Re: "he had downloaded documents to an external drive against company policy"
You are very right to think that. It is critical that audits be done about copying data to external media if employees are meant not to do so. This company is very fortunate that all this guy wanted to do was take work home without permission. Had he taken a copy and showed up at a prearranged consulate, he could be happily living in another country with the data handed over before the company even knew there was a problem.