Enigma Forensics CEO & President, Lee Nuebecker welcomes Attorney Mark Halligan as they discuss internal trade secret management.
The transcript of the video follows
Lee Neubecker: Hello, I’m here today with author and attorney Mark Halligan from Fisher Broyles, and he’s going to talk a little bit about his books today. Mark, how are you doing?
Mark Halligan: Very good.
Lee Neubecker: Thanks for being on the show.
Mark Halligan: Thank you, thanks for inviting me.
Lee Neubecker: So you were approached about writing a book a while back on the Defend Trade Secrets Act. Can you tell everyone a little bit about what your book covers and why it’s relevant?
Mark Halligan: Well, the Defend Trade Secrets Act of 2016 is a watershed event in intellectual property law and it’s the culmination of, you know, years of work on my part to emphasize the need for a federal civil course of action. In most cases, the victims are corporations and they should access to the federal courts.
Lee Neubecker: Okay. In what cases would the Defend Trade Secret Act apply?
Mark Halligan: Well, in any case involving the alleged misappropriation or the actual misappropriation or threatened misappropriation of trade secrets, you now have access to bring a private civil course of action. That is subject matter jurisdiction in the federal courts nationwide.
Lee Neubecker: So now, you’ve written a second book more recently, The Trade Secret Asset Management 2018 book. Can you tell people a little bit about what that’s about?
Mark Halligan: Well, that’s the next phase in trade secrets law. That is the internal act of management by companies of their trade secret assets, which involves identification, classification, protection, and valuation. And in order to be able to use the Defend Trade Secrets Act and be able to allow this intellectual property right to thrive and grow, now with federal protection in the courts, you have to have internal systems in place for these trade secret assets.
Lee Neubecker: So do clients sometimes contact you before employees leave and take things to proactively try to make sure their stuff’s in order?
Mark Halligan: Well, unfortunately, companies wait until the horse is out of the barn and then they scramble to retain outside counsel and then I scramble around trying to determine what the trade secrets are and what the evidence and misappropriation is. And we’ve seen this play out in major cases now, most recently in the Waymo case out in California, where everybody is running around trying to determine what’s at issue in the case. So it’s better to do that ahead of time with internal management.
Lee Neubecker: So clients that are proactive and they get an assessment of what their assets are beforehand, do they tend to spend less money when they become embroiled with litigation if they’ve done that?
Mark Halligan: Yes, yes, absolutely. If you have internal active trade secret management, you are able to identify within a matter of seconds literally the trade secrets that are in issue and the evidence that the employee had access to those trade secrets, or the former employee.
Lee Neubecker: Now, you have some proprietary program you developed that deals with that, correct?
Mark Halligan: I do. The name of the program is The Trade Secret Examiner and it was introduced, commercially deployed version, I believe version four or version five, last August. And it is a revolutionary new platform to assist companies in the identification, classification, protection, and valuation of trade secret assets.
Lee Neubecker: So if someone is watching this video at night and they’re an executive of a company and they lost their head of sales and marketing, what steps should they take immediately to help protect their company and their client base?
Mark Halligan: Well, if they have been engaged in internal trade secret asset management, then I would expect they have a trade secret incident response plan that can be activated immediately and a SWAT team, which is essentially outside counsel ready to go to the courthouse, you know. And if they do not have those procedures and mechanisms in place, then they call me and I head out to the company with a yellow pad and a pen, and start to interview witnesses to see if I can determine what the trade secrets are and what the evidence and misappropriation is.
Lee Neubecker: So once you have reason to believe that some of your clients’ data was inappropriately taken and misappropriated, what do you do first to get ready for court after you’ve taken those notes? What do you prepare, have the data prepared for your TRO?
Mark Halligan: Well, again, from a forensics standpoint, the first thing you need to do is cordon off the area where the defendant worked or had computers and you get EnCase images of the computer to preserve the evidence. You certainly don’t want to have the IT department flailing around inside the computer because you know, that will change the evidence.
Lee Neubecker: You know, it was interesting, Mark. One of my colleagues Alex Gesson had done some research and what he realized is that companies that use tools such as FTK Imager, when you capture the forensic image of a hard drive device, it records a serial number for that device that is not detected when you do forensic analysis to see if devices were plugged in. In actuality, there’s two serial numbers on a hard drive and only one of the two serial numbers is the one reported and they’re not always consistently detected. So we agree with you on that, using EnCase to make the forensic image. EnCase actually, at the time of imaging, EnCase will capture the serial number that can be detected in the registry. So what we’ve discovered is that people who haven’t used EnCase, they later on do this analysis to see, was the thumb drive plugged into the computer, and they can actually have a false negative because they didn’t appropriately image the media at issue.
Mark Halligan: Well, that’s fascinating and that shows you how critical it is to do the forensics correctly at the very beginning of the case. It could be case-determinative.
Lee Neubecker: So you’ve done the forensics and you’re going into court. What are you hoping to prove when you’ve done the computer forensics? What type of things are you hoping to be able to express in the form of an affidavit or support for your motion?
Mark Halligan: Well, a trade secret misappropriation case involves the actual or threatened misappropriation of trade secrets. So what you’re trying to do is protect these fragile assets. I mean, a trade secret, once lost, is lost forever. So you are attempting to stop the bleeding, plug the dyke, get an order that there is to be a preservation of evidence. Also, stop the continuing misappropriation activity or if it has not occurred yet, through injunctive relief, set up a wall to prevent the misappropriation of trade secrets, and to the extent possible, prevent its dissemination to other computers in the United States or to other parts of the world.
Lee Neubecker: Well, Mark, can you tell me any war stories about your use of computer forensics and what happened going into court?
Mark Halligan: Well, I think what I have seen in some occasions and I represented a major company in a case involving very serious acts of trade secret misappropriation and alleged foreign economic espionage. You know, the federal courts want to protect the privacy rights of individuals with electronically stored information, so there’s always this tension between, you know, the plaintiff seeking to prove up its trade secret case or misappropriation of trade secrets with the defendant’s interest in protecting the privacy of files and things that are on the computer. So oftentimes, the court requires search terms and you start off the case by looking at whether or not these search terms pop up on the computers. In a case that I was involved with, when those search terms were plugged in, we found that a file destruction software program had been run.
Lee Neubecker: Oh, that never happens.
Mark Halligan: And that the clock had been changed. And with that kind of evidence before the judge, we were then given access to the entire computer. No more search terms. And when we got access to the entire computer, we found out other third parties that were involved and of course, the case expanded to involve other defendants, other entities. But it all happened with the finding on the initial search terms of indicia of a file destruction software being run.
Lee Neubecker: Well, thanks a bunch for being on the show today, Mark. This was great stuff.
Mark Halligan: Thank you.
Lee Neubecker: People need to reach you, they can see the link to your website.
Mark Halligan: Thank you.
Lee Neubecker: Thanks a bunch.
Mark Halligan: Thank you very much, take care.