Employee Deceptions: Too Little Too Late

Protus3 conducts a wide variety of corporate investigations related to employee deception. Some of the more common issues involve harassment complaints or theft of data. Sometimes these issues appear while the employee is still with the company. In other cases, the employee deception does not come to light for weeks or months after they have left the company.

Even when an investigation becomes necessary, computer forensics and collecting data is often an afterthought. This can lead to serious legal problems as well as impede the investigation of employee deception.

Did an employee leave and start working with a competitor? Did they take any of your confidential information with them? It could be weeks or months before you become suspicious. Similarly, complaints of sexual harassment may not appear for quite some time after the employee has left. As a result, any data that could show whether or not these events occurred could be compromised or erased permanently by this time.

COMMON MISTAKES:

• An employee used their personal device (phone, laptop, etc.) for business purposes, but no one removed company data from these devices before the end of employment.
• A company allowed the used of web-based file sharing through Dropbox or Sharefile without oversight and controls.
• The company reassigned or reset an employee’s computer after their departure.
• An employee’s emails were deleted.

It is important for employers to be prepared if a situation with a departing employee becomes or is expected to become contentious. These situations can arise in various ways across every industry. One example would be an employee or group of employees who leave to work for a competitor or form their own company. Unhappy employees or those leaving involuntarily can also indicate a potential lawsuit for a company.

A key step when preparing for such situations is preserving the existing data. Not taking the proper steps can lead to the loss or deletion of critical data. First, a company’s IT department can assist with this process by preserving existing emails or securing the computer. If this is not possible, it is probably important to consult with an expert and have a forensic image of the computer collected and stored. Finally, remember to collect all company-issued devices prior to the employee’s departure.

Going back after the fact will surely result in lost data, especially if the employee is hoping to hide something.