How employers make sure the employees are not stealing the source code? 
I recently came across this article: http://www.iplawalert.com/2012/04/articles/trade-secret/us-v-aleynikov-second-circuit-reverses-sdny-due-to-statutory-interpretation-errors/

Essentially this guy was caught for uploading the source code owned by his employer to an internet server in Germany. 

What I am curious is, how the did even he get caught? I can understand you will get caught by downloading your code to a thumb drive or DVD -- the employer just needs to install some software to monitor the activities on the USB key or DVD, but how do they monitor uploading activities? `scp` to a remote server should be encrypted, right? 

Also, archiving / monitoring all the network traffic that goes in and out of a workstation just sounds incredibly expensive to me. And how do you even find out that a source code file is being transported in the massive network traffic? If one simply zips up all the files in a compressed file, finding whether a source file is being transported will be even harder, right? 

All I can come up with is looking up the employee's command line history. But that only assumes he doesn't disguise the files, such as an easy renaming, or deleting the file afterwards. 

I am not interested in stealing code or monitoring my employee's workstations (I am a self-employed programmer). But I am just curious from the technical perspective. 
How employers make sure the employees are not stealing the source code? 
===

I recently came across this article: http://www.iplawalert.com/2012/04/articles/trade-secret/us-v-aleynikov-second-circuit-reverses-sdny-due-to-statutory-interpretation-errors/

Essentially this guy was caught for uploading the source code owned by his employer to an internet server in Germany. 

What I am curious is, how the did even he get caught? I can understand you will get caught by downloading your code to a thumb drive or DVD -- the employer just needs to install some software to monitor the activities on the USB key or DVD, but how do they monitor uploading activities? `scp` to a remote server should be encrypted, right? 

Also, archiving / monitoring all the network traffic that goes in and out of a workstation just sounds incredibly expensive to me. And how do you even find out that a source code file is being transported in the massive network traffic? If one simply zips up all the files in a compressed file, finding whether a source file is being transported will be even harder, right? 

All I can come up with is looking up the employee's command line history. But that only assumes he doesn't disguise the files, such as an easy renaming, or deleting the file afterwards. 

I am not interested in stealing code or monitoring my employee's workstations (I am a self-employed programmer). But I am just curious from the technical perspective. 