Uncovering – and preventing - intellectual property theft

Imagine this:

You’ve been building your business for years, slogging it out, honing your craft, developing unique technologies and designs to outmaneuver the competition. Then, your best manager joins them. And takes your trade secrets with him.

Sound like an unlikely scenario? Unfortunately, this happens all the time. Intellectual property theft (IPT) is a serious crime with extensive damage connotations.

Background

Although a certain amount of IPT occurs from overseas in complex cyber attacks, a growing number of cases take place within the walls of business by their own employees. Home-grown direct attacks on your business and your bottom line, perpetrated by people you trust.

The U.S. Federal Bureau of Investigation defines IPT in this way:

“Intellectual property theft involves robbing people or companies of their ideas, inventions, and creative expressions — known as “intellectual property”— which can include everything from trade secrets and proprietary products and parts to movies, music, and software”.^[1]

The Canadian Intellectual Property Office^[2] refers to these protected business assets as “trade secrets.” In Canada, courts considering whether information is a trade secret, whether an action involves the misuse of a trade secret, and how to compensate an owner of a trade secret for its misuse look at factors including the following:

• measures taken to maintain secrecy
• the value of the information
• cost in money or time of creating or developing the information
• ease with which the information could be acquired or developed by others independently
• degree to which the owner regards and treats the information as confidential
• degree to which the recipient regards and treats the information as confidential
• whether the recipient ought to have known the information was confidential
• whether misuse of the information resulted in detriment to the owner

Examples

In our practice, IPT cases often involve blueprints, drawings, and technical specifications; software or IT development; tooling details; customer details and lists; project management information, etc. The industries involved include oil and gas, manufacturing, energy, cannabis, mining, IT, transportation, utilities, forestry, and other sectors.

It is not uncommon for employees and business partners, who may have helped your business develop trade secrets, to feel as if they own them. However, the law is clear on this. Intellectual property developed or created during the course of an employment arrangement is almost always the property of the employer.

It is important to understand the differences between confidential information and intellectual property. For confidential information to also be intellectual property, a proprietary right must be attached to the property.

Proving it happened

While it might seem an obvious first step, proving IPT happened can be complex. Preserving the evidence is critical to forward your case and should be done by experienced digital forensics professionals. They will:

• isolate when your intellectual property has been accessed, copied, downloaded, sent, moved, or printed from your business servers and connected digital devices;
• establish a sequence of events of movement of your intellectual property via electronic means;
• determine the person(s) responsible for access and use of your intellectual property;
• facilitate expert evaluation of competitor products that have used your technologies and designs; and
• isolate methods of access and exact dates and times.

A thorough team will also employ skilled interviewers, examine security records and data, and use other means to establish facts and evidentiary sources.

For example, proof of IPT or data exfiltration may require the examination of work laptops, personal laptops, work and / or personal cell phones that are available, USB thumb drives, cloud-based or on-premises email, and collaborative work platforms such as SharePoint, OneDrive, Dropbox, Google Workspace and Microsoft 365 accounts. 

Once the relevant data sources have been established, keyword searches can be run to create timelines and determine what external devices have been connected to the computers. Proper interpretation of the extracted results will tell us if IP theft has occurred or not.

Quantification of Damages

Once you have determined the sequence of events giving rise to damages, it is time to turn your minds to quantifying (calculating) losses to your business as a result of IPT.

When your intellectual property is stolen, there are a number of matters to consider and quantify to determine true damages to your business, such as:

• costs of developing the trade secrets;
• the incremental value or advantage of the trade secrets in the marketplace;
• efficiencies or reduced costs provided by the use of the trade secrets;
• the period of time during which the losses will or have occurred;
• calculation of lost profits;
• loss of customers; and
• cost of litigation or experts to prove the damages.

Accurately measuring the damages and supporting those amounts is complicated and nuanced – every element of the analysis needs to be understood and supported. Ensure your advisors have significant experience in preparing and defending damage quantification conclusions, and include accountants and chartered business valuators on their team.

Insurance impacts

You may have insurance coverage for IPT. There may be insurance coverage in the following policies that should be examined:

• cyber policy
• property policy
• commercial general liability

To invoke this coverage, you will need to:

• examine your policy for coverage provisions and exclusions
• discuss with your broker the loss event and determine if there is a need to notify insurers
• quantify the resulting loss and damages
• prepare a documented insurance claim in accordance with the policy coverage

Defend your property

Consider the following proven techniques to mitigate your risks:

• secure intellectual property in a safe place: a safe; in restricted electronic folders; or with your legal counsel;
• encrypt your data, both at rest and in transit;
• ensure your employment contracts with all employees clearly delineate that the intellectual property developed during their employment is the property of the employer;
• set a Code of Conduct that references intellectual property, and require employees to acknowledge their understanding of it annually;
• apply for patents, trademarks, copyright, or protections for your original industrial designs;
• train your employees so they understand the rules and consequences;
• set alarms within your IT systems to alert you for unauthorized access; large downloads; or file copies made; and
• restrict electronic access to your intellectual property, and avoid use of email to examine or refine it.

Conclusion

Intellectual property is often the result of lengthy, expensive development processes. Protect what you have created from both external and internal sources that may seek to profit from what you have built.

For more information, contact Lisa Majeau Gordon, National Leader, Forensics and Litigation Support, at [email protected], Craig Burkart, CPA, CA, IFA, CFF, CIP, National Leader, Insurance Advisory, at [email protected] or James Dyack, CPA, CMA, CBV, P.Eng., Valuations and Litigation Support, at [email protected].