Dynamic Duo? Not So Fast.

data-theft-employeeWhile we do work for defendants accused of intellectual property theft much more than we used to, as previously mentioned, the majority of our work is still with businesses and their attorneys that have been the victims.  Encountering scenarios with employees that either think they are entitled to take what they’ve been working on for a business, or just brazenly steal it, all the while being compensated by the same company still sometimes boggles my mind.  And sometimes they are more egregious than others.

This particular real world example starts with a client that has used our services before, where we have assisted with some data policy and procedure development work as well as reviewing the electronic devices of departing high level executives, as a usual course of business.  This time we were called in because one of our client’s long term customers had recently called and informed them that one of their recently departed mid level sales guys had called on them with the hopes of taking them to their newly formed business.  As a side note, I sat back and admired the fact that “stronger than oak” business relationships do still exist.digital-forensics-data-theft Well, shifting back to the investigation, fortunately the named ex-employee’s computer system had not been recycled or put back into service with a new image yet. This is where our consulting about protecting data, as well as finding it, comes into play. Since they had worked with us before, our client was informed and had a good policy in place, which is our typical recommendation of a cooling period of anywhere from 60-120 days when folks leave that had the potential to take corporate data with them.  It’s easy “evidence insurance” if you will.  At any rate, we began our methodical process of forensic imaging, indexing, processing and reviewing of data access, particularly via USB device.  While there was an amount of data that had been put to external USB thumb drive, it didn’t occur in the weeks leading up to their departure nor was it of a volume that would have raised eyebrows.  No, they hadn’t turned in that thumb drive when they left, and that was an issue, but frankly it paled in comparison to what we noted with regard to their network traffic.  And no, not local network traffic on the corporate network.  What was more interesting was the traffic that occurred over a mapped drive letter to the employee’s home network.

It seems they had an off the shelf home network server type device that would be available at any big box electronic store.  You see they had a fair bit of information locally stored on the computer system and they had been increasing this amount during the last couple months of their employ.  The data was still on the computer in fact, even after they departed, no deletion.  What we were able to discern is that when they went home, this home server device was home-server-forensicsthen local to their computer and they merely clicked the “M:” drive and they could then copy the files from the laptop to the home server.  We were able to build essentially an index of the contents of this home server device from forensic artifacts on the laptop, without even seeing the server itself.  Pretty cool!  Another interesting piece we took note of during the course of this investigation occurred while reviewing the files that had been moved. Lo and behold there was another salesperson’s name that kept coming up, either in content or noted on some of the folders.  I’ll tell you, as an investigator for over 25 years those are the moments that make you sit up and lean in for a closer look at what you’ve uncovered, while thinking, “Well…what do we have here?” When we brought this to the client’s attention, the implication slowly took root as they remarked that this other salesperson had left their employ shortly after the first subject.  Thus, we reviewed their system as well.  The most notable item uncovered on this computer system was the new venture’s business plan.  Notable indeed! Fragments were carved from the computer’s unallocated data and reassembled to form a fairly complete business plan.  From this document’s details, we were able to go back to the original subject’s machine and discovered that the disingenuous duo had setup their own accounts for the new business with their ex-employer’s vendors.  Evidently these vendors did not take issue with the idea of the employees subverting their employer’s revenue since they would still be making sales I suppose.

The other very interesting take away from the business plan was that the new venture was funded by the employees’ 401k accounts, a so called ROBS plan or Rollover as Business Startup.  Now, before I go any further I’ll give you a brief history on these two employees; they were young and had been employed by our client for about 10 years, during which time they had managed to work themselves into sales positions even though they had no sales experience. They had worked for our client and made contributionsemployee-ip-theft to the company sponsored 401k plan.  You might be wondering now, “Why go into this detail when we’re talking about forensics?”  I’ll explain. Remember how the employees used their retirement plans to help fund their new venture? Well, the company matched funds up to 4% in this plan.  Thus, the company had unwittingly helped fund the pair’s future venture.  Well, fortunately for our client the story doesn’t end there.  Armed with this ironclad evidence from our investigation, outside counsel was engaged and litigation was initiated.  Then, almost as soon as it began, it stopped and culminated with an agreed judgment and motion for permanent injunction granted.  Case closed!  This story is a great example of the importance of being able to interpret data, convey the results to a client in an understandable language and plain old fashion paying attention during an investigation. Oftentimes, small details or patterns are dismissed by others as insignificant or just missed completely as they operate with tunnel vision, just checking the boxes. We like helping our clients win, so paying attention to details is an obvious, but often underutilized skill that is not only second nature for us, but invaluable to a case. I hope you enjoyed this post, more stories to follow!

Share this: