If anyone from junior assistant level upwards can copy the database, apparently without senior management caring or even noticing, how do we know that other unauthorised copies haven't been made?