The View From the Other Side
Having worked countless cases on both sides of trade secret and intellectual property matters, we’ve certainly seen our share of departing employees accused of taking data that doesn’t belong to them.
But it’s worth flipping the coin: what does this look or feel like from the employee’s side?
Surprisingly, even when accusations are heavy-handed or flat-out wrong, many former employees don’t do much to actively disprove them. In my experience, there are a few reasons for this:
- Shock and overwhelm. Getting a letter that says you’re violating a non-compete or failed to return company property is enough to knock most people off balance, guilty or not.
- Belief that digital evidence is purely black-and-white. They assume that anything found on a device must tell the full story (it sometimes doesn’t).
- Cost and intimidation. Hiring an attorney and digital forensic expert isn’t something people generally plan for. It feels overwhelming and expensive, especially if they think the whole thing might just blow over.
Of course, there are also those who are actually guilty, and choose to keep their heads down and hope for the best.
Employers Can Be Heavy-Handed, Too
Yes, believe it or not, sometimes companies do jump to conclusions.
If you’re considering leaving your job, or if you’ve already left and find yourself on the receiving end of a letter, here are some important thoughts and practical suggestions.
Watch the “Innocent” Things You Do With Data
It’s not always as simple as “don’t take what isn’t yours.” Sometimes employees inadvertently set themselves up for scrutiny. For example:
- Emailed yourself a copy of the vendor or client list to work on over the weekend?
- Saved a folder to a thumb drive because the network wasn’t working?
- Used Dropbox or Google Drive to move work files around?
All very common. But after the fact, these choices may give your former employer ample reason to question your intentions.
And if a forensic investigation kicks off, remember there’s a wealth of data left behind on your company computer (and maybe your own devices) that can tell a story, whether or not you realize it. “Private mode” browsing doesn’t protect you like you think. Deleted files often aren’t really gone. Even the absence of expected artifacts can be suspicious, like a crime scene that’s been staged.
A Few Practical Tips Before You Leave (or After You Have)
Don’t use your company computer for personal business.
It muddies the waters later, and makes it harder to clearly remove personal files without drawing attention.
Avoid USB drives, personal email, and online storage for work files unless officially sanctioned.
Even innocent use can look questionable, and forensics might later connect your USB device to your personal computer at home.
Keep emotion out of it.
Leaving a job can be emotional for both sides. If there’s even a hint of wrongdoing, emotions flare higher. Stay calm.
Don’t make big exit declarations.
Comments like, “Let’s see how this place runs without me!” or “Take this job and shove it!” can escalate things. An emotional employer may feel compelled to dig for dirt, and they have the means to do it. It’s best to keep a level head and avoid draining your rainy day fund on an IP theft defense.
A Quick Story: When the Employer Overreacted
A few years back, I was brought in on a case where an employer jumped to some pretty serious conclusions.
A sales associate had resigned abruptly. Just before resigning, she emailed herself a large zip file from her company email to her personal account, then deleted the sent message. The company did a basic analysis and saw that the file was about 1.5 MB. They immediately assumed it contained three of their critical files.
They obtained a temporary restraining order (TRO), and I was allowed to image her personal computer to find out what she’d actually sent. Turns out? The zip file contained nothing more than family photos. The case ended almost as quickly as it started.
In this scenario, the former employee didn’t even need her own forensic expert. Her attorney knew us from another matter and trusted our reputation. Our independent analysis stood on its own, no second opinion necessary.
Takeaways
1. Employers can and do jump to conclusions, especially after an abrupt departure.
In this case, I don’t believe the company was acting maliciously, they were simply trying to protect their interests.
2. Make sure your actions don’t give them a reason to jump to conclusions.
Exiting a job can be emotional. But if your decisions are logical, measured, and above-board, you’ll reduce the likelihood of an emotional, and expensive, reaction from your former employer.
Bottom line:
It’s business. Don’t take what doesn’t belong to you. And try not to make it personal.
If you ever need help sorting through an allegation or proving what really happened, we’re here. Just reach out.
About Swailes Computer Forensics
Swailes Computer Forensics provides expert digital forensic services to law firms, corporations, and organizations nationwide. Our work includes investigations into intellectual property theft, employee misconduct, data breaches, and more. With decades of experience and a commitment to integrity and clarity, we help clients uncover critical evidence and take informed action.
If you’re facing a potential case of employee data theft or have concerns about unauthorized activity, contact us for a confidential consultation.