Trade Secret Theft Investigation: When a Departing Employee May Have Taken the Files

The Moment It Becomes a Trade Secret Matter

The signal usually arrives sideways. A sales director resigns on a Friday, and on Monday a customer mentions a new competitor. IT notices a large upload to a personal cloud account in the week before an engineer's last day. A former manager's new company launches a product that looks uncomfortably familiar. A client asks why a proposal it received from a stranger quotes your pricing.

Each of these may be innocent. People take their skills, experience and general knowledge with them when they leave, and they are entitled to. What they may not take is information that qualifies as a trade secret, and the gap between those two things is where most departing-employee matters are decided. A trade secret theft investigation exists to establish, on a documented record, which side of that line the facts fall on, before anyone commits to a demand letter, a lawsuit or an accusation.

This article is written for the company and its counsel. It covers what to do first, what an independent investigation can lawfully establish, what it cannot do, and how its findings feed the legal options counsel will weigh. The wider question of when a company should investigate itself at all, and how privilege is structured, is covered in internal and workplace investigations. The article is informational, not legal advice: every legal decision described here belongs to counsel.

What Makes Information a Trade Secret, and Why That Comes First

Under the Defend Trade Secrets Act of 2016 (DTSA), information is a trade secret only if two things are true: its owner has taken reasonable measures to keep it secret, and it derives independent economic value from not being generally known to, and not being readily ascertainable through proper means by, another person who can obtain economic value from its disclosure or use (18 U.S.C. § 1839(3)). The DTSA does not displace state trade secret law (18 U.S.C. § 1838), so a state claim can run alongside the federal one.

That definition shapes the investigation from the first day. The opening question is not only what the employee took but whether what they could reach was protected: confidentiality and invention-assignment agreements, access limited to the people who needed it, marked documents, acknowledgments signed at hiring and at exit, and the security controls around the systems that held it. A customer list anyone in the industry could rebuild from public sources, or pricing the company sends to prospects without restriction, may not qualify, however much it matters commercially.

Misappropriation then turns on how the information was acquired, used or disclosed: improper means includes misrepresentation and inducing a breach of a duty of secrecy, and excludes reverse engineering and independent derivation (18 U.S.C. § 1839(6)); the full line is set out in competitive intelligence for deal teams and boards. An investigation therefore assembles two bodies of fact at once: how the company protected the information, and what happened to it. The improper-means line binds the investigator too, which is why method matters as much as findings.

Preserve First: The Evidence That Disappears

The most expensive mistakes in a departing-employee matter are made in the first week, and most of them are acts of curiosity or routine. A manager opens the returned laptop to look around. IT wipes and reissues the machine on its normal schedule. A mailbox is deleted when the license is reclaimed. Each can destroy or alter evidence that cannot be recreated: file metadata, traces of deleted material, the record of which external drives were connected, and the logs showing what was downloaded, synced or forwarded, and when.

Forensic imaging and log analysis are specialist technical work. As in its litigation support work, Fortaris coordinates digital evidence with counsel and forensic-IT partners so that chain of custody holds, and ties that work into the rest of the inquiry. The full sequence for the opening weeks of a matter, including the hold and the privilege structure, is set out in the first thirty days of a corporate fraud investigation.

Preservation is a legal question as well as a practical one. Federal Rule of Civil Procedure 37(e) addresses electronically stored information "that should have been preserved in the anticipation or conduct of litigation" and is lost because a party failed to take reasonable steps to preserve it and cannot be restored or replaced through additional discovery; a court may order measures to cure the prejudice and, where a party acted with intent to deprive another of the information's use, more severe ones. Whether a litigation hold is needed, how it is worded and who receives it are counsel's calls. In practice, the first steps usually look like this:

• Keep the departing employee's company devices as they were returned, unopened, until a forensic image has been made
• Suspend deletion and license reclamation for the person's mailbox, cloud storage and collaboration accounts
• Export the logs that age out, or extend their retention: email, cloud-storage, remote-access, badge and print logs, and any data-loss-prevention alerts
• Collect the paper record: confidentiality and invention-assignment agreements, the exit checklist, any return-of-property certification, and the access the role carried
• Write down who noticed what, and when, before memories settle into a story

What an Independent Investigation Can Lawfully Establish

Once the evidence is held, the investigation works outward, from the company's own systems to the public record. Each strand below is lawful, and each produces something counsel can test.

The company's own systems. The forensic-IT partners' findings are read against the role: what the person accessed in the final weeks compared with their usual pattern, what left the network and by which route, and whether anything was deleted afterward. The returned devices are compared with the return-of-property certification, because a signed statement that everything came back is itself evidence if the logs say otherwise. Interviews of managers, colleagues and IT staff, conducted openly under counsel's direction, fix the timeline and record what the person said about their plans.

The new employer and any new entity. State business filings show whether the person, or people close to them, formed a company, when, and with which registered agent; where a state does not list owners, ownership is reconciled from several records rather than read from one. The new employer's public announcements, product launches, website changes and job postings show what it is building and how quickly. Patent and trademark records can show who is claiming what, with one caution: a United States patent application is generally published promptly after 18 months from its earliest filing date (35 U.S.C. § 122(b)), so a recent filing may not be visible yet.

