Checklist · Intellectual Property

When a Breach Hits Your Crown Jewels: A Trade Secret Incident-Response Checklist

Type
Checklist
Jurisdiction
National
Date
2026-01-11
Topic
Intellectual Property

The intrusion that copies a customer email list may in the same pass carry off the proprietary information that is the company's real competitive advantage, yet most incident-response plans are built for personal data and the notification clock and never ask whether the crown jewels were touched. A privacy-only response can quietly forfeit the very trade secret status the company would need to stop the harm, because under the Defend Trade Secrets Act and the Uniform Trade Secrets Act, security and legal protection are the same question, and post-breach conduct is part of the reasonable-measures analysis. This checklist folds trade secret preservation into incident response across three horizons: readiness before the breach, recognition and containment during it, and remedies, notification discipline, and coverage after. It gives special attention to the forensic-privilege trap that produced adverse rulings in In re Capital One and related cases, the eight statutory findings behind a DTSA ex parte seizure, and the disclosure paradox that pits breach-notification law against the duty of silence. Each step is paired with the reason it matters and the authority that makes the stakes concrete.

When a Breach Hits Your Crown Jewels: A Trade Secret Incident-Response Checklist

Intellectual Property > Trade Secret | Published 11 January 2026 - Updated 26 February 2026 | UpLaw - uplaw.us

A breach response tuned only to personal data can save the company from a notification fine while it loses the one asset it can never recreate, re-file, or insure back into existence. This checklist builds trade secret preservation into incident response so the secret survives the intrusion that exposed it.

Keywords: trade secret incident response, data breach, DTSA reasonable measures, crown-jewels inventory, forensic work product privilege, In re Capital One, ex parte seizure, Economic Espionage Act, litigation hold, cyber insurance notice, notification paradox, insider threat.

The intrusion that takes two things at once

Picture the alert that lands in a security operations center at 2:00 a.m.: anomalous outbound traffic, a service account behaving strangely, a data-loss-prevention tool flagging a large transfer to an unfamiliar endpoint. The response machine wakes up and does what it was built to do. It counts records. It asks how many people's names, Social Security numbers, and payment cards were exposed, and it starts the clock on the notification statutes that carry hard deadlines and per-record penalties. That machine is well engineered for one job — protecting regulated personal data — and it will do that job competently.

The problem is that the same intruder who scraped a marketing database may, in the same lateral movement, have copied the thing the company actually competes on: the catalyst formulation, the source code, the pricing model, the unreleased device geometry, the customer-margin file. Personal data is replaceable and, in a legal sense, fungible; the company will notify, offer credit monitoring, and move on. A trade secret is neither. Once it is out, no filing restores it, no registration certificate reissues it, and no policy pays to make the market un-know it. The secrecy that gave the asset its value can bleed away in the hours it takes a privacy-focused team to conclude that the engineering directory "held no personal information" and file it under no notification required.

This is the gap this checklist closes. Under the Defend Trade Secrets Act of 2016 (DTSA), Pub. L. No. 114-153, 130 Stat. 376 (codified at 18 U.S.C. §§ 1836-1839), and the Uniform Trade Secrets Act (UTSA) adopted in some form by nearly every state, a trade secret exists only so long as its owner takes "reasonable measures to keep such information secret," 18 U.S.C. § 1839(3)(A), and the information "derives independent economic value . . . from not being generally known," § 1839(3)(B). Those two clauses mean that security and legal protection are the same question asked twice. And critically, the reasonable-measures inquiry is not frozen at the instant of the intrusion. What the company does after it learns of the breach — how fast, how visibly, how well-documented — becomes evidence, for or against it, that it genuinely treated the information as a secret. A clumsy, privacy-only response is not merely a missed opportunity; it can be an admission.

For the narrative treatment of the same problem, see Protecting Trade Secrets During a Data Breach: Building IP Into Incident Response. For the program you should have built before any of this happened, see Standing Up a Trade Secret Protection Program: A Practical Checklist and the foundational overview in Trade Secret Law: How Secrecy Becomes Protectable Intellectual Property.

Two clocks, running in opposite directions

Every serious IP incident is governed by two clocks that tick against each other.

