August 29,
2015
How Digital Forensics Can Help: Intellectual Property Theft
Cases
In the
second of our series of “How Digital Forensics Can Help” articles, we’ll focus
on an area that is most applicable to corporations – Theft of intellectual
property. Intellectual Property (IP) is
defined as:
The
legal rights that arise from intellectual activity in the industrial,
scientific, literary and artistic fields.
This includes works of art, inventions, designs, trade secrets, words,
phrases and symbols.
Pro Digital
is not just a cool digital forensic firm, it’s also a company that was built
from the ground up. Like many companies,
we have proprietary and confidential information that we would not welcome our
competitors to have. Most corporations
fall into this category. Think about
your company or companies you know.
There are things that make them different and unique and many times,
there’s some blood, sweat and tears (not to mention money) that has been
invested over a significant period of time to help separate those companies
from others who may claim to offer the same products or services. This is why intellectual property is so
important – It is information that can potentially break a company if provided
to competitors.
When Should Digital Forensics Be Used in IP Theft Cases?
In keeping
with the best practices of the digital forensic methodology, whenever the
slightest potential of an IP theft incident has occurred, a digital forensic
consultant should be called immediately.
Many times, these cases end up in some formal legal proceeding. Also quite often, the custodian of the
digital evidence is also a party to that legal action, a circumstance in which
an argument could be made that there is a conflict of interest. Even if that argument isn’t made, it’s best
to call in a digital forensic consultant as soon as possible after the theft is
detected to ensure they get a look at the evidence in the purest form possible.
Some cases
may require notification of law enforcement, but this can also go both
ways. In many state courts (including
Virginia), theft of proprietary information can be handled both civilly and/or
criminally. That means there are
remedies in the state law for both types of legal actions. The decision of whether or not to pursue
criminal charges against the suspected thief of the intellectual property is
something that should be carefully considered and counseled upon with your
attorney(s). If the decision is still “up
in the air”, make sure you choose a digital forensic consultant who is
knowledgeable about proper evidence handling and has testified in court as an
expert witness (hint: one such consultant writes this blog).
What Types of Evidence Can Be Useful in IP Theft Cases?
Consider
this brief case **example from a recent Pro Digital client: Acme company provides specialty technical
analysis services to corporations and governmental clients. Acme has been in business for about 10 years
and has developed a decent client base through their sales and marketing
department over that time. For the
majority of the 10 years, Bob Bouey has been Acme’s Sales Manager, but Bob has
been slacking for quite some time and has even been counseled and disciplined
for his failure to acquire new customers.
Finally, Bob is fired, but he’s not dumb and saw the writing on the
wall. A few days before he was fired, he
transferred the entire Acme customer database to a thumb drive and took that
information with him to a competitor, who now has acquired several of Acme’s
(former) clients. Acme’s President finds
out about this and files suit.
In this
case, we were called by Acme to conduct a digital forensic exam on Bob’s former
work computer to see if there was any digital evidence that Bob stole the
customer database. There most certainly
was! We were able to ascertain the date
and time of the file transfer, the size of the file, the device onto which the
database was transferred and even specific items such as the volume label of
the USB thumb drive Bob put the database onto: BOBS FILES. The FBI calls that a clue.
Cases like
these are probably more common than most companies are aware of. And this is just one example. In the age where company perks include mobile
devices, computers and other cool electronic gadgets which all store high
volumes of data, it’s important to also bear in mind that these devices only
help to facilitate the potential theft of information… and they all contain
digital evidence when that happens.
Digital Forensics in IP Theft Case Tips
So now that
you know what types of evidence are potentially accessible in your IP theft
case, what should you do to help ensure the most benefit your case? Here’s some tips about how to maximize
effectiveness in IP theft cases:
·
If a problem employee is identified, start your documentation
EARLY
·
Identify what digital items are most vital to
the operation of your business and keep an open mind about how that may be
exploited
·
If an intellectual property theft is suspected…
o
Secure and lock-down any and all equipment used
by the suspected thief immediately
o
Make sure remote access is shut off, including any
back doors
o
Call a Digital Forensic Consultant and schedule
a meeting as soon as feasible
o
If criminal charges will be sought, notify law
enforcement as soon as feasible
o
Be aware that you may be without the computer or
mobile devices used by the suspected thief for the duration of the examination
and litigation
Digital
devices are ubiquitous in our work and personal lives. Tech has interwoven itself into everything we
do for better productivity, entertainment and communication. Because of this, it’s also best practices
when an employee or associate is thought to be unhappy at work to assume that
some sensitive and/or proprietary information will be absconded at some point
before their access is cut off. By
keeping this in the back of your head, you already start to increase your effectiveness
in response to any suspected IP theft and set the stage for a better outcome in
partnership with your Digital Forensic Consultant.
**For confidentiality, the names of the
company and former employee were changed in this example**
Author:
Patrick J.
Siewert, SCERS, BCERT, LCE
Principal
Consultant
Professional
Digital Forensic Consulting, LLC
Based in
Richmond, Virginia
Available
Globally
About the Author:
Patrick Siewert is the Principal
Consultant of Pro Digital Forensic Consulting, based in Richmond,
Virginia. In 15 years of law
enforcement, he investigated hundreds of high-tech crimes, incorporating
digital forensics into the investigations, and was responsible for
investigating some of the highest jury and plea bargain child exploitation
cases in Virginia court history. A
graduate of both SCERS and BCERT (among others), Siewert continues to hone his
digital forensic expertise in the private sector while growing his consulting
business marketed toward litigators, professional investigators and
corporations.
Twitter: @ProDigital4n6
