You just found that the secretary of a key employee has gone to work for a potential competitor, without giving two-week notice. Not only that, she has not surrendered possession of your company’s laptop, which she used to access your computer network from home via a Virtual Private Network. What do you do?
First, run in circles, scream, and shout! Use profanity – it may help you feel better. [insert cheesy emoticon here]
Then, after you’ve blown off some steam, take steps to reduce the damage.
The first thing to do is call your IT provider and have VPN access cut off to the wayward laptop. It may be closing the barn door after the horse has left, but at least the leakage of information will be limited to anything taken before the VPN connection is killed.
If you used some foresight, you had your IT provider LoJack for Laptops (www.lojackforlaptops.com). If you did, you can trace the laptop via the Internet and/or remotely freeze the computer, displaying a custom message to the user. As a last resort, you can even delete all of your data from the laptop remotely.
But you say you didn’t have LoJack for Laptops installed? Well, don’t panic. There are other things you can do.
If your server has VPN logging activated, your IT provider will be able to track when the laptop has accessed your server over the VPN. You may also be able to determine which if any, files were transferred to the laptop. Obviously, any access after the employee leaves your company is suspect, and evidence to support the issuance of a temporary restraining order by a court.
It is of great importance to retrieve the former employee’s laptop. A competent forensic technician can make a forensic copy of the hard drive and then determine what files are on the machine, what files were deleted, and what portable storage devices were attached and when. Even if incriminating files have been deleted, they will probably be accessible.
If the hard drive has been wiped so as to make files inaccessible, that in itself is evidence of bad conduct as such an action is beyond the competence of the average computer user. The forensic image and the data from the analysis of the copy will be very potent evidence in court.
If you believe that your company’s confidential and/or trade secret information has been taken, then your only recourse may be immediate legal action.(2) A Houston law firm, such as The Vethan Law Firm, PC, which is experienced in protecting its client’s confidential information, can file a suit seeking injunctive relief from the court. That is a suit asking the court to order the former employee to return any data taken, and forbidding him or her and her new employer from using or disclosing any such information. Obtaining injunctive relief is not cheap, but it may be cheaper than losing your company’s lifeblood, its intellectual property, and trade secrets.
And remember, “forewarned is forearmed.” If you take steps today to protect your confidential information tomorrow, you can reduce the damage from an employee deciding to take that information to his new employer.
(1) Edward James Olmos in “Stand and Deliver,” 1988.
(2) Legal action will be much more effective if you have the right employment documents, including an enforceable non-disclosure agreement with the rogue employee and a written policy regarding confidential information.
