Overview
Employers can face legal and reputational risk when employees use company devices for illegal or harmful activities, including viewing or sharing pornography on work computers.
When employers learn of possible criminal activity on workplace systems, failing to investigate or report it can expose the business to third-party claims or regulatory consequences.
Key takeaways
- Maintain clear computer-use and monitoring policies so employees do not have an expectation of privacy.
- Investigate credible reports of illegal activity on company systems promptly and notify law enforcement when required.
- Insurance and workplace safety programs can reduce risk, but proactive policies and training are essential.
How it works
Most liability arises from a combination of employee misconduct and employer inaction: if a company knows (or should know) about illegal activity on its equipment and does not take reasonable steps, injured third parties may sue for negligent hiring, supervision, or retention.
Reasonable steps typically include documenting the report, preserving digital evidence, conducting an internal review consistent with policy and privacy law, and notifying law enforcement when child exploitation or other criminal conduct is suspected.
For guidance on related workplace misconduct issues and how employers handle investigations, see Sexual Harassment in the Workplace.
What it may cover (and what it may not)
Insurance products and risk-transfer tools may respond to claims alleging negligent supervision or failure to prevent an employee's unlawful acts; coverage varies by policy, exclusions, and jurisdiction.
Policies that address employment-related claims, cyber incidents, or third-party liability can mitigate financial exposure, but they generally do not eliminate the need for sound workplace controls and prompt reporting.
For help evaluating how hiring practices, safety programs, and workers' compensation intersect with these risks, review Hiring, Workplace Safety & Workers' Compensation.
Common mistakes to avoid
- Failing to adopt or communicate a clear acceptable-use and monitoring policy for company devices.
- Ignoring or delaying an investigation when credible evidence of illegal activity appears.
- Deleting or altering electronic evidence instead of preserving it for investigators and insurers.
- Assuming insurance will cover every consequence without first confirming policy terms and exclusions.
Questions to ask an agent
Ask what employment practices liability, cyber liability, or third-party liability coverages apply when an employee's conduct causes harm offsite or to third parties.
Confirm whether policy language addresses claims arising from on-premises misconduct and whether it includes defense costs, regulatory investigations, or limits for settlements.
If your business serves vulnerable clients or operates in regulated settings, consider specialized protections and consult resources such as Medispa Services Sexual Abuse Coverage for tailored examples of coverage approaches.
Next steps
Update your acceptable-use and monitoring policy, document any reports, preserve relevant files, and set a clear internal escalation path for suspected criminal activity.
Train supervisors on how to recognize and report concerning behavior, and coordinate with legal counsel and law enforcement when necessary.
To compare coverage options or start an application, talk to your insurance provider or ask an agent.
Frequently Asked Questions
Do employers have to monitor employee computers?
Employers are not universally required to monitor devices, but many adopt monitoring to reduce risk and protect the workplace; ensure monitoring complies with applicable privacy laws.
What should I do if I discover illegal material on a work computer?
Preserve the evidence, document the discovery, suspend further access to the device, and consult legal counsel about reporting to law enforcement.
Can insurance cover damages from an employee's illegal conduct?
Some liability policies may respond to claims alleging negligent supervision or related harms, but coverage depends on policy terms and specific exclusions.
How can I reduce my company's exposure to these risks?
Adopt clear policies, provide training, enforce acceptable-use rules consistently, and maintain appropriate insurance and incident-response plans.