Defending against trade secret theft allegations

• Interview the data custodian to identify all relevant data. Even if the allegations relate to only a single USB device or email account, conduct a thorough interview of the data custodian to assess and preserve all the custodian’s devices and accounts, as well as all appropriate business devices and accounts. It is often useful to have an experienced digital forensics professional attend the interview and assess the available data for preservation.
• Retain an experienced digital forensics professional early to help identify and preserve all relevant data. The digital forensics professional can help with crafting discovery directed to the plaintiff to uncover the relevant data, including forensic artifacts, devices, and online accounts that the plaintiff might rely on to support its trade secret theft allegations.
• Caution against spoliation. Counsel the data custodian and act proactively to prevent alteration, deletion, or destruction of data. It is a common tactic to allege spoliation if data has not been properly preserved. Severe penalties can result for failure to preserve data.
• Immediately upon learning of the allegations, issue litigation hold notices to the defendant, all potential data custodians, and the company IT department outlining the scope of relevant data. It is important to alert the IT department to suspend any planned software or hardware upgrades and to suspend automatic deletions that otherwise would occur in the regular course of business.
• Conduct a forensic investigation to assess the allegations of theft, including transfer, copying, and use of the alleged stolen data. It is important to quickly learn about the facts by assessing email, texts, and application data to identify any communications that might be relevant to the trade secret theft allegations.
• Work with the forensics professional to assess whether the plaintiff organization had reasonable measures in place to protect the alleged trade secret data. If the plaintiff organization failed to use reasonable protection measures, the court might find the information was not legally a trade secret.

Pitfalls to avoid during a trade secret theft investigation

• Be wary about relying on the IT department to copy the relevant data. Common IT tools might copy the data but not to forensic standards. A digital forensics professional is properly trained and uses forensic software to image data and appropriately document the data acquisition.
• Be careful not to review original data sources. Accessing and interacting with original data sources can alter metadata and generate artifacts of user activity that can cause confusion and obfuscate the original user’s activity.
• Be mindful of any relevant data located outside of the United States as privacy laws might restrict the import of that data. For example, strict European Union privacy laws govern personal information, including business emails.
• Do not rely on the trade secret pleading to identify the data sources at issue to preserve and analyze. At the early stage of the case, the plaintiff’s pleading might not contain all of the relevant devices or accounts. The defendant needs to go through its own diligence to understand the scope of relevant data. Failing to do a deep dive into the data at the beginning of the investigation can jeopardize evidence that might be very beneficial to the defendant’s case.

Understanding these steps now can help attorneys be prepared for future trade secret theft investigations, so they can quickly marshal the digital evidence needed for a robust forensic investigation to support a defense for their clients.