How to Investigate an Employee Suspected of Stealing Company Data

When an employee is suspected of stealing company data, the situation requires immediate, careful, and legally compliant action. The potential loss of intellectual property, trade secrets, and confidential information can severely impact a business, making a robust and defensible investigation critical. This note outlines a structured approach for UK organisations, focusing on legal frameworks, practical steps, and the forensic collection of electronic evidence.

The objective is not merely to confirm data exfiltration but to gather admissible evidence for potential civil litigation, regulatory action, or even criminal prosecution, such as under the Computer Misuse Act 1990 or the Bribery Act 2010. Adherence to data protection principles, particularly the UK GDPR, and civil procedure rules, like CPR Part 31 and Practice Direction 57AD, is paramount throughout the process.

Establishing the Legal Basis and Initial Considerations

Before any investigative steps are taken, the legal basis for processing employee data must be clearly established. For UK GDPR compliance, a legitimate interest assessment is often necessary, ensuring that the investigation's necessity and proportionality outweigh the individual's privacy rights. Alternatively, a contractual obligation or legal duty may provide a basis.

It is crucial to consider the employee's contractual terms, particularly those relating to company property, data usage, and confidentiality. These clauses can provide a clear mandate for access to company devices and systems. Legal advice should be sought promptly to assess the strength of the case and the appropriate course of action, including whether to involve law enforcement.

Consideration must also be given to the potential for spoliation of evidence. Once suspicion arises, steps should be taken to preserve data in situ where possible. This includes preventing the suspected employee from accessing systems or devices that may contain relevant evidence. However, this must be balanced against the need to avoid tipping off the individual prematurely, which could lead to further data destruction or concealment.

Practical Steps for a Data Theft Investigation

Immediate Preservation and Isolation

• Suspend access: Temporarily suspend the employee's access to company networks, systems, and physical premises if the risk of further data exfiltration or destruction is high. This action must be proportionate and legally defensible.
• Isolate devices: Identify and isolate all company-issued devices (laptops, mobile phones, USB drives) and company-controlled cloud storage accounts (e.g., OneDrive, Google Drive, Dropbox) used by the employee.
• Preserve key systems: Ensure that logs from network devices, email servers, and company applications are being retained and not overwritten.

Forensic Collection of Electronic Evidence

The collection of digital evidence must adhere to forensic best practices to ensure its integrity and admissibility. The ACPO principles of digital evidence (now updated by the NPCC) provide a robust framework, focusing on minimal intervention, an audit trail, and competent personnel.

• Imaging: Create forensically sound images (bit-for-bit copies) of all relevant storage media, including hard drives, mobile devices, and USB drives. This process must be performed by a qualified forensic practitioner using specialist hardware and software.
• Cloud data collection: For cloud services, forensically collect data directly from the service provider or through specialised tools that preserve metadata and audit trails. Consider O365 logs, SharePoint version histories, and cloud storage activity.
• Network and server logs: Collect relevant network traffic logs, firewall logs, VPN connection logs, and server access logs. These can indicate unusual data transfers or access patterns.
• Email and communication data: Preserve and collect the employee's company email account, including sent items, deleted items, and drafts. Investigate any use of personal email on company systems.
• Backup systems: Identify and preserve relevant backup data. This can be critical if primary data sources have been deleted or altered.

Interviewing the Employee

This is a sensitive stage and requires careful planning. If there is a possibility of criminal proceedings, the employee must be cautioned in accordance with PACE. For internal investigations, ensure HR is involved and that the interview process adheres to employment law best practices. The objective is to gather information, allow the employee to explain anomalies, and assess their credibility. Any statements made should be accurately recorded.

The eDiscovery Workflow in Data Theft Investigations

An effective data theft investigation integrates seamlessly with the eDiscovery workflow. Each stage, from identification to production, is critical for building a comprehensive case.

• Identification: This initial phase involves identifying potential sources of electronically stored information (ESI) relevant to the data theft. This includes not only the suspect's devices but also network shares, email servers, cloud accounts, and any systems that track data access or transfer. Key custodians and potential data locations are mapped.
• Preservation: Once identified, relevant ESI must be preserved to prevent alteration or deletion. Legal holds are issued, and technical preservation steps, such as those outlined above (imaging, suspending access), are implemented.
• Collection: Forensic collection ensures that ESI is gathered in a defensible manner, maintaining a chain of custody and preserving metadata. This stage is crucial for ensuring the admissibility of evidence.
• Processing: Collected ESI is processed to make it reviewable. This involves extracting text, de-duplication, de-NISTing (removing known system files), and preparing data for review platforms. File types such as PSTs, MSG files, and various document formats are converted into a common, searchable format.
• Review: Legal teams review the processed data to identify documents relevant to the data theft allegations. This includes searching for keywords related to intellectual property, confidential terms, transfer methods (e.g., 'USB', 'personal email', 'Dropbox'), and communications with external parties. Tools for conceptual searching and technology assisted review (TAR) can be deployed to manage large datasets efficiently.
• Analysis: Beyond simple review, analysis involves piecing together the narrative of the data theft. This may include timeline analysis of file access and transfer, examination of deleted files, and correlation of network activity with specific documents. Data visualisation tools can help identify patterns of suspicious behaviour.
• Disclosure or Production: If litigation proceeds, relevant and non-privileged documents identified during the review and analysis phases will be disclosed or produced to the opposing party, adhering to CPR Part 31 and PD 57AD requirements. A Disclosure Review Document (DRD) may be required for complex cases.

Challenges and Mitigations

Investigating data theft presents several challenges. The sheer volume of ESI can be overwhelming, necessitating sophisticated tools and methodologies. Data encryption poses a significant hurdle; policies should ensure that keys or access methods for company devices are available. The risk of reputational damage, both to the company and the employee, must be managed carefully. Furthermore, cross-border elements introduce complexities related to international data protection laws and mutual legal assistance treaties.

Mitigation strategies include implementing robust data loss prevention (DLP) systems, conducting regular employee training on data security policies, and having a pre-planned incident response framework. Regular audits of system access and data transfer activities can help detect anomalies early. Engaging experienced external forensic and legal professionals can navigate the complexities effectively and ensure compliance with all regulatory and legal obligations.

Conclusion

Investigating an employee suspected of stealing company data demands a structured, legally sound, and forensically robust approach. From establishing the initial legal basis to navigating the eDiscovery workflow, each step must be executed with precision. Proper planning, adherence to UK legal frameworks, and engagement of expert practitioners are essential to protect the company's assets and ensure a defensible outcome.