The first is the notification clock. Breach-notification statutes in all fifty states, sector-specific rules like the HIPAA Breach Notification Rule, and, for public companies, the SEC's cybersecurity disclosure regime under Item 1.05 of Regulation S-K push relentlessly toward disclosure, on deadlines measured in days. This clock is loud, familiar, and heavily lawyered.

The second is the secrecy clock. It runs the other way. Every hour a stolen formula sits on an attacker's server, every additional recipient who sees it, every public description of what was taken erodes the "not generally known" element that keeps the asset protectable at all. This clock is silent. Nothing beeps when a secret degrades. And the two clocks collide directly: the disclosure the first clock demands can be the very act that stops the second — a phenomenon this checklist returns to as the notification paradox. The discipline that follows exists to keep a team racing the loud clock from unthinkingly running out the quiet one.

Because the material below is dense, here is the map. Phase 1 is readiness before anything happens. Phase 2 is recognizing, in the first hours, that you are looking at an IP incident and not just a privacy one. Phase 3 is containing the intrusion while preserving evidence in parallel — not after. Phase 4 is building the forensic record to courtroom standards and keeping it privileged. Phase 5 is the remedies analysis: injunctions, damages, seizure, and criminal referral. Phase 6 is coordinating notifications and protecting insurance without broadcasting the secret. A closing section reframes the whole exercise as a single continuing story about reasonable measures.

Phase 1 — Before the breach: build the readiness you cannot improvise

Nothing in Phases 2 through 6 works if the groundwork is missing. The company that tries to assemble a crown-jewels inventory at 2:00 a.m. while the notification clock runs has already lost the race.

  • [ ] Maintain a current crown-jewels inventory. Map each key secret to the systems and repositories where it lives, the identities authorized to touch it, and the specific measures protecting it (access controls, encryption, segmentation, contractual coverage). This is the artifact that lets you answer, within hours, the only question that matters at the outset: were the crown jewels touched?
  • [ ] Assign a named owner and a refresh cadence. The inventory decays. Refresh it after every R&D milestone, system migration, cloud re-platforming, acquisition, and reorganization. A stale map that omits the repository the attacker actually hit is worse than no map, because it breeds false confidence.
  • [ ] Put the right notices in the right agreements. Confidentiality, employment, and IP-assignment agreements must carry the DTSA whistleblower-immunity notice under 18 U.S.C. § 1833(b)(3). Its absence does not defeat a misappropriation claim, but it forfeits exemplary damages and attorney's fees against that bound individual — precisely the insider most likely to be a defendant. See Building an Enforceable NDA Clause by Clause: A Practical Checklist and Non-Disclosure Agreements for Technology Deals: Drafting for Enforceability.
  • [ ] Write an IP annex into the incident-response plan. Give it triage triggers, a named IP liaison with authority to convene the business owners of each secret, and pre-identified trade secret counsel and forensic vendors chosen before the crisis, not during it.
  • [ ] Run tabletop exercises with trade secret scenarios. Not only privacy drills. Rehearse a departing executive copying the strategic plan on the way out; ransomware that threatens to publish R&D rather than merely encrypt it; a patient, low-and-slow intrusion into manufacturing documentation timed to a competitor's product cycle.
  • [ ] Pre-position the preservation and privilege architecture. Decide now which forensic firm outside counsel will engage, under what engagement letter, and how reports will be marked and routed. Improvising this at hour one is how companies fall into the privilege trap discussed in Phase 4.

A word on the modern threat picture, because it changes what "reasonable" readiness looks like. The stereotype of the breach — an outsider tunneling through a firewall to grab a database — is now only one of several shapes. Ransomware crews increasingly run double-extortion operations: they encrypt for leverage and exfiltrate for a second threat, publish-or-pay, aimed squarely at whatever the victim most wants kept quiet. For a company whose real value is a formulation or a codebase, the "pay or we leak your R&D" threat is a trade secret event dressed as a ransomware event, and a plan that treats ransomware as purely an availability problem will miss it. Meanwhile, the crown jewels no longer sit behind a single perimeter; they live in SaaS platforms, code-hosting services, cloud object storage, and the laptops of a distributed workforce. Reasonable measures in that environment are measured against a different baseline than they were a decade ago, which is precisely why the inventory has to map where the secret actually lives today, not where the network diagram says it should.

