the statistic everyone quotes is about a different month

The hostile departure guide covers the hour after somebody’s departure has been decided. This guide is about the weeks before anybody knows, when a person who has already made up their mind still has every permission they have ever had and no reason to be watched.

The first thing to know about that window is that the number everybody cites is not about it.

the number, correctly

The finding comes from the CERT insider threat programme at Carnegie Mellon, and its actual wording is that approximately seventy percent of insiders who steal intellectual property do so within thirty days of announcing their resignation.

Three things about that sentence.

It says thirty days. A ninety-day version is in wide circulation and does not appear in the primary source.

It says within thirty days of announcing, so the clock starts when you find out. The book from the same programme frames it as a sixty-day window, thirty days either side of the announcement, which is closer to what people think they are quoting.

And it comes from eighty-four intellectual property theft cases inside a database of over seven hundred insider incidents, drawn largely from prosecuted or detected US cases, most of them from before 2012 and most of them on-premises.

A second number often gets folded into the same claim, usually attributed to Symantec: that half of departing employees kept confidential data. That is a different study, a self-reported survey of 3,317 people across six countries, run by the Ponemon Institute for Symantec and published in 2013, and it contains no timing claim at all.

So the best-known statistic in this field describes the period after the announcement, and says almost nothing about the period before it.

which means nobody has measured this

The consequence is the centre of this guide.

The window before anybody knows is unobserved by definition. There is no dataset, because a study would need to know when somebody privately decided to leave, and the only cases that get counted are the detected ones: the ones where somebody eventually announced and somebody eventually looked.

So nobody can tell you how much happens in that window. What you can know is what is possible to see on your plan, which turns out to be the more useful question.

the window the statistic covers, and the one it doesn't

1. 1decides to leaveNobody knows. Nothing is measured. All access still in place.
2. 2announcesThe clock in the CERT finding starts here.
3. 3the next 30 daysWhere about seventy percent of the IP thefts in the CERT cases happened.
4. 4leavesThe hour the hostile departure guide covers.

what the courts have seen

The cases that do exist are worth reading, and the European ones cut differently from the American framing.

In 2025, Germany’s Federal Labour Court decided a case, reported by the law firm Orrick, in which an employee passed information to a competitor’s shareholders while still employed. The employer’s injunction failed, because the confidentiality clause was a catch-all and the court found it invalid.

In 2020, the Higher Regional Court in Stuttgart (2 U 575/19) looked at whether a company had taken appropriate measures to protect its trade secrets after former managers and staff set up a competitor. The court judged those measures objectively and as a whole. Access should follow need-to-know, and letting staff keep secret files on private storage counted heavily against the company: one tolerated leak can make the whole protection inadequate.

And in the UK, the case from the CRM export guide: an employee who emailed 957 client records to a personal address on the way to a competitor, prosecuted under data protection law.

Read those three together and the pattern has little to do with detection. In both German cases, the employer’s position was weakened by something it had done long before the departure: a contract drafted too broadly, or access and storage left too loose. The control that mattered was upstream of the incident by years.

what you can and cannot see

Now the practical part, and it has a firm answer.

Google’s Drive log records downloads, including copies made from Drive to a local device, file copies, and changes of visibility to shared externally. That is a useful set of signals, and you have it.

What you do not have, on Business Standard or Business Plus, is any way to be told about it. Google lists data loss prevention for Drive on Frontline Standard and Plus, Enterprise Standard and Plus, Enterprise Essentials Plus and the education editions. Business is not on that list, and neither the security investigation tool nor automated actions in activity rules are available to you.

So for a company your size: the log records it, the log does not tell you, and by the time you go looking the person has left and you are reconstructing.

That makes the practical step a review habit. No alert you can configure exists at that price.

the legal line, and it runs the opposite way to your intuition

The instinct is that an org-wide alerting rule is safe and watching one named person is where the trouble starts. In Germany both have gates, and they are different gates.

A works council’s co-determination right under the German Works Constitution Act is triggered when a system is objectively suitable for monitoring performance or behaviour, whether or not monitoring was the employer’s intent. So the org-wide rule is the thing that needs the works council.

Targeted observation of a named individual is a data protection problem instead. The European data protection authorities’ opinion on data processing at work (Article 29 Working Party, Opinion 2/2017) requires necessity, proportionality, an assessment beforehand and transparency, and treats employee consent as almost never freely given.

Two separate gates.

Most companies your size in most of Europe have no works council, so the first gate is often empty for you. It is still worth knowing about, because it arrives with your first German enterprise customer or your first fifty German employees. The second gate is never empty. Watching one named person is a data protection decision wherever you are, and it is one to take with advice, in advance, once, exactly like the suspension question in the hostile departure guide.

what to do instead

Given all of that, here is what is defensible for a company your size.

Set the floor. What reduces this exposure is a salesperson’s export permission that is scoped, a departing engineer’s repository access that reflects the last two years rather than the last five, and need-to-know that means something. That is the stayers essay, the reorg guide and the CRM export guide, and all of it is done before anybody resigns.

Make the Drive review part of the quarterly export. The log export guide gives you an hour, four times a year, and one of its steps is Drive log events filtered to external sharing and visibility changes. Read that file as well as filing it. You are looking for shape, never for suspects.

Write down what normal looks like now. How many large exports happen in a typical month, and who runs them. Without that baseline you cannot say anything about a specific month afterwards, and it costs nothing to collect while nothing is happening.

And do the thing courts reward. Need-to-know access, and specific contractual language in place of a catch-all clause. Both of those decided the German cases above, and neither is a security purchase.

That last point deserves more weight than it usually gets. In the Federal Labour Court case, the employer had the facts and lost anyway, on the drafting. In the Stuttgart case, the measures were judged as a whole, and loose handling of secret files weighed heavily. If you want one thing from this guide that survives contact with a lawyer, it is that the protection is built into how access and contracts are structured beforehand. What you observe afterwards cannot replace it.

the ending

This guide set out to be about a dangerous window. The window turns out to be undocumented, the famous statistic is about a different month, and the tooling that would let a small company watch it is on a plan it does not have.

That is less satisfying than a scary number and an alert to configure. It is more useful, because the scary number would have been wrong and the alert is one you cannot set up.

The window is real. Nobody has measured it. What you can do about it happens months earlier, in the boring work, which is where most of the answers on this site turn out to live.