Real-Life Decision Making
You are a computer forensic investigator employed by a consulting firm.
You arrive at a client site and sit down with the CEO for a briefing on a
new case. He tells you he fired his vice-president of sales last month and
recently learned that the former employee was just hired by a major competitor.
From a variety of sources, the CEO believes the former VP copied the entire
customer database onto a thumb drive the day before he left. This is in violation
of company policy and a written agreement signed by every executive of the
company. The CEO believes the former VP took the customer list with him and
fully intends to share it with his new employer.
You begin your investigation by examining the ex-employee's laptop. As
you examine folders on the server, you find a "hidden" folder. You look in
the folder to determine if there is a copy of the customer database. You do
not find any files related to your investigation, but you do find more than
50,000 mp3 music files.
A brief review of the mp3 files indicates that this database server is
being used to distribute pirated copies of music throughout the company and
the Internet. You observe that music files are being transferred to dozens
of computers on the company network.
As you complete your investigation, you determine a copy of the customer
database was transferred to the laptop and then to a thumb drive, just as
the CEO suspected. When you meet with the CEO, should you also tell him about
the pirated music server and that dozens of his employees are sharing these
songs and sending them to friends on the Internet?
What do you do?