Why this matters. The inventory is doing double duty. Operationally, it is what converts a vague "something was exfiltrated" into "the attacker pulled from the repository that holds the Cerulean catalyst spec, which forty-one people can access and which we encrypt at rest." Legally, that same document is the contemporaneous record of reasonable measures that a future court will want to see. Trade secret plaintiffs lose not because their information lacked value but because they cannot show they treated it as secret; the classic teaching that protective measures need not be "heroic," only reasonable under the circumstances, comes from Rockwell Graphic Systems, Inc. v. DEV Industries, Inc., 925 F.2d 174, 179-80 (7th Cir. 1991) (Posner, J.), but "reasonable" still requires a record, and the inventory is the spine of that record. For the discipline of building and validating it, see Auditing Your Trade Secrets: A Practical Checklist and Building Trade Secret Protection from the Ground Up: A Comprehensive Guide.

Worked example — the map you wish you had. Cerulean Materials (a hypothetical specialty-chemicals maker) keeps its flagship catalyst formulation in a segmented engineering vault, encrypted, accessible to forty-one named employees, each under an NDA carrying the § 1833(b) notice. Its consumer-facing e-commerce database sits in an entirely different environment. When a compromised contractor credential is used to move laterally toward the engineering vault, the inventory lets Cerulean's IP liaison say, in the first ninety minutes, exactly which secret is in the blast radius, who could have staged the exfiltration, and what protective measures were in place at the moment of intrusion. A competitor with no such map would spend those same ninety minutes arguing about which SharePoint site the "formula stuff" lives on. The difference is not tidiness. It is the difference between a preliminary injunction and a shrug.

Phase 2 — During the breach: recognize that this is an IP incident

The single most consequential decision in a trade secret breach is made silently and early: the decision, usually by default, to treat the event as a privacy incident and nothing more. Recognition is a discrete skill, and it has to be built into triage.

  • [ ] Ask the IP-incident question at initial triage. Three sub-questions decide it. Does the exfiltrated or accessed data appear in the crown-jewels inventory? Does the attacker's behavior suggest targeting of proprietary information rather than monetizable personal data? Does attribution or timing point to a trade secret motive — a competitor, a departing insider, a nation-state actor, an event tied to your product roadmap?
  • [ ] Look for the forensic signature of a hunt, not a smash-and-grab. Ordinary financially motivated intruders behave differently from someone stealing know-how. Watch for selective exfiltration (engineering directories pulled while the far larger customer database sits untouched), reconnaissance and lateral movement toward specific repositories, R&D-native file types (CAD, source code, formulation spreadsheets, test data), and timing aligned to a launch, an M&A process, a financing, or a patent filing.
  • [ ] Engage the IP liaison and the affected business units immediately. The people who own the secret can tell you in minutes whether the accessed files are the crown jewels or drafts of last year's brochure. Standard breach forensics cannot.
  • [ ] Do not let a "no personal data" finding close the file. A privacy-competent investigation will note the engineering files only long enough to confirm they contain no Social Security numbers, then dismiss them. That is exactly the moment the crown jewels disappear from view.

Why this matters. The forensic questions that matter for privacy — what regulated data, how many people, which states — are not the questions that matter for trade secrets. An IP-aware investigation asks which proprietary asset, how completely, and to whom. The most famous illustration of the hunt pattern is the Waymo v. Uber litigation, where an engineer was alleged to have downloaded roughly fourteen thousand files of self-driving-car design material before departing; the case settled during trial for equity reportedly valued around $245 million. Waymo LLC v. Uber Techs., Inc., No. 3:17-cv-00939 (N.D. Cal. 2017-2018). The lesson is not the headline number. It is that the exfiltration looked, to any tool watching for it, like a deliberate collection of one company's engineering corpus — not a random data grab — and that pattern is detectable if someone is looking. For how the perimeter dissolves in remote and cloud environments (and why selective exfiltration is easier and harder to see than ever), see Guarding Trade Secrets Without a Perimeter: Remote Work and the Cloud.

