Mobile messaging apps - usage and policy: guidance

Guidance overview

Under new Scottish Government (SG) policy covering the use of mobile messaging applications (MMAs) and non-corporate communication channels (NCCCs). The use of MMAs for everyday government work is not permitted.

MMAs include, but are not limited to, WhatsApp, Viber, Signal, Telegram, WeChat, Wickr and Snapchat. However, it is important to recognise that this list is not exhaustive and may be subject to change as new products come to market. (Please note social media applications which include messaging applications are covered by the Social Medial Policy).

This guidance applies to all SCOTS users. This includes, but is not limited to, all SG staff (including senior civil servants and special advisers), contractors, ministers and others appointed to work for Scottish Government. Colleagues working in agencies and non-ministerial offices or other public bodies using the SCOTS platform may wish to consider this guidance for their own purposes.

Using corporate devices and applications ensures we can maintain the security and integrity of government information and comply with our duties in relation to records management, Freedom of Information and Environmental Information Requests as well as public inquiries. Compliance with the principles of good governance ensures our information is available, searchable and can be shared in line with our statutory duties.

Information is fundamental to enable the SG to carry out our business effectively and plays a major role in helping us meet the priorities outlined in our In the service of Scotland: mission, vision, improvement priorities and values. This will ensure openness, transparency and accountability to our citizens and it is the ethical responsibility of all of us.

If the SCOTS network and/or all major corporate devices and services become unavailable (for example, in the event of a cyber-attack), SCOTS users and contractors should use a necessary means of communication for a limited time until the network, devices or services become available. 

If this happens you would be expected to return to using your corporate device or system as soon as possible. In these circumstances, all communications should be captured, retained, time and date stamped, along with details about the communication method used.

In such an event managers are responsible for both accounting for staff during emergencies and doing anything they reasonably can to notify them of office closures, alternative work locations and workarounds in emergency situations.  When the incident is over, the MMA policy and guidance must be complied with fully.