The Resigning Engineer, 1.1 GB of SharePoint, and a 14:00 Walk-Out

Principle: preserve, then contain at the moment of the meeting - not before, and not casually.

10:00–10:30 - Preserve, without alerting:

• Litigation hold on mailbox and OneDrive; export SharePoint audit logs, proxy logs, and badge records now. Log retention windows are the enemy here.
• Open a case file with a single owner; every action timestamped and attributed.

10:30–11:00 - Decide the tipping-point trade-off explicitly with HR and legal:

• Revoking repository access immediately stops further collection but tells him he is under investigation and he may delete local copies or accelerate an upload.
• Leaving access in place preserves the observation window for two more days but accepts further loss.
• Given 1.1 GB already synced and Dropbox uploads observed, the marginal loss from two more days is real but the marginal intelligence is small. Recommend targeted revocation of the highest-value repos only, keeping general access so nothing looks unusual.

11:00–13:00 - Quietly rotate shared secrets he could have copied: CI/CD tokens, Terraform state access, service account passwords, SSH keys in the repos he downloaded. This step is routinely forgotten and is the actual risk to the company.

13:30 - HR calls him to a meeting; IT is on standby, not in the room.

14:00 - At the moment the meeting starts: disable the account, revoke sessions and refresh tokens, collect the laptop and badge, issue the MDM selective wipe on his phone.

Imaging: if legal wants a forensic image, arrange for him to be called away from the machine before the meeting, image during it, and never boot the laptop into normal operation first.

Two devices, two very different legal postures.

Company laptop:

• It is company property and the user has no expectation of privacy on it under a normal acceptable-use policy - confirm the policy wording before you act.
• Do not let him 'hand it over' and have IT start using it. Take custody, document the serial number, photograph the physical condition, and keep it powered off until the forensic image is taken (image, then work from the copy).
• Chain of custody: who collected it, when, where, from whom, stored where, who has access. If this becomes an employment dispute or a criminal referral, that log is the evidence.

Personal phone (BYOD, MDM-enrolled for email only):

• Selective wipe only - remove the mail profile and the containerised company data; do not remote-wipe the device. A full wipe of personal property is a legal and reputational problem and may be unlawful in some jurisdictions.
• Check whether the MDM policy disclosed the selective-wipe capability at enrolment; if it did not, get legal sign-off first.
• Assume he may have forwarded mail to a personal account: review mail flow and forwarding rules for the last 30 days.

Dropbox uploads: you cannot reach into a personal cloud account. Document what the proxy logs show, and let legal decide whether a preservation letter or subpoena is warranted. Do not attempt to access his personal account.

Frame it as a risk decision for HR and legal, not an IT preference, and put the trade-offs in their terms.

Option A - immediate walk-out at 14:00:

• Gains: closes all access channels in one move; minimises further exfiltration and retaliation risk; clean and defensible if handled respectfully.
• Costs: loses the knowledge-transfer value; risks an unfair-dismissal or defamation complaint if the exit is handled as an accusation without evidence; loses any chance to observe who else he is in contact with.
• Mitigation: HR conducts the meeting; IT never appears. Keep the conversation about the exit process, not about the investigation - you have logs, not a confession, and 'we know what you did' invites a dispute you do not need.

Option B - monitored exit until Friday with a Thursday session:

• Gains: knowledge transfer; observation window.
• Costs: two more days of repository access and remote-work exposure for a person already demonstrating intent; every day of continued access weakens any later claim that you treated the data as confidential.

Recommendation to give: immediate exit, but decouple it from the accusation. Run the knowledge transfer today or by 11:00 tomorrow with a manager present and a documented handover list, then complete the exit at 14:00 or at the end of the handover. That captures most of the manager's value without granting two days of unmonitored access.

Finally: this is a data-loss incident whether or not it is a crime. The deliverable on Friday is a report on what left, what was rotated, and what control failed - not a verdict on his motives.