Well you can at least get the guy fired from where ever he works, should be no leagal issue with seting up a honeypot type system wit hthe ghost image, then run some sort of packet sniffer between it...