Refusal to Return Organizational Devices

The subject delays, ignores, or refuses requests to return organizationally owned devices, such as laptops, mobile phones, removable media, or other assigned hardware, where those devices are required for investigative, security, or administrative purposes.

This behavior typically occurs following termination, suspension, role change, or during an active investigation. By withholding physical assets, the subject prevents timely forensic acquisition, disrupts evidence preservation, and creates uncertainty around the integrity and completeness of available data.

Stalling in this form may be explicit (e.g., refusal, dispute, or conditional compliance) or passive (e.g., non-response, repeated deferral, or claims of unavailability). Regardless of intent, the delay introduces risk by extending the window in which evidence may be altered, destroyed, or remain outside organizational control.