A protocol to investigate fraud by employees is being designed. Which measure can be part of this protocol?

An internal fraud investigation protocol must adhere to legal and privacy regulations. A workstation is company property, and employees generally have a reduced expectation of privacy when using it, especially when a clear Acceptable Use Policy is in place. This policy should state that company assets are subject to monitoring and investigation for legitimate business purposes, including security incident response. Therefore, investigating the contents of a company-owned workstation is a standard, legally defensible measure within a corporate investigation. This approach respects the critical legal distinction between corporate assets and an employee's personal property and communications.

A. A private laptop is personal property. Seizing or investigating it without a warrant or explicit consent is a severe privacy violation and generally illegal.
C. A private mailbox is protected by privacy laws (e.g., GDPR, ECPA). Accessing it without legal authorization constitutes an unlawful interception of communication.
D. Phone tapping is a highly regulated surveillance activity that typically requires a court order, making it unsuitable for a standard internal company protocol.

1. ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection — Information security controls, Control 5.31 (Legal, statutory, regulatory and contractual requirements). The implementation guidance for this control requires organizations to identify and comply with all relevant legislation, which includes privacy laws that govern the boundaries of internal investigations, distinguishing between corporate and personal property.

2. Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet (3rd ed.). Chapter 3, "Legal Aspects of Digital Forensics," discusses the legal authority for searches. It clarifies that employers have the right to search their own property (e.g., a company-owned workstation) but not an employee's personal property without consent or legal authority (pp. 95-98).

3. University of California, Berkeley School of Law, Course Material. Legal precedent, often taught in cybercrime and privacy law courses, supports this distinction. For example, the U.S. case United States v. Ziegler, 474 F.3d 1184 (9th Cir. 2007), established that an employer could consent to a government search of an employee's work computer because the company owned the equipment and had a policy in place that eliminated any reasonable expectation of privacy. This principle is widely applied to internal corporate investigations.