There are no state agency policies that specifically address the use of encrypted messaging apps like Signal and WhatsApp. While there are state agency policies that govern record retention and appropriate use of state devices, none of them specifically address the use of encrypted messaging apps like Signal and WhatsApp.

Inside Investigator reached out to the Office of the Public Records Administrator (OPRA) and the Office of Policy and Management (OPM) after the use of apps like Signal and WhatsApp have been at the center of court proceedings against Public Utilities Regulatory Authority (PURA) chair Marissa Gillett.

Gillett’s personal text messages have been a subject of interest in a lawsuit brought against PURA by Avangrid. The utility has sought text messages Gillett allegedly sent about an op-ed written by Rep. Jonathan Steinberg, D-Westport, and Sen Norm Needleman, D-Essex, who chair the legislature’s Energy and Technology Committee chairs. The op-ed, which was published by CT Mirror in December 2024, claimed the state’s utility companies had colluded with credit rating organizations to blame Gillett for rejecting rate requests and lowering their credit ratings.

While Gillett and Steinberg have denied Gillett had anything to do with the op-ed, a text message Gillett sent to Steinberg, which the Hartford Courant obtained through a Freedom of Information Act (FOIA) request, says she finished a “draft” and was waiting for her chief of staff Theresa Govert “and others” to read it before sending it to Steinberg and Needelmen.

Gillett has denied the draft is a reference to the op-ed, instead saying it’s a reference to a legislative proposal.

In the same text message, she also told Steinberg she had sent her an “overly formal” email response because she was concerned about the correspondence being requested through FOIA.

During the discovery process in Avangrid’s lawsuit against PURA, Gillett admitted to deleting the text messages from her personal phone, claiming when she purchased the phone in November 2023 it was set to delete text messages after 30 days. PURA later discovered the draft being discussed in the text messages months after it had initially been requested. It’s not the only document PURA has failed to provide under discovery.

During deposition in the lawsuit, both Gillett and Govert generally denied using their personal cellphones to conduct state business. Gillett said that at the time she sent the text messages to Steinberg, she did not believe they were state business that required preservation.

Both Gillett and Govert also denied using either WhatsApp or Signal on their work phones. Gillett did admit to previously using Signal on her personal phone. She denied using Signal on her work phone or having any awareness of other PURA employees either using or discussing use of Signal.

Govert denied using Signal on either her personal or work cellphones but admitted to using WhatsApp on her personal phone. She denied ever discussing the case on WhatsApp. Both Gillett and Govert testified to searching their phones for responsive documents and records, but Govert said she had not searched her WhatsApp message history because she claimed she would not have communicated about the case through it.

She claimed she did not have any knowledge of the settings of when messages were set to disappear on her WhatsApp account but said she had “potentially” altered the settings because of concerns of storage and safety while traveling abroad.

Both Signal and WhatsApp both use end-to-end encryption, meaning only the sender and recipient of a message can read it. Both apps also have settings that allow a user to set their account to automatically delete messages after a set time period.

Both the encryption and the automatic deleting of messages pose a problem not only for production of FOIA requests, but because the state’s record keeping schedule requires that various categories of records be kept for certain periods of time. Agencies are also required to seek OPRA’s approval before destroying records at the end of the retention period laid out in the relevant schedule.

For electronic records, agencies are required to maintain not only copies of records but associated metadata and to store them either on public agency servers or in the cloud. They’re also required to regularly back up records and associated metadata.The use of apps like Signal and WhatsApp make these things impossible.

OPRA’s standards for electronic records management specifically call out email and text messages.

Agencies are directed to have policies and procedures “that clearly document how each communication technology should be used, set limits on what content may be transmitted by such technologies, and outline policies for retention, retrieval, preservation, and disposition of communication content.” They also note that the content, not the format, of records is what determines value and how long they should be retained.

The standards also notes that text messages are public records when they relate to public businesses and are subject to the minimum retention period, based off the content of the text. They also urge public agencies to consider either having users save text messages, or have either the agency or a vendor capture text messages and store them in a repository accessible to the agency.

According to Nicole Besseghir, a public records analyst with OPRA, they often advise agencies in training and meetings that “auto-deletion features are generally unacceptable under records retention policy and procedure in the state, as our office must approve destruction for the majority of record types produced in the course of public business.”

OPRA’s guidance generally deals with categories or groups of records rather than specific applications. They, rather than the Freedom of Information Commission, which handles complaints about noncompliance with FOIA, handle complaints about the improper destruction of records. According to Besseghir, OPRA has not received any complaints about state employees using Signal or similar apps.

Besseghir suggested Inside Investigator reach out to OPM or the Department of Administrative Services’ Bureau of Information Technology Services, since they issue more specific guidance on the acceptable use of applications.

OPM communications director Chris Collibee told Inside Investigator that app availability is governed by the state acceptable use policy for technology or the Internet, which applies to all executive branch agencies.

The policy stipulates that state systems, including email, must be used exclusively for state business. It does not specifically mention text messages or any particular apps that are prohibited.

OPM’s website lists a policy on management and retention of email messages and other electronic messages, which links to OPRA guidance for those records. Most notably, it states that electronic messages, including email and faxes, must be kept for a minimum of two years. The two year period applies to messages if they are “routine correspondence” relating to commonplace office tasks. Records related to specific agency business often must be retained for longer, with the specific time frame for which they must be retained determined by their content.

Inside Investigator could find no policy through OPM or BITS that referenced specific apps that have a blanket prohibition for use on cellphones provided by the state.

“Employees using all such apps are required to follow the state’s records retention laws. Additionally, OPM has a policy regarding records retention, including text messages, which follows state record retention laws.” Collibee said. Collibee also added that OPM is not aware of any employees using Signal or similar applications for state business.

Republish This Story

Republish our articles for free, online or in print, under a Creative Commons license.