It soon became clear that the employee had indeed stolen confi-dential
customer lists, pricing and technical data and that both he
and the competitor were using this information to poach the com-pany’s
customers. The company therefore brought an injunction to
prevent the use of its confidential information and to require the
employee and competitor to return it. Although the court grant-ed
a partial injunction – prohibiting the employee and competitor
from soliciting the company’s customers – it declined to make an
order for the return of confidential information. This was for two
reasons, both of which could potentially have been avoided if the
company had followed the steps set out above.
First, because there was no forensic image of the devices, the
company could not prove what information was on them pri-or
to its investigation, nor could the defendants carry out their
own forensic analysis on them. Second, although the compa-ny
could demonstrate that the employee had inserted certain
USB devices on certain dates, its investigation had inadver-tently
deleted any evidence of what was transferred to those
devices. Given the frequent and legitimate use of USB devices,
the court was not willing to infer that confidential information
had been taken.
While the injunction against soliciting the company’s clients
was an important victory that “stopped the bleeding,” the weakness
of the electronic evidence meant the employee and competitor
were able to retain the company’s confidential pricing and tech-nical
It does not need to be an expensive and time-consuming pro-cess
to engage an expert to carry out these key steps. Creating a
forensic image and running the forensic searches described above
can be done relatively quickly and inexpensively and is essential
to ensuring important evidence is properly collected. As the case
study demonstrates, failing to do so can seriously prejudice the
company’s position going forward, especially if court proceedings
are ultimately required.
By contrast, when a forensic investigation is conducted properly,
the company has a wide range of options available to it.
If there is evidence the employee has taken or transferred con-fidential
information to a competitor, the company can seek a
court order that the information be returned and that the com-petitor
forensically search its computers and servers to delete any
information it received. This will prevent any further harm to the
If there is evidence that the employee is breaching restrictive
covenants in the employment agreement, such as non-solicitation
or non-competition provisions, the company can seek a court
order that the employee immediately stop the solicitation or com-petition.
This again prevents any further harm from occurring.
In either case, the court will expect the company to produce ob-jective
evidence demonstrating the alleged misconduct and will
often require the company to provide the original source of that
evidence (the forensic images) to the employee and his or her own
forensic expert. n
Aniko Kiss is the principal and lead computer forensic expert at
Digital Excellence Forensics Inc. Matthew Law is a litigator at Lax
O’Sullivan Lisus Gottlieb LLP.
Brina Blum / Unsplash
16 ❚ FEBRUARY 2018 ❚ HR PROFESSIONAL