Investigating a Departing Employee's Devices and Accounts: What Is Allowed

The short answer, expanded

The question has two halves that are easy to run together. The first is what the company may look at. The second is how it should look, so that whatever it finds can be used. Getting the first half wrong exposes the company to claims under the federal Stored Communications Act and the computer-access statutes. Getting the second half wrong means the evidence of the taking is contaminated or gone.

The rule of thumb is ownership and authorization. The company owns its devices and controls its accounts, and it decides who is authorized to access them. The employee owns their personal accounts, and the company is not authorized to enter them because a password happens to be cached in a browser. Everything else follows from that line.

Company-owned devices and company accounts

A laptop, phone or tablet the company issued, and the email, file-share and CRM accounts the company administers, belong to the company. Examining them after an employee leaves is generally lawful. The company's position is stronger when it has a written policy, acknowledged by the employee, stating that company systems may be monitored and examined, that employees have no expectation of privacy in company devices and accounts, and that the company may review activity when someone leaves.

The Texas Harmful Access by Computer Act, chapter 143 of the Civil Practice and Remedies Code, and the Penal Code offense it rests on, section 33.02, turn on access without the effective consent of the owner. The company is the owner of its own systems, so its examination of them is not the problem. The employee's unauthorized access, by contrast, may be.

Two cautions apply even on company devices. Personal information will be on them: family photographs, banking sessions, medical messages. A forensic examiner working under a protocol that targets company data avoids the company's managers reading through all of it, which matters both for the employee's privacy claims and for how the company looks to a judge. And a device used for both work and personal life under a bring-your-own-device arrangement is governed by whatever the policy says; without a policy, the company's right to examine a personally owned phone is far from clear.

Personal email, messaging and cloud accounts

This is where employers get into trouble. A departing employee's personal Gmail is often still signed in on the company laptop. Opening it to see whether files were forwarded there feels like examining the company's own device. It is not.

The Stored Communications Act, 18 U.S.C. § 2701, makes it an offense to intentionally access without authorization a facility through which an electronic communication service is provided and thereby obtain a communication in electronic storage. A web-based email account is such a facility, and the employee, not the employer, is the one who can authorize access to it. Section 2707 gives the account holder a civil action for actual damages with a statutory minimum of $1,000, punitive damages for willful or intentional violations, and attorney's fees, with a two-year limitations period. The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, can apply to the same conduct.

The practical rule for the company is simple. Do not open personal accounts, even if they are open on the screen. If the examiner finds evidence that company files were sent to a personal account, that evidence comes from the company's side, in the sent-mail folder of the company account or in the device's logs, and it supports a request that a court order the employee to preserve and produce the personal account under a protocol. The court can order what the company cannot do on its own.

Claims the company may have against the employee

Two computer-access statutes add claims to the trade secret and contract claims a company typically brings. Neither is as broad as employers hope.

The federal Computer Fraud and Abuse Act

Section 1030(g) of title 18 gives a civil action to anyone who suffers damage or loss from a violation of the Act, but only if the conduct involves one of the listed factors, most often a loss to one or more persons aggregating at least $5,000 in a one-year period. Damages for that category are limited to economic damages, and the suit must be brought within two years of the act or the discovery of the damage. Loss is defined to include the reasonable cost of responding to the offense, assessing the damage and restoring data, which is where most employers meet the threshold.

The larger limit came from the U.S. Supreme Court in Van Buren v. United States, decided June 3, 2021. The Court held that a person exceeds authorized access under the Act only by entering parts of a computer system that are off limits to them, not by using access they were given for an improper purpose. An employee who downloaded files they were permitted to open, even to take them to a competitor, generally has not violated the Act. An employee who used a colleague's credentials, or who logged in after their access was revoked, may have.

The Texas Harmful Access by Computer Act

Section 143.001 of the Civil Practice and Remedies Code gives a civil action to a person injured by a violation of chapter 33 of the Penal Code, if the violation was committed knowingly or intentionally. The core offense, section 33.02, is knowingly accessing a computer, computer network or computer system without the effective consent of the owner. Section 143.002 awards the prevailing plaintiff actual damages and reasonable attorney's fees and costs. The suit must be filed before the earlier of five years from the last act or two years from when the claimant discovered or reasonably could have discovered the violation.

The Texas statute has no dollar threshold and includes fees, which makes it attractive. Its limit is the same consent question: an employee who accessed what they were allowed to access, during employment, has a weak case against them under this Act. Access after termination, or after the company revoked permission, is the clearer violation. Where the company's real claim is that permitted access was abused, the Texas Uniform Trade Secrets Act and the confidentiality agreement are the better vehicles, as explained in can an employee take my customer list.

Preserve first, then examine

The order of operations decides whether the company's findings are usable.

1. Issue a litigation hold covering the employee's devices, accounts, logs and backups, and the accounts of anyone who worked closely with them. What a hold requires is covered in what a litigation hold letter requires.
2. Do not log in and browse. Every login changes file access times and can overwrite the artifacts that show what the employee did. The device should be powered down and secured.
3. Have a forensic examiner image the device before anything else, with a documented chain of custody. The image is what the examiner works from; the original is preserved.
4. Pull server-side logs now, because many systems overwrite them on a rolling basis: email server logs, file-share audit trails, VPN records, cloud-storage activity, badge records.
5. Suspend automatic deletion on the employee's mailbox and accounts, and preserve backups from the relevant period.

A company that reissues the laptop to the next hire, or lets IT poke around first, loses most of this. It may also face a spoliation argument if a lawsuit follows, which is treated in deleted emails and lost data: spoliation consequences.

What a forensic examination typically shows

A competent examination of a company laptop can usually establish, with timestamps, what the owner needs to know:

• USB devices connected, when, and which files were copied to them;
• files uploaded to personal cloud services or synced through a personal account;
• emails forwarded to outside addresses and attachments sent;
• large downloads or exports from the CRM or file share in the final weeks;
• mass deletions, use of wiping tools, or a factory reset shortly before the device was returned;
• searches and browsing that show intent, such as how to delete file history.

The examiner's report, with the preserved image behind it, is the kind of specific fact that supports a temporary restraining order under the Texas rules and that persuades a judge to order the employee's personal accounts examined under a protocol.

Example

Suppose a Dallas architecture firm's project manager resigns to join a competitor. His company laptop still shows his personal Dropbox and Gmail signed in. The office manager, meaning well, opens the Gmail and finds three emails to himself with project files attached, then forwards them to the firm's owner as proof.

The firm now has a problem of its own. The office manager accessed a personal account without authorization, which is the conduct the Stored Communications Act describes, and the way the evidence was gathered will be the first thing the project manager's lawyer raises. Had the firm instead powered down the laptop, had an examiner image it, and pulled the company mail server's logs, it would have found the same three emails in the sent folder of the company account, with no exposure, and would have been able to ask a court to order the personal account preserved and searched under a protocol.

Bringing a lawyer and an examiner in early

The investigation and the lawsuit are the same project. The litigator decides what needs to be preserved to support a temporary injunction, what the company may and may not look at, and how to frame a protocol the court will approve. The examiner carries out the technical work in a way that survives cross-examination. Together they also tell the company, sometimes within a day, that nothing was taken, which is worth knowing before anyone sends a letter.

Tina Wysk represents Dallas employers in trade secret and departing-employee disputes in state and federal court, including the investigation stage that precedes a filing; the practice is described at trade secret litigation.