Source code is among the most valuable assets a technology business holds, and among the most targeted by employees who are departing to competitors or establishing competing ventures. It represents years of development effort, encodes the product’s core functionality, and provides a competitive advantage that is directly and immediately transferable to a new employer or a competing business if it can be taken.
Source code theft investigations are technically demanding in ways that other IP theft investigations are not. The digital environment in which source code is developed — version control systems, cloud repositories, development environments, build pipelines — creates a rich evidential record that a well-conducted forensic investigation can exploit, but also creates technical complexity that requires specialist expertise to navigate accurately.
Why Source Code Is Targeted
Source code is targeted because its value is immediate and transferable. A competitor who obtains a company’s source code for a proprietary product can accelerate their own development by months or years, replicate features that differentiated the original product, or establish a competing product with significantly lower development investment. An employee who takes source code to a new employer or a new venture is not just committing a theft; they are removing a competitive moat that may have taken years to build.
The technical accessibility of source code also makes it an attractive target. In a well-managed development environment, source code is version-controlled, accessible to multiple developers, and regularly backed up. The same properties that make it manageable for legitimate purposes make it straightforward to exfiltrate: a developer with repository access can clone the entire codebase in minutes.
Warning Signs
- A developer who is known or suspected to be leaving, particularly to a competitor or to establish a competing product, who has recently cloned or downloaded large portions of the repository.
- Repository access activity outside normal working hours, from geographic locations inconsistent with the employee’s normal work pattern, or from devices not registered as authorised development environments.
- Creation of new personal accounts on repository hosting platforms (GitHub, GitLab, Bitbucket) by an employee, followed by access to the organisation’s repositories from those accounts.
- Transfer of code to branches, forks, or external repositories not associated with the organisation’s normal development workflow.
- Increases in code download activity, particularly covering broad sections of the codebase rather than the specific modules relevant to the employee’s current assignment.
- Deletion of code, commit history, or documentation in a manner inconsistent with normal development activity, suggesting an attempt to remove evidence of access or to sabotage the codebase before departure.
Repository Analysis
Repository analysis is the most productive investigative step in a source code theft investigation, and one that can be conducted quickly using the audit logs maintained by modern version control systems.
Commit history analysis: the commit history of a git or equivalent repository records every change made to the codebase, by whom, at what time, from what device, and to which branches. This history is maintained even where the employee has subsequently deleted their local copy or attempted to rewrite history.
Clone and download logs: repository hosting platforms maintain logs of clone operations, download requests, and API access. These logs identify who cloned what, when, from what IP address, and to what destination.
Branch and fork analysis: identification of branches, forks, or mirrors created from the organisation’s repository that are not part of the normal development workflow. A personal fork created on the eve of an employee’s departure is a significant indicator.
Access control audit: a review of the permissions granted to the departing employee, any changes made to those permissions in the relevant period, and whether access was revoked promptly upon departure.
Digital Evidence Collection
Beyond the repository analysis, the digital evidence collection in a source code theft investigation covers the full range of digital evidence sources: the employee’s development environment (their local machine, any cloud development environments they used); their email account (for evidence of code transmitted by email, or correspondence about the theft); their personal cloud storage accounts (for evidence of code stored outside the organisation’s systems); and any collaboration tools used for development (Slack, Teams, Jira, Confluence) that may contain shared code snippets or discussions about the theft.
Device forensics on the employee’s company-issued development machine can identify whether code was copied to external storage, what removable media was connected to the device, and whether any deletion or anti-forensic activity occurred in the relevant period.
Recovery Strategies
Injunctive relief: an urgent application for an injunction preventing the employee or their new employer from using, compiling, distributing, or building upon the stolen code. Where the investigation has produced sufficient evidence, a without-notice injunction can be obtained and served before the employee has had time to make the code functional in a competing product.
Search and seizure: a search order requiring the inspection and seizure of devices in the employee’s possession, to identify and recover copies of the stolen code. Executed by the court’s officers alongside the applicant’s solicitors and forensic investigators.
Copyright and confidentiality claims: civil claims for breach of copyright, breach of confidence, and breach of the Trade Secrets (Enforcement, etc.) Regulations 2018, seeking damages for the harm caused and an account of any profits made using the stolen code.
Criminal referral: where the conduct meets the threshold for a Computer Misuse Act offence, a referral to the police or NCSC for criminal investigation alongside the civil proceedings.
Investigating suspected source code theft? Contact iSpy Detectives for expert digital forensic and repository analysis services.