Investigating potential trade secret theft

During investigations into trade secret theft, do:

• Stay vigilant for any suspicious behavior and be ready to act fast if IT monitoring detects concerning behavior. This behavior might include forwarding work emails to personal accounts, uploading files to cloud storage, creating multiple zip files or archived personal storage table files, deleting large files, increasing USB activity, excessive printing, and accessing company systems outside of business hours.
• Identify, inventory, and take custody of any departing employees’ devices.
• Power off all devices and secure them until they can be preserved.
• Document the chain of custody, including date, time, and personnel in possession of departing employees’ devices.
• As part of offboarding, obtain mobile device PIN codes and computer passwords from departing employees.
• Immediately preserve departing employees’ devices and accounts using a qualified digital forensics specialist. These devices might include company-issued computers, phones, USB devices, email and cloud storage accounts, and any relevant log files that might show when files were accessed, copied, transferred, deleted, or printed.
• Change shared passwords for company cloud storage accounts and cut off departing employees’ access to company email immediately.
• Back up encryption keys before removing a device from a resource management system.
• Put a legal hold on departing employees’ work email accounts.
• Work with a specialist to conduct a detailed forensic investigation to determine the manner and scope of suspected theft, including a review of the following:
  • Employee activity for the last three to six months
  • Data exfiltration using USB, email, webmail, and cloud storage
  • Web browsing activity, including sites visited and searches
  • File deletion or file destruction activity
  • The existence of personal USB devices, email accounts, and cloud accounts to request in discovery

While investigating trade secret theft, don’t:

• Power on the computer for any reason until the device has been properly forensically preserved.
• Plug in any USB devices to the computer for any reason.
• Transfer any data off the devices until they have been forensically preserved.
• Permit employees to share their device passwords with others.
• Permit employees to reset their mobile devices before returning them.
• Reissue a returned device until it has been forensically preserved.
• Have a company IT department attempt to forensically image any devices, attempt a forensic investigation, or attempt any data recovery operations on any devices until they have been properly preserved by a forensics specialist.

During any incident – especially trade secret theft – nobody wants to waste valuable time. These do’s and don’ts can help personnel start an investigation with confidence. It’s also important to find an experienced digital forensics team to support any investigation.