By Hemanisha Baskaran
Watching “Charlie and the Chocolate Factory” recently, I couldn’t help but notice the depiction of intellectual property (IP) theft wherein a worker in Willy Wonka’s factory steals his chocolate’s secret recipe and sells it to rivals in the candy industry in an attempt to bring down Willy Wonka’s business.
Theft of IP happens when a person intentionally takes, uses, misappropriates, or steals property that is protected under the relevant IP laws. Examples of IP theft include previous employees of an organization who steal confidential information either for the purpose of working for a rival, selling it to another organization or to set up their own company; or business partners, third parties and hackers who steal highly guarded trade secrets. IP theft can be committed in various ways such as reproducing copyrighted material; planting malware or spyware to record confidential information or via verbal communication with competitors.
As an example, back in 2019, Tesla, Inc. filed a lawsuit for misappropriation of trade secrets, breach of contract and breach of fiduciary duty against Dr. Guangzhi Cao, a former Autopilot engineer who left to join Xpeng, a top competitor in the electric vehicle industry. Tesla claimed that Cao downloaded its Autopilot autonomous driving system’s source code prior to resigning and sold it to Xpeng upon joining the company. The lawsuit was later dropped when Tesla failed to uncover any evidence of Cao’s alleged wrongdoing.
Most of the time, IP theft remains undetected until the relevant information is used by an unauthorised person. The use of a computer is often prominent in IP theft, and as such, computer forensics is an important component when it comes to restoring the information and gathering evidence needed for an effective investigation or possible legal action. Strict measures must be taken to ensure proper collection and preservation of evidence when an organization suspects that their IP or trade secret has been compromised. The organization involved should also hire a computer forensic specialist who is familiar with recent techniques used to analyze digital evidence and is also experienced in providing expert testimony in Court proceedings.
Preserving evidence
It is crucial to understand the necessary steps to take when there is an allegation of IP theft since it can impact the investigation process. As an example, when a former employee is alleged to have misappropriated IP by copying electronic data, investigation by any party other than a qualified computer forensic specialist may lead to evidence contamination. This, in turn, could result in discontinued investigations, failed lawsuits, and the failure to return the IP to its lawful owner.
The said employee’s computer or devices must be turned off immediately and safeguarded until a computer forensics expert images or copies the hard drive, similar to how a crime scene is preserved to ensure there is no contamination of any potentially usable evidence. The expert would normally create a forensic image of the hard drive which is a mirror copy of the drive’s contents. An analysis of the image will then be conducted, while the original hard drive will be secured and isolated. It is also important to label all evidence, list down the person who gathered the materials and location of where it has been stored. All evidence must be timestamped and dated accordingly.
Additionally, a chain of custody must be maintained for the collection, retention, and movement of all digital and physical artifacts until produced in Court as evidence. Chain of custody is the chronological record of the sequence of events during an investigation process, describing the custody of evidence, inventory control, transfer, analysis and nature of the evidence. Any break in the chain of custody may prove fatal in Court as doubts would be created over the authenticity of the evidence.
Accessory to theft
Employees who commit IP theft use a range of tools to obtain information such as storage devices (online and physical), web-based e-mail, as well as afterhours access to copy data to optical media.
Further to this, external storage devices such as USB thumb drives and external hard drives are used frequently in computer crimes. Whenever an external storage device is connected to an organization’s computer or device, the operating system of the respective device will record the date and time; model and serial number of the serial device that was used. Nevertheless, the operating system does not track details of the data that has been copied to or from the storage device.
When IP theft involves the use of external hard drives or thumb drives, a date and time analysis of the entire hard drive may assist in identifying the copied files. When files are copied from an organization’s computer to an external storage device, the act of accessing the relevant files can assist in determining what was copied to the storage drive. When the employee opens a file on the external storage device while connected to a computer, the operating system creates a short cut of the file that contains embedded data which includes the file’s name, the date or time stamps, size of the file, as well as information about the external drive.
In IP theft, it is not uncommon to find employees sending e-mails containing confidential information. They tend to use a web-based e-mailing system, believing it will go unmonitored or undetected. Little do they know that this form of activity is recorded in the user’s Internet history and cached web pages. Use of advanced forensic software assists in recovering deleted Internet histories and cached web pages. A forensic specialist is also able to detect if employees in an organization use the laptops issued to them to copy data from that laptop to another device. Where information is obtained by accessing the company’s network after hours using a Virtual Private Network (VPN) connection, user activities may be logged. These logs are crucial during the investigation process as well.
The organization should be prepared for the possibility that the investigation may escalate to the point where multiple computers and/or devices must be analysed to link the evidence together. From the perspective of a computer forensic expert, it will be important to understand and incorporate the findings from the investigation, and assess how the data has been gathered, whether it is via live capture or by copying a hard drive through bit-by-bit image. The way of obtaining the evidence must be adapted on a case-to-case basis, and the format of the digital image is also crucial. Additionally, the investigation report must also provide the steps involved in the investigation; and forensic images must be available to other experts as needed.
An interesting IP feud that involved computer forensics is the case between Mattel Inc. and MGA Entertainment (a.k.a. Barbie vs the Bratz). Mattel had accused former employee and designer of the Bratz dolls, Carter Bryant, of coming up with the idea for the dolls while working for Mattel, which breached his employment agreement. Mattel independently used computer forensics and uncovered the use of a program designed to remove sensitive information from Bryant’s laptop just days before investigators were to duplicate the contents. While Bryant was eventually paid more than USD30 million in royalties as he reached a settlement with Mattel, the battle between Mattel and MGA continues.
As the digital world continues to develop day by day, it is crucial to recognise what measures can be taken to protect intellectual property from being stolen, whether online or offline. It is also advisable for organizations to safeguard their intellectual assets and monitor the amount and type of data that is accessible to employees. If you have questions, write to us at kass@kass.asia!
- Legal Consequences of an Unregistered Franchisor in Malaysia: Hasjay Group Sdn Bhd & Anor v Eco Passions Sdn Bhd & Ors [2022] MLJU 433 - July 25, 2024
- Spotlight Changes of Vietnamese Trademark Laws - July 25, 2024
- Wait, is this Eng the Same as that Eng? – Confusingly Similar Trademarks - July 25, 2024
