Cases can be won and lost based on digital forensics, particularly in matters involving theft of trade secrets or stolen confidential business information. Presenting evidence that reveals what actually happened, by whom and when are powerful in a courtroom, and in some instances game-changing if known prior to filing a lawsuit. In this series of articles, we’ll discuss 3 critical areas:
- Under what circumstances should you consider a forensic examination?
- How can the timing of an examination provide an advantage over the opposition?
- Where to find evidence that can tip the scales in your favor?
Under what circumstances should you consider a digital forensics investigation?
If you’re a business, you should consider a forensic investigation as soon as you as aware of a potential problem, such as the suspicious circumstances around an exiting employee. Whether it’s an executive, engineer, sales manager, product development or an employee with access to your confidential information, they all can be potential threats, if information is copied or otherwise taken. When you consider more than 70% of departing employees take company information the impact could be significant. Here are some things to consider when assessing the risk surrounding an employee departure:
- Did the employee have access to confidential information you would not want a competitor to view? Often the senior most positions have the most access, but don’t forget to consider mid-level employees with access to innovation, proprietary processes, software and product development, and sourcing.
- Where is the departing employee going to work? If it’s a competitor, you should be concerned. If the employee will not disclose the new employer, this may be a red flag to factor in your assessment.
- Is the employee leaving to return to his country of birth? A number of significant data theft cases have involved this scenario and there are certain countries that have open programs and incentives to induce the theft of your data.
- Was a reasonable period of notice given or did the employee give same-day or no notice? The shorter the notice period, the larger the red flag.
- Could the employee be disgruntled? Things like a missed bonus, a promotion that went to someone else, restructuring, disagreements with management and company layoffs are usually cited as the justification to steal data.
- Trends in departures. Sometimes we see employee departures that don’t appear to be high risk, until we start to see a trend. A trend may be a number of employees leaving a specific business unit, or various employees who could collectively represent an entire product or service area, such as sourcing person leaving one day followed by a manufacturing employee another day and then a sales or marketing employee departs. Staggered departures can sometimes be a planned event.
Some businesses don’t look for the indicators of theft, and learn of the stolen data long after it was originally copied, taken or shared. In this scenario, it is usually when an unexpected competitor emerges at lower price points and starts to beat you on deals. Even if your sales team isn’t reporting the losses, you will notice an erosion of your market share and/or margins at some point.
While the sooner you investigate, the sooner you’re able to make informed decisions, it’s never too late to start a digital forensic investigation.
In our next series of this blog, we will look at the optimal time to engage a digital forensic investigator to give you the advantage over the opposition.