Corporate Investigative Ethics
 

Imagine you work for a large company and it is discovered, one day, that there is evidence that inappropriate material is being browsed at your company desktop. This evidence comes from an automated system that keeps an eye on network traffic, mostly web requests and proxy traffic, and has detected this through keyword content matching or known URLs. A company investigator is sent to your desk while you are away to find and retrieve the system linked to the originating IP address.

When the company investigator arrives, they see the company desktop PC, but they also find your laptop that obviously isn't owned by the corporation: it is a different make and model from anything ordered, it has no property label, and the serial number matches nothing in inventory. Knowing this, the investigator confiscates both systems and returns to a lab where the hard drives on both systems are removed and the content is searched for any material that violates company policy. Regardless if anything is found or not:

Is the above situation legal?
Does the answer change if your laptop was visibly connected to the company network?
Is it legal if it is suspected that the end user is browsing illegal material or involved in illegal activities?

I don't know nothing 'bout legal...

But I'd say that if the laptop was being used during company time, then ethically they have the same right to search it as the company machines, whatever right that might be--I'm assuming that you signed some sort of internet usage policy when you were hired, since almost everyone does nowadays. However, they obviously do not have the right to keep the laptop or destroy any of the data that might or might not be on it.

Wow was the laptop AT the place of employment? Did it contain work related material, was it used for work? Was the "illegal" stuff downloaded on personal or private time.

I have no answers, just more questions, but it would seem that if it was done on company time - that would be an issue and/or if it was brought into the workplace where others had the opportunity to see it.

Very good, very important questions. The investigator walks in with no knowledge of the laptop, no evidence that the laptop was being used on company time for work material or not, and no evidence that the laptop was being used for the illegal (or not) activities -- only the desktop has logged questionable material on the network.

Based on this evidence, I'd argue:

(1) That the investigator only has the legal authority under the employee's contract/company internet usage agreement/etc to seize the company PC for dissection and analysis and not the laptop. Inappropriate and/or illegal material is being accessed using company resources, so they (the company) have the right to seize any of its assets that may have been used in the act. The laptop, however, is private property of the employee and not subject to corporate search. This of course is contingent upon the absence of any clause in the employee contract/internet usage policy/etc that would grant the company the authority to seize the laptop.

(2) That, even barring any clause as aforementioned, the investigator would have probable cause to seize the laptop if a clear and present connection to the company network was visible at the time of his arriving at the workstation. Whether it was the company PC or the laptop which accessed the objectionable material, the access was done through the company network. Whichever device was used in the misuse of services would be subject to search as the service misuse is the issue.

(3) If it turns out that the laptop was used to access the material, and this was discovered without prior approval granted to search it or a clear link to the company network present at the time of the investigator's arrival at the scene, then legally speaking that evidence is inadmissible because it was obtained illegally. The investigator would only have had the power to search the company PC, not the laptop.

IMHO, I think a case could be made that a formal search warrant would be required to take the lap top and search it's content, hooked to the network or not. If the hardware is not owned by the company they have no right to search it and definately have no right to seize it. I would have to make it a huge legal issue and hire a high powered lawyer. For the hardware they own, they have all the rights and numerous cases have supported the rights of a business to do this. The other thing is that some businesses, and most government agencies retain the right to search anything in your posession if you enter their property. You supposedly abdicate your rights when you enter their property. But given that, even the military goes through a formal process to search certain containers that are considered personal property. For example, they may be able to look in your purse for security reasons to make sure you were not armed, but they would have no right to search your address book for names of people. But I am no lawyer. Someone at EPIC would know.
http://www.epic.org/

Is this a correct analogue?: On suspicion, towing the employee's car to the company parking garage where a company locksmith pops the door so the glovebox and trunk can be searched. After all, it was parked on company property.

Sidenote: I'm not in trouble, here, nor is anyone I know. Just in case anyone was curious...

I am pretty sure that they would need probable cause, but on governmental property, and military property, yes they could do this.

Actually, no they don't.
If they don't own the property, they can't search it without your permission or a cop with a warrant.
Sure, if you are on their server they can link in, but they cannot physically hook it up and then look.
A company can look in your desk, but if you have a purse, wallet, box or something closed, no they cannot look in it without your permission.
Your property is YOUR property no matter where it is and must be treated that way.
What they did was very illegal and if it were my company I would prosecute so they would not do it to anyone else in the future.
They can do whatever they want with a company PC.
I've been a supervisor/administrator more than once and trained in these laws each time. I did random desk/locker searches and the like and had to know where my boundaries were.

What does your (or your hypothetical friend's) actual contract with the company say? And what's in the employee handbook?

There may have already been informed consent regarding this possibility.

Lemme just get this out of the way for everyone - THIS IS ALL HYPOTHETICAL-
If the laptop was connected to the company server, do they have an argument that it was being used for work purposes and could therefore be searched?

It does not matter.
They can link to it while it is connected only.
After that they are out of luck without a warrant or your permission.

No.
Yes.
Yes, because employer is vicariously liable for the actions of its employees.

I am telling you, it is illegal, period.
Private property is private property.
Also, so there is porn on there.
1. prove he got it off of your server.
2. porn is not illegal
3. it is illegal
Do not fuck with the EEOC, the employee will OWN your company in a week.

Boeing routinely, randomly, searches vehicles, lunch boxes/coolers, briefcases and handbags leaving their property. Sometimes they are looking for something specific, sometimes not. Intellectual property could be something specific and I'd imagine they would search any hard or flash drives, if they were looking for that. They may have more power, dealing with government secrets, but I don't know that for sure.