Digital Evidence, Departing Employees, Overdue Awareness
A recent Law Technology News article by Vancouver journalist/lawyer Marlisse Silver Sweeney focuses on gathering digital evidence from departed employees.
Now, best practice demands that employers have a protocol for gathering digital evidence at the moment an employee leaves. Otherwise, the ex post facto gathering of evidence is closing the barn door after the horse has left.
But, setting aside this concern, the main point of Ms. Sweeney’s piece is that ex-employees will likely have data - i.e. digital evidence - in more places than the obvious ones. Sure, the employee’s business email account, phone and computer will house evidence. But Ms. Sweeney also points to:
- the employee’s browser data (e.g. searches, pages viewed, map data);
- social media accounts;
- cloud-based accounts (e.g. Google Drive, Dropbox, Flickr).
To these potential sources of evidence, we could add:
- personal accounts to which the ex-employee forwarded email;
- messaging apps and services like WhatsApp or BBM;
- accounts of ex-employee’s assistants and co-workers;
- ISP and phone company records;
- messages and data stored in the ex-employee’s car.
We at ellwood Evidence once found conclusive, smoking-gun evidence in the wiped files - not merely deleted, but wiped (deleting leaves files retrievable; wiping, in principle, does not) - of an absconding ex-employee.
There are other places to look for digital evidence. How extensively we search depends on (a) how much access we are granted to the computers and accounts of the ex-employee, and (b) how thorough a search is needed in the circumstances.
But there’s a larger lesson to draw from Ms. Sweeney’s article: Awareness. Ms. Sweeney’s piece raises awareness about digital evidence. Awareness that digital evidence is a multi-faceted thing. It may be here. It may be there. It may be here and there. The methods of collecting and preserving evidence that were good in the past, are not adequate for digital evidence.
People in business and law need to be aware of the realities of digital evidence. These realities are not new. They have been with us for almost a decade.
It’s not about knowing the details and technicalities of collecting digital evidence. It’s just about the need to be aware of the new realities. The awareness (amongst most people) is, frankly, overdue.
Read Marlisse Silver Sweeney’s article here (registration required).