> If you have an internal chat app that never logs messages -- say, the sender looks up the recipient's IP address on the VPN and connects to them directly -- then a court can't order you to write new code to enable logging.
No, they absolutely can. You may be confusing this with various first amendment cases about compelled speech, given the focus on a court ordering code authorship. A regulator does not have to concern themselves with the mechanism of storage, they can simply designate communications as requiring storage. And they have done so in the case of electronic transmissions. The relevant law allows regulators to compel retention of written communications. Storing a communication in memory and sending it over the network to the memory of another computer for display is by itself sufficient to qualify as a written communication.
You're still fundamentally conflating "aren't logged" with "are logged, but chats expire".
Consider what would happen if a company deployed a system of microphones across their offices such that all in-person conversations were logged. They'd then look at these logs, discipline people based on "private" exchanges etc.
Then when they got into some legal trouble they'd say "oh, we'll keep the microphones and surveillance practices, but expire the records after X days".
That's fundamentally different from the situation of simply removing the surveillance. A court could very reasonably conclude that the company is structuring its affairs in such a way as to avoid court oversight.
I've worked at other companies with similar expiry policies. It's well known in the industry that everyone does this to avoid discovery.
For the employees it's the worst of both worlds: You don't get privacy, and you also can't look up some valuable exchange that happened 90+ days ago.
I think the courts are right to call companies on this particular line of bullshit, and very much doubt that the government could force companies without the proverbial microphones everywhere to install them.
No, they absolutely can. You may be confusing this with various first amendment cases about compelled speech, given the focus on a court ordering code authorship. A regulator does not have to concern themselves with the mechanism of storage, they can simply designate communications as requiring storage. And they have done so in the case of electronic transmissions. The relevant law allows regulators to compel retention of written communications. Storing a communication in memory and sending it over the network to the memory of another computer for display is by itself sufficient to qualify as a written communication.