Top 5 Reasons HR Professionals Should Use Digital Forensics

HR professionals get involved when employees are disciplined or dismissed for contravening workplace policies. Computers, smart phones, tablets and the internet are incredibly prevalent in the modern workplace and therefore the chances are high that discipline or dismissal will involve the use of technology or the internet in the workplace.

Digital Forensics examiners acquire evidence from computers and digital sources in order to investigate criminal or unlawful activity and misconduct and determine the facts of an investigative scenario. One of the most frequent areas of engagement for DFI Forensics Inc., a Canadian digital forensics firm with offices in Vancouver, Langley, Calgary and Toronto, is workplace disputes. Yet, many HR professionals remain unaware of the services offered and why they are an important part of the HR professional’s toolkit.

REASON #5 – DETERMINING THE FACTS MAY SAVE DISPUTE AND LEGAL REPRESENTATION COSTS LATER IF THE EMPLOYEE CHALLENGES YOUR DECISION OR THE EVIDENCE THAT IT WAS BASED ON.

The best decisions are made once the facts are known and all circumstances and consequences of choosing a course of action are fully considered. This is particularly true in determined whether an employee has offended a workplace policy and, if so, what action will be taken against that employee in response.

Disciplining or dismissing employees can have significant effects on an organization so decisions should be made carefully. The facts must be determined with great certainty and, if called into question at a later time, it is advisable that the determination of facts upon which disciplinary action was taken is as bullet-proof as possible.

Digital forensic examiners collect evidence carefully and follow strict protocols to ensure that the digital evidence is preserved, analyzed precisely and that the findings are verifiable. Much in the same way that a crime scene investigator collects physical evidence, such as fingerprints and DNA samples, and produces that evidence at a criminal trial, digital forensics examiners collect, analyze and produce findings in workplace investigations and civil litigation disputes.

If you have good evidence, you will know all the facts and, therefore, will be in the best position to make a sound decision. Digital evidence is a mystery for many people and makes are commonly made in collection, contamination and analysis that can impact your organization later if an employee challenges your decision to discipline or dismiss them in the future. Remember, clearly demonstrated conduct that establishes just cause for dismissal can save your organization thousands and thousands of dollars in severance pay, legal costs and lawyer fees.

REASON #4 – IF YOU HAVE WORKPLACE POLICIES GOVERNING THE USE OF TECHNOLOGY, YOU MAY NEED A SPECIALIST TO DETERMINE IF THAT POLICY HAS BEEN VIOLATED.

Does your organization have an Acceptable Use Policy, governing employee conduct on the internet during the course of their employment, a Bring Your Own Device Policy, governing the use of employee-owned devices in the workplace or an Employee Conduct Policy, governing the conduct of employees outside of the workplace – particularly on social media?

If so, then it would be strongly advisable to have a digital forensics resource to call upon to discuss potential policy violations and the need to collect evidence quickly and determine what, if any, misconduct or policy contraventions have occurred.

Remember, you and your organization doesn’t have to be an expert on everything. Sometimes it is helpful to know that there are experts that specialize in a particular field to be called upon as needed. DFI Forensics Inc., a CPHR BC & Yukon Industry Partner Member, is readily available to answer questions and react quickly, if the situation calls for it.

REASON #3 – NOT EVERYTHING IS AS IT FIRST APPEARS!

Digital forensics examiners use a critical thinking mindset to produce the best results during the fact-finding process. We verify and cross-verify after questioning whether what we know what we think we know in the first place. Sometimes there are multiple reasons for the appearance of a single piece of evidence and we are experienced and trained to avoid leaping to conclusions that don’t logically flow from the evidence.

In many cases, those that are close to the situation and know the suspect(s) on a personal level fail to adequately remain objective in reaching findings of fact. An independent, third-party investigator can examine digital evidence to determine what happened, how, when and who was responsible for the occurrence.

REASON #2 – DIGITAL EVIDENCE CAN RESOLVE DIFFERING VERSIONS OF THE SAME EVENTS WHEN TWO OR MORE EMPLOYEES TELL DIFFERENT STORIES

We know longer live in a world in which testimony, witness statements and the frailties of the human memory system are the only sources to determine what happened. Now, when two or more parties tell dramatically different versions of the same event(s), there are many digital sources of evidence that can be used to corroborate one version or the other.

As noted in the above video, “digital fingerprints are everywhere” and we can use them to verify who communicated to whom, what was said, when and how. We can determine who interacted with a computer or cell phone, when and what was done. We can verify location and time of people through digital means and interactions with digital sources. The possibilities are endless when we start to explore the world of digital evidence, but you need to know who to reach out to when your organization requires assistance in this specialized field.

REASON #1 – YOUR “IT GUY” CANNOT BE EXPECTED TO DO EVERYTHING!

Information Technology (“IT”) professionals are highly trained in their own right, but are often unfairly called upon to deal with and handle any “computer stuff” that may arise in an organization. In practice, the training, tools and role of IT professionals are very different from cybersecurity and digital forensics professionals. Further, for most organizations it not realistic or economically feasible to have their IT person fulfill these roles. It is best to have a digital forensics firm as a resource to contact on an as needed basis.
While many IT people are not afraid to take on this roles, it is not advisable nor fair to call upon them to do so in most cases. If the situation is important enough to warrant collection and analysis of digital evidence, it is important to do it properly and to have the task(s) performed by a trained, experienced digital forensics firm who has the equipment, software and certifications to conduct a thorough, effective, efficient and professional investigation for your organization.