Managing human resources is a fact of life for any enterprise. An aspect of human resource management that needs to be handled with utmost care is the separation of an employee from the enterprise. While in most cases these events are handled routinely there is always the exception which requires time, expense and often lawyers to resolve. No small part of this process is managing the employees electronic footprint in the organization, which is what I will focus on today.
Whether it be an employee termination, the corporate partner breaking away or the key employee moving onward, all expose the company to risk and all share one common conundrum, you usually cant predict which separation will be the one that causes you grief until your in the soup.
A good portion of our business is assisting clients in sifting through the leftover digital media after the problem has been identified. Scenarios we encounter include:
- Business partner leaves and legal issues arise after the fact.
- Employee leaves under good terms, surfaces with a close competitor who targets the previous employer’s key clients or introduces a “new product” suspiciously similar to the previous employers latest product.
- Terminated employee alleges “wrongful dismissal”.
In the typical scenario the departing individual has one or two company computers, an email address, a network share and a smart phone. When they leave,
- their computers are re-assigned or repurposed by the IT department.
- the phone if collected is reset.
- email may be left available with a surrogate looking after it, eventually archived or deleted.
- the network share languishes on the network until either archived or deleted.
Business carries on as these events unfold and often other employees are given access to resources previously used by the departed party to ensure a smooth transition.
The typical scenario may be efficient if all separations are amicable and trouble free. But wait, what if its not? Generally when a problem arises it is recognized after the employee is gone, sometimes weeks or months later. Managements first reaction includes gathering more information. Any number of people are asked to review digital copies of files, emails etc of the departed party, often on the same computers the departed employee used. Data is gathered, copied, moved and shared as staff try to resolve the matter. At some point the scope of the problem is recognized and security staff or legal are involved. Somewhere during this process, staff recognize that the departed employees data should be preserved. A digital forensics expert is engaged and sets out to first preserve all sources of data and then provide an analysis of what is still available.
The problem with the typical scenario is that some of the departed employees data has been inadvertently destroyed through the normal company procedure when they leave and then further data has been tainted or destroyed by staff response to the problem. In addition the expert’s analysis has been seriously complicated by the process, causing added examination and legal expense as the examiner and lawyers try to piece together the digital tatters to mount a case. Ultimately the companies inability to gather data from the ex-employee’s digital resources may prevent them from seeking redress or defending the company from claim.
Clearly there has to be a better way.
While there is no perfect solution there are some preventative choices you can make. We suggest that when a key employee separates from the company, all their digital resources be preserved immediately for a cooling off period to ensure they are available should the need arise. Generally wether the work is done in house or contracted out there is a cost to the company, however it is likely to be far less than the costs incurred in cleaning up after the typical scenario.
EFS can preserve a key employee’s data efficiently and at a reasonable cost. Our staff are all specially trained experts that can preserve the data in a legally defensive process. In addition hiring a qualified third party to complete the task can assist in establishing the authenticity and confidence of the data should legal proceedings arise.
EFS is equally adept at piecing together the tatters should you fall into the “typical” scenario or somewhere in between, the path your company travels is your decision. EFS will be available to assist with preservation analysis and expert testimony involving digital evidence however we find it.
Reactive imaging/analysis of digital tatters = $$$ …