Thank you for sharing!

Your article was successfully shared with the contacts you provided.
Employment terminations, whether voluntary or forced, may later result in company intellectual property or confidential information being disseminated by the departed employees. Customer lists, source code, proprietary technology — the potential value of such information is limitless. In addition, employment terminations can cause disruptions in business continuity as projects are transferred to remaining employees who may not have the same level of familiarity with the relevant documents or data. Indeed, it may not become apparent until months later that a departed employee had possession of a key document or piece of data. For these reasons, many companies would like to be able to preserve and search the documents and data that an employee possessed during employment. The cost of doing so, however, has traditionally been an obstacle. Current technology has largely surmounted this obstacle. Many companies have deployed a networked computer forensics capability for a variety of reasons, including responding to computer security incidents, for e-discovery, or for internal investigation purposes. Such companies can quickly and cost-effectively preserve the hard drives of each departed employee, thus enabling the companies to later protect their intellectual property, as well as transition important files or data to remaining employees. LOST PROPRIETARY INFORMATION Particularly in the case of trade secrets, which are lost if the owner does not adequately protect them, .1 Preserving a forensic image of an employee’s hard drive provides essential proof of the information an employee had access to at the time of his or her departure, including deleted and hidden data. If the employee later misappropriates proprietary information, the preserved hard drive will likely show whether the employee had access to the information, which may be a key factor in establishing liability. If there is a dispute regarding whether certain information was treated as confidential by the employer, the data on an employee’s hard drive may contain evidence of “confidential” or “proprietary” markings or stamps. In short, preserving the hard drives of terminated employees can help establish the specific information that was available to the employee prior to termination and how such information was treated by the company, which can facilitate later legal action if warranted, and which therefore aids in protecting the trade secrets of the company. SCOPE OF THE PROBLEM One case that illustrates the scope of the problem is Computer Associates International v. Altai,2 in which a company did not realize that a former employee copied source code to create a computer program for a competitor until three years after the employee left the company. In 1984, Claude Arney left Computer Associates to work for Altai, explicitly telling Computer Associates that he “retained no proprietary information and would not divulge trade secrets to any third party.” Despite this statement, Arney actually copied the computer source code for two versions of a Computer Associates program, and used this code to develop a program for Altai. For three years, Altai unknowingly (except to Arney) used this stolen code as “a component of several of its computer programs that competed with several of Computer Associates’ programs.” While the court ultimately held thatAltai’s program was infringing on Computer Associates’ copyright, the trade secret claim was barred by the two-year statute of limitations. As this case illustrates, “[I]n this world of high employee mobility and easy transportability of information, vigilance is required in the area of trade secrets.” Another case that highlights the difficulties that can befall employers is TMP Worldwide Inc. v. Franzino,3 in which the court denied TMP’s motion for a preliminary injunction against a former employee who had allegedly misappropriated trade secrets because TMP failed to provide evidence “that the individual defendant had access to, much less, misappropriated any customer lists, trade secrets, business plans or other confidential information.” If TMP had preserved a forensic image of the former employee’s hard drive, presumably it would have been in a better position to show that the ex-employee had access to the trade secrets in question. A case that illustrates the value of computer forensics in misappropriation cases is AdvantaCare Health Partners v. Access IV,4 in which a computer forensic investigation revealed that two of AdvantaCare’s former employees misappropriated proprietary information while working for AdvantaCare and used this information to start their own company, Access IV, a direct competitor to AdvantaCare. Upon learning of its former employees’ startup venture, AdvantaCare hired a computer forensic agency which, according to the court, determined that “(Defendant) accessed AdvantaCare’s computer network and copied a large number of AdvantaCare’s files prior to leaving, including files containing company policies and procedures, patient databases, employee lists, and contracts. The forensic agency also determined that (Defendant) tried to conceal his copying activities by deleting copied files from his hard drive. These findings are undisputed.” BUSINESS CONTINUITY Preserving a terminated employee’s hard drive also offers companies the ability to deal with transitional issues. Preservation may prevent customer service disruption and promote continuity ofoperations when faced with corporate mobility. Terminated employees are not likely to comply with requests for information after departing a company. Even employees who depart voluntarily may have trouble remembering details of a document or project, particularly after substantial time passes. By preserving a forensic image of a departed employee’s hard drive, which can be searched for key words or particular documents or files, a company is able to retrieve important data that may otherwise be lost,thereby saving time and money. Electronic data produced by companies is increasing. In 2000, “most companies store(d) up to 70 percent of their records in electronic form.”5 By 2003, approximately 93 percent of corporate information was being stored in digital format.6 In addition, between 1999 and 2003, there was a 114 percent aggregate increase in the production of original content stored digitally on hard drives.7 Clearly, the amount of