Texts are no longer private.
Getty
Updated on December 2 with Google’s response to the furor surrounding this update.
Microsoft sparked viral outrage when it unveiled an update to Teams to let your company know when you’re away from work. Now Google has done the same. Forget end-to-end encryption. A new Android update means that RCS and SMS texts are no longer private.
As reported by Android Authority“Google is rolling out Android RCS Archival on Pixel phones (and other Android phones), allowing employers to monitor and archive RCS conversations on work-managed devices. In simpler terms, your employer will now be able to read your RCS conversations in Google Messages despite end-to-end encryption.”
This applies to task-managed devices and does not affect personal devices. And in some regulated industries it simply adds RCS archiving to existing SMS archiving. However, employees in regular organizations see texting as different from emailing, especially given the expectations around end-to-end encryption. This is no longer the case.
This highlights the widespread misunderstanding of end-to-end encryption. Security protects your messages when they’re sent, but once they’re on your phone, they’re decrypted and available to anyone controlling the device.
Google says this is “a reliable, Android-supported solution for archiving messages, which is also compatible with SMS and MMS messages. Employees will see a clear notification on their device whenever the archiving function is active.”
Suddenly, the privilege of being on the phone at work isn’t as good as it seems. While workers have long been aware of the dangers of oversharing in email—a terribly insecure technology that’s easy for employers to monitor, texting is seen differently. And this is not just about regulated industries. All organizations can play together.
Google “This new feature, available on the Google Pixel and other compatible Android Enterprise devices, gives your employees all the benefits of RCS — such as keystrokes, read receipts, and end-to-end encryption between Android devices — while ensuring your organization meets its regulatory requirements.”
In response to the outrage surrounding this update, Google told me “this update does not change or affect the privacy of personal devices. This is an optional feature for work phones operated by businesses in regulated industries where employees have already been notified that their communications are being archived for compliance purposes.”
There has long been a concern that workers are turning to IT shadow peer-to-peer communication systems — namely WhatsApp and Signal; This latest update will not help to improve this situation.
There have been questions about whether Google’s new update means other messaging app content can also be archived and shared with employers, especially secure apps like WhatsApp and Signal. The answer is no.
SMS and now RCS messages are built into the phone’s operating system itself, managed by Android (or iOS). Over-the-top platforms are not. They control their encryption and decryption. Their databases can be included in a generic phone file, but need not be.
This applies to general texting. “Previously,” says Google, “employers had to block the use of RCS entirely to meet these compliance requirements; this update simply allows organizations to support modern messaging — providing employees with messaging benefits such as high-quality media sharing and typing indicators — while maintaining the same compliance standards that already apply to SMS messaging.”
Meanwhile, if you have an Android phone with task management, watch out for the message warning that your texts are no longer as private as they used to be.
