Some companies don't allow personal USB (or any other) devices to be plugged into their computers, so the OP needs to make sure they aren't violating company policies when they make copies of the paper trail. Emails to a private account might be just as against policy, as well a paper copies removed from company offices. Saving the emails to a backup/archive on their computer's drive might work for hardcore company IP policy. BTW, you might want to add talking to the company's lawyers about copyrights. Having company law backing their refusal to comply with orders is key.

USB drives can easily get corrupted or lost. If you get it on a drive, you should still later send it per email to yourself so (1) you can find and access it when you need it and (2) the upload of the file is timestamped by a third party (the email provider). Yet another option is making a photo of the email, which again may or may not be allowed by company policy.

Many of the companies that ban such personal storage are doing so because they operate in a highly regulated field. That's the sort of environment where there is a legal department looking out to keep the company out of legal troubles, and such a legal department would want to know about these intents to break the law.

@KillianDS It's not about why you take the copy, the copy is an explicit security risk should be it lost, misplaced or stolen when moved to another medium. Companies spend millions trying to secure their networks and moving data around on USB thumbs or personal mail that can be hacked is reckless on behalf of the employee - justifying suspension or PIP in many cases. Its very likely in their contract so they should be careful.

Getting it in writing is your best bet. I have had experience where this happened to me and it turned out that the company also billed per query and things got very expensive and were noticed. You might also want to look for a different company that won't ask you to do these things.

This is the only correct answer. It is missing one piece, though: You should ask for this already in writing. Corporate e-mail if possible and the company has a retention policy that prevents the boss from deleting it. You are likely to run into conflict with your boss over this, and being able to prove what you got into trouble for can be very, very valuable. It can be a friendly mail, something like "just asking for confirmation here, did I understand correctly that you want me to do X and Y ?"

DO NOT BCC from a corporate email server expecting it to be unknown (that you BCC'd someone). The mail server will know and so will the IT people and your boss. Just get the email copy from your machine.

@Mindwin corporate email server can see everyone you email. If you're going to do that, just use BCC.

You can take a picture of your screen with your cellphone, and in many cases you then have a picture that's backed up to the cloud.

I don't see what benefit a BCC provides - you aren't going to get the reply at the BCC'd address. Otherwise all that BCC'd account has is an email where you state that someone else asked you to do something.

The important thing is that you have hard evidence of the emails being sent. Take pictures of the screen with the sent/received email open if you have no other options.

Can you please add something to make sure his boss understands this issue? Like a link to an article where a company got in trouble, or the risks (the amount of the fine for exemple). "Software related regulation" contains the word software, so some people just think it's not "real".

@Mindwin doesn't matter that they can see that you did that. The point is that you have an electronic trail with authentic login/logout and routing timestamps through several servers (not just the company). Anyone with a wee bit of patience can manipulate a screenshot / picture taken of screen. A digital trail server-side, outside of company control, is much, much harder to do (if not impossible unless NSA)

@xyious So you took a picture of some text. That's easily faked. Just email / BCC yourself. What are they gonna do about it, get angry that you make sure that stuff which can affect is properly documented / covered? If that's the case, take exit 1 and leave.

You can always go old school and print it out and take it home.

@xyious "You also realize that the email header can be faked as well, right ? I could send myself an email from whitehouse.gov right now ...." ...and any web mail provider will run SPF, DKIM and DMARC checks, laugh its ass off, mark it as fake and put it in the trash before you ever see it. The fact that an email PASSES those checks is how you know they're legit.

Another good answer on workplace that could start with "Update your résumé, then..." Maybe SE could automatically prepend that. :)

There are 2 aspects to this question: legal and ethical. 1. Legal aspect: I am not sure what your accountability in court would be. The code you develop is not owned by you, but by your company. It is probably (lawyers, please) the responsibility of the company to ensure that it is not violating 3rd-party licenses, NOT the employees. I have worked in places where the company understood that it was culpable and had it code vetted against tools like black duck.