They probably have all kind of activity meta data on all emps but don't actively monitor and only go back and reconstruct in these kinds of events (leaks, IP disputes, emp misconduct, etc.)
They won't have been monitoring his laptop. They will have been monitoring the Google laptop he used.
It's an important distinction people are well-advised to remember.