Bad leavers: how to manage data and IP risks

Bad leavers are employees who've moved on from your business - or who are in the process of being moved on by you.

They may be individuals who feel resentful at leaving your business; or, quite commonly, they may be leaving of their own volition, but walking out of the door with a lot of valuable data that they should not lawfully be permitted to pass on...

They fit the label 'bad leaver' because they can create all sorts of trouble for you and your business.

Unfortunately, “bad leavers” can often look like just plain “leavers” when they move on. You may have said nice things in their leaving speech, been to their leaving party and wished them well for their future. Some considerable time may pass before you realise that they have been less than genuine employees, so it is important to put yourself in the best position to be able to produce documentary evidence if needed.

---

We asked Ankura Managing Director, Rob Jones, one of THE experts on data security and data forensics to collaborate with us on producing this guide, because when it comes to what employees past and present are doing with your data, Rob and his colleagues have pretty much seen it all.

---

“In our experience,” Rob shares, “these are a few signs that may indicate you have a potential bad leaver situation:

1. Your teammate seems busy, but is less productive than usual… (Maybe they’re printing or carrying documents, taking work home, more than usual – or downloading data on to a USB stick, unusually working earlier or later hours when others aren’t so much around…)

2. You lost one or more competitive bids to a rival, who now employs your former colleagues

3. Other team members have resigned, or have already left to join your competitor

4. Your trusted clients start to compare you more to your competitors

5. You suspect that your business data has been compromised”

“Your management skills will help you to confront some of these issues directly,” Rob comments.

“However, when all you have is a gut feeling, or the issues are too sensitive to raise formally, the evidence you require may be found in your company’s data.”

---

1. Communications are key

Your employees send and receive emails, text messages, instant messages and other types of communications daily.

These communications may contain important proof of bad behaviour.

2. Data leaves a trail

When documents are opened, edited, printed, or copied, this may be logged by the computer or servers used to access the information.

These records can be accessed and analysed by a computer-forensic expert, and they can help you to understand what may have happened and whether it is continuing.

3. Deleted data can be recovered

Even where an employee has gone to some effort to cover their tracks, experts armed with the right technology can find what may have been deleted, evidencing the concealment efforts as well, which can add even more weight to your case against the employee or ex-employee.

4. Think of your systems and devices as a potential crime scene

Data are the DNA and fingerprints that will help you to capture your culprit, so make sure that you at least do the following each time a person leaves:

a.) Ask them to return all computers, tablets, mobile phones and removeable media they may have. These include hard drives, memory sticks, CD’s and even floppy disks!

b.) Create an inventory and securely store all devices pending any or all inquiries.

c.) If you have to re-use the devices, make sure that they are forensically copied and then wiped before they are re-issued. If you do have a bad leaver, this good practice helps to remove doubt about who left the evidence on the device.

5. Make sure you always have the rights...

Always ensure that your employment (or other service) contracts, policy documents and staff handbook contain a robust collection of rights for you to be able to control, monitor, adapt and update your staff's data obligations and practices.

Make sure that your staff understand these documents and the obligations and rights they contain.

For more tips and recommendations on how to ensure that your staff are respecting your business and using its data and your IP responsibly, see our separate guide, also produced with Rob and the Ankura team, on this topic.