Outsider or insider: the same theft, a different response

Recognition also means classifying the actor, because the two archetypes call for different moves. The outside intruder who lacked any authorization presents cleaner legal theories — the CFAA's "without authorization" prong still reaches true trespassers even after Van Buren, and the intrusion itself is wrongful. The forensic job is attribution and scope. The trusted insider — the engineer, the executive, the contractor with legitimate credentials — is the harder and, statistically, the more common trade secret adversary. Here the wrong is not the access but the use and the breach of a duty of confidence, which is why, as Phase 5 explains, the DTSA fits better than the CFAA after Van Buren. The insider case also collapses the boundary between this checklist and ordinary departing-employee hygiene: the same offboarding discipline that recovers devices and revokes access is what generates the forensic evidence you will need. See Protecting Trade Secrets When Employees Leave: A Practical Checklist. And because non-compete enforceability has narrowed and fractured across the states, many companies now rely on trade secret and confidentiality theories to do work that covenants once did — another reason to get the trade secret response right. See The Future of Non-Competes: FTC Rulemaking and the State-Law Patchwork.

Worked example — two intrusions, one alert. NorthArc Robotics (hypothetical) suffers a phishing compromise. The privacy team finds that an HR mailbox with a few hundred employee records was accessed and starts the notification workflow — correctly. But the crown-jewels inventory flags that the same compromised session also touched the motion-planning source repository, and the access logs show a targeted git clone of exactly the two modules NorthArc has never patented and guards as secrets, executed the week before a rival announced a competing product. Two intrusions rode in on one alert. A privacy-only response would have notified the HR employees and never noticed that the company's actual moat had been copied. The inventory plus a trained triage question is what separates those two outcomes.

Phase 3 — Contain and preserve, in parallel and not behind

The instinct to triage the regulated personal data first, because it carries the hard deadlines, is understandable and, from the standpoint of the asset's survival, backwards. Containment and preservation for the trade secret must run alongside the privacy response, not queued behind it.

  • [ ] Contain the intrusion while preserving evidence, not overwriting it. Stop ongoing exfiltration, close the attack vector, isolate affected systems, and revoke compromised credentials — but do it in a way that captures, rather than destroys, the logs, images, and artifacts you will later need to prove what was taken and by whom. Reflexive re-imaging of a compromised host can wipe the very evidence of the theft.
  • [ ] Run an access review and tighten access to the affected secret. Breaches routinely reveal that a "restricted" secret was in fact readable by hundreds. Narrowing access now stops further spread and shores up the ongoing reasonable-measures showing. Over-broad internal access is a favorite defense argument that the information was never really guarded.
  • [ ] Issue a litigation hold early and broadly. Capture forensic images and logs — and, just as important, the materials that prove the secret's value and the company's protective efforts: development records, lab notebooks, confidentiality agreements, access policies, and the crown-jewels inventory itself. A hold that captures only the intrusion artifacts misses half the case.
  • [ ] Engage counsel immediately. Two reasons, both urgent: to preserve the compressed timelines for emergency relief (a TRO sought weeks late is a TRO denied), and to establish the privileged posture of the investigation before the first frank written assessment is generated.

Why this matters. The preservation obligation is not optional and not soft. The duty to preserve attaches when litigation is reasonably anticipated — which, in a targeted trade secret theft, is essentially the moment you recognize it — and failure to preserve exposes the company to sanctions for spoliation of electronically stored information under Federal Rule of Civil Procedure 37(e); the modern preservation framework traces to Zubulake v. UBS Warburg LLC, 220 F.R.D. 212 (S.D.N.Y. 2003). Worse than the sanction is the perverse optics: a plaintiff who let the evidence of its own theft be overwritten hands the defense a ready narrative that the plaintiff never truly valued the confidentiality it now claims to have lost. For the mechanics of holds, ESI, and preservation done right, see Rule 26 Initial Disclosures and the Discovery Plan: A Practical Checklist and Federal Civil Discovery: Mastering the Tools, Rules, and Pitfalls. Prompt, visible, well-documented action preserves trade secret status; delay and indifference do the defendant's work for it.

Phase 4 — Document for the courtroom and protect privilege

This is the phase where sophisticated companies most often defeat themselves, and it is the phase this checklist treats in the greatest depth, because the case law is unforgiving and widely misunderstood. Two things have to happen at once: the forensic record must be built to litigation standards rather than operational ones, and the candid analysis layered on top of the facts must be structured to stay privileged.

