Companies are often built on trade secrets — typically proprietary technology but also confidential sales and marketing information. When an employee leaves, companies often worry that their most valuable assets may walk out the door as well. A dilemma these companies face is whether to file a suit and hope the stolen information comes out in discovery or whether to send a stern letter of warning and hope for the best.
Now, technology allows companies and their lawyers to determine more accurately before filing suit whether an employee left with information. Cutting-edge forensic computer analysis can detect not only copying but also deletion of information about the copying and user-deployed, data-eradicating software. Here’s what lawyers need to do if a client calls with concerns about departing employees:
• Investigate quickly and thoroughly. Confer with IT personnel and immediately preserve the suspected employee’s computer. Most lawyers will need to hire a forensics company unless they have in-house forensics capabilities. Experts must properly undertake computer forensics to maintain a valid chain of evidence and carefully handle computer evidence to avoid contaminating or altering data.
• Check personal e-mails and deleted files. Few employees are foolish enough to believe they could walk out the door with their work computer, but many would not hesitate to e-mail proprietary files to personal e-mail addresses or copy them to an external memory device. In a September 2005 study by The Radicati Group Inc. and Mirapoint Inc., six percent of employees surveyed from corporations of all sizes admitted to e-mailing company proprietary information to someone they shouldn’t have, and 25 percent admitted using personal e-mail accounts such as Yahoo or AOL on company computers.
Most bad actors delete incriminating e-mails or use personal e-mail accounts. But intelligent forensics can recover the e-mails, which are effective exhibits in trade secret cases.
Some suggest that private investigators are obsolete, but lawyers should not overlook the value of old-school-style investigation. Investigators complement forensics. Even if a former employee physically destroys a hard drive, an old-fashioned gumshoe may turn up physical evidence the employee overlooked.
• Obtain immediate relief and protection from the court. Lawyers must drive the investigation to occur quickly, allowing the company to obtain temporary injunctive relief. Simultaneous to seeking temporary relief, request an order requiring preservation of electronic evidence. If forensics reveal recent deletion, copying or use of external media, evidence of this may make the court more inclined to grant such an injunction.
Preservation orders should define the media at issue to avoid an overbroad ruling. The order should require preservation of all e-mails in personal e-mail accounts. All CDs, thumb drives and external memory devices used during the relevant time period — which the forensic analysis should have identified — must also be included.
The preservation order sets the stage for later discovery and precludes an excuse of routine deletion. Courts will not look kindly on employees who forensics reveal to have deleted e-mails after receiving a preservation order. Providing a court with forensic proof that a former employee used data-eliminating software can go a long way toward securing a spoliation inference instruction at trial.
• Pre-suit forensics leads to targeted discovery early in the litigation. On the heels of the preservation order, the company should seek expedited discovery. Target initial requests to images of the identified external devices — a bit-by-bit copy of things such as USB thumb drives and external hard drives — and personal computers. Be tenacious in digging out this evidence and running it through forensics.
To persuade the court to order production of personal e-mail accounts over privacy objections, the company may present evidence that the ex-employee used such accounts in conjunction with the trade secret theft. Forensic analysis is the key. It may also be prudent to subpoena the Internet service provider to make certain the ex-employee produces all relevant e-mails, as someone who takes trade secrets may not be forthcoming in divulging that behavior.
Proprietary intellectual property has great value to business. An effective approach to catch trade secret theft relies on a combination of sophisticated forensics and traditional gumshoe tactics. Although more expensive at the outset than simply obtaining a temporary restraining order and starting discovery, early forensics and investigation is likely to ultimately shorten the case and achieve better results for less.
John Keville is a partner in the intellectual property practice group of Howrey’s Houston office who focuses on patent, trade secret, trademark and copyright litigation. His e-mail address is [email protected]. Sheryl Falk is of counsel at the firm’s Houston office, working in the global litigation practice group and focusing on e-discovery and computer forensics. Her e-mail address is [email protected].
