Security Manager's Journal: Did DLP tool prevent an assault?

A data loss prevention tool flags keywords that lead to the discovery of a possible conspiracy to commit a crime.

The plain view doctrine allows law enforcement officials to seize, without a search warrant, evidence or contraband perceptible during a lawful observation. As an example, if a police officer who is exercising a warrant to search a house for illegal weapons sees drugs on the kitchen counter, in plain sight, then the officer can confiscate the illegal drugs and charges could be filed, even though the search was for weapons.

Trouble Ticket

DLP monitor instigates an investigation that uncovers what seems to be an employee's plan to attack his wife's lover.Action plan: Bring the evidence to HR and Legal and go from there.

Page 2 of 2

I printed out a transcript, along with information about the employee, and met with our legal department and human resources. HR's impulse was to give the employee the benefit of doubt, but our general counsel, concerned that we could be charged with negligence if an assault occurred, disagreed and said we needed to contact law enforcement immediately. I then told the employee's manager to confiscate his laptop until the matter is resolved.

I checked in the other day to find out what is happening and learned that the police investigation is ongoing and that HR has put the employee on administrative leave. There is still a chance that the entire thing was a hoax, but the incident nonetheless provides further justification for our investment in DLP.

All in all, though, I'd be happier with other sorts of justification for such a valuable initiative.

This week's journal is written by a real security manager, "Mathias Thurman," whose name and employer have been disguised for obvious reasons. Contact him at mathias_thurman@yahoo.com.

Join in the discussions about security! Computerworld.com/blogs/security

Read more about security in Computerworld's Security Topic Center.