How to Handle Employee Poaching and Data Theft: Seeking Advice on Next Steps

Hi All, We are a small company with 15 employees. One of our employees worked on a dedicated software project; he created all critical components. In the middle of the project, we observed that the customer was not showing interest in the project and was not making the payment either. It was a phased project. Still, we asked him to work on it and finish the project. Last week, we noticed that the employee was taking a backup of the data. When asked the same day, he resigned and left. We have been trying to contact him, but he is not responding. Meanwhile, we learned that he has joined the same company for which we were working, and it seems that he has already given the source code to them.

This is a serious case of poaching, and we have communicated to him that we won't provide a relieving letter to him, but we think he may have already informed the new employer, and they do not seem concerned about it.

Options and Next Steps

Now, what options do we have? Can we blacklist this employee somewhere? Also, for dealing with this type of situation in the future, what should we do? Is there any forum where we can file a complaint against them?

Please guide. We hired this individual only for this project, for which we did not receive payment from the customer, and the salary we paid him for his tenure has resulted in a loss for us.

Serious Offense and NDA Considerations

This is a very serious offense. Being an IT professional, I can understand the impact on the organization and fellow employees. Do you have a Non-Disclosure Agreement (NDA) policy in place? Has he signed such a document upon joining?

Regards

Does the NDA mention the clause that doesn't allow him to join your client? What about the contract with the client? Didn't you have indemnity mentioned in it?

Immediate Actions for Data Security and Legal Measures

Please clarify/confirm the points Pon & (Cite Contribution) mentioned ASAP. Also, please ensure the computer system, which this individual used while he was with you, is not used by anyone from now on. A lot of data/files can be retrieved even if deleted—there are special tools to handle this task.

Next, please ask your System Admin to check ALL the emails he sent from this system—both from the official ID and personal IDs. I know this traffic can be tracked while in use, but I'm not sure if it can be done retrospectively.

Preparing for Legal Action

Next, please prepare your company mentally to file a police complaint with the Cyber Crimes Cell in Bangalore. The success of this step depends a lot on the files retrieved from his system (basically evidence of what Pon mentioned)—this is why I mentioned NOT to allow anyone else to use this system until you get to the bottom of this.

Blacklisting such individuals won't really help YOU. What you ought to be focusing on is how to protect YOUR interests in this issue. Once you file the police complaint, he will be taken care of. If the other company—your ex-client—can't show any evidence to support their claim (which you can bet they would say, that they are innocent), they too would have to face the music. The NDAs, Indemnity Bonds, etc., will come later in the courts. But you still need to be ready with such documents.

Regards,

TS

No, as of now, we don't have any proof of him copying the data. We are assuming this based on the fact that our customer stopped taking calls from us and is not tracking the project status, even though they have paid the initial amount for the project.

We have an NDA agreement, and I will verify if this client has specific requirements. I remember we have that clause.

As TS suggested, do we have to go to the police with a complaint? We are just considering that it might permanently affect his career, so we are contemplating whether to take this course of action or not.

Like Pon suggested, if you either don't have proof or can't get 'sufficient' proof, then "let him reap what he sowed." Just 'let go.' Nature has a way of paying back anyone and everyone in the same coin.

Police Complaint Considerations

Coming to the police complaint issue, it all depends on to what extent the company is taking the hit—if the project this guy was involved in isn't a very high-value one (in technical and/or financial terms), then it may not be worthwhile to go after him. Going to the police has its own set of headaches to be handled. I suggest you keep the company/organization as your reference point and not the guy. What you would be doing (if you do decide to go to the police) is in self-defense and not being vindictive.

Learning from the Incident

Another aspect of the whole incident is: this 'maybe' gives you a chance to correct your systems and processes. So learn from it and make the necessary corrections within the organization to avoid any repetition and also include clauses that handle the worst-case scenarios, if and when they occur.

Regards,
TS