Build the forensic record to courtroom standards

  • [ ] Apply litigation-grade forensic protocols. Establish and document chain of custody. Take forensically sound, bit-for-bit images rather than working on live systems. Verify with cryptographic hashes. Keep contemporaneous examiner notes. Use qualified examiners who can withstand a challenge to their methodology under Federal Rule of Evidence 702 and the Daubert line. See Daubert and the Consumer Survey for how gatekeeping actually plays out, transposed to the forensic context.
  • [ ] Prove access and exfiltration, not just intrusion. Privacy forensics asks whether a system was compromised. Trade secret forensics must prove what specific proprietary files were accessed or copied, when, by which identity, and where they went. That is a higher and more particular evidentiary burden, and it depends on logging you either had or did not have before the breach.

Structure the investigation to preserve work-product protection

  • [ ] Have outside counsel engage the forensic firm directly. The engagement letter should frame the work as undertaken to enable legal advice in anticipation of litigation — and the facts on the ground must actually match that framing.
  • [ ] Where feasible, retain a forensic firm separate from your standing security vendor. Using the same firm that already does your routine incident response, under a pre-existing statement of work, is the single most reliable way to lose the privilege.
  • [ ] Mark reports appropriately and restrict distribution. Do not circulate the report broadly for ordinary operational use, and do not hand it to regulators, auditors, or the business side as a matter of course. Every non-legal use is evidence the report would have been created anyway.

Why this matters — the doctrine. Work-product protection under Federal Rule of Civil Procedure 26(b)(3) shields material prepared "in anticipation of litigation." Courts operationalize that phrase through the "because of" test: a document is protected only if it was created because of the prospect of litigation and "would not have been created in substantially similar form but for the prospect of that litigation." In re Grand Jury Subpoena, 357 F.3d 900, 908 (9th Cir. 2004); accord United States v. Adlman, 134 F.3d 1194, 1202-03 (2d Cir. 1998). The trouble for breach forensics is that most companies would have investigated a serious intrusion anyway — to restore operations, satisfy regulators, and reassure customers — which means the report often would have been created in substantially similar form regardless of litigation. That is the trap.

Why this matters — the cases. A short line of data-breach decisions maps the boundary precisely, and they do not all come out the same way:

  • The cautionary tale. In In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238, at *4-5 (E.D. Va. May 26, 2020), the court ordered the forensic report produced. Capital One had a longstanding relationship with the forensic firm, Mandiant, retained years earlier under a standing incident-response agreement; after the 2019 breach, outside counsel papered a new engagement, but the underlying scope and payment structure looked materially the same as the pre-existing arrangement, and Capital One in fact used the report for "various business and regulatory purposes." The company could not show the report would have looked different but for the litigation. Restructuring the paperwork was not enough when the substance had not changed.
  • The other cautionary tale. In re Premera Blue Cross Customer Data Security Breach Litigation, 296 F. Supp. 3d 1230, 1245-46 (D. Or. 2017), reached the same production result where a forensic firm's engagement was merely amended — rather than genuinely reconstituted around anticipated litigation — after the breach.
  • The counter-examples that show the protection is real. In In re Experian Data Breach Litigation, 2017 WL 4325583 (C.D. Cal. May 18, 2017), the report was protected because outside counsel retained the forensic firm immediately and directed a distinct, litigation-purposed investigation. In Genesco, Inc. v. Visa U.S.A., Inc., 302 F.R.D. 168 (M.D. Tenn. 2014), the general counsel retained the consultant to help the company prepare for litigation, counsel directed the work, and the protection held. And in In re Target Corp. Customer Data Security Breach Litigation, 2015 WL 6777384, at *1-2 (D. Minn. Oct. 23, 2015), a deliberate dual-track structure — one investigation for ordinary business remediation, a separate privileged investigation for counsel — preserved protection for the litigation track.
  • The trap sprung again. Guo Wengui v. Clark Hill, PLC, 333 F.R.D. 7, 11-13 (D.D.C. 2019), and In re Rutter's Data Security Breach Litigation, 2021 WL 3733137 (M.D. Pa. July 22, 2021), both ordered production where the record showed the forensic work served broad business purposes "far broader than merely assisting outside counsel in preparation for litigation."

