One of the first things a company should do when it suspects that its trade secrets have been compromised or that an employee has violated post-employment restrictive covenants is to conduct an investigation. Doing so will identify and ensure preservation of evidence supporting any claims, and is critical to the ability to demonstrate the need for emergency injunctive relief, especially at a time when courts are taking a rigorous approach to what constitutes a " litigation emergency." Conducting a prompt investigation also helps to avoid any potential defenses of delay, bad faith, or a failure to investigate.
Because each case is fact-specific, there is no one-size-fits-all formula for conducting investigations of this nature, the typical investigation will include (i) a forensic examination of electronic devices and computer systems, (ii) witness and exit interviews, and (iii) monitoring and surveillance. While the COVID-19 pandemic has changed the physical location of employees, witnesses, electronic devices, and even wrongdoers, a full investigation still can, and should, be conducted when an employer has reason to believe that a misappropriation has occurred, or a restrictive covenant breached.
Forensic examination
The vast majority of business documents and communications today are digital. As a result, a forensic examination of a departing employee's electronic devices, emails, cloud accounts, and any other electronic or virtual storage systems is a routine first step. A forensic examination may determine whether there have been any unusual or improper downloads, emails, printing, or internet search activity, among other things. In the case of unauthorized computer access, a forensic examination can also be performed to determine the source of the misappropriation (and potentially the identity of the misappropriator).
Although in-house resources such as IT professionals may be competent to perform a forensic examination, it is generally advisable to hire an outside expert. Outside forensic experts have specialized expertise, as well as sophisticated tools and techniques that internal IT employees do not often have in their arsenal. They also have specific experience with the preservation and interpretation of digital evidence, including metadata. An outside forensic expert is also (at least theoretically) "neutral" and free from bias in the event he or she has to give testimony. If necessary, outside forensic professionals can also help outside counsel and the company interface with the FBI or other law enforcement agencies when appropriate.
These considerations have taken on added weight during the COVID-19 crisis, and tilt firmly in favor of retaining outside experts rather than relying on internal IT professionals, in no small part because many IT professionals are stretched to capacity as they support a newly-remote workforce. Their time is likely better spent supporting current employees and business initiatives than it is conducting forensic examinations. In addition, even an internal IT professional who would be perfectly capable of conducting an on-site forensic examination, may not have the capability or tools to perform a remote examination. On the other hand, any reputable outside forensic expert will have the tools and know-how to carry out an examination remotely. This includes using web- and cloud-based platforms to maintain and review documents and other information. Companies and counsel can also take advantage of secure videoconferencing and document-sharing to discuss and analyze findings with their experts.
Witness and exit interviews
Because restrictive covenant cases and many trade secret misappropriation cases involve departing employees, exit interviews are potential sources of valuable evidence, along with interviews of other witnesses. Although certainly not as ideal as in-person interviews, witness and exit interviews can be conducted remotely by phone or videoconference. Because body language allows an interviewer the ability to gauge credibility and determine whether the interviewee will make a good witness if called to testify, videoconferences are preferable to phone calls, when possible. However, if a videoconference is not possible, then a phone call is better than nothing. In addition, videoconferencing, if used correctly, can help ensure that witnesses are paying close attention and reviewing necessary documentation, and that nobody else is in the room coaching them to lie. We faced a situation recently (pre-COVID-19) in which a witness was interviewed remotely by a company's corporate security group via videoconference, but he covered the camera and claimed it did not work, only to admit later during litigation that he was instructed to do so by a co-conspirator who was in the room during the interview coaching him to lie. So if videoconferencing is being used, make sure that it is fully functional and being utilized properly and that passwords and other security measures are turned on to avoid unwelcome (and potentially unannounced) participants.
Many witness and exit interviews require the sharing of documents that you would not necessarily want the witness or departing employee to see and prepare to address before the interview. Fortunately, many videoconferencing services offer the ability to share your screen, such that you can put a document on the screen, focus attention on key portions of it, and ask the witness or departing employee questions about it. If used properly, this can be almost as effective as sharing documents at a face-to-face interview. That being said, witnesses should be sure to fully review any documents placed in front of them, and ask for the opportunity to do so if it is not initially provided. As for signing documents, including formal witness statements, affidavits, or releases, most states permit the use of electronic signatures in lieu of wet signatures.
Finally, it is often helpful to record witness and exit interviews for use in later litigation. State laws with respect to consent must be consulted, however, as many states require two party consent and it can be a criminal offense not to obtain consent from both parties. Moreover, where applicable, interviews should be conducted under the attorney-client privilege and/or the work product doctrine to prevent discovery in litigation (unless the company has a reason to waive those rights).
Monitoring and surveillance
Monitoring and surveillance are frequently helpful ways of uncovering or proving wrongdoing. This does not necessarily mean cloak-and-dagger surveillance carried out by a private investigator. Rather, basic monitoring and surveillance can be as simple as company personnel or counsel paying close attention to an employee's social media, especially LinkedIn or other "professionally focused" social media sites, to monitor their business and employment activities.
Companies also should be vigilant in looking for evidence that their trade secrets are being misused or their customer relationships leveraged improperly. For example, watch out for sudden low-ball bids by competitors, solicitations of customer accounts at contract renewal time, leveraging confidential pain points known only to the trade secret owner, faster than expected advances in development by a competitor that an former employee has joined, or, in rare cases, publication of trade secrets publicly or on the dark web.
When a more sophisticated investigation and more extensive monitoring or surveillance is required, an outside investigator should be retained, although larger companies with expansive corporate security departments may be able to rely on their own investigators. Professional investigators are better equipped to conduct investigations that are consistent with the law and likely to yield useful information. Professional investigators also generally have experience providing testimony, if necessary. The outside investigators can range from an individual gumshoe to big international operations that employ former CIA, Mossad, and MI-6 agents.
During a quarantine, some traditional investigative techniques may be more difficult, because people are conducting fewer face-to-face meetings. Faithless employees likely will not be visiting a competitor's offices, or more covertly on a park bench, to hand off the goods. Similarly, an employee or former employee is unlikely to be interviewing or meeting with customers in-person. However, electronic monitoring and surveillance should not be impacted, and may even be more fruitful as the use of social media and other online activities no doubt increases as a result of a quarantine.
Of course, state and federal law should be consulted to make sure that all monitoring and surveillance activities are conducted by the book, and not in violation of any civil or criminal statutes. Federal laws that may be implicated include the Computer Fraud and Abuse Act and the Stored Information Act, and state analogs to those statutes may also be implicated, along with certain harassment and invasion of privacy laws. And even if not in violation of a federal or state law, if evidence is gathered in a below-board manner, a court may exclude it. For instance, although there have been reports of certain videoconferencing services being less than secure, and companies relaxing their security standards in the name of convenience and efficiency, that does not mean that hacking into those systems as part of an investigation is legal—it may just be easier. As noted above, using professional investigators who are familiar with these and other laws, and the bounds in which they must legally and ethically work, can help minimize these risks.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
