Businesses are filing law suits against departed employees who remove trade secrets and computer forensics is playing a pivotal role in those suits. These days loyalty to a company is not as common as it used to be. It is becoming more and more uncommon to find someone who has worked for the same company 30+ years as seen in our parents’ generation. The Bureau of Labor Statistics (BLS) stated in a September 2016 report “the median number of years that wage and salary workers had been with their current employer was 4.2 years in January 2016, down from 4.6 years in January 2014.” With an ever increasing employee change-over rate there is a greater risk that an employee will leave on bad terms.
Given this information, it is becoming evident how important properly formulated exit procedures are so that if an employee does leave, issues can be investigated and addressed in a timely manner. A set of exit procedures may include some combination of the following actions:
- Exit interview with departed employees
- Preservation of digital media (Computers, USBs, phone, email)
- Examination of work space (papers, loose devices, etc.)
- Review of social media accounts
In recent news, Ars Technica reported that two employees resigned from mobile game developer Zynga to work for a competing mobile game developing company, Scopely. Upon their departure, a formal forensic investigation was conducted upon their Zynga work computers. It was discovered that critical data was downloaded from a Zynga maintained Google Drive, saved to a USB drive and taken with the individuals to their new employer. Armed with forensic evidence, Zynga filed suit against each departed employee and Scopely to enjoin Scopely from using Zynga’s trade secrets, recruiting Zynga personnel and profiting from information obtained from Zynga’s former employees. The basis for Zynga’s suit is not only that Scopely stole trade secrets from them via the two former Zynga employees, but that Scopely unlawfully interfered with contracts between Zynga and its employees.
A forensic investigation of a departed employee’s computer can provide an enormous amount of useful information, typically answering these questions, and more:
- What files were they accessing?
- Did they delete any files?
- Were any files printed, uploaded to a cloud storage account or emailed to a personal email address?
- What websites were they browsing in the weeks leading up to their departure?
- Were any USB devices plugged into the computer that are not accounted for?
Forensicon has hundreds of cases related to departed employee disputes. We have been instrumental in the collection, analysis and reporting which often leads to Temporary Restraining Orders or other injunctions entered against the former employee.
Gary Hunt is a Senior Digital Forensic Examiner for Forensicon, a QDiscovery Company. Gary holds the Certified Computer Examiner (CCE) certification, is an active member of the International Society of Forensic Computer Examiners (ISFCE) and High Technology Crime Investigation Association (HTCIA) organizations and is one of QDiscovery’s testifying experts. Prior to joining Forensicon, Gary managed the Midwest presence for TransPerfect Legal Solutions’ Forensic Technology and Consulting division. His diverse background in technology, forensics and eDiscovery provides a unique perspective to many challenges faced in the eDiscovery industry.
- Staff Recognized for Departing Employee Investigations - The first issue of Corporate Counsel Business Journal, CCBJ, includes an interview with our Director of Digital Forensics, Yaniv Schiff, and Solutions Architect, Curtis Collette, on the evolution of departing employee investigations. Departing Employee: When Do Investigations Become Necessary? appeared in the print publication, online edition, and on CCBJ’s In-House Tech website. For Increasing Numbers of Employers, Departing Employee Investigations[...Read More]
- Chicago Office Food Drive – The Results Are In - QDiscovery’s Chicago Office collected nearly 1,000 containers of food for the local food bank this Holiday Season! Our office competed with sister offices in Indiana and Connecticut. Alas, we came in third. Our sister offices each collected nearly 2,000 containers for their local food banks. Relatively new to the company-wide food drive, the Forensics Division[...Read More]
- QDiscovery QMobile App Wins Innovation Award - QDiscovery’s QMobile is winner of a 2017 Relativity Innovation Award. Presented at Relativity Fest, the Innovation Award celebrates organizations that create apps or integrations that extend the functionality of Relativity’s eDiscovery software. Our development team created an application that makes the analysis of mobile collections much more manageable. Relativity users can now produce and review mobile[...Read More]
- Moving and Changing - Acquired by Connecticut-based QDiscovery in 2016, Forensicon’s capabilities multiplied overnight, both in forensics brain power and eDiscovery expertise. As part of a leading provider of end to end litigation support, moving to larger offices that are more central to the Chicago legal community was inevitable.
- QDiscovery Named One of the Top 20 Providers of Legal Services! - Leading industry publication, CIO Magazine, has named Forensicon’s parent company, QDiscovery, to it’s Top 20 Providers of Legal Services. The annual listing includes 20 companies that are at the forefront of providing legal solutions and impacting the marketplace. Read the whole article here. Featured in the publication alongside QDiscovery President, Dave Barrett, is Director of Digital Forensics, Yaniv[...Read More]