] The San Francisco Standard: Judge sanctions Google for deleting internal chat logs central to antitrust cases, 28 March 2023 – https://sfstandard.com/2023/03/28/judge-sanctions-google-for-deleting-internal-chat-logs-central-to-antitrust-cases/
[2] Microsoft Learn: Review Microsoft Teams content in a review set in eDiscovery – https://learn.microsoft.com/purview/edisc-review-set-teams-data
[3] U.S. Securities and Exchange Commission: SEC Charges 16 Wall Street Firms with Widespread Recordkeeping Failures, press release 2022-174, 27 September 2022 – https://www.sec.gov/news/press-release/2022-174
[4] SRF: Nachrichten nicht archiviert – UBS und CS bezahlen je 125 Millionen Dollar Strafe, 29 September 2022 – https://www.srf.ch/news/wirtschaft/nachrichten-nicht-archiviert-ubs-und-cs-bezahlen-je-125-millionen-dollar-strafe
[5] U.S. Securities and Exchange Commission: Twenty-Six Firms to Pay More Than $390 Million Combined to Settle SEC’s Charges for Widespread Recordkeeping Failures, press release 2024-98, 14 August 2024 – https://www.sec.gov/newsroom/press-releases/2024-98
[6] In re Google Play Store Antitrust Litigation, U.S. District Court N.D. Cal., sanctions order of 28 March 2023; summary: Lowe Law, Google Punished by Court for Not Preserving Employee Chats – https://lowelaw.com/google-punished-by-court-for-not-preserving-employee-chats/
[7] Legal Dive: Google’s deleted messages were deliberate spoliation, judge tells jury in Epic Games case, 12 December 2023 – https://www.legaldive.com/news/deleted-messages-google-antitrust-case-epic-games-deliberate-spoliation-donato/702306/
[8] The Sedona Conference: Commentary on Ephemeral Messaging, 2021 – https://thesedonaconference.org/publication/Commentary_on_Ephemeral_Messaging
[9] Swiss Civil Procedure Code (Zivilprozessordnung, ZPO), SR 272 – https://www.fedlex.admin.ch/eli/cc/2010/262/en
[10] Swiss Criminal Procedure Code (Strafprozessordnung, StPO), SR 312.0 – https://www.fedlex.admin.ch/eli/cc/2010/267/en
[11] Schreiber, C. / Kettiger, D.: Elektronische Beweismittel – neue Herausforderungen, in: «Justice – Justiz – Giustizia» 2024/2 (Richterzeitung) – https://www.advo-schreiber.ch/dok/Schreiber_Kettiger_Richterzeitung_2024_2_el_Beweismittel.pdf
[12] Swiss Code of Obligations (Obligationenrecht, OR), SR 220 – https://www.fedlex.admin.ch/eli/cc/27/317_321_377/en; Federal Act on Data Protection (Datenschutzgesetz, DSG), SR 235.1 – https://www.fedlex.admin.ch/eli/cc/2022/491/en