Intellectual Property and Trade Secrets Theft
CASE STUDY
Digital Forensics Investigation for Intellectual Property Theft
Tags
Digital Forensics, Intellectual Property Theft, Breach of Employment Contract, Accounting Firm, Trade Secrets Theft, Corporate Counsel
Background
The General Counsel for an accounting firm contacted Maryman to assist with an investigation into a former employee of the firm. It was discovered that the former employee had accepted a partner position at a competing firm. A short while later, some of the individuals chose not to have the client firm prepare their tax returns for the following year, with one stating that the new firm, with the former employee, offered to prepare the tax returns at a lower cost.
The client suspected that the former employee took client documents and other information with them when they accepted the partner position at the other firm.
Scope
Brad Maryman, Joe Greenfield, and the Maryman team were engaged to perform a digital forensic investigation of the former employee’s computer desktop system, laptop, company-issued mobile device, email account, and review the logs from one of the major tax preparation software packages. The goal was to determine if the former employee exfiltrated company information that would aid them in providing a competing service at their new company at a lower cost to undercut their former employer.
Preservation
Analysis and Findings
It was discovered that the former employee took the company’s proprietary information in every possible way. During the 60 days prior to giving the company notice, the former employee accessed nearly every high-net-worth client in the tax preparation software. Many of the records were saved as PDF documents on their desktop and laptop system, while others were directly printed on their local printer.
It was discovered that a USB flash drive was inserted into their system the day before the former employee gave notice. There were forensic artifacts indicating that numerous marketing documents, including confidential pricing information, were copied to the flash drive the day before they gave notice.
The former employee also had a personal cloud account that had been used as unauthorized storage of client information.
Finally, the week before they gave notice, the former employee made calls to at least fifty accounting clients for whom they were assigned but had already completed their work. One of those individuals reported to the accounting firm that the former employee attempted to bring them to their new firm.