I'm guessing they saw it through remote access logs? If they see he downloaded gigs of data he wasn't supposed to be using for his job then that's very suspicious. I wonder how they found out that he copied it to an external hard drive though. I'll want to watch this case as it develops.