Trade secrets are immensely valuable, and warrant every ounce of protection that can be mustered. And some industries—such as pharmaceutical, biotech, medical device and software development—are particularly at risk for trade secret theft. Years of effort and investment in research and development can simply walk out the front door on a mobile device or thumb drive, or be transferred or disclosed to outside parties through email or personal cloud or social media accounts—in either case, directly winding up a competitor’s hands.
A prime example of this concern is the DOJ’s indictment filed against two electronics industry enterprises in the People’s Republic of China for economic espionage—primarily theft of trade secrets—from U.S.-based Micron Technology Inc. According to pleadings filed in the Northern District of California, United Microelectronics Corporation (“UMC”) and Fujian Jinhua Integrated Circuit Co. Ltd. (“Jinhua”) misappropriated several electronic files comprising Micron trade secrets in an effort to “realize the domestic manufacturing of [dynamic random access memory “DRAM”] chips….” According to the indictment, several employees of a Micron subsidiary copied the files to USB drives and cloud accounts, and then transferred them either physically or via personal email to UMC and Jinhua, before leaving Micron and taking up employment with UMC. And while they were still at Micron, several of these employees were in periodic electronic communication with UMC employees relating directly to the theft.
There are two principal components to every trade secrets case—forensic examination and internal investigation. Forensic examination, i.e., finding the operating system fingerprint detailing the misappropriation, is beyond the scope of this paper. Instead, this discussion focuses on the investigation techniques that might be used to quickly and efficiently locate electronic evidence that will help prevent or remedy malfeasance.
Internal investigations are often a valuable risk mitigation tactic. Regardless of the impetus—suspected economic espionage, complaints from disgruntled or departed employees, or just general preventative measures—even the smallest signs of smoke surrounding the security of corporate intellectual property should trigger some measure of internal investigation as a means of determining whether, and how, proprietary information may be compromised. Early, swift and proactive efforts will be invaluable in protecting against, and promptly mitigating, corporate misconduct.
Even in the most clear-cut matters, however, finding evidence of trade secret theft can be difficult—especially when digital evidence is obfuscated through direct or indirect efforts. Ferreting out the truth, especially when the telltale facts are hidden, requires sophisticated e-discovery and analytics tools that enable in-house legal teams and their outside counsel to develop leads that can move an investigation forward efficiently, toward an expeditious resolution.
1. Preserve and collect immediately—and discreetly
Like most internal investigations, you may have little to go on, and probably don’t know exactly who is involved or the circumstances. But you can go to the source of the documents that triggered the investigation and work backward, starting with interviewing the custodians who created the documents in question (so long as they do not appear to be involved) before expanding the scope of the investigation. Since time is of the essence, a legal hold application integrated with collection tools can expedite the investigation process. By sending known document custodians a questionnaire asking for additional information while simultaneously collecting their data and documents for review, you can prepare for in-person custodian interviews sooner.
Because many internal investigations deal with potential employee misconduct, they should be approached cautiously and discreetly. If discretion is necessary, you can use remote collection tools that operate silently in the background without ever alerting the employee. Simultaneously, IT can automatically suspend the routine destruction of data without tipping off the custodian.
At the same time, as new information surfaces, you can continue to define potentially relevant data sources and work with IT to defensibly preserve those sources, recover deleted data, gain access to password-protected files and identify documents and system artifacts to piece together a chain of events. Taking this proactive approach early will also provide an obvious to your forensic examination efforts.
2. Use communication analytics to identify additional custodians
The clock is the enemy when investigating potential trade secret theft: the goal is to get to the heart of the matter as quickly as you can by promptly identifying the key witnesses, documents and facts. The faster you can isolate the witnesses who hold critical documents and link them to other custodians, the faster you can unlock the insights that will let you accurately assess the matter.
As you gather facts from your custodians, you can apply multiple layers of advanced analytics tools to unearth important details earlier. Analytics tools can help you understand the entire social network of communications across a document population, which highlights the main players. Visual analytics can then reveal these individuals’ communication patterns, pinpointing additional witnesses for interviews and targeted collection and, equally as important, identifying potentially critical external communications.
With the right visualization tools, you’ll simultaneously gain insight into the relationships between all of your documents, custodians, timelines and more, so you can drill down based on what is of most interest. Advanced tools can also help you avoid a fishing expedition: These tools create a methodical “breadcrumb” history of precisely how you arrived at the data in your current searches, which you can organize into folders for further review and application of technology-assisted review.
3. Use efficient, technology-assisted review techniques
Technology-assisted review (TAR), well known for its proficiency in accelerating litigation document review, can play an equally important role in internal investigations.
Generally, early TAR tools start slowly: They ingest an entire collection at once and require iterative training rounds to refine their algorithm before yielding trustworthy results. These tools won’t work in the quick-turn investigation setting: Your investigation can’t wait until you’ve collected the full universe of potentially relevant documents, or you have to start over with the TAR system when you identify new custodians whose data warrants review (which is more often the case than not).
Instead, choose a TAR tool based on a continuous active learning (CAL) protocol, so you can start review once you collect the first document. The CAL protocol refines its decision-making with every judgment it makes, incorporating documents seamlessly as you collect them, so you can prioritize the most important documents for the earliest review.
If you haven’t identified pertinent documents at the start of an investigation, you can give a CAL-based tool a head start by creating a synthetic seed document that includes concepts essential to the investigation. After ingesting this document, the CAL protocol will recognize these central words and phrases and begin prioritizing similar documents. And you won’t need to start the training and review over again as you identify new custodians and collect new data — CAL incorporates both into its learning on a continual basis.
4. Make sure to effectively explore the unknown
When you’re starting from scratch in an investigation, you may worry that your limited understanding of the situation has caused you to miss a key document. With first-generation TAR tools, that review bias may continue to eliminate important information, because the algorithm looks only for documents using the concepts and documents that you expected to see. Modern TAR tools with CAL can locate contextually diverse documents—those with unexpected concepts or terms—that may ultimately shed additional light on your investigation. That means you won’t risk missing the critical needle in the haystack of documents.
Applying the latest e-discovery technologies will not only make trade secret investigations faster and easier, but they can also help companies spot and proactively address potential infractions, all while avoiding negative impact to what may be the most valuable assets the organization possesses.
To learn more about optimizing modern ESI investigations download the free White paper.
