An organization has adopted a bring-your-own-device (BYOD) approach for mobile devices such as smartphones and tablets. An employee's tablet has been identified as an unauthorized bridge between the organization's secure network and the public Internet. The organization's incident-handling team is baffled as to how this could happen and attempts to call the employee and retrieve the device. The employee refuses to provide the device and cites their right to privacy and their ownership of the device. The owner states that they have sensitive personal information on the device and under no circumstance will they allow the organization to search the device. What can the organization do in this situation?