Addressing Employee Misconduct Through Technology-enabled Investigations

Related to: Nuix NEO Data Privacy , Nuix NEO Investigations , Nuix Workstation

Employee misconduct is an issue government agencies and corporations can ill-afford to ignore. The vast majority of employees perform their official duties and daily assignments with integrity and conduct themselves in accordance with the highest ethical standards established by their employers. However, both public sector and commercial organizations frequently encounter employees engaging in behaviors that violate policy and procedure or are antithetical to organizational values and mission statements. It is estimated that employee-related misconduct costs US companies approximately $50 billion annually. The global costs of employee misconduct are even greater with the estimated annual financial impact exceeding $3 trillion.

While the risks of financial loss related to employee misconduct are alarming, the potential impact on the financial bottom line is only part of the problem. The variety of bad acts in which employees may engage can degrade workforce morale, undermine organizational reputation, and diminish public confidence and stockholder value in the organization. And when it comes to workplace misconduct, co-workers are often the first to become of aware of the issue. Where the organizational culture supports reporting, co-workers are the first to bring the information to the attention of management officials.

 

WHAT DOES EMPLOYEE MISCONDUCT LOOK LIKE?

Employee misconduct comes in many shapes and sizes; it is as diverse as the workforce itself. It can be intentional and malicious or unintentional and inadvertent. Regardless of intent, misconduct involving an employee must be properly addressed and resolved quickly to limit its potentially corrosive impact on the organization and the workforce.

Consider these examples:

• In September 2018, a bank teller in Brownwood, Texas was charged with the theft of more than $300,000 from her employer. The teller had worked for the bank for more than 25 years and became a suspect after an audit identified a shortage of approximately $2 million. During interviews with law enforcement, a co-worker reported that the teller frequented casinos with her spouse. Evidence collected by law enforcement demonstrated the teller spent more than $3 million at an Oklahoma casino between 2011 and 2018.
• Internal reporting led to the investigation of an allegation that a supervisor sexually harassed and retaliated against subordinate employees and in at least one instance engaged in an improper, consensual sexual relationship with a subordinate. Investigators determined the supervisor coerced female subordinates to engage in sexual activities in exchange for promotions. The investigators also found that the supervisor-subordinate relationship undermined the consensual nature of the relationship, potentially violating agency policy and negatively affecting the appearance of impartiality in the supervisor’s oversight of the employee’s official duties.
• A California Department of Motor Vehicles (DMV) employee reportedly slept on the job but escaped any disciplinary or corrective action. For more than three years, DMV co-workers reported the activities of their colleagues to management; however, no action was taken. An audit disclosed the DMV employee failed to perform her official duties and misused 2,200 work hours at a cost of $40,000 to California taxpayers.

 

UNDERSTANDING THE MODERN THREAT LANDSCAPE

The internet, email, social media, and the availability of applications available for use on computers, smartphones, and tablets have empowered employees in creating and retrieving information. However, these same technological innovations have also provided employees with the ability to access, collect, share, and disclose data that may violate organization policy and procedure, place the employer and its mission at risk, or implicate a variety of administrative and potentially criminal violations. Allegations related to employees accessing inappropriate content while in the workplace are common. Similarly, allegations of employees sharing offensive emails, inappropriately accessing and disclosing information online, and using company-owned devices for non-work purposes create similar challenges for internal investigators in public agencies and in commercial organizations.

As W.H. Allen noted, “Forensic examination of computer and other digital data has become an indispensable tool for law enforcement, corporate security and intelligence gathering.” (p. 59). While the proliferation of digital devices in our daily lives provides malicious actors with the ability to skirt the rules and regulations that govern employee on-duty and off-duty conduct with relative ease, investigators empowered with the right technology solutions are exponentially more effective finding the answers to the most critical questions that form the foundation of employee misconduct.

During June 2017, a contract employee supporting a US intelligence agency was charged with unlawfully disclosing classified information. Investigators used a combination of traditional investigative techniques and the review of digital data to determine the suspect had accessed a government system to locate, acquire, and email documents containing classified information to an online news outlet. Information maintained in digital format helped reduce the number of suspects from six to one, and empowered investigators in their efforts to determine who was responsible for the classified information leak.

