Intellectual Property Theft Investigation

Notice the common thread: in every category the legal theory is well established, and the practical obstacle is the same one. Before any statute can be invoked, a rights holder needs a name. The remaining sections walk through how that name is found, what the records research can and cannot do, the statutes the work supports, and where the lawful boundaries sit.

The heart of an IP-theft investigation, the part that decides whether there is a case at all, is turning an anonymous operation into a named, locatable defendant. This is records research, not hacking. Everything below is drawn from public records, open commercial databases, corporate registries, and open-source intelligence gathered from material that is already public. None of it involves accessing a private account or a protected system.

Unmasking an anonymous online seller or site

When the infringer hides behind a storefront or a website, the trail usually runs through registration and corporate records. Domain registration history, including the layers behind a privacy-proxy service, can be researched through lawful channels and, where the operator has slipped, archived registration data. A storefront on a marketplace typically leaves a footprint, a business name buried in policy pages, a return address, a support contact, a fulfillment pattern, that ties back to a real entity. Standalone commercial sites must collect tax and shipping details and frequently disclose a legal business name somewhere in their terms. We pull these threads together and cross-reference them against corporate filings to put a company, and then the people who control it, behind the listing.

Tracing shell companies and registered agents

Sophisticated operations route everything through entities, an LLC to hold the storefront, another to hold the bank relationship, a registered agent standing in for the real owner. Those entities are not invisible. Secretary-of-state corporate registries list formation documents, registered agents, and, in many states, officers and members. By following the chain of filings, common agents, shared addresses, and overlapping officers, an entity that looks like a dead end can be connected to the natural person who actually runs it. This is the same entity-resolution work that underpins serious asset tracing, applied here to identify who must be named and served.

Locating a departed employee

When the theft is internal, the suspect is a known individual who may have moved, changed jobs, or gone quiet. Standard skip tracing, building a current address, place of work, and contact picture from public records and licensed databases, locates that person for service and confirms where they have landed. Where a subject has tried to obscure their identity, the techniques in our guide to finding someone using a fake name apply directly.

Connecting the person to the operation

Identification is only useful if it connects the individual to the infringing activity. Open-source research, public professional profiles, job postings, conference and trade-show materials, company announcements, and public business filings, can establish that a named person now works for, owns, or controls the entity benefiting from the stolen IP. We treat publicly available profiles and public filings as the lawful sources they are, and we never create fake personas, never access private accounts, and never represent ourselves as anyone we are not.

The takeaway is that no single player covers the whole case, and the identification step is the one most often missing. Counsel cannot serve a defendant who has no name, a forensic examiner works the devices but does not chase ownership through corporate registries, and a process server needs a target before they can act. Filling that gap, lawfully and with documentation, is precisely our lane.

Most trade-secret theft is an inside job. The recurring story is an employee with legitimate access who, in the weeks before resigning, downloads files in volume, forwards documents to a personal email account, copies data to a USB drive or personal cloud storage, and then surfaces at a competitor doing conspicuously similar work. The forensic side of that, what was copied and when, is a job for an examiner working the company’s own systems. The identification side, where the person went, who they now work for, and how that employer is structured, is ours.

A defense you will hear early is independent development, the claim that the competitor built its product from scratch. Identification work strengthens the rebuttal indirectly: by establishing the timeline of where the former employee landed and when the competing product appeared, and by tying the named individual to the entity now selling it. Paired with the forensic record of files copied before departure, the timeline becomes hard to wave away. Another recurring theory is inevitable disclosure or targeted hiring, the argument that a competitor that recruits the exact person holding the secrets, and then ships a matching product, did so to exploit that knowledge. Documenting a pattern of targeted recruitment from one division, drawn from public job postings and announcements, is open-source research that supports that narrative.

There is also a hard practical question counsel asks early: if we win, can we collect? An individual former employee may have few assets, while the competitor that benefited usually has more, and where the individual operates through a business entity, the analysis extends to who really controls that entity. Identifying the right defendant is therefore not only about who is liable but about who is worth pursuing, which is where subject identification, entity resolution, and asset research overlap.

The statutes offer several damages theories, and which one a plaintiff elects shapes what the case needs to prove. Actual damages measure the profits the rights holder lost. Disgorgement reaches the infringer’s own profits from using the stolen IP. A reasonable royalty asks what a legitimate license would have cost. And the enhancement provisions, exemplary damages up to twice the award under the trade-secret statute, trebling and large statutory awards under the trademark statute, can multiply the figure where conduct was willful. Counsel selects the theory; the investigation supports it by helping establish who profited and how.

But a damages number on paper is not money in hand. The most common disappointment in IP enforcement is winning a judgment against a defendant who turns out to be a thinly capitalized shell, or an individual who has moved assets out of reach. That is why asset research belongs in the analysis early, not after judgment. Identifying which defendant actually holds value, whether an individual has assets worth pursuing or has shifted them, and whether an entity is a genuine business or a hollow front, all of it shapes the litigation strategy from the outset. The entity-resolution and asset work that supports judgment enforcement, including looking through shell structures to the parties who control them, is the same research described in our business asset tracing guide. Identifying the right, collectible defendant at the start is what keeps a hard-won judgment from becoming an uncollectible piece of paper.

A recurring lesson in trade-secret litigation is that the defense often attacks the protection, not the taking. Because a trade secret only qualifies for protection if its owner took reasonable measures to keep it secret, a defendant’s first move is frequently to argue that the information was not really guarded, and therefore was never a protectable secret at all. That means the steps a company takes before anything is stolen are not merely good hygiene; they are evidence, and an investigation built later will lean on them.

The measures that tend to matter are familiar but easy to neglect. Confidentiality and non-disclosure agreements that clearly define what is protected and for how long establish that employees and partners were on notice. Where they are enforceable in the relevant state, non-compete and non-solicitation terms add structure to a departure. Access controls that limit sensitive data to the people who genuinely need it, paired with monitoring for unusual access or bulk downloads, both reduce the risk and create a record if something goes wrong. Confidentiality markings on documents, training that reminds staff of their obligations, and a structured departure protocol, returning devices, reminding the departing employee of continuing duties, and promptly terminating access, all leave a trail that an investigation can later document.

Perhaps the single most useful artifact is a formal record of what the company treats as a trade secret and what it does to protect each item. When a dispute arrives, that register lets counsel show, concretely, both the value of the secret and the reasonable measures in place, exactly the two elements the law requires. None of this is something we administer for you; it lives inside your organization. But it shapes what an investigation can prove, and it is worth having in place long before you ever need to identify the person who walked out the door with it.