Many companies don’t think about how important a departing employee’s computer could be. Well, they may recognize the computer as being valuable itself. That is, as equipment to hand over to another employee. But the information on the computer could be worth even more. Especially if the employee causes trouble or otherwise ends up in a dispute with the company.

Which Employees?

Yes, there are still many jobs that don’t directly involve the use of computers. But even some of those employees have email access. Or they might have the ability to log in to a computer station at work for limited purposes. You would at least want to tie down their email accounts and log-ins.

Other employees rely heavily on computers in their work. Some people have greater access to indispensable company data. And different employees have varying capacity to harm the company electronically or otherwise, such as through future competition.

You probably don’t need to preserve every aspect of every employee’s computer when they leave. But you should consider which positions and which employees are vital enough to warrant these measures and to what degree.

Recovering the Computer Equipment

If the employee is leaving with notice, you have time to work out a plan. You can get everything back in an orderly manner. When you’re letting someone go involuntarily without notice, however, you have to be ready to act fast.

Many employees have a laptop that they take home with them, or maybe a tablet device or company smartphone. Some, of course, have a physical desktop computer. When you bring these employees into a termination meeting you want someone else in the organization to be cutting them off from their access. They may still have a smartphone in their pocket at the moment, so you don’t want them to reach in their pocket and frantically forward company information off to a personal account. So get that access cut off quickly.

The next step then is during the meeting you want to start the process of getting the property back from them. If they do have a company phone in their pocket, they can be expected to hand it over to you immediately because it’s the company’s property. There may be issues that need to be worked out, like who gets to keep the phone number. And they might have personal files on it that they need. But you can work those matters out later. You’re not going to be unreasonable about it, but you have to secure company property first.

Other equipment, like a laptop, might be at home. You’ll have to make arrangements to get that as soon as possible.

Preserving Computer Evidence

When you can’t get equipment before the employee walks out the door, cut off any remote access you can. But it is still possible they could do something between the time they know they’ve been fired and the time you get the information or hardware back. So one thing you might want to consider is copying whatever they do return. This could mean copying the files on their desktop that’s already just still sitting at the office. It could mean copying the hard drive of their laptop that they were using, etc. This approach might be sufficient where there’s not much risk of a dispute down the road.

However, if the stakes are higher, you would ideally get a forensic image made of the hard drive, for example. That means having a qualified vendor copy everything, including meta-data and other electronic minutiae all the way back into the background details of the device (before you access anything). Then if there was a reason that someone needed to, an expert could go in and find out exactly what the user–the now-former employee–had done on the devices.

[You can find more on the technical details of forensic imaging here.]

This precaution could become especially important if there’s any risk of a trade secret theft or breach of a confidentiality agreement or something like that. There’s the possibility that this employee was already planning to go work for a competitor. Forensic imaging comes at some cost and hassle. But it can prove invaluable to make that copy, which you can then save in reserve for optimal evidentiary purposes down the road.

You might also need the information to defend your company against lawsuits by the former employee.

Reviewing the Former Employee’s Computer

You may need to go through the former employee’s computer, but in many cases, you shouldn’t go through the only copy, because then you will upset the evidentiary value by changing the metadata, etc. But certainly, once you get all of this information back and preserve whatever you need to preserve, you probably will want to go in and at least look around and see what they’ve been doing. You should make sure they didn’t do anything untoward at least based on your initial review. And, more practically, you may need some of their files for projects they were working on and otherwise to facilitate the transition going forward.

Have the Right People Involved

When dealing with a departing employee’s computer equipment, make sure the necessary personnel are on the same page. This often involves coordination between supervisors, human resources, IT, and legal. The last category becomes even more important if there is an expectation of future litigation or circumstances that could produce legal disputes. Some companies have appropriate in-house resources in each of these areas, but others will need to bring in trusted third-parties to cover all these bases.

 

For more useful tips and updates, sign up for the Horton Law email newsletter here.