data theft accusation

Having worked both sides of issues that involve theft of trade secret and intellectual property, we’ve seen our share of the departing employee being accused of all manner of malfeasance. But with all the talk of employees taking data from a company that doesn’t belong to them, one might wonder what this looks or feels like from the other side, as the employee. Believe it or not, for as many times as we work with a business or attorney to chase down folks that took or retained possession of data that didn’t belong to them, I’m often surprised by the lack of effort on the accused part to disprove this. I think there are several reasons for this. First of all, regardless if a person is guilty or not, I think there is generally an initial shock that occurs when someone gets a letter telling them it’s come to the attention of their former employer that they are either violating a non-compete agreement (or other long forgotten document) they signed, or they failed to comply with the return of company owned materials. Second, I think most folks assume that every bit of evidence developed from a computer or company device is in fact black and white in terms of what transpired. Third, the prospect of actually hiring counsel to defend them and an expert to decipher the ins and outs of materials (digital evidence can be especially daunting), can be overwhelming. The cost associated with hiring an attorney and a forensic expert is not normally factored into someone’s “rainy day fund.” It’s understandably not something people plan for. I’m certain there are other reasons to include. Perhaps the belief that such demand letters are blunderbuss and they will not be pursued (particularly if the letter just comes from the company). We also have to consider that the accused party might in fact be guilty, and instead of tipping their hand, they decide to roll the dice and see what unfolds. At any rate, believe it or not, there are times when an employer is heavy handed with accusations against those that have left. What are those folks who find themselves in such a position to do? Well first of all I’d suggest that if you are considering leaving, you ensure you’re careful not to take information that doesn’t belong to you. While this statement might seem rather silly and contrite at face value, it’s not always that simple. Remember the time that you emailed yourself a copy of the vendors or clients so that you could get a head start on your audit or project over the weekend? What about the time your computer wouldn’t connect to the network so you saved that folder to your thumb drive? Or you used DropBox or Google Drive for a similar purpose? What happened to that data? Ideally you used it appropriately and in line with your job and that was that, but what did you do after? Did you wipe the data or otherwise make it unusable in the future? And where is that thumb drive now? All of these are valid questions from the previous employer’s perspective and you should be prepared for them. How do I know? I’m someone who comes up with the questions, both initially, and after a review of the available evidence left behind via the company computer or smartphone you used. A cursory read of any of the previous postings here should reveal that there is quite a bit of information left behind when actions are taken on a computer, even if you try to hide, erase or clear potential files that you can think of. There is almost always another piece of data left behind. Think your “private mode” browsing is completely off limits to someone going through your computer after the fact? Not completely as there again it seems there’s always another piece of incriminating evidence left. And if not outright incriminating then at least concerning to your former employer, the kinds of things that make them go hmmm. What else should you do or not do? Well, let’s take a look at a few: Don’t use your company computer for personal business. Co-mingling makes it more difficult to take personal items off it without drawing attention later. Try not to use the resources I just listed (USB’s, Personal Email & Online Storage) as they can look bad after the fact. Digital forensics tells a lot, but sometimes not all, and you may just open yourself up to accusations. Particularly if it wasn’t a company issued device, or you left the USB device behind. Remember, we’ll analyze that as well to determine if there are artifacts that point to you connecting it to another computer, like your personal one at home. Try to keep in mind that leaving the employment of a company can be emotional (for both sides) so try to keep emotion out of it. When there is even a wisp of wrongdoing, sometimes emotion takes over with all parties, keep yours in check. Don’t leave your employer hanging. This can factor in with the emotional element as well. No matter how tempting it may be at the time, it’s best to refrain from statements like, “you can take this job and shove it” or “let’s see how this place runs without me!” Again, emotion in the moment may cause your ex-employer to pull out all the stops in the interest of pursuing any & all possible evidence against you. And let’s be honest, they normally have the means to do it. It’s best to keep a level head. Why drain the “rainy day fund” on an IP Theft defense? Admittedly a number of these are common sense but they bear listing as reminders nonetheless, especially when emotion is involved. Remember, you’re working with people, not machines (though T-1000 and skynet could be any day now). Before I end I’ll leave you with a bit of anecdotal evidence regarding one such heavy-handed employer. I was contacted a number of years ago by local outside counsel for an out of state employer. They had a sales associate that worked here that had tendered her resignation rather abruptly. Immediately before giving her resignation, the employee emailed herself a rather large zip file from her corporate email account to her personal email account. She then deleted the sent email from her sent email folder. After she left, the company did a cursory analysis of her system and discovered this. Aside from the facts above, the company also zeroed in on the size of the zip file, which was about a megabyte and a half. Upon learning the file size, they immediately assumed that the subject had zipped three critical files of theirs and emailed them to herself. I got involved when a TRO (temporary restraining order) was issued and I was allowed to image her personal computer in an attempt to determine what she emailed to herself. Ultimately I determined that it was some personal family photos that the subject had grabbed from her computer, zipped and then emailed them to herself. The case quickly halted and the parties went their separate ways, but not before each had retained counsel and I was brought in. It’s worth mentioning in this particular scenario the defendant did not need to retain her own digital forensic expert largely because our reputation preceded us. One of her attorney’s partners was already familiar with our work in another unrelated matter. We pride ourselves on being trusted experts in the world of digital forensics and not merely a hired gun! Our analysis stood alone and a second opinion was unnecessary. What are the takeaways? I can quickly think of a couple. Number one, employers can and do jump to conclusions when employees abruptly leave. In this matter, I don’t believe there was anything untoward done on the behalf of the company. The employees at the company were acting in their employer's best interest in trying to investigate. Which leads me to number two. When you leave the employ of a company, don’t do anything that might afford them the opportunity to jump to such conclusions. As stated, I realize changing jobs is oftentimes an emotional matter. However, if your actions are more positive, logical and deliberate then you stand a good chance of minimizing the emotional response from the employer you are moving on from. Remember, business is business, don’t take anything that doesn’t belong to you and don’t make it personal.

Tag: data theft accusation

Maybe it’s Cyber or Maybe it’s an Insider Threat?

Exiting Employees – What About the Other Side of the Coin?