Investigating Trade Secret Theft by a Departing Employee

When a departing employee leaves with client lists, source code, or pricing data, you can act, but only with evidence that was gathered lawfully. A trade secret theft investigation documents what was taken, how, and by whom, in a form that holds up if the dispute reaches court. We are a matching service, not an investigative agency, and we connect New York businesses and their attorneys with New York State licensed investigators who do this work the lawful way.

What Trade Secret and IP Theft Looks Like Inside a Company

Most corporate IP theft is not dramatic. It happens in the two or three weeks around a resignation, when an employee who is already planning their exit forwards files to a personal email account, copies folders to a USB drive, downloads the customer database, or syncs a work account to a personal device. The information taken is rarely a single secret formula. It is the accumulated, confidential material that gives a business its edge: client and prospect lists, pricing and margin data, proprietary methods, product roadmaps, source code, and supplier terms.

Not everything an employee knows is a trade secret. The general skills and experience a person builds during a job belong to them and travel with them. A trade secret is confidential business information that has independent economic value because it is not publicly known, and that the company has taken reasonable steps to keep secret, such as access controls, confidentiality agreements, and need-to-know handling. Where the line falls in a specific case is a legal question for your attorney, and the description here is general information rather than legal advice.

Manhattan concentrates exactly the businesses that depend on this kind of information. Financial firms, law firms, advertising and media companies, and technology startups all run on proprietary data, and a competitor is often a short subway ride away. That density is part of why departing-employee IP disputes are a steady source of corporate investigation work in New York.

How a Licensed Investigator Documents the Theft

A trade secret investigation is a forensic and research exercise before it is anything else. The strongest evidence usually already sits inside systems the company owns and is authorized to examine, and the investigator's job is to surface it cleanly and preserve it properly.

• Digital forensics on company-owned devices and accounts the employer controls, recovering deleted files, USB connection records, and email-forwarding rules that show data leaving the building.
• Review of access, download, and print logs from the company's own systems to establish exactly what was touched and when, relative to the resignation date.
• Open-source and public-records research on the new employer or any newly formed competing entity, including corporate filings and business registrations that show where the person landed.
• Lawful association analysis connecting the departing employee to a competitor, a co-conspirator, or a venture that suddenly appears with a suspiciously familiar product or client base.

Good investigators do this in coordination with the company's own IT staff and outside counsel rather than around them. The employer controls the systems, counsel sets the legal strategy, and the investigator gathers and documents the facts. Keeping those roles clear is what makes the resulting evidence defensible.

Building Evidence a Court Will Accept

Documenting the theft for your own peace of mind is one thing. Documenting it so it survives a challenge in litigation is another, and it is where licensed, experienced investigators earn their fee. That means forensic images captured with a verifiable chain of custody, timestamped records, and reports structured so the investigator can testify to what was found and how.

Those facts then feed the legal claims your attorney may bring. The federal Defend Trade Secrets Act, enacted in 2016, gives trade secret owners a federal civil cause of action for misappropriation, and New York recognizes common-law misappropriation and related claims as well. Which claims fit your situation is for counsel to decide. The investigator's role is narrower and concrete: establish what was taken, by whom, and how, with evidence that stands up.

Licensing matters here. New York licenses private investigators through the Department of State under Article 7 of the General Business Law, and evidence gathered by a licensed investigator working within that framework is more readily defensible than work product from an unlicensed operator. A licensed investigator can also appear as a witness to their findings if the case is litigated.

What an Investigator Cannot Do

The fastest way to wreck a strong trade secret case is to gather evidence the wrong way. A legitimate investigator will not access the former employee's personal email, phone, or cloud accounts, will not obtain protected records by pretexting, which the federal Gramm-Leach-Bliley Act prohibits, and will not place a tracker on a private vehicle or trespass to gather information.

The federal Computer Fraud and Abuse Act makes unauthorized access to computer systems illegal, which cuts two ways in these cases. It constrains how the investigation itself may be conducted, and it is often part of why the employee's own conduct was unlawful when they reached into systems or accounts they no longer had the right to use. Evidence obtained through illegal methods can be excluded and can expose your company to its own liability. Any provider who offers shortcuts like these is the wrong one to hire. This is general information and not legal advice.

Where We Fit In

We do not investigate trade secret theft ourselves and we do not give legal advice. We connect New York businesses, in-house teams, and the attorneys who represent them with New York State licensed investigators who handle departing-employee IP cases and who work only through lawful methods. Tell us what happened and what you are trying to protect, and we match you with an investigator experienced in corporate work in Manhattan and the surrounding boroughs. There are no guarantees of a particular outcome, only experienced, lawful investigative work.

Frequently Asked Questions

How do we prove an employee took our trade secrets?

The clearest proof usually comes from your own systems. Forensic review of company devices and accounts can show files copied to external drives, emails forwarded to personal addresses, and large downloads in the days before a resignation. A licensed investigator preserves those records properly and ties them to a timeline, which is far more persuasive than the suspicion that someone left with your client list.

Is the information we want to protect actually a trade secret?

It depends on whether the information has economic value because it is not publicly known, and on whether your company took reasonable steps to keep it confidential, such as access restrictions and confidentiality agreements. General skills and knowledge an employee gains on the job are not trade secrets. Whether your specific information qualifies is a legal question for your attorney. This is general information, not legal advice.

Can an investigator access the former employee's personal devices or accounts?

No. A legitimate investigator will not access someone's private email, phone, or cloud accounts, and will not use pretexting to obtain protected records. Unauthorized access to private computer systems is illegal under federal law, and evidence collected that way can be thrown out and can create liability for your company. Lawful work focuses on systems the employer owns and on public and proprietary records the investigator is authorized to use.

Should we involve our attorney before starting an investigation?

In most cases, yes. Trade secret matters move quickly toward litigation, and involving counsel early helps protect privilege, shape what evidence is gathered, and align the investigation with the legal strategy. Many corporate investigations in New York are run in coordination with outside counsel for exactly that reason. Your attorney also decides which claims, if any, to bring.

How fast can an investigation produce usable evidence?

The most time-sensitive step is preservation. Company logs, email records, and device data should be preserved as soon as theft is suspected, because routine retention settings can overwrite them. Once data is preserved, an investigator can often establish the basic facts of what left the company within days, while tracing where it went and who else was involved can take longer. A licensed investigator should give you a realistic estimate after reviewing what you already have.