The Newberry Group Blog

Archived Categories

Sort By: Title   |   Blog Date
Tuesday, June 07, 2016

Temporary Restraining Orders. Part 3 in a 6 Part Blog Series

In my last blog post, I began two case studies.  In both instances, we found that intellectual property had been taken when the employees left the company.   Following our process, we created the Departing Employee Report that outlined all of our findings.  We gave the report(s) to our clients and their external counsel.  It is at this point in the story that these two very similar cases went in completely different directions.

In most cases, after our client and their law firm have a chance to review our findings and determine a course of action we are typically asked to write either an affidavit or a declaration.  We take the information in our report(s) and put it into an accepted legal format (the affidavit or declaration) that can be presented in court. Which document we create depends on the law firm we are working with.  Typically one of these documents is presented with a TRO (temporary restraining order). 

When you hear TRO, many of you might immediate think of some type of harassment or abuse case.  However a TRO has other purposes as well.  One such instance that I have seen used over and over again in theft of Intellectual Property (IP) cases is requesting a TRO where the employee that left and took IP with them, not be allowed to go to work for the new company until the theft of IP case has been resolved in some manner.  Typically in these cases where this type of TRO is requested, the law firm and the forensic company must move quickly so that the legal team has the information that they need to file for a TRO. 

I cannot stress enough how important speed is when working a case like this.  Because if the new employee has already been working at the new company for a few months, there is a high likelihood that the information that was taken has already been disseminated around the new company and a TRO is less likely to be effective. While I am not saying that you can’t get a TRO after a few months, you can, but you will just have more hoops to jump through.  This scenario alone is a great reason to have a relationship established with a forensic company that excels at investigating IP theft cases.

Let’s get back to those two case studies.  While these two case studies are of two companies in completely different industries, they are very much alike from a forensic standpoint.  Data was taken upon employee departure, the departing employees went to work for the competitor and the companies hired external law firm to help.  In both of these cases we were initially hired by the same law firm, a law firm that we had worked with for years and had a well-established process with. 

Internal Employee Case Study Continued:

For this case, we wrote an affidavit to go with the TRO and the documentation went to both the departed employee and the departed employees “new” company.  The “new” company was a Fortune 100 company, they were large enough that their first response back to the TRO was “if we wanted that companies IP, we would have just bought them”.  At this point, the fun really started.

Along with the TRO, it was requested that the employee send all USB drives that they had used at our client’s company so that we could forensically examine them to find and remove our client’s IP.  If our client’s IP was found on any of the devices, the court would uphold the TRO and the employee would not be able to work until the case was resolved.

Based on the request, the former employee sent four USB drives.  As you may remember from the previous blog post, we were expecting over 20 to show up.   So the fact that we only got four devices surprised us and angered the legal team.    However, we still analyzed the 4 drives that we were given.  Once the serial numbers were identified, we realized that only 3 of the devices that were sent to us had been used at the former company.  The one extra USB drive was completely new to us.  In addition, the key USB device that we were looking for was not one of the four that was sent to us.

All of this information was sent to the court, along with a request to get access to the former employee’s home computer.  When the court learned that only 4 USB devices had been turned over, the court ordered that the home computer had to be sent to us for analysis.

A few days later, the home computer arrived and performed the full departing employee analysis on the home computer.  Undertaking a USB analysis on the computer, we were able to identify that most of the 20+ USB devices that we were looking for were also used on his home computer, along with several other USB devices that were used at home but not on his old work computer.   During this investigation, it was discovered that the one USB device that we didn’t have information on, showed up as being used on his home computer.  What was the most shocking/concerning to our client, was that the key USB device had been used on his home computer just after he had resigned.

Since we had a lot of information about this key USB device, we performed some special searches for files that we knew had, at one time, resided on that device which belonged to his former employer, our client.  We were able to determine that these files had been accessed and opened on his home computer, from that USB device after he had already started at the new company.   These facts were presented to the court. The court did two things, first they granted the TRO and the employee couldn’t work anymore until the case was settled and secondly, the court gave us access to his work laptop.  This upset his new company as they didn’t want to give up his work laptop. 

A few days after the court order, his new work laptop arrived in our forensic lab.  Once the device was in our lab, we performed the New Hire Program package on his machine.  Stay tuned to future blog posts to see what this uncovered and how both companies responded.

Home Based Employee Case Study Continued:

In the case of the home based employee for this case study, things took a completely different spin once we delivered to outside counsel the report and they showed our client that had the employees leave.  This company decided it would be in their best interest to change law firms and retain a firm in the state which the two former employees resided.  I have worked many cases where our clients have changed law firms mid investigation, but this change did surprise me because the original law firm had a well know reputation for successfully litigating IP theft matters and I knew nothing about the new firm besides the fact that they were a very large international firm.

Our client and the now former law firm had told me that our report had been sent to the new firm and that I would be hearing from them shortly.  Weeks passed and I had heard nothing.  Knowing that we were initially going down the path of a TRO for both these employees I was getting concerned that I had not heard from the new law firm.  

I contacted our client and let them know that I had not been contacted by the new law firm.  They were surprised and said someone would reach out to me within 24 hours.  Not one hour later, my phone rang.  It was an associate at the new law firm.  She said the partner asked her to touch base with me just to let me know that they got the initial report and they were working their way through it.

The clock was ticking for a TRO and it still took them two more weeks before they called again.  This time they actually asked me to step them through the report so that they could better understand what IP had been stolen.   This call ended up being the first of many phone calls to discuss the report and help better understand it.

In the end, the new law firm opted not to pursue a TRO against the two departed employees.   They decided to “play nice”, reasoning that the employees would willing turn over their personal devices for us to search and remove all IP associated with their former employer.  As you can imagine, that was not what happened.  The employees each retained their own counsel, which vigorously fought any request to turn over their personal devices. In the end, instead of utilizing the courts to litigate the stolen IP, the decision was made to continue the “play nice”. It was decided they would pursue arbitration instead.  It would be 8 months before I would hear from the new law firm again.

Where to Go From Here:

As you can see, two cases that were nearly identical at the start, have taken off in different directions. Is there are right or wrong way to take these cases?  I would say yes…  Over the next few blog posts, I will explain why as we continue with these two case studies. In addition, I will take a look at some things you can do to both prevent IP from being taken from your company and from new hires bringing stolen IP into your company.

Newberry Group has services that can support all of your needs in these areas.  Our experienced team can conduct investigations that cover both the departing employee as well as the new hire for a fraction of the cost that you could incur should the examples above play out.  Our Departing Employee Program and New Hire Program are fixed fee programs that consists of defined computer investigation service packages that identify and report on employee data activity. The packages vary as to scope and cost in order to provide you with a level of assurance proportionate to the value of the employee and the access that the employee had to your IP.

For more information on these services as well as other Forensic-related services we offer, please visit our website at or email us at

 Next Blog: Reverse IP Theft

Posted by: Jerermy Wunsch
 | permalink

Leave a comment
*First Name  *Last Name 
*Email Address
*Type the code below into the textbox.