On Sunday, September 13, 2015, a 30-year employee of Charter Dura-Bar, Robert O’Rourke, downloaded electronic data containing confidential and trade secret information belonging to Dura-Bar. According to a Law360 article, a disgruntled O’Rourke downloaded 1,900 files in only 20 minutes that Sunday from a company shared file server. Two days later, he resigned from Dura-Bar with the intention of helping a competitor in Jiangsu, China. Dura-Bar is the leading continuous iron bar manufacturer in the United States with 90% of the domestic market.

Somewhat surprisingly, O’Rourke told friends and colleagues about his plans which resulted in federal authorities arresting O’Rourke weeks later when he attempted to board a plane to China. This year, a jury found O’Rourke guilty of seven of thirteen counts of trade secret theft. Earlier this month, a federal judge in Illinois sentenced O’Rourke to a year and a day in prison, acknowledging that he had not managed to carry out his plans.

In this case, O’Rourke’s disloyalty was reported by his colleagues in time for management to alert authorities. Reporting illegal activity to federal authorities, however, is only a first step. Companies must immediately act to ensure evidence collection, preservation, and examination are carried out in a defensible, forensically sound manner. They must recognize that intellectual property theft is most frequently carried out by internal actors/employees, such as O’Rourke, with inside knowledge. Among the 1,200 files that O’Rourke stole were Dura-Bar’s “operational playbook” and lab reports. Notably, O’Rourke’s counsel pointed out that the 1,200 files were located on a file server that contained no access restrictions and were not identified as either confidential or proprietary.

Failure to properly identify or secure confidential and trade secret information, as well as a poorly conducted investigation, can put a company at great risk. With investigations, defensible evidence handling requires deep expertise and training that are not typically the requisites for quality IT staff. Additionally, internal IT may unknowingly fail to preserve important evidence, suppress key details, and hesitate to thoroughly investigate an incident that could involve a colleague. Ensuring the authenticity and integrity of digital evidence is where experts come into play.

Companies faced with trade secret theft can rely on bit-x-bit to piece together a complete timeline of the data exfiltration down to the second and develop a factual narrative that can withstand scrutiny before the courts. Additionally, bit-x-bit can assist in securing confidential and trade secret information with the development and implementation of appropriate policies and procedures.