The open-source footprint. Professional profiles, conference talks, published articles, customer announcements and archived versions of web pages can show a person describing new work in terms that overlap the old, or reaching out to the same customers. Each item is a lead rather than a conclusion, and each is captured with its source and the date it was retrieved, using the method set out in how an OSINT investigation actually works.

Court records. Earlier litigation involving the person or the new employer, including other trade secret, non-compete or non-solicitation disputes, is on federal and state dockets and can show a pattern, or show that the same question has already been argued.

Read together, these strands answer the questions counsel will be asked first: what the information was and how it was protected, what left and when, where it appears to have gone, and what remains unknown.

What the Investigation Does Not Do

The limits are not a formality. Evidence gathered unlawfully can be excluded, can expose the company to counterclaims, and can turn a strong position into a weak one. A competent investigator states the limits before the engagement starts:

• No access to the person's personal email, personal cloud storage, phone or home computer without their consent or a court order; those are reached through counsel, by agreement, demand or legal process
• No pretexting: nobody poses as a customer, recruiter or journalist to draw information from the person or the new employer
• No covert recording, and no monitoring or surveillance of the individual: the work is the company's own systems, the public record and lawful interviews
• No approach to the new employer's staff for its confidential information, which would itself be an improper means
• No view on whether a claim will succeed: that judgment, and every decision about what to file, belongs to counsel

Two Federal Provisions That Bear on Departing Employees

The Computer Fraud and Abuse Act has been invoked against employees who took data they were permitted to access. In Van Buren v. United States (2021), the Supreme Court read its "exceeds authorized access" clause narrowly, which bears on whether an insider who misused access they were entitled to can be reached under that clause at all.

The DTSA itself gives immunity to an individual who discloses a trade secret in confidence to a government official or an attorney solely to report or investigate a suspected violation of law (18 U.S.C. § 1833(b)), so a disclosure that looks like a leak may be protected. Which statutes fit a given matter is for counsel.

How the Findings Feed a DTSA Claim, a State Claim or a TRO

The investigation does not set the legal strategy, but it decides what the strategy can rest on. The DTSA gives the owner of a misappropriated trade secret a federal civil action if the secret relates to a product or service used in, or intended for use in, interstate or foreign commerce (18 U.S.C. § 1836(b)(1)). An action must be brought within three years after the misappropriation is discovered or, by the exercise of reasonable diligence, should have been discovered (§ 1836(d)), which is one reason the date the company first noticed the problem belongs in the record.

Emergency relief is where a documented record matters most. A federal court may issue a temporary restraining order without notice to the other side only if specific facts in an affidavit or a verified complaint clearly show that immediate and irreparable injury will result before the adverse party can be heard, and the movant's attorney certifies in writing the efforts made to give notice and why it should not be required; such an order expires at a time the court sets, not to exceed 14 days, unless extended (Fed. R. Civ. P. 65(b)). The DTSA also provides for an ex parte civil seizure order, but only in extraordinary circumstances (§ 1836(b)(2)).

Two provisions bear directly on departing employees. A DTSA injunction may not prevent a person from entering into an employment relationship, and any conditions placed on that employment must be based on evidence of threatened misappropriation and not merely on the information the person knows (§ 1836(b)(3)(A)(i)(I)). And an employer must give notice of the whistleblower immunity in any contract or agreement with an employee that governs the use of a trade secret or other confidential information; for agreements entered into or updated after the DTSA's enactment on May 11, 2016, an employer that did not give notice may not be awarded exemplary damages or attorney fees against that employee (§ 1833(b)(3)). The agreements pulled in the first week answer that question too.

Criminal referral is a separate decision. Theft of trade secrets is also a federal crime under the Economic Espionage Act (18 U.S.C. § 1832). Whether and when to refer a matter to law enforcement, and what that does to the company's control of the timeline and the evidence, is for the company and its counsel.

What counsel needs from the investigation is a findings report that separates established fact from inference and from allegation, ties each finding to a record and its date, and states plainly what could not be established. This is general information, not legal advice.

Insider Threat Investigation: When the Signal Comes Before the Departure

Not every matter begins with a resignation. Some begin while the person is still employed: an alert on unusual downloads, a manager's concern, a tip. Security teams call this an insider threat investigation, and the same rules apply with one difference. While the person is still inside, the company controls the timeline, and a quiet inquiry run under counsel can establish what is happening before anyone is confronted.

The longer-term answer is a program rather than a case: knowing which information qualifies as a trade secret, limiting access to it, monitoring company systems lawfully, with whatever notice the employer's policies and applicable state law require, and running exit procedures that collect devices and signed certifications as a matter of routine. Fortaris advises on insider threat programs within its security practice; when a signal turns into a matter, the work moves to investigative services.

When to Bring In an Investigator

The best time is before the departure, when someone with access to the information that matters most resigns. The next best is the day the signal arrives, before devices are reissued and logs age out. The case for an outside investigator rather than HR or IT alone is the familiar one: independence, an evidentiary standard, and a record built to be tested by the other side's lawyers. How this fits among the other kinds of corporate investigation is mapped in corporate investigation services.

Fortaris takes misappropriation of trade secrets, IP theft and NDA breaches as part of its investigative work, typically engaged through counsel and structured to protect privilege. It is licensed in Michigan (Private Investigator License #3701207862) and works nationally through licensed specialists where state law requires. An engagement begins with a confidential conversation about what may have been taken, what has already been preserved, and what counsel needs to decide.