Intellectual property theft is one of the most commercially damaging and most underreported categories of corporate crime. The stolen asset — source code, a product design, a proprietary formula, a client database, a strategic plan — continues to exist in the victim’s possession while simultaneously being exploited by the thief. There is no empty safe, no missing stock count, no balance sheet line that reflects the loss. The harm manifests instead in eroded competitive advantage, unexplained competitor progress, or the slow realisation that information whose value depended on its secrecy is no longer secret.
Bond Rees investigates intellectual property theft for businesses across a wide range of sectors. This article explains the categories of IP that are most commonly stolen, the methods by which theft occurs, the investigation process, and the evidence standards required for the legal proceedings that typically follow.
Categories of Intellectual Property Most at Risk
Trade Secrets and Confidential Information
The broadest and most commercially significant category. Trade secrets include formulas, processes, methods, compilations of information, customer and supplier databases, pricing structures, strategic plans, and any other information whose commercial value derives from the fact that it is not generally known. This is the category addressed in depth in our dedicated article on trade secret misappropriation investigations, and it is the foundation of most IP theft cases because it requires no registration and arises automatically from the commercial value and confidentiality of the information.
Source Code and Software
Software companies, technology businesses, and any organisation that has developed proprietary software face a specific risk of source code theft by departing developers or by external actors. Source code theft is particularly damaging because: the code can be directly used by a competitor to accelerate their own product development; it may be possible to reverse-engineer the stolen code to derive trade secrets that extend beyond the code itself; and the harm may not become apparent until a competing product launches that replicates specific features that could not have been independently developed in the available time.
Product Designs and Technical Drawings
Manufacturers, engineering firms, and product development businesses whose competitive advantage lies in specific product designs or technical specifications face the risk of theft of those designs, either by departing employees who take them to a competitor, or by a competitor that obtains them through espionage. Design right and copyright may protect these materials independently of any trade secret claim, providing additional legal routes to enforcement.
Client and Customer Databases
Customer data, contact lists, and commercial databases that have been compiled through significant investment and that represent a material asset of the business. The theft of customer databases is both an IP theft matter and a data protection matter: the personal data of customers is subject to UK GDPR, and the organisation that suffers a breach of its customer database may have reporting obligations as well as civil claims against the individual responsible.
Strategic Plans and Commercial Intelligence
Business plans, M&A strategy, pricing models, bid strategies, and other forward-looking commercial information that is not yet in the public domain. The theft of strategic planning information is particularly insidious because its impact is felt in the competitive context rather than in any immediately visible financial loss: the competitor who knows your M&A targets, your pricing approach, or your product roadmap, has an advantage whose consequences are difficult to measure and even harder to attribute.
How IP Theft Occurs
The mechanisms of intellectual property theft are largely digital, because the information is stored digitally and the digital transfer of large volumes of information can be accomplished quickly and without leaving obvious physical traces:
Email and Cloud Transfer
The most common exfiltration method: an employee emails files to a personal account, uploads them to a personal cloud storage account, or forwards them through a messaging application. Email and cloud transfer is detectable through the firm’s email security and data loss prevention systems, and it leaves a record in the email server and cloud access logs that digital forensic investigation can recover even if the employee deleted the messages from their sent folder.
USB and Physical Media
Copying files to a USB drive or other removable media. USB transfer is traceable through the device connection logs maintained by modern operating systems: the system records when each USB device was connected, its unique identifier, and the files transferred. An employee who copies 50,000 files to a USB drive in the week before their resignation has left a recoverable forensic trace.
Printing and Physical Removal
Physical printing and removal of documents. This is the hardest exfiltration method to detect digitally, although print logs maintained by networked printers can identify unusual printing activity, and CCTV footage of the employee leaving the premises with unusual volumes of material may be relevant in some cases.
Memory and Knowledge
The retention of confidential information in memory, without any physical or digital transfer. This is the most legally complex form of IP theft because it is invisible until the former employee uses the information in a way that is detectable, and it raises the difficult distinction between the general knowledge and skills that an employee is entitled to take with them and the specific confidential information that belongs to the employer.
The Investigation Process
Step 1: Define What Has Been Stolen
The investigation begins by establishing with precision what information is alleged to have been taken. This is both an investigative question — identifying the specific files, databases, or materials that the investigation will focus on — and a legal question, because the strength of the claim depends in part on how clearly the protected information can be identified and differentiated from information the employee is entitled to use. Working with the client’s technical team and legal advisers at this stage produces a focused investigation scope rather than a sprawling review of everything the employee ever touched.
Step 2: Forensic Preservation and Analysis
Digital forensic preservation of all relevant evidence sources, followed by systematic forensic analysis establishing what was accessed, copied, transferred, or deleted in the period of concern. The forensic analysis produces a specific, documented, and evidence-supported picture of the exfiltration activity: the files accessed, the transfer mechanism used, the timing, and the destination. This is the core of the investigation and the foundation of any legal proceedings.
Step 3: Intelligence on the Destination
Investigation of where the stolen information has gone and how it is being used. For an employee who has gone to a competitor, this involves corporate intelligence and open source investigation of the competitor’s current activities, products, and technical capability. For a more complex theft involving multiple parties or an international dimension, this step may involve international investigation through our partner network.
Step 4: Evidence Package for Legal Proceedings
Production of an investigation report and supporting evidence in a form suitable for the legal proceedings that follow: an interim injunction application, a civil claim for breach of confidence and trade secret misappropriation, or in serious cases a criminal referral to the police. The evidence package includes the forensic findings, the chain of custody documentation, and a witness statement from the investigating officer that is ready for use in proceedings.
Emergency Injunctions
Where there is urgency — where the stolen information is being used by a competitor and the harm is ongoing — an emergency injunction application may be the most important immediate step. An interim injunction requires the applicant to show: a serious issue to be tried; that damages would not be an adequate remedy (because the harm from continued use of the stolen information is ongoing and not fully compensable financially); and that the balance of convenience favours granting the injunction.
The quality of the forensic investigation evidence is directly relevant to the injunction application: a specific, documented forensic picture of what was taken is considerably more persuasive to a court than an allegation that ‘information has been stolen’. Bond Rees works with IP solicitors to ensure that the investigation evidence is produced in the form and at the speed required to support an emergency injunction application.
Frequently Asked Questions
How quickly does an IP theft investigation need to start?
As quickly as possible. Digital evidence is overwritten, cloud sessions expire, USB device connection logs are cleared, and the longer the gap between the suspected theft and the start of the investigation, the more evidence is lost. An investigation that begins within days of the suspected theft will recover significantly more evidence than one that begins weeks later. Bond Rees can begin an investigation on an urgent basis, with evidence preservation as the first step.
What if the employee used personal devices?
Where evidence has been transferred to a personal device or personal cloud account, the investigation of those devices requires either the employee’s consent or a court order. An interim injunction can include an imaging order requiring the employee to deliver up personal devices for forensic examination. Bond Rees advises on the specific approach in the context of the overall legal strategy.
Can we prosecute as well as pursue civil claims?
Yes, in appropriate cases. Theft of physical documents is a criminal offence under the Theft Act 1968. Computer misuse in the course of IP theft may constitute an offence under the Computer Misuse Act 1990. And in serious cases — particularly those involving corporate espionage — fraud and conspiracy offences may be relevant. Civil and criminal proceedings can be pursued in parallel, although the sequencing requires careful legal advice to avoid creating complications for either route.
Investigating intellectual property theft? Contact Bond Rees for expert corporate investigation and litigation support.