The pattern across the cases is clear enough to state as a rule: privilege follows substance, not paperwork. An engagement letter that says "in anticipation of litigation" will not save a report that was, in fact, used to run the business. The reliable structure is the Target dual track — a separate, litigation-purposed forensic engagement, retained by counsel, distributed narrowly, and genuinely different from the operational investigation. Note the boundary that even a perfect structure cannot cross: the facts of a breach are never privileged. What happened, what was taken, and when are all discoverable; what privilege can protect is the candid legal analysis layered on top. Do not let anyone confuse the two. On the parallel attorney-client protection for internal investigations conducted to secure legal advice, see Upjohn Co. v. United States, 449 U.S. 383 (1981), and In re Kellogg Brown & Root, Inc., 756 F.3d 754, 758-60 (D.C. Cir. 2014). For the discipline of logging what you withhold and why, see Building a Privilege Log: A Practical Checklist.

Worked example — the two-report problem. After the Cerulean Materials intrusion, the security team's standing vendor — the same firm on a monthly retainer for routine monitoring — writes a frank root-cause report noting that the engineering vault's access controls had been "effectively bypassed for months" and that "logging was inadequate to fully reconstruct what left the building." Circulated to the CISO, the audit committee, and the cyber insurer, that report is almost certainly discoverable, and its language will read at trial like a confession that Cerulean's measures were not reasonable. Had Cerulean instead run the Target dual track — a separate forensic engagement retained by outside counsel, scoped to the anticipated misappropriation suit, distributed only to the legal team — the operational fixes would still happen, but the candid legal assessment of exposure would have a real chance of staying protected. Same facts, two very different trial exhibits.

Phase 5 — Pursue, or document the consideration of, remedies

Trade secret law gives the injured owner an unusually powerful and time-sensitive remedial toolkit. Even where litigation is not immediately viable, the record that the company weighed these remedies is itself part of the reasonable-measures story and the answer to a defense that the plaintiff slept on its rights.

  • [ ] Evaluate injunctive relief first and fast. A temporary restraining order and preliminary injunction can freeze the harm and preserve confidentiality going forward. 18 U.S.C. § 1836(b)(3)(A). The value here is preventive: an injunction that stops the secret from being used may matter far more than any eventual damages, because it protects what secrecy remains.
  • [ ] Model the damages, including the enhanced tier. The DTSA authorizes recovery of actual loss plus unjust enrichment not captured by actual loss, or, in the alternative, a reasonable royalty. § 1836(b)(3)(B). For willful and malicious misappropriation, exemplary damages up to twice the compensatory award and attorney's fees are available. § 1836(b)(3)(C)-(D). But the exemplary-damages and fee remedies are conditioned, as to a bound employee or contractor, on having given the § 1833(b) whistleblower-immunity notice — the readiness step from Phase 1 that pays off here. For how these measures are actually computed and proven, see What an IP Case Is Worth: A Guide to Intellectual Property Damages.
  • [ ] Evaluate ex parte civil seizure — carefully, and rarely. In "extraordinary circumstances," § 1836(b)(2) lets a court order law enforcement to seize property to prevent the propagation or dissemination of a trade secret, without notice to the target. It is genuinely exceptional relief. The court must make eight specific findings, including that an ordinary injunction under Rule 65 would be inadequate, that the applicant is likely to succeed, that immediate and irreparable harm will otherwise occur, that the harm to the applicant outweighs the harm to the target, and — a trap for the impatient — that the applicant "has not publicized the requested seizure." § 1836(b)(2)(A)(ii). Seizure sought without support exposes the applicant to liability for wrongful seizure. § 1836(b)(2)(G). This remedy fits the scenario where data is about to cross a border or be irretrievably scattered, not the ordinary case.
  • [ ] Weigh a criminal referral under the Economic Espionage Act. For theft to benefit a foreign government or instrumentality, 18 U.S.C. § 1831; for commercial theft "intended for the economic benefit of anyone other than the owner," § 1832. A referral trades control and confidentiality for the government's investigative reach; the choice is strategic, not automatic. For the full civil-and-criminal exposure map, see The Real Cost of IP Piracy: Civil Damages, Criminal Charges, and Secondary Liability.
  • [ ] Document the analysis even when you do not sue. A contemporaneous memo showing the company evaluated injunction, seizure, damages, and referral — and made a reasoned choice — is evidence of diligence and valuation. Silence in the file looks like indifference.

A note on injunction scope. Not every