Company sues ex-employee who lost flash drive

A former employee who worked in the risk management and internal audit department at a data management company may have become a security risk herself after she reported losing a USB flash drive containing thousands of sensitive documents.

According to a now-dismissed suit that was filed in federal court against the ex-Computershare employee, Kathyann Pace held onto her company-issued laptop for almost three weeks after voluntarily resigning last year.

A forensic examination of the laptop found that she had copied thousands of documents and emails, including internal reports and personally identifiable information of shareholders who used the Canton, Mass.-based company’s services.

When Computershare demanded that Pace return the USB drive, she said she had lost it.

“The privacy and financial records of millions of shareholders were potentially at risk,” the complaint stated.

The story garnered headlines in Australia, where Computerworld was founded. One technology columnist quipped that USB should stand for “unexploded security bomb” because the tiny drives make transferring sensitive information so easy. (The acronym actually stands for Universal Serial Bus.)

Boston attorney John R. Bauer of Robinson Cole, who litigates intellectual property disputes, agrees. Companies who loan their employees laptops with sensitive information “should find a way to disable the USB port,” he says. “And why are companies allowing employees to email themselves sensitive documents? Why not store it on a network or in the cloud? There should be some device that precludes me from using my laptop once my employment is terminated.”

Computershare’s attorneys at Boston’s Jackson Lewis invoked the Computer Fraud and Abuse Act in their complaint. They did not respond to several requests for comment.

“The CFAA was originally created to go after hackers,” Bauer says. “But those of us who do a lot of work with departing employees realized this is good tool to get us into federal court if we don’t want to be in state court.”

The suit, which sought to prevent Pace from sharing any of the documents, claimed only “in excess of $5,000” in damages resulting from the forensic examination and legal fees.

Bauer says it’s common for CFAA complaints against former employees to seek small damage amounts “because what you really want is an injunction preventing the employee from doing anything with the information.”

Several months after the lawsuit was filed, both parties agreed to dismiss the case and pay their own legal fees.

The case resulted in newspaper columns and blog postings mocking Computershare’s security controls, but Bauer says employers may be willing to withstand the negative press that such a complaint can generate.

“A lot of these cases get filed for the same reason non-compete violation cases get filed: to send a message to the people who still work for the company that you shouldn’t do these things,” he says.