Computer Forensics in Employment Defense

Due to the massive layoffs our country has experienced through this recession and the inability for much of that workforce to obtain new jobs, employment litigation is currently a focal point for attorneys representing employers. There are many standard practices that employers should follow when terminating an employee, but one of the most valuable steps is often overlooked. The potentially most valuable resource to defend employment matters could be the company issued phones and computers. With the proper acceptable computer usage policies in place, the digital evidence in the employer’s possession could contain the information needed to successfully defend the suit.

For the majority of today’s workforce, the lines between business and personal lives no longer exist. The majority of employees today work during their personal time and conduct personal business while at work. The primary tool for work and personal activities is technology of some flavor. Until recently, it was routine for employees to conduct personal conversations primarily via email, both using the company email system and personal email accounts typically not logged by the company (Gmail, Hotmail, etc).

Social Media

However with the recent explosion of social networking sites, email is now combined with Facebook, MySpace, and Twitter communications just to note a few. If you currently have a Facebook account, you can test this theory. Analyze the times of status updates for your Facebook “friends” and note the times of the posts. Or simply look to see who is online with the Facebook system during periodic times during the workday.

I want to be clear that this is not an indication of someone’s dedication to his or her work, but the culture shift. It is likely that those with even those with the most stringent work ethic will participate in these activities during business hours, the lines between work and personal lives are eroding. Combining email and social networking sites with detailed Internet activities, research, personal pictures, and other activities performed on their work computer or mobile phone may provide an unintentional diary that will aid in your employment litigation matters.

Now that the stage has been set for the value of digital technology in employment litigation, let’s be sure the appropriate paperwork is in place. As case law has demonstrated, just because the company owns the asset that this information is located does not necessarily guarantee that it can be accessed and reviewed. As the “Time to Review Corporate Computer Policies” article in this newsletter states, companies need to be certain that the appropriate acceptable usage policies for corporate technology is in place before issues arise that will benefit from leveraging this information. The above mentioned article outlines three good examples of “loopholes” in the policies that prevented crucial information from being leveraged in employment matters and provides tips for tighten up the policies for your clients.

With everything in place, let’s apply digital forensics to routine employment litigation.

Employment Litigation in Action

Let’s start with a sexual harassment case in which the plaintiff accused a superior of sexual harassment and filed suit. Leveraging digital forensics discovered thousands of Facebook chat messages, Internet activity, and deleted emails with pictures attached confirming that the relationship was mutual and that the superior had actually tried to end the relationship numerous times.

In a wrongful termination suit, the information technology manager was terminated for a number reasons, including an inappropriate relationship with a co-worker that was denied. Digital forensics was leveraged to recover more than 200 text messages from a smartphone that was inadvertently backed up to a corporate computer, important explicit images were found, recovered Internet history confirming secure communication with the coworker, evidence demonstrating abuse of authority by checking the email of superiors, and detailed efforts of spoliation to destroy important information. All of the information was gathered from the technology assets within the defendant’s possession.

In a worker’s compensation suit after an accident at work, the plaintiff claimed medical conditions that diminished the quality of life. A digital forensic investigation discovered extensive research on the claimed conditions. However the Internet research did not detail treating or living with the conditions, the research performed was specific to worker’s compensation calculators, workers compensation attorneys, and the physical symptoms of the extraordinary conditions that were demonstrated during depositions. In addition there were personal pictures taken of the plaintiff after the incident while at a sporting event, enjoying a family beach vacation, camping, jumping off of a rock cliff into a lake, and jumping off of a bridge into a lake.

Electronically stored information must also be handled properly when asked to produce in litigation. Remember that the “Genesis” of eDiscovery as we know it today started with Zubulake v USB Warburg, a “routine” employee discrimination suit. In another routine eDiscovery request in a wrongful termination suit, the defendant failed to properly preserve and produce emails requested. The defense also did not produce emails from two named custodians and failed to properly preserve the laptops used by these custodians. When the plaintiff produced emails that the defense did not, problems quickly arose for the defendant. In the majority of all case law in which the defendant is sanctioned, it is due to lack of proper identification and preservation.

In today’s challenging environment of employment litigation defense, this potential wealth of valuable information might very well be in the possession of your client and ready for your use to defend them. The challenges that you face will be ensuring that the proper acceptable usage policies are in place and that the data is properly preserved. Company issued laptops, mobile phones, email servers, shared files servers, and even electronic badge systems may contain the proverbial “smoking gun” for your case.

It is also possible to determine whether or not value exists before making a large investment. As an example, we have what we call our “early case assessment” procedure in which we can quickly search for keywords, determine all documents accessed, applications executed, and a quick Internet usage analysis in a minimal amount of time. This information helps our clients to determine whether or not to continue with a full investigation of the digital device.