| Computer Misuse - What Should I Do If I Suspect? | | | | Clingfilm wrap and lock away in a secure area. |
| These are some simple actions to assist you as an | | | | 6. Records: record EXACTLY what you have done to |
| HR Manager to ensure that your company is following | | | | the item from the first minute you touched the suspect |
| correct procedures, ACAS guidelines and best | | | | computer. State the EXACT time that the equipment |
| practice, and legal requirements. | | | | was powered down by you, and the EXACT time it |
| 1. Always have an independent witness to the actions | | | | was placed in a sealed bag (or wrapping) and the time |
| you are taking | | | | it was placed in a secure, locked area. Get the |
| 2. If the data/images are on a desktop computer: | | | | independent witness to sign the statement to verify |
| Advise the user that you are carrying out an | | | | the data recorded by you. Also record your exact |
| investigation into the computer usage and Turn off the | | | | conversation and actions taken with the employee(s) |
| suspect computer immediately – if possible take out | | | | involved in using the equipment. |
| the power supply to the computer, do not use | | | | 7. CONTACT DISKLABS IMMEDIATELY these |
| windows to power down the computer. Consider the | | | | actions have been taken. |
| most appropriate action to be taken at this point | | | | 8. The Disklabs specialist HRProACT team will attend |
| against the user of the suspect computer, this may be | | | | and conduct a detailed forensic analysis and produce |
| alternative work, or suspension on full pay whilst the | | | | a comprehensive professional report which if |
| forensic analysis and investigation is being completed. | | | | necessary can be produced in a court of law or |
| 3. If it is a Laptop computer: Take the power cable out | | | | tribunal. |
| of the computer and remove the battery pack. Again, | | | | 9. The Disklabs HR Consultants will be available to |
| consider the most appropriate action to be taken at | | | | advise you and/or your managers and staff on the |
| this point against the user of the suspect computer. | | | | appropriate actions to take regarding the people |
| This may be alternative work or suspension on full pay | | | | management issues. This will include investigative |
| whilst the investigation and forensic analysis is being | | | | interviews, rights of representation, statements and |
| completed. | | | | witnesses, disciplinary procedures, and if necessary |
| 4. Move all of the suspect equipment to a safe, secure | | | | preparation for Court of Law or Employment Tribunal |
| lockable storage area. | | | | hearings. Also ensuring that ACPO (Association of |
| 5. Seal the computer/laptop (ideally seal each suspect | | | | Chief Police Officers) guidelines are understood and |
| piece of equipment in their own ‘professional’ | | | | followed where appropriate or applicable. |
| plastic exhibit bag), alternatively place it in polythene or | | | | |