Assignment
Situation
A company's Human Resources department receives a complaint from a female employee. She has received "secret admirer" messages from an email address she does not know. The sender comments on things she is wearing at work, suggesting it is a coworker. She also suspects a particular person.
The company asks its Information Security team to investigate. A forensics examiner captures an image of the suspected individual's corporate workstation using a remote acquisition tool. The examiner finds web history for the user, including access to gmail, and cached information shows the address logged in is that of the "secret admirer".
During examination, the examiner reviews image files on the workstation. The examiner notices several photographs of females, taken from behind, and recognizes the surroundings are hallways and break areas of the company office.
When the examiner reports this information and expresses concern that the suspect has done more than just the unwanted email, HR asks why image files were reviewed and suggest the examiner may have exceeded what was requested.
Task
Review about the issues this case addresses, including the following.
A. How should the investigation be authorized and tracked to be compliant and ethical?
B. What effects on employee investigation will widespread working from home cause?
C. Do you agree that the investigator exceeded the information requested? Does the type of evidence discovered, in this case or with other types, affect this?
D. If you were the HR representative involved in this case, what would be your actions and recommendations to your management?