Description: Richard Roe was an employee of Acme Voice/Data Cabling Company hired to run the voice/data cabling division of this growing organization. Richard Roe terminates his employment with Acme, providing no notice and no provision for Acme to inquire about any open issues with existing clients and jobs.
Type of Case: civil litigation
Court: Dallas County in Dallas, TX
Plaintiff: Acme Voice/Data Cabling Company
Defendant: Richard Roe in Operations at Acme
Complication: To complicate matters, there was no employment contract, confidentiality agreement, security policy, or employee titles. The employee handbook consisted of approximately two pages of text. No documentation existed showing that Richard Roe was an Officer of Acme.
Richard Roe becomes Secretary of Advent Corp. on April 27, 2005.
Richard Roe’s term of employment at Acme was May 8, 2000 through May 11, 2005.
Mr. Project Manager’s term of employment at Acme was September 29, 1997 through May 11, 2005.
Claims of Plaintiff
Acme purports that Richard Roe was an Officer of Acme and, as an Officer, had a Fiduciary Duty of no harm. Acme believes that Richard Roe and Mr. Project Manager at Acme took both customer contact and proprietary data from company systems to use in direct competition. Acme also believed existing data had been modified or removed from their system by Richard Roe and/or his accomplice, Acme’s Mr. Project Manager.
Texas is a right-to-work state and doesn’t enforce non-compete agreements. Richard Roe claimed no knowledge of his job title or responsibilities within Acme. Both Acme’s Richard Roe and Mr. Project Manager denied any tampering with, or possession of, Acme data, customers, or employees.
Computer Forensic Evidence Recovered
Due in part by the actions of Acme’s Richard Roe and Mr. Project Manager, the data recovery effort was extraordinary. A temporary Microsoft Exchange environment was established to restore and recover emails across two months of backups. All tapes were removed from rotation and replaced. Files, logs, dates, and timestamps had to be recovered and correlated across five systems and cell phones to determine, as closely as possible, what had actually transpired.
There appeared to be a concerted effort to cover electronic trails by deleting emails the same day they were processed, removing data from personal computers and network file servers, removing temporary files, running defrag utilities on computers, removing line item detail and closing bids to clients that had yet to be lost by Acme. While both Defendants had claimed in sales meetings at Acme there was no bidding activity in March and April, numerous bids were located, created by both Defendants, totaling more than $350,000.
Here’s a sample of what was found:
- Project Manager made visits to a prospective client and created a bid for work worth about $17,000. This bid was provided to Advent Corp., purportedly as a subcontractor bid, in an email dated April 11, 2005 stating, “…it would be nice for us to do this through Advent Corp.” The response from Advent Corp. was clear: “…I think the timing of the job will allow us to work it in-house when we complete things.”
- April 21, 2005: Richard Roe’s attempted to burn more than 300 MB of Acme data to CD including the bidding, job tracking, employee tracking, purchase order database system, client environment documentation, and all contact information. When this attempt failed, Richard Roe began to systematically, over the course of a few weeks, compress and email this same data to his personal Verizon account and to another co-conspirator.
- April 26, 2005: Richard Roe sends an email to Advent Corp. providing the required software to purchase, and the contact information for this purchase, to allow importing of the data acquired from Acme.
- April 27, 2005: Mr. Project Manager sends four proposals for existing Acme clients to Advent Corp. stating, “…4 quotes to send to…” These proposals were removed from the Acme bidding system.
- April 28, 2005: Mr. Project Manager makes several attempts to copy client bid, purchase order, and documentation to floppy. These floppies would not hold all the data and were found left at his station. Mr. Project Manager then communicates with his spouse and created 19 emails, with approximately 219 Microsoft Word documents attached, addressed to her work email account.
- April 29, 2005: Richard Roe sends proprietary work for a client proposal worth in excess of $750,000 to XYZ Company. Richard Roe continued to work on this proposal and on May 3, 2005 sends additional information to Advent Corp. for preparing the final product.
- May 5, 2005: Richard Roe receives an email from a prospective client, referred to Acme by a current customer, requesting information about Acme. This email was immediately forwarded to his personal Verizon account, and no follow-up was performed from Acme. Richard Roe, after May 11, 2005, provided a proposal to this prospective client on behalf of Advent Corp.
This is just the tip of this iceberg, as there were numerous other items found with similar impact to those mentioned above. Of course, Advent Corp. and its officers were added as defendants. Additional charges included conversion, misappropriation of trade secrets, Texas theft liability, unfair competition, conspiracy, and others.
All defendants disastrously chose to continue the fight in an attempt to negate the computer forensic evidence mounted against them. Before granting the temporary injunction, the judge stated that the forensic evidence was “compelling.”
As the process moved into e-discovery and deposition, the defendants found no end to their plight as the situation progressively worsened. Finally, a settlement was reached, but not until the defendants lost numerous customers and countless dollars. In the end, the Computer Forensics could not be ignored.
NOTE: Protegga LLC respects the privacy of all parties involved in each of our computer forensics investigation cases and, therefore, will not disclose cause numbers, company or individual credentials, or other items that may lead to identification.