electronic data produced by companies is increasing annually and will likely continue to do so in the future. However, the cost of storing such data is decreasing at a far faster rate. The amount of data on an employee’s computer varies by company, industry and employee. A high estimate is that a typical employee’s computer will contain 20 gigabytes of data. Meanwhile, the cost of storing data has rapidly decreased with rapid advances in technology. “The first PC hard disks had a capacity of 10 megabytes and a cost of over $100 per MB. Modern hard disks have capacities approaching 100 gigabytes and cost less than 1 percent MB! This represents an improvement of 1,000,000 percent in just under 20 years, or around a 67 percent cumulative improvement per year.”8 Even the options for storing data are increasing as companies can store data on devices ranging from optical disks to magnetic tapes to hard drives. A DVD can hold 4.7 gigabytes of data at a cost of less than $115. Increasingly, companies are storing data on magnetic LTO tapes, which offer the capacity to store up to 200 gigabytes of data for $55 — or $.28 per GB16. Some companies continue to store data on traditional external hard drives, which can store up to 500 gigabytes for roughly $1 per GB.9 Whichever storage medium a company chooses, the costs are surprisingly minimal, with upper bounds of just $1 per GB. Therefore, if a typical employee’s computer has a hard drive of 20 gigabytes, the cost of preserving a copy of that hard drive is approximately $20. Notwithstanding that the amount of data on an employee’s hard drive is increasing each year, the cost of storing this data is reasonable now and will continue to decline as technology advances. SOME EXAMPLES Let’s put these numbers to work in a few hypothetical situations. A large financial company with 50,000 employees will, if it has average employee turnover, lose approximately 12,000 employees per year. If the company has a networked computer forensics capability deployed, the cost of creating a forensic image of the hard drive of each departing employee will be minimal, as the technology allows the forensic acquisition to occur almost with the push of a button. Assuming 20 gigabytes of data per employee, and using 50 percent compression, the cost of preserving the forensic images of the hard drives would be approximately $10 per employee, or $120,000 per year for all departed employees. While this may seem like a large expense, keep in mind that a financial company with 50,000 employees may have revenues in the range of $35 billion to 40 billion. Given the size of the company, spending $120,000 to preserve the hard drives of each departed employee, which allows the company to later defend its intellectual property, and may allow the company to locate a crucial document or piece of data relevant to its business, is a minimal cost. To take another example, an average company with 1,000 employees in the professional/businessservices industry will have an annual turnover of approximately 400 employees. Again, if the company has a networked computer forensics capability, the cost of acquiring the forensic images would be minimal. For this company, the total cost of preserving the forensic images of all departed employees’ harddrives would be just $4,000. CONCLUSION To combat potential IP theft and loss of proprietary information, and to assist in the transition of important data upon the termination of employment, a company should preserve a forensic image of the hard drive of employees who are leaving the company. A company that does so can, if the need arises, produce the confidential information that the employee had access to, and can easily locate files or documents that may be important to ongoing projects. The common perception is that preserving data is expensive. However, although the amount of electronic data stored by a typical employee on his or her hard drive is increasing, the cost of storing this data is decreasing at a far faster rate. A company that has a networked computer forensics capability can easily acquire forensic images of hard drives, and the storage costs are negligible. Given the benefits of widespread forensic imaging of the hard drives of departing employees and the reasonable costs involved, doing so should be standard practice for sophisticated companies. Victor Limongelli is general counsel at Guidance Software, Inc., in Pasadena, Calif. Gregg Smolar is a law clerk at Guidance Software. ENDNOTES 1. Uniform Trade Secrets Act �1(4)(ii) (1985). 2. Computer Assocs. Int’l v. Altai, 918 S.W.2d 453 (Tex. 1996). 3. TMP Worldwide Inc. v. Franzino, 269 A.D.2d 332 (N.Y. App. Div. 2000). 4. Advantacare Health Partners, LP v. Access IV, No. C 03-04496 JF, 2004 WL 1837997 (N.D. Cal. 2004). 5. Lori Enos, “Digital Data Changing Legal Landscape, E-Commerce Times,” at http://www.ecommercetimes.com/perl/story/3339.htmlv (May 16, 2000). 6. “How Much Information 2003?,” at http://www.sims.berkeley.edu/research/projects/how-much-info-2003/(Oct. 27, 2003). 7. Id. 8. Charles M. Kozierok, Hard Disk Drives, at http://storagereview.com/guide/guide_index.html. 9. John Moran, “Bargain Prices for Hard Drive Storage,” at http://www.ctnow.com/technology/hcmoran0617.artjun17,1,6596276.column?coll=hc-headlines-technology (June 17, 2004).

This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.

To view this content, please continue to their sites.

Not a Lexis Advance® Subscriber?
Subscribe Now

Not a Bloomberg Law Subscriber?
Subscribe Now

Why am I seeing this?

LexisNexis® and Bloomberg Law are third party online distributors of the broad collection of current and archived versions of ALM's legal news publications. LexisNexis® and Bloomberg Law customers are able to access and use ALM's content, including content from the National Law Journal, The American Lawyer, Legaltech News, The New York Law Journal, and Corporate Counsel, as well as other sources of legal information.

For questions call 1-877-256-2472 or contact us at [email protected]


ALM Legal Publication Newsletters

Sign Up Today and Never Miss Another Story.

As part of your digital membership, you can sign up for an unlimited number of a wide range of complimentary newsletters. Visit your My Account page to make your selections. Get the timely legal news and critical analysis you cannot afford to miss. Tailored just for you. In your inbox. Every day.

Copyright © 2021 ALM Media Properties, LLC. All Rights Reserved.