Study Shows Employees Steal Corporate Data and Don’t Believe It’s Wrong

Half of employees who left or lost their jobs in the last 12 months kept confidential corporate data, according to a global survey from Symantec (Nasdaq: SYMC), and 40 percent plan to use it in their new jobs. The results show that everyday employees’ attitudes and beliefs about intellectual property (IP) theft are at odds with the vast majority of company policies.

Employees not only think it is acceptable to take and use IP when they leave a company, but also believe their companies do not care. Only 47 percent say their organization takes action when employees take sensitive information contrary to company policy and 68 percent say their organization does not take steps to ensure employees do not use confidential competitive information from third parties. Organizations are failing to create an environment and culture that promotes employees’ responsibility and accountability in protecting IP.

Click through for findings from a survey, conducted by Symantec, focusing on employees’ attitudes toward intellectual property theft, as well as recommendations organizations can take to protect their data.

Employees move intellectual property outside the company in all directions, and never clean it up. Sixty-two percent say it is acceptable to transfer work documents to personal computers, tablets, smartphones or online file sharing applications. The majority never delete the data they’ve moved because they do not see any harm in keeping it.

Most employees do not believe using competitive data taken from a previous employer is wrong. Fifty-six percent of employees do not believe it is a crime to use a competitor’s trade secret information; this mistaken belief puts their current employers at risk as unwitting recipients of stolen intellectual property.

Employees attribute ownership of intellectual property with the person who created it. Forty-four percent of employees believe a software developer who develops source code for a company has some ownership in his or her work and inventions, and 42 percent do not think it’s a crime to reuse the source code, without permission, in projects for other companies.

Organizations are failing to create a culture of security. Only 38 percent of employees say their manager views data protection as a business priority, and 51 percent think it is acceptable to take corporate data because their company does not strictly enforce policies.

Employee education: Organizations need to let their employees know that taking confidential information is wrong. Intellectual property theft awareness should be integral to security awareness training.

Enforce non-disclosure agreements (NDAs): In almost half of insider theft cases, the organization had IP agreements with the employee, which indicates the existence of a policy alone — without employee comprehension and effective enforcement — is ineffective. Include stronger, more specific language in employment agreements and ensure exit interviews include focused conversations around employees’ continued responsibility to protect confidential information and return all company information and property (wherever stored). Make sure employees are aware that policy violations will be enforced and that theft of company information will have negative consequences to them and their future employer.

Monitoring technology: Implement a data protection policy that monitors inappropriate access and use of intellectual property and automatically notifies employees of violations, which increases security awareness and deters theft.