Intellectual property is, for many businesses, their most valuable asset. The brand that customers recognise, the process that gives a competitive advantage, the product design that took years of development, the client relationships built through sustained investment — each of these is a form of intellectual property that an employee can take in a way that causes harm disproportionate to the size of the file transferred.
IP theft by employees is a specific and serious category of insider threat, and one that the departure scenario makes particularly acute. An employee who joins a competitor, or establishes their own competing business, and who takes proprietary data to accelerate their new venture, is not just committing a breach of their employment contract. They may be committing a criminal offence under the Computer Misuse Act 1990, a breach of the Trade Secrets (Enforcement, etc.) Regulations 2018, and a tort of breach of confidence.
Understanding Intellectual Property Theft
Intellectual property theft in the employment context is the taking or misuse of an employer’s proprietary information or assets by a person who had authorised access to that information in the course of their employment. The theft does not require the physical removal of a document; copying a file, forwarding an email, memorising a formula, or retaining access to a cloud system after employment has ended can each constitute theft of the intellectual property those methods capture.
The categories of IP most commonly stolen by employees are: trade secrets and confidential technical information, including formulas, processes, and methodologies; client and customer data, including contact information, purchase history, and relationship data; product designs and specifications; source code and software; business plans and strategic information; and pricing models and financial projections.
Common Methods
Pre-departure data transfer: the employee systematically copies proprietary data to personal devices, personal email, or cloud storage in the period before their resignation or dismissal becomes known. This is the most common method and one that digital forensic analysis is most likely to detect.
Email forwarding: forwarding sensitive emails to a personal account, sometimes as a systematic exercise covering all emails in a specific category, and sometimes selectively targeting the most valuable correspondence. Email forensic analysis can identify forwarding activity even where the employee has subsequently deleted the forwarded emails from the corporate account.
Repository cloning: in software and technology businesses, cloning of code repositories to personal accounts or external storage. The git history of a cloned repository records when the clone was created, from what source, and by whom.
Screenshot and photograph: taking photographs of screen content or screenshots of proprietary systems, which bypass some monitoring controls. Where devices are available for forensic examination, screenshot and photograph history can be recovered.
Memory and notes: in less technical environments, taking detailed handwritten or digital notes of proprietary information. This is the most difficult method to detect and prosecute, but it is also the most limited in scope and accuracy.
Evidence Sources
Device forensics: analysis of the employee’s company-issued devices for evidence of data access, copying, and transfer. Even where the employee has deleted files or factory-reset a device, forensic recovery techniques can reconstruct significant portions of the evidential record.
Email system logs: corporate email system logs maintained server-side record every email sent, received, forwarded, and deleted, including metadata about recipients, timing, and attachment content. These logs are not accessible to the employee and are not affected by the employee’s deletion of items from their client.
Cloud storage and collaboration platform logs: platforms such as SharePoint, Google Workspace, and Teams maintain detailed audit logs of file access, download, sharing, and modification. These logs are a primary source of evidence in IP theft cases involving cloud-stored data.
USB and removable media logs: Windows event logs record the connection of USB devices and, in appropriately configured systems, the files accessed from or copied to those devices.
Network traffic logs: network boundary logs record outbound data flows, including large transfers to external IP addresses or cloud storage services, that may represent exfiltration.
Digital Investigation Techniques
The digital investigation of IP theft by employees follows the forensic methodology described in the Digital Forensic Investigations article in this series: device imaging before any analysis is conducted, hash verification of all evidence, a documented chain of custody, and analysis conducted on forensic copies rather than originals. The specific analytical focus in an IP theft case is on identifying what data was accessed, when, in what volumes, and through what channels.
Keyword searching of forensic images can identify whether specific proprietary documents were accessed or copied. File carving techniques can recover deleted files or fragments of files from unallocated space on the device. Timeline analysis reconstructs the sequence of the employee’s activity in the relevant period, placing specific acts in context and identifying the pattern of the theft scheme.
Litigation Support
Digital forensic evidence in an IP theft case provides direct support for civil proceedings: establishing what was taken, when, and through what channels, in a form that can be disclosed to the court and presented to the opposing party. The forensic report, the chain of custody documentation, and the expert witness statement from the forensic investigator are the core evidential materials in any litigation arising from employee IP theft.
Where the investigation produces evidence sufficient to support an emergency injunction application, the forensic findings can be placed before the court on a without-notice basis to obtain urgent relief preventing the employee from using, disclosing, or distributing the stolen IP. Speed is critical in these applications: the longer the employee has to use or disseminate the stolen information, the more difficult it becomes to contain the harm.
Investigating suspected intellectual property theft by an employee? Contact iSpy Detectives for expert digital forensic investigation support.