When a company suspects that confidential files, source code, pricing models, customer lists, formulas, designs, or other sensitive know-how left with a departing employee, vendor, or business partner, the first few hours often feel chaotic. Leadership may be worried about competitors, customers, investors, regulators, and internal morale all at once. Legal and security teams are often trying to answer the same urgent question: What happened, and what can be done about it now?
That urgency is not misplaced. Trade secret law can offer powerful remedies, including injunctions and, in rare cases, federal seizure relief, but those remedies usually turn on facts gathered early and preserved carefully. Under the federal Defend Trade Secrets Act, courts can issue injunctions to prevent actual or threatened misappropriation, yet the statute also limits overreach by requiring evidence-based showings rather than assumptions about what a former worker knows or where they went next. 18 U.S.C. § 1836. And across the states, the Uniform Law Commission continues to describe the Uniform Trade Secrets Act as one of the country’s widely adopted commercial laws, which helps explain why these disputes appear in both federal and state court.
In this post, you’ll find the 10 questions companies commonly ask when proprietary information appears to have walked out the door, along with practical context on what those questions often mean in a real-world investigation. If you want broader background on the legal framework, this overview of what trade secret claims often look like when confidential business information is taken can help connect the dots.
<aside> 💡 Scroll to the bottom for every post in this series.
</aside>
Before a company can evaluate remedies, it usually starts here: Was the information actually protected in a way the law recognizes?
Not every internal file qualifies as a trade secret. In general terms, trade secret protection turns on two recurring ideas: the information derives independent economic value from not being generally known, and the owner took reasonable measures to keep it secret. The Legal Information Institute’s summary of trade secret law highlights that secrecy efforts matter, and that information can lose protection if the owner failed to take reasonable protective measures. Cornell’s Wex explanation of trade secrets. The same concept shows up repeatedly in statutes and case law.
That is why companies often inventory facts like:
These questions do more than support a later lawsuit. They also test whether the company treated the information as genuinely sensitive before the departure happened.
This is usually the first operational question, and often the hardest.
Companies often start by identifying which files, systems, repositories, devices, or cloud accounts were accessed, downloaded, synced, emailed, printed, or copied near the employee’s departure or the end of a vendor relationship. Cybersecurity guidance from CISA’s Insider Threat Mitigation Guide emphasizes that insider incidents often involve authorized access being misused, which is one reason ordinary-looking activity logs can become central evidence later.
The practical issue is that “something was taken” is rarely enough. Lawyers and courts usually want specificity. Was it: