An interview with QDiscovery’s Yaniv Schiff and Curtis Collette. Their remarks have been edited for length and style.
CCBJ: Tell us about the types of situations with departing employees that warrant investigations. Do you find this is more typical in certain industries, sectors or divisions of certain companies?
Yaniv Schiff: We see investigations across the board. Every industry, every company has information that’s valuable to them. Intellectual property and trade secrets, of course, or it might be the price list or a client list or some other internal documentation that makes their company unique. If somebody made off with that and if it’s valuable enough, it might warrant an investigation.
There are some common situations that warrant investigations. We often get involved when an employee goes to work for a direct competitor. Sometimes that’s evident because the competitor is suddenly winning bids they wouldn’t typically win. Or perhaps a competitor releases a new product more quickly than expected. These are both common scenarios where our forensics group gets involved and performs an investigation.
Curtis Collette: When a group of employees, particularly a team, leaves at or near the same time, an investigation may be warranted. Unhappy employees, particularly those who have been very vocal about their unhappiness, can be another investigative trigger, primarily when the employee is not leaving voluntarily. And the most obvious trigger is employees who mention or threaten litigation.
Beyond these situations, many companies have standard investigation policies for particular roles within their company. The roles that most often warrant investigations include sales, executive-level employees, product development and other roles that have access to data the company considers essential.
What are some of the indicators that an investigation is going to become litigious?
Schiff: Probably the biggest indicator is evident after we report our initial finding and the company attempts to get the information back from the former employee. Their success will dictate whether they need to file a temporary restraining order or an injunction of some sort. The suit might be against the individual employee or against the company the employee went to. We often see employees leaving as a group, either to form their own company or to re-create their team at a new company, in which case it might be that the other company is poaching certain groups of people and you might have a course of action against that competitor.
Collette: Some indicators are more obvious than others, such as if an employee was let go. The departure may be the final step in the HR process stemming from an incident or the result of performance concerns. The departing employee might be a member of a protected class and have a readily available course of action.
What are the risks or possible costs of not treating investigations as if they will evolve into litigation?
Schiff: One of the biggest risks is spoliation, or loss of data. It’s not uncommon for a company to repurpose computers when employees leave. Six months down the road, the former employee sues or the company wants to launch an investigation. That computer has now been in use for the past six months by a different employee, so there’s the possibility that data has been lost and deleted. Not preserving the data properly, even if you’re not going to perform a full-fledged investigation, is a risk. The costs involved in preserving the data are pretty negligible compared to the risks if litigation comes down the road.
Also, if you terminate an employee and the employee makes a comment during the exit interview that leads the HR person to observe, “This might turn into a lawsuit,” it’s the obligation of the company to preserve certain information in response to anticipating that lawsuit.
On the other hand, if you fire somebody and you anticipate going after them because you know they’re going to a competitor and you fear they stole your information, you still have a duty to preserve as long as there’s that anticipation of litigation.
We treat everything as if it’s going to go to litigation. All the preservation, all the analysis we perform, all of the opinions we offer our clients are presented so they can be used in court if necessary.
Collette: If an investigation does evolve into litigation and steps were not taken during the investigation to prepare for it, then the opportunity to be proactive can be lost. By taking additional steps early on, legal teams have the time and information needed to respond appropriately rather than reacting. For defendants, the best cost-saving opportunity in litigation is in limiting the scope as early as possible.
We treat the investigation work we do for clients as if it is part of a litigation. The individual projects define the level of activity. In some cases, we might do a collection for preservation purposes and limited, if any, analysis if the likelihood of litigation is low. On others, we may collect everything and perform immediate in-depth analysis to confirm all of an employee’s activity. Such an investigation might even come before the employee has departed. In either situation, all work is conducted in a credible and defensible manner so that it is admissible in court should litigation ensue.
What are the most important steps a team should take to prepare for possible litigation?
Schiff: From the forensic perspective, maintaining chain of custody and ensuring no data loss. That can be as simple as making sure the email account used by the departing employee doesn’t get deleted. Maybe it just gets disabled and archived. It could also include creating a clone or forensic image of their computer. In more complex environments, it might include backing up certain network environments or logs of some sort.
Collette: Employers should have a consistent off-boarding process for all employees that includes a procedure to evaluate whether additional investigation is merited. Part of that evaluation might be based on role or department. Also, be on the lookout for triggers such as comments from a departing employee that indicate they’re unhappy or threatening litigation. You want to make sure your process highlights the factors that increase risk of litigation and merit more in-depth action. There should be some flexibility to customize the process when there’s a specific need, particularly when there are indicators that the investigation is likely to become litigious.
Just as important as having a process is following it for all employees. There has to be some sort of audit built in. How do you validate that you’re following your processes? Are you checking your processes on a regular basis to make sure they are reliable and defensible?
Make sure different departments talk to each other. Investigations will often be initiated by a compliance group. They shouldn’t conduct investigations independent of the litigation group. Similarly, the HR person handling the layoff needs to be aware of indicators the employee may sue the company and loop in the appropriate departments. It shouldn’t just be attorneys talking to each other. The attorneys never own the data. The data is almost always held by some technical person who will know where that data is and will understand what kind of retention policies exist. This discussion at the first sign of potential litigation can save your company time and greatly reduce investigation costs.
Let’s talk about the evolution of employee departures over the past ten years and what you anticipate over the next five or ten years.
Schiff: From the forensic perspective, the biggest evolution has been mobile devices and cloud-based data storage. The mobile device has become a treasure trove of information: text messages, pictures, even geolocation information allowing you to see whether the employee was where they said they were. That becomes incredibly relevant in certain types of investigations.
Almost every single investigation we work on now involves some sort of internet-based data transfer. Did the employee upload a document to Dropbox? To their personal Gmail account? Every day there are different services and applications that offer different solutions.
Collette: There is now a blurring of lines between personal and company resources that can make once-routine processes much more complicated. Think of the stereotypical “departure,” with the now former employee walking out of the office with a box of personal items, leaving behind their ID badge, laptop and company phone. With the rise of “bring your own device” (BYOD) policies and enhanced telecommuting, companies must have processes that address departing employees who have never entered a company office and never had possession of a company device. A company’s departing-employee processes must continue to evolve to keep pace.
Those processes also need to keep pace with the frequency of departures. There is a lot more transition in the economy with people leaving jobs more quickly. Every departure does not merit a full investigation, but you can’t afford to miss the ones that do. Your processes need to be predictable and aligned so that you can do this in a cost-effective manner.
Yaniv Schiff leads QDiscovery’s Digital Forensic Investigative and Technical consulting services and is also the lead testifying expert for many cases involving trade secret theft and matters involving spoliation. He can be reached at [email protected].
As solutions architect for QDiscovery, Curtis Collette partners with clients and internal teams on the efficient definition and delivery of services with the best mix of processes, people and technology. He can be reached at [email protected].
Published January 11, 2018.
