Successful second opinion in corporate espionage case – uncovering a salesperson’s theft of customer information

A top salesperson at a specialist software company was accused of stealing customer information and using it at a competitor. The case went to the Federal Court of Australia and was appealed all the way up to the full bench of the Federal Court. Initially, a well-known forensics company was assigned to the case, but they failed to analyse the evidence effectively. Notion Digital Forensics was called in to provide specialist assistance to the client and the law firm.

Problem

The client faced several challenges:

• The initial forensics company conducted a basic analysis, not a ‘close and detailed’ one.

• The case required advanced digital forensic techniques to uncover the full story.

• The client needed to be certain that the salesperson took customer information to make informed decisions on whether to seek damages and costs.

• The salesperson lost evidence, or some of the evidence was stolen from their possession.

Approach

Notion Digital Forensics stepped in to re-analyse the evidence using advanced techniques and a rigorous scientific approach. The investigation concluded:

• Identifying that the salesperson had copied files to a USB stick, proving unauthorized data transfer.

• Demonstrating that the salesperson copied and pasted information from the CRM system (Sugar CRM) into Excel, which helped the Court make its findings.

• Demonstrating the salesperson used a different computer to copy the information out of the CRM system.

• Reconstructing log files from old tape backups to reveal the reports that the ex-employee had run.

• Confidently responding to the ex-employee’s claims, based on the thorough scientific investigation.

Results

As a result of Notion Digital Forensics’ in-depth investigation and expert testimony, the following outcomes were achieved:

• The client obtained strong evidence of the salesperson’s theft of customer information, which led to damages being awarded in their favor.

• The client had more confidence in the scientific value of the evidence.

• The client was more satisfied with Notion Digital Forensics’ performance during cross-examination than with the initial forensics company’s efforts.

Conclusion

Notion Digital Forensics’ timely intervention and comprehensive investigation helped the professional services business mitigate the breach’s effects. Our expertise in digital forensics enabled the company to regain control over their systems, reassure their customers, and safeguard their reputation in a timely manner.This case study highlights the importance of engaging the right digital forensics experts and the value of a second opinion in complex cases. Key lessons learned include:

• The choice of digital forensics professionals can have a significant impact on the outcome of a case. Bigger firms might focus more on filling seats rather than ensuring people are as experienced and knowledgeable as they need to be.

• Advanced digital forensic techniques and a rigorous scientific approach an strengthen the evidence in corporate espionage cases.

• A second opinion from experts like Notion Digital Forensics can help uncover critical evidence that may have been missed or inadequately analysed by other parties.

Quotes from the Full Bench of the Federal Court of Australia

Their Honours: Paragraph 187 [Talking about Mr Garner’s appeal of Notion Digital Forensics’ Evidence – Matt O’Kane]: “Contrary to [1.5] of the Amended Notice of Appeal, it is not correct to say that the conclusions concerning the ability of the appellant to remotely access SUGAR were founded on “nothing more than the evidence of Mr O’Kane”. The submission fails to grapple with the compelling nature of the objective evidence considered by Mr O’Kane and upon which his opinions were based. Among other things, they were based on material found to exist within the SUGAR system which evidenced activity undertaken by a user accessing the database via the appellant’s login details. Mr O’Kane’s evidence explained how that material was found and expressed an opinion as to what that meant. There was no challenge to Mr O’Kane’s expertise to undertake the examination of the SUGAR system or the Intercad Laptop or to express an opinion about what was found there. The evidence of Mr O’Kane was more than sufficient to support the conclusions concerning remote access and the appellant’s proficiency of use of the SUGAR system more generally.

188 On the basis of the respondents’ expert evidence, the primary judge concluded that the appellant had used SUGAR “reasonably extensively in the closely examined final three months of his employment” (J [123]), that he “had no apparent difficulty in generating SUGAR reports” (J [123]), and that he “had the ability to copy and extract data from SUGAR without the need to generate a SUGAR report” (J [243]). Again, on our review of the evidence we are unable to identify any basis to disturb those findings. They are firmly supported by the forensic examination of the respondents’ information systems.”

Garner v  Central Innovation Pty Limited [2022] FCAFC 64 – http://www.austlii.edu.au/cgi-bin/viewdoc/au/cases/cth/FCAFC/2022/64.html