R Mark Halligan on the Defend Trade Secrets Act of 2016
Defend Trade Secret Act of 2016
R Mark Halligan, noted author and trade secret attorney with FisherBroyles, LLP recently discussed the Defend Trade Secrets Act of 2016 and his new book, Trade Secret Asset Management 2018: A Guide to Information Asset Management Including RICO and Blockchain, with CISO Lee Neubecker. War stories involving success in using computer forensics to help his clients obtain great results are also shared in this interview. A transcript, as well as a link to Mr. Halligan’s new book on Amazon, is available below.
[Transcript]
Lee Neubecker: Hello. I’m here today with author and attorney Mark Halligan from FisherBroyles LLC and he’s going to talk a little bit about his books today. Mark, how are you doing?
Mark Halligan: Very good, Lee, thanks for inviting me.
Neubecker: You were approached about writing a book a while back on the Defend Trade Secrets Act. Can you tell everyone a little bit about what your book covers and why it’s relevant?
Halligan: Well the Defend Trade Secrets Act of 2016 is a watershed event in intellectual property law. It’s the culmination of years of work on my part to emphasize the need for a federal-civil cause of action. In most cases the victims are corporations and they should have access to the federal courts.
Neubecker: In what cases would the Defend Trade Secrets Act apply?
Halligan: In any case involving the alleged misappropriation or actual misappropriation or threatened misappropriation of trade secrets, you now have access to bring a private civil cause of action that is subject to the jurisdiction of the federal courts, nationwide.
Neubecker: You’ve written a second book more recently, the Trade Secret Asset Management 2018 book – can you tell people a little bit about that?
Halligan: That’s the next phase in trade secrets law, that is the internal act of management by companies of their trade secret assets, which involves identification, classification, protection and valuation. In order to be able to use the Defend Trade Secrets Act and be able to allow this intellectual property right to thrive and grow, now with federal protection in the courts, you have to have internal systems in place for these trade secret assets.
Neubecker: So, do clients sometimes contact you before employees leave to proactively try to make sure their stuff is in order?
Halligan: Well, unfortunately companies wait until the horse is out of the barn and then they scramble to retain outside counsel, and then I scramble around trying to determine what the trade secrets are and what the evidence of misappropriation is. We’ve seen this play out in major cases now, most recently the Waymo case out of California where everybody is running around trying to determine what’s that issue in the case.
So, it’s better to do that ahead of time with internal management.
Neubecker: So clients that are proactive in getting an assessment of what their assets are beforehand – do they tend to spend less money when they become embroiled in litigation?
Halligan: Yes, absolutely. If you have internal, active trade secret management, you are able to identify within a matter of seconds, literally, the trade secrets that are in issue and the evidence that the employee had access to those trade secrets, or the former employee.
Neubecker: You have some proprietary program you developed to deal with that, correct?
Halligan: I do, the name of the program is the Trade Secret Examiner, and it was introduced, commercially deployed at version four or version five, last August, and it is a revolutionary new platform to assist companies in the identification, classification, protection and valuation of trade secret assets.
Neubecker: If someone is watching this video at night and they’re an executive of a company and they just lost their head of sales and marketing, what steps should they take immediately to help protect their company and their client base?
Halligan: Well, if they have been engaged in internal trade secret asset management, then I’d expect they have a trade secret incident response team that can be activated immediately, and a SWAT team, which is essentially outside counsel, ready to go to the courthouse. If they do not have those procedures and mechanisms in place, then they call me and I head out to the company with a yellow pad and a pen and start to interview witnesses to see if I can determine what the trade secrets are and what the evidence of misappropriation is.
Neubecker: Once you have reason to believe that some of your client’s data was inappropriately taken, or misappropriated, what do you do first to prepare for court after you’ve taken those notes?
Halligan: From a forensics standpoint, the first thing you have to do is cordon off the area where the defendant worked or had computers, and get EnCase images of the computer to preserve the evidence. You certainly don’t want to have the IT department foiling around inside the computer because that will change the evidence.
Neubecker: It was interesting Mark, one of my colleagues, Alex Gessen, had done some research and realized companies that use tools such as FTK Imager, when you capture the forensic image of a hard drive device, it records a serial number for that device that is not detected when you do forensic analysis to see if devices were plugged in.
In actuality, there’s two serial numbers on a hard drive and only one of the two numbers is reported, and they’re not always consistently detected. So, we agree with you on that, using EnCase to make the forensic image. EnCase actually, at the time of imaging, EnCase will capture the serial number that can be detected in the registry. What we’ve discovered is people who haven’t used EnCase, later on they’ll do this analysis to see if a thumb drive was plugged into another computer and they’ll get a false negative because they didn’t appropriately image the media at issue.
Halligan: That’s fascinating, and that shows you how critical it is to do the forensics correctly at the very beginning of the case. Could be case determining too.
Neubecker: You’ve done the forensics and you’re going to court – what are you hoping to prove when you’ve done computer forensics? What type of things are you hoping to express in the form of an affidavit or support for your motion?
Halligan: A trade secret misappropriation case involves the actual or threatened misappropriation of trade secrets, so what you’re trying to do is protect these fragile assets. A trade secret, once lost, is lost forever. You’re attempting to stop the bleeding, plug the dyke, get an order that there is to be a preservation of evidence, also stop the continued misappropriation activity or, if it has not occurred yet, through injunctive relief set up a wall to prevent the misappropriation of trade secrets, and to the extent possible, to prevent its dissemination to other computers in the United States or other parts of the world.
Neubecker: Mark, can you tell me any war stories about your use of computer forensics and what happened going into court.
Halligan: What I have seen in several occasions, and I represented a major company in a case involving very serious acts of trade secret misappropriation and alleged foreign economic espionage. The federal courts want to protect the privacy rights of individuals, with electronically stored information, so there’s always this tension the plaintiff seeking to prove up its trade secret case or misappropriation of trade secrets with the defendant’s interest in protecting privacy of the files and things that are on the computer.
So, oftentimes the court requires search terms, and you start off the case by looking at whether or not these search terms pop up on the computers. In a case that I was involved with, when those search terms were plugged in, we found that a file destruction software had been run, and that the clock had been changed. With that kind of evidence before the judge, we were then given access to the entire computer, no more search terms.
When we got access to the entire computer, we found other third parties that were involved. And, of course, the case expanded to involve other defendants and other entities. But it all happened with the finding on the initial search terms of the addition of the file destruction software.
Neubecker: Well thanks so much for being on the show today, Mark, it was great stuff. If people need to reach you, they can see the link to your website.
Halligan: Thank you.
Buy R Mark Halligan’s books on Amazon.com.
”