Protecting your business from an employee departure - the IT response.

                                         
 
 
 
Assume a scenario where you star salesperson tells you he/she is quitting or you are about to fire a subpar employee.  The employee may or may not have a non-compete or non-solicit.  The employee regularly has access to proprietary information.  This includes customer contact information, customer pricing information, and confidential internal pricing information.  What do you do in terms of protecting that information?
 
  • Email - Does the company monitor employee email - probably not.  As distasteful as it may sound someone in HR or someone on the business side may need to examine the substance of the employee's emails (from the company email address).  How far back? Depends on the situation.  The employee's  emails need to be scrubbed to determine if they are offloading or have offloaded proprietary information to competitors or personal email accounts for future use.  Further, the IT department needs to maintain and preserve the email account but end the employee's access to the account either immediately or upon some agreed time.


  • The network - Most employees are not going to email company information to a competitor or even a personal email account - some still do though.  The delivery device of choice is the thumb drive.  It's small, cheap, and can hold a lot of information.  I'm no IT expert but many IT folks can determine what type of downloading an employee has been up to including the use of zip drives or thumb drives.  How far back should the company go?  As far as necessary to obtain some "comfort" level.  

 

  • Beyond email and the network - Many companies have proprietary databases where customer/client information is maintained.  In one non-compete case a client was able to show that the former employee had dumped the entire database (through printing) the night before they were fired.  Can you do the same?  Many databases require an additional log in and indicate the when, what and where of the employee access.  Was there a middle of the night access prior to quitting or strange access from home? Find out.
 
These are of course a start - not a comprehensive list.  An IT policy for exiting employees is a must. The employee is naturally going to take what they have developed or worked on during their tenure. But, that "information" may not belong to them.  The company needs a standard operating procedure for handling the departure - an ad hoc response will not suffice.  That former employee will be your competitor.  

 

The Death of Downtime - Never Ending Content and Evidence

                                        

With the rise of social networks that permit us to update the world on the details of our lives and smart-phones that allow access to email, social networks, and the internet 24/7, there is always something to do. Take a look around. On my drive into work there is always someone on a phone texting, emailing, or talking. Same thing when I am in line at a store or even at my daughter’s soccer game. The worst is when I’m in meetings and the “constant emailer” can’t put down their blackberry for 5 minutes. (Sometimes I'm the constant emailer.)  There is no downtime.

 

I’ll leave the social commentary to those more qualified. But, from a legal perspective we are now creating a never-ending stream of written material that in many cases is archived a/k/a evidence. Email, social network posts, and other records can be used to recreate the details of a particular event or day. For example, if an employer has a general idea of when an employee began actively planning to establish a competing venture in violation of a non-compete, the discovery is endless. The employer now plaintiff can seek emails, Linked-in communications, Facebook posts and even phone records to trace the evolution of the competing business.

 

It seems as though we’re well past putting the brakes on 24/7 evidence creation through email and social media. But, everyone must be cognizant of what this means for business and employment disputes. Privacy, in many instances, is being abandoned by choice as we disclose our life's details on the web.

Email Rules - Beyond Foul Language

                                        

In cases with significant email traffic lawyers often use applications that sift through emails and documents using specific search phrases and terms.  Usually, the search terms and phrases tie to significant issues to the case or dispute.  Recently, the search terms used by the lawyers investigating the Lehman Brothers debacle were published. Those lawyers were charged with going through approximately 700,000 plus documents which totaled somewhere around 8 million pages.  They used a variety of search terms/phrases but the search that stood out was this one:

Shocked or speechless or stupid* or “huge mistake” or“big mistake” or dumb or “can’t believe” or “cannot believe” or “serious trouble” or “big trouble” or
unsalvageable or “too late” or ((breach or violat*) w/5 (duty or duties or obligation*)) or “nothing we can do” or uncomfortable or “not comfortable” or “I don’t
think we should” or “very sensitive” or “highly sensitive” or “very confidential” or “highly confidential” or “strongly disagree” or “do not share this” or “don’t share this” or “between you and me” or “just between us” or ((can’t or cannot or shouldn’t
or “should not” or won’t or “will not”) w/5 (discuss or “talk about”) w/5 (email or e-mail or computer)) or should w/5 (discuss or talk) w/5 (phone or “in person))

There are countless examples in the report.  As discussed here before, common sense is usually the best approach to determining whether your email is environment appropriate, but there is also a second level of screening.  I'll call it the "smoking gun" screen. How would you feel if the email you just sent was put up in front of a jury and you were cross-examined on its contents?  A far stretch in most circumstances but an issue that should always be in the back of the author's mind. 

Consideration of what is placed in an email should go beyond avoiding foul language and crude humor.  There are simply some issues that should not be addressed in electronic communications.  It ultimately goes back to common sense - there is no written policy that can provide sufficient guidelines.  Sometimes a phone call or even face-to-face meeting makes more sense than an email that lacks context and fails to adequately convey the issue.

(h/t Jacob Goldstein with National Public Radio)

 

Employee Departures and Trade Secrets

 

                                                

In a survey of 950 former employees, 60 percent admitted to taking confidential information from their former employers. 

Most of the data takers (53 percent) said they downloaded the information onto a CD or DVD, while 42 percent put it on a USB drive and 38 percent sent it as attachments via e-mail, according to the survey.

The survey also found that many companies seem to be lax in protecting against data theft during layoffs. Eighty-two percent of the respondents said their employers did not perform an audit or review of documents before the employee headed out the door and 24 percent said they still had access to the corporate network after leaving the building.

                                                A flash drive is a convenient way to take trade-secrets.

With layoffs taking place across the employment spectrum, employers must be vigilant in protecting their proprietary information from walking out the door with their former employees.  I've previously addressed what a trade secret is under Texas law, but just because something isn't a trade secret doesn't mean a former employee can take it with them.  So what can be done?  Here are a few suggestions:

  1. Ensure that your employee manual or agreement contains defines what the proprietary information is and requires the departing employee to return it at the conclusion of their employment term.
  2. Ensure there are appropriate safe-guards for proprietary information.  Is it password protected? Can you determine when employees have accessed databases or other company information?  If so, you can prevent or at least ascertain whether an "information dump" has taken place.
  3. During exit interviews with the employee, have a candid conversation with them about their obligations under the aforementioned agreements and confirm they have returned all proprietary information.
  4. Cut off the the departing employee's access to the company network. 
  5. Keep an eye on what former employees are doing.  Are they using company information with a new employer or new venture?