Trade secrets are the focal point of ongoing international political tensions, with threats of trade wars, tariffs and criminal charges making the news on a daily basis. Experts from the Commission on the Theft of American Intellectual Property estimate the cost to the U.S. economy alone caused by theft of U.S. trade secrets is as high as $600 billion per year.  Whether and how the political issues will be resolved is unclear, but one thing is certain: no political rhetoric, trade agreement or criminal prosecution will do much to protect a company from losses or restore its value once its trade secrets are stolen.

Trade secrets are the 'crown jewels' of any business. Too often they are compromised by departing employees, competitors or criminals looking to advance their own interests. While many companies have publicly faced trade secret theft challenges – from T-Mobile to General Electric to Apple to Waymo to Tesla – one needs only to look at the American Superconductor case to understand how quickly a business can falter once its trade secrets are lost.

That case began when Sinovel, one of American Superconductor's biggest customers and the world's second leading wind energy supplier, paid an American Superconductor employee to steal encrypted computer software that regulates the flow of electricity from wind turbines. Sinovel then cancelled its pending contracts, causing American Superconductor's stock price to plummet. The employee in question pled guilty in 2011 and was sent to jail, but Sinovel was not indicted until 2013, after the technology was found in Sinovel wind turbines sold in the U.S. Sinovel was convicted in 2018, seven years after the theft, and was ordered to pay almost $60 million in fines. Justice may have been done, but American Superconductor suffered losses that far outweighed the fine paid.

While many nations have strengthened their trade secrets laws and threatened trade tariffs to punish bad behaviour, the reality is that these efforts have done little so far to effect change. Those intent on stealing remain undeterred. And while businesses have continued to pursue and adopt more sophisticated measures to guard their intellectual capital, those intent on stealing trade secrets have likewise employed increasingly sophisticated means to take them. As the American Superconductor case makes clear, companies operating in this environment must be proactive in protecting their information and cannot afford to rely on after-the-fact legal remedies alone.

Know the law. Identify, protect, and monitor your most important trade secrets. Don't ignore vulnerabilities. Trade secrets can take many forms, from technical information such as lab notebooks, computer code, software algorithms, designs, formulas, product ingredients, devices and methods, to commercial information such as customer lists or internal pricing information. Regardless of the type of information at issue, a critical characteristic of any trade secret is the fact that it is not publicly known nor readily ascertainable. Nearly all companies that design and sell products and services have trade secrets that are protected by both federal and state statutes. If a trade secret it stolen, these laws both allow for criminal prosecution and provide rights to private causes of action to limit the harm. The question for many is how best to use the weapons in their arsenal when it matters the most.

The key to protecting any trade secret is to identify it and limit the information any one person may have about it. Companies should make sure employees are fully trained and sensitised to the importance of trade secret information, foster a culture of responsibility, update IT policies on the use of company data and enforce restrictions necessary to protect the secrecy of the information. They should adopt measures to monitor and detect unusual data transfers by employees with access to critical information and maintain a vigilant lookout for malware and other intrusions that may result in data being compromised. They should pay particular attention to departing employees who may have had access to highly sensitive information, especially terminated or disgruntled employees and those taking jobs with current or potential competitors. Many companies require nondisclosure or noncompetition agreements in the event of departure. They should diligently and uniformly enforce those agreements, making it clear to employees and the courts that the company will take all reasonable steps to prevent its secrets from becoming public.

Pay attention to clues you may be compromised. While trade secret theft often comes as a surprise, there are usually warning signs:

• Loss of employees to a competitor
• Large amounts of data downloaded or copied by departing employees
• Departing employee files or folders are 'wiped clean'
• Unauthorised access to and downloading of certain kinds of data
• Former employee establishes a company with a competing product
• A competitor releases a similar product
• A tip that someone is trying to sell your information

If it appears that trade secrets have been stolen or compromised, companies must act immediately or risk losing their rights not only to the thief but also to others in the future.

If theft occurs, act quickly to determine what's at stake. Be ready with a multi-pronged strategy to prevent further harm.

Have a plan ready in the event a breach is detected. Treat any breach like the crisis it is. Consult experienced trade secrets litigators and investigations counsel. Undertake an immediate, confidential internal investigation to confirm any trade secrets compromised and the company's ability to re-acquire them in order to limit further dissemination of the material. Prepare a coordinated response to the threat that includes both pursuing civil remedies to protect against further damage and, where appropriate, notify criminal authorities.

• Stay head of the issues. Assemble the right team to assure the investigation team and litigators are actively coordinating and strategising with advisers considering intellectual property, employment, cyber and data privacy, security, public relations, SEC disclosure and board governance specialists.
• Set clear investigation objectives. Identify information stolen, perpetrators and collaborators, and methods used. Understand whether the information was publicly available or included in company confidential information, how the information may be used, and whether there is a risk of any immediate disclosure and harm. Fix any weaknesses in the system immediately.
• Assess whether the information has already been transferred. Interview IT and security personnel. Engage the services of a forensic data consultant, if needed, to identify, trace and preserve relevant information. Conduct a preliminary review of emails around the time of the data breach by the involved parties.
• Review departing employee exit interviews. Conduct further interviews with employees who may be responsible for or aware of the breach. Evaluate the employee's motivations and any legitimate reason or innocent explanation for the employee's actions. Rule out the possibility that the employee's actions are protected by applicable whistleblower laws. If the employee admits to the theft, seek his or her immediate cooperation in returning the data, which may include permission to access the employee's personal electronic devices or email accounts that contain trade secrets, and action against other actors who received the secrets.
• Determine whether the employee has violated relevant employment, nondisclosure or other contractual agreements or company policies. Assess whether there is any history of similar conduct in the past by the employee(s) or others with whom the employee(s) is connected. Consider appropriate disciplinary action or other legal action.
• Assess whether the company may have an obligation to report the theft to the authorities. This could be important if there is evidence that data has been shared with unauthorised third parties or there is a possibility that regulated data may be transferred out of the country. Where national security issues are involved, the company may have to report. In other cases, the company may have discretion. Qualified investigations counsel can help in making these determinations.
• Where possible, get statements from the relevant actors in signed affidavit or declaration form. If the company decides to pursue an injunction or other civil remedy, having ready-made, sworn witness statements both saves time and helps ensure accuracy as memories fade. If confidential and trade secret information cannot be retrieved and the breach is not contained, the company must carefully weigh reporting to law enforcement and filing for an immediate injunctive relief to prevent further disclosure. If reported, make sure the government is aware of sensitive information and request appropriate protective orders.

No matter what, don't delay and don't leave matters to chance. The more strategic and proactive a company is before any breach, the more likely it is that it will survive and limit the damage. Although political solutions may be critical for the future, no business can afford to leave the protection of its crown jewels to others.

BC Boren is a partner in Baker Botts' Palo Alto office, where he chairs the firm's IP/Technology litigation group. Amy Conway-Hatcher is a partner in the firm's Washington, D.C., office where she focuses on corporate internal investigations and criminal and civil enforcement matters.