Trade secret litigation is on the rise. In the last two years, the number of filings have grown more than 30 percent. The stakes in these matters are becoming increasingly high as well—with awards reaching into the hundreds of millions for some civil cases. Investigators are facing new challenges that make the task of gathering evidence and remediating lost IP ever more difficult.

When trade secret theft is suspected or a suit is filed, the investigations that commence are complex, expensive, and intense. They involve collection of data from numerous physical and digital sources, across multiple geographies, and for potentially dozens of custodians. In addition to searching for evidence of trade secret theft or malicious behavior, investigators must then also locate every place to which stolen trade secret information has been copied or shared, and remove it from those unauthorized stores. When you layer in the potential for data privacy concerns, the complexity is even more evident.

In my investigations work in recent years, I've seen the scope and complexity of these matters deepen significantly, along with changes in how they are approached. Complicated protocols for investigations are causing costs to rise. The proliferation of varied data sources and cloud usage introduces more challenges for finding and remediating lost IP. Gaps between new demands and the capabilities of technology solutions are placing added importance on the skill and expertise of investigators.

Recovering trade secrets, remediating them, and pursuing reparations for losses relating to IP theft is often worth the investment, but only if efforts are strategic, such that every step truly brings value to the case. Below are four areas counsel must consider and address in today's trade secret litigation landscape to prevent time and costs from spiraling out of control.

1. Case and Protocol Strategy: Make mindful case strategy a priority, especially with regard to protocols and the use of neutral experts. In these matters, plaintiffs want to find evidence that their lost IP is not being used or disseminated. One way they do this is by negotiating protocols, the scope of how the investigation is carried out and the extent of date ranges, keywords, custodians and data sources that must be examined. We're observing plaintiffs heavily negotiate complicated protocols above and beyond what was the norm five or 10 years ago. Complex protocols can contain highly technical aspects that don't always yield value proportionate to the cost of the in-depth, technical forensic analysis required.

For example, the protocol in one recent matter required us to search unallocated space (space not currently being used by an active file but may contain remnants of prior deleted data). Unallocated space can contain a wealth of information about deleted files—but understanding why it should be searched is critical. Does counsel wish to establish that a file once existed but does not anymore? Is the goal to recover the file and review it? Without an understanding of the goal, one can easily spend a great deal of money running keywords that won't return actual files. In the case referenced above, the existence of the key documents in unallocated space would not have told the parties anything they didn't already know and thus added very little value despite the cost. Work with digital forensics experts to build a strategy that will recover key information without breaking the budget.

2. Understand Remediation: Remediation is an important part of a trade secret theft investigation, to stop misappropriation from perpetuating. Unfortunately it is rarely as simple as hitting the delete button and moving on. Each place where trade secret data lives must be addressed across operating systems (Windows, MacOS, iOS, Android, Linux, etc.) and hardware (Mac, PC, iPhone, Android, USB external hard drives), all which introduce unique nuances in how data could be deleted and overwritten. More, the volume of files that must be remediated is also increasing.

While rare, certain technical limitations may lead to thousands of dollars in costs to overwrite just one file, even when lower cost alternatives exist. Often, forensic investigators are bound by a remediation protocol that doesn't give them the flexibility to deviate to a lower cost alternative. Close coordination between forensic experts and counsel can help address technical challenges as they arise to ensure timely, accurate and cost effective removal of misappropriated trade secrets.

3. Be Prepared for Cloud Complications: Data taken from an organization can quickly end up in a lot of different places. From an investigations standpoint, this requires the team to cast a wide net in the sources they search and analyze, and ultimately remediate. A single action, like taking a photo of a confidential information, could cause replication of trade secrets to numerous locations. Investigators must address a vast variety of virtual and physical digital data sources.

In the example of the photo, I commonly advise clients to check iCloud, Dropbox, Google Photos, Amazon Photos and other similar services, in addition to traditional sources, like a laptop, for copies of the same photograph. The first step in this process is to identify all the possible locations where the trade secrets could have spread. Once those locations are identified, the team may encounter a range of challenges getting access to the files and removing the files from the accounts, adding to the remediation challenges and costs outlined earlier.

One recent case involved a single individual who took trade secrets. At first, we expected the matter to be resolved quickly given the individual's assertion that he would cooperate with our investigation. We obtained his computer and cloud account credentials. Upon inspection of the computer, we identified other cloud accounts not provided to us, as well as files in a Dropbox folder that didn't match the online Dropbox account. As it turned out, the individual had multiple Dropbox accounts but had only provided one to us. Further investigation of the second account revealed yet another computer to which the client's trade secrets had been synchronized.

Despite the fact that the laptop and cloud credentials were provided up front, the investigation became quite extensive—the work of accessing and combing through data sources and remediating the trade secrets was significant for what was initially considered a fairly isolated and small incident. The lesson? Counsel must be prepared for cloud complications and take them into consideration when planning case strategy.

4. Get Smart about Technology: First, understand that today's forensics tools, while robust, lack certain capabilities to meet today's complex needs. They do provide the ability to work much faster, but at the same time, investigators often mix and match different tools to meet the unique challenges of any given investigation. In some circumstances this means writing custom scripts, or building proprietary tools to bridge gaps—tasks that require specialized expertise in computer forensics and an understanding of tools available and the nuances of trade secret theft work.

Further, analytics can provide significant value to searching for key information in a case, but only when applied alongside experienced people and thoughtful process. Our teams have seen numerous instances in which clients relied upon leading analytics tools to uncover specific information in a trade secret matter, only to find that other settings, other tools or custom tools would have been more effective at uncovering the critical evidence. This is a valuable reminder of the importance of having a deep understanding of the tools and how they are used.

The most critical step counsel can take in dealing with these new trends is to strike a healthy balance of people, process, and technology. With input from digital forensic investigators that understand the activities and factors that will drive up costs, counsel can ensure an approach that is reasonable and effective without scorching the earth in terms of cost and effort.

 

Daniel Roffman is a Senior Managing Director at FTI Consulting in the Computer Forensics practice of the Technology segment. Mr. Roffman is an expert in computer forensics, eDiscovery, and cyber investigations.