The Mayor’s Office of Neighborhood Safety and Engagement (MONSE) and the Baltimore Health Department have been using a communications platform outside of the city’s messaging system, leading to concerns about data security and whether documents requested under the Maryland Public Information Act (MPIA) are being properly disclosed.

Inspector General Isabel Mercedes Cumming singled out MONSE for its extensive use of the Slack platform for staff communications in a report released yesterday.

Although “all MONSE Slack messages fall under the MPIA with limited exceptions,” Cumming wrote, when a news organization requested all electronic communications from MONSE  – including Slack messages – “the city did not provide any Slack communications.”

The Slack messages were only disclosed – to Cumming herself – after her office subpoenaed the information as part of its investigation into the use of third-party communications by city employees.

A news organization requested all electronic communications from MONSE  – including Slack messages – but “the city did not provide any Slack communications,” Cumming says.

Cumming questioned the justification that MONSE used to buy and deploy the Slack system, saying that neither BCIT, the city’s IT arm, nor the law department were properly informed of the arrangement.

She also noted that the city health department allows employees to utilize Slack and other communication systems outside of Microsoft Teams, the official messaging platform available on all city-issued computers and mobile devices.

“Using these applications without BCIT’s approval and the Law Department’s awareness could lead to data loss, record retention issues, potential MPIA noncompliance, reduced government transparency, and perceptions of attempting to circumvent the city’s network,” the report noted.

Cumming recommended that the Scott administration “prohibit city agencies from using third-party communications software such as Slack, WhatsApp and Signal without BCIT’s approval and configurations for best practices.”

“No intentions to circumvent”

“Neither BCHD or MONSE have intentions or a practice of using Slack to circumvent records retention or MPIA requirements,” MONSE Director Stefanie Mavronis and Interim Health Commissioner Mary Beth Haller said in response to the report.

They said that managers and staff at both agencies understand that Slack correspondence “is official government communication subject to the MPIA,” with Haller further disclosing a directive sent out BCHD employees following receipt of Cumming’s findgs.

The May 2 memo “immediately” bars the use of unapproved communication technology by staff, sayng:

“If you are using any technology, AI programs or applications that have not been specifically provided by or approved by the City, the use of that technology, AI program or application must cease immediately. If you believe there is available technology, AI, or applications necessary for your work, it should be submitted for approval.”

The Health Department has sent out a memo that now bars the use of unapproved communications platforms.

Haller said her agency began using Slack began during the Covid pandemic and before the city transitioned to Microsoft Teams. She said some staff members still use a free version of Slack for internal communications, although that practice will end.

In addition, the tuberculosis and maternal and infant care programs utilize WhatsApp to communicate with clients, and one staff member uses Signal. These systems also will be deactivated.

MONSE began using Slack in 2021 under its previous director, Shantay Jackson, and has spent $12,156 through December 2024 in subscription fees.

MONSE’s former associate director of finance justified the expenditures by telling BCIT that the agency’s work in gun prevention and reduction required community participation and only Slack could be used to communicate with members of the public.

In fact, Cumming writes, Slack was used only for internal MONSE communications. She cites a memo from Jackson instructing employees that all messaging be sent through Slack to reduce “email overhead” – something the former associate director acknowledged in an interview.

In a one-week period examined by the inspector general, MONSE staff sent 2,517 messages and uploaded 258 files through Slack.

Defending Slack Usage

According to Cumming, MONSE utilizes a subscription plan that lacks the security and data compliance capabilities of two more expensive Slack plans.

Among the deficiencies are an absence of audit logs, data loss prevention, legal holds, data exports for all messages and support for HIPAA compliance, raising the question, Cumming writes, of whether the agency’s records are being properly managed, stored and available to the public.

In a May 28 response sent to Mayor Brandon Scott, City Administrator Faith Leach and others, MONSE Director Mavronis defended the agency’s use of the service:

“From its customization to suit core agency functions to the indefinite retention of messages transmitted, Slack has proven to have value for MONSE as a collaboration tool. Communications about public business on the Slack platform constitute government records and are subject to the Maryland Public Information Act (MPIA) just like other electronic records, including emails and Microsoft Teams messages. MONSE’s paid Slack Pro account retains messages and files transmitted indefinitely.

“In fact, the Office of the Inspector General requested six months of MONSE communication. Those electronic records, totaling tens of thousands of transmitted communications, were exported and provided in full as requested. Accordingly, MONSE has demonstrated the ability to retain and produce records on third-party software other than Microsoft Teams.”

Mavronis and Haller said they “continue to stand ready to comply with any directive made in accordance with city and state records retention laws.”