Report: Employee Theft of Information is Pervasive

Multiple media outlets (see here  and here, for example) have been covering an alarming report jointly issued recently by the Ponemon Institute, an Arizona-based research group, and Symantec Corp., that data theft is common among departing employees. As reported in the Washington Post, the most significant finding of a joint survey of employees who left a job in 2008 was that almost 60% of ex-employees admitted to taking company data of one sort or another. The most commonly identified kinds of records taken were “email lists,” personnel records, customer information (including contact lists), and “non-financial business information” (which presumably can encompass technical information, strategic information etc.). 

Approximately two-thirds of those who admitted taking company information said they did so in order assist with a new job. The report indicates that employees are stealing data in multiple ways. Most common (61%) is old-fashioned theft of paper documents or hard files, followed by downloading information onto a disc (53%), onto a USB memory stick (42%), and sending documents as attachments to personal emails (38%). Interestingly, comparatively few employees ]were taking information by stealing BlackBerrys and laptops. Another quite alarming finding is that approximately 25% of the employees indicated that they were able to access data on a company’s network even after they had departed.

If these findings are an accurate gauge of employees across a range of industries, they have far-reaching implications. I will put aside the obvious privacy and identify theft issues raised by such security lapses. (See this new blog for a comprehensive discussion of information security issues.) Companies are losing important, competitive information to employees who are taking such information because it may be valuable to a competitor. Yet, it is precisely in order to protect against such unfair competition that states have developed laws prohibiting theft of trade secrets and confidential information. For the same reason, most states permit enforcement of contractual covenants restricting certain post-employment conduct by departed employees.

So, what’s going on? As is surmised in the Washington Post article -- and I can confirm seeing this repeatedly in my own practice -- employees increasingly have a sense of personal “ownership” in the information they work with while employed. Many feel entitled to keep that information -- particularly if it involves their own work product -- after they leave. Coupled with the rapid evolution of technology in the workplace and employee mobility, the taking of valuable information as employees depart has become increasingly prevalent. 

The response from employers worried about these trends should be better planning and increased vigilance. Many companies have a haphazard approach to protecting their IP, particularly as employees depart. They may do a good job of requiring new hires to sign standard agreements, but then fail to remind employees of their obligations as they leave or even to recover company data and equipment. And many companies fail to take even rudimentary steps to protect against theft of information by departing (and often disgruntled employees).  An employer that wishes to protect against the phenomena described in the Ponemon report would do well to develop an approach to protecting information and an exit process that lays the groundwork for the possibility of later enforcement of existing agreements and policies. If the company has suspicions about the outgoing employee’s conduct or intentions, immediate consideration should be given to investigating the employee’s computer-related activities prior to his or her departure.  The fact is that most of the conduct described in the Ponemon report would have been detected by an employer that actually was looking for it.

Recent Decision Highlights Risks of the "No-Noncompete" Situation

While some in the business community continue to focus on whether the ability to enforce noncompetes in Massachusetts places the state at a competitive disadvantage vis-à-vis Silicon Valley, a recent decision from the Massachusetts Superior Court’s Business Litigation Session -- Network Systems Architects Corp. v. Dimitruk -- highlights the difficulties departing employees and their future employers can face even in the absence of a contract restricting post-employment activities.  These “no-noncompete” scenarios represent a significant litigation growth area.  (An article on this subject, co-authored by this writer and Sheila O’Leary, can be found here.) 

Absent a restrictive covenant, departing employees and their new employers still can be subjected to litigation involving claims of misappropriation of trade secrets, breach of fiduciary duty, violation of federal and state computer fraud statutes, tortious interference, and violation of  state unfair business practices laws.  The Network Systems Architects case involved the departure of a director of sales from the plaintiff to a competing venture, Accunet Solutions.  The employee apparently was not subject to a noncompetition or nonsolicitation restriction; hence, under Massachusetts law, he generally was permitted to leave for a competitor and, once there, compete for the customers he previously had serviced.  However, Mr. Dimitruk and his new employer, Accunet, found themselves defending claims that Dimitruk had misappropriated his former employer’s trade secrets and used them to solicit his former customers on behalf of Accunet.  In addition, Network Systems Architects alleged that Dimitruk had, before he resigned, solicited business from his customers on behalf of his future employer.  That allegation formed the basis of plaintiff’s claim that Dimitruk breached his fiduciary duty of loyalty.  Under Massachusetts law, an employee is free to make plans for subsequent employment, including with a competitor.  “What the employee may not do during his employment,” the court stated, “is undermine his employer’s business, such as by diverting his employer’s customers or employees to a competitor, or its resources to uses that serve interests inconsistent with those of his employer.” 

The Network Systems Architects decision addressed the parties’ competing motions for summary judgment.  The court denied both parties’ motions, finding that there was sufficient evidence for the claims to proceed to trial.  Thus, the plaintiff in this “no-noncompete” situation can continue to litigate claims of theft of trade secrets and breach of fiduciary duty against the former employee, and claims of intentional interference and unfair business practices against his new employer. 
A lesson to take from a case like this one is that hiring employers need to take a careful, strategic approach to hiring employees from competitors even in the absence of restrictive covenants.

Stay tuned for further developments on this topic