In December 2018, a report was issued regarding an internal investigation into significant misconduct within a US sports organization. The report demonstrates the value of technology-enabled investigations in the review and assessment of digital evidence to determine the veracity of information obtained during traditional witness interviews, the retrieval of digital evidence from a variety of devices, and the identification and collection of evidence that may have been intentionally or inadvertently deleted by individuals who are parties to the underlying investigation.

 

INVESTIGATING EMPLOYEE MISCONDUCT

Properly investigating employee misconduct requires a methodical approach on the part of managers and investigators alike. Prior to launching an internal inquiry, managers who become aware of an employee misconduct allegation may need to take immediate action to mitigate additional risks and limit future damages. Depending on the type of allegation and relevant internal policy and procedure, a manager may need to work with their human resources office or general counsel to take immediate administrative actions, such as the issuance of a cease and desist order. In some instances, reassignment or paid suspension may also be an appropriate method for mitigating risks while an investigation is underway.

Once initial administrative triage activities are complete, investigators must conduct a competent inquiry to determine the circumstances underlying the allegation. Such an investigation will require the collection of documentary evidence and the taking of testimony to fully understand the allegation and to ensure a comprehensive investigation is conducted. In the not too distant past, the collection of documentary evidence would have been limited to paper that might be important to proving or disproving an allegation. With modern technology and connectivity, employee misconduct investigations have become much more complex. They regularly require the collection of digital evidence from a variety of sources and in a variety of formats.

Failure to collect and understand the context of all relevant digital evidence may have a deleterious effect on successful completion of an investigation. Haris Hamidovic observed, “If relevant evidence is not gathered in the beginning of an investigation, it may be too late to do so later in the process. Therefore, an organization’s management should consider the importance of digital evidence from the outset and be prepared to gather it for a wide range of scenarios.” Investigators tasked with conducting employee misconduct investigations must ensure they identify and collect all relevant digital evidence from the devices issued by the organization, including computers, smartphones, servers, and any other device on which relevant evidence may be present. Additionally, because many organizations have adopted “bring your own device” methodologies, investigators may need to retrieve potentially relevant data stored on a personally-owned device if, and when possible.

 

THE ADDED VALUE OF TECHNOLOGY-ENABLED INVESTIGATIONS

The exponential growth of data sets potentially relevant to employee misconduct investigations and the ubiquitous nature of digital devices in our daily lives has created an increasing number of sources where pertinent evidence may be located. As a result, the deployment and use of technology-enabled investigations solutions is essential to conducting efficient and effective inquiries.

Lucas Donato observed that, “We live in an era in which information is essential to human society. The kind of technology that handles information evolves quickly and constantly offers new powerful resources for information processing and transmission.” Accordingly, investigators working in both the public and private sectors must be prepared to collect and analyze digital evidence in the process of thoroughly addressing employee misconduct allegations. The effective exploitation of digital evidence can, according to Hamidovic, “limit business risk by providing support for legal defense, civil litigation, criminal prosecution, internal disciplinary actions, intellectual property rights claims, and due care documentation.”

However, in today’s digitally enabled world, the sheer volume of data available for review while investigating employee misconduct can overwhelm the resources available to support data collection and analysis. As Jennifer Schroeder and her colleagues found, “To correlate known entities [an investigator] must manually search for associations by examining a large number of documents. The documents may range from structured database records … to unstructured report narratives.”

To overcome the challenges associated with data volume, investigators need the support provided by technology-enabled solutions that:

• Automate the analysis and review process
• Recognize a variety of file types
• Incorporate pre-defined named entities
• Allow for the customization of named entities to further refine the data set under review.

The existence of employee misconduct is an unfortunate reality. Public agencies and commercial enterprises can choose to ignore it at their own peril or implement policies and procedures to be both proactive and preemptive in dealing with workforce misconduct challenges, including the establishment of internal investigative components or the use of third parties to conduct inquiries into allegations of workforce-related issues.

As Stephen Nickson suggested, “When it comes to investigating suspected incidents of employee misconduct on the job, an employer can either significantly limit potential liability or greatly expand it. How the investigation proceeds, when it is conducted and what is done with the collected information can make or break even the most legitimate cases of employee wrongdoing.”

Through the use of trained, skilled investigators and the introduction of the proper technology-enabled investigative solutions, public sector and commercial organizations can mitigate risk and overcome the investigative and data analysis challenges of today and tomorrow.