When signed in 2016, the Defend Trade Secrets Act marked a landmark shift in how trade secrets are treated in the legal arena—igniting an upswing in the volume and intensity of IP theft litigation.

A survey by Baker McKenzie found that two-thirds or more of respondents in industries spanning healthcare/pharma, consumer goods, technology, financial services and others, agreed that trade secrets and IP are an important or essential component of their brand value and corporate strategy. It makes sense then that protecting these assets is a critical and rising priority.

Along with the increasing appetite for legal action around trade secret misappropriation is a new depth to the complexity of these types of cases. In my investigations work in recent years, I’ve seen some interesting trends in the way trade secret matters are evolving, which are detailed below.

Complex Plaintiff Protocols

When IP theft is suspected, plaintiffs often look for evidence to assure the lost information is not being used. In this effort, many plaintiffs have become pretty sophisticated in demanding/negotiating protocols, which are essentially the scope of how the investigation is carried out, and the extent of date ranges, keywords, custodians and data sources that must be examined.

Historically, defendants would suggest an approach, and plaintiffs would typically approve it for the investigation to move forward. But now, we’re seeing plaintiffs heavily negotiate complicated protocols. These typically include highly technical aspects that increase the matter’s overall costs.

For example, a protocol may include the requirement to search devices extensively for unallocated space and deleted files. While these insights can be helpful, they require broader context from other pieces of the puzzle (which may or may not be recoverable), they don’t always yield value proportionate to the cost of the in-depth, technical forensic analysis required.

It’s important for lawyers to understand how a wide-sweeping protocol can dramatically increase the cost of an investigation. They must work with digital forensics experts that can offer guidance on a strategy that will recover key information without breaking the budget.

Cloud Synchronization Challenges

Today’s reliance on the cloud means that our work and personal devices are now synchronized to more data sources than ever before. What this also means is that data taken from an organization can quickly end up on a lot of different devices. From an investigations standpoint, this requires the team to cast a wide net in the sources they search and analyze, and ultimately remediate.

Five or 10 years ago, if a person took data from one company to another, the number of places to which that data could have migrated was likely far less than it is now. External hard drives were more expensive, cloud use was far less prevalent and computers were somewhat isolated.

All of that has changed, and many cloud systems will replicate data to yet another store (e.g. iPhone to Mac to iCloud to Dropbox, etc.)—so investigators must address a vast variety of physical and digital data sources to ensure they have found every incidence of a stolen trade secret and/or proof of wrongdoing by suspected parties.

Cloud environments also create challenges in remediating stolen trade secrets. As part of an investigation, my team is often responsible for deleting stolen data from every source to which it has spread. Synchronization features aren’t always seamless when removing data, and working around these challenges can inflate the workload significantly.

Remediations Are Growing in Scope

Beyond remediation challenges relating to cloud synchronization as discussed above, the size and scope of files that must be remediated in trade secret cases are also growing.

Each place where trade secret data lives must be addressed across operating systems (Windows, Mac, iOS, Android, Linux, etc.) and hardware (Mac, PC, iPhone, Android, chip-based memory, USB external hard drives), all which introduce unique nuances in how data may be recovered and deleted, or whether it can be overwritten, etc.

Counsel often believes that remediating data is a simple task, but it is actually quite complicated in these matters, and rarely as simple as hitting the delete button.

Forensic Tools Are Evolving

The technology available to computer forensic experts is improving, and some tools have robust features. Still, capabilities are limited against the backdrop of a matter’s complex needs and challenges. Investigators must often mix and match different tools to apply toward the unique challenges of any given investigation. In some circumstances this involves writing custom scripts, or building proprietary tools to fill the gaps where the technology falls short.

Counsel overseeing a trade secret investigation will have a very real need for advising on technology application as well as investigation approach, strategy and protocols. In these situations, the involvement of experienced digital forensics experts becomes essential.

Increasing DOJ Attention

Alongside the rise in trade secret litigation, the DOJ has acknowledged the economic significance of trade secret protection, and in turn grown increasingly aggressive in its attempts to pursue criminal action against individuals for its theft.

Case in point is an ongoing matter in which six individuals were indicted in 2018 for criminal charges of stealing trade secret information from their former employer, and using it for the benefit of a competitive company. Government involvement in trade secret investigations introduce the potential for additional steps and requirements for corporations pursuing related civil suits.

The most critical step counsel can take in dealing with these new trends is to make mindful case strategy a priority. As with most high stakes endeavors, a healthy balance of people, process, and technology is necessary in trade secret theft investigations.

With input from digital forensic investigators that understand the activities and factors that will drive up costs, counsel can ensure an approach that is reasonable and effective without scorching the earth in terms of cost and effort. Recovering trade secrets, remediating theft and pursuing reparations for losses relating to IP theft is worth the investment, but only if efforts are strategic, so that every step truly brings value to the case.

This column does not necessarily reflect the opinion of The Bureau of National Affairs, Inc. or its owners.

Author Information

Daniel Roffman is a senior managing director at FTI Consulting in the computer forensics practice of the technology segment. Roffman is an expert in computer forensics, eDiscovery, and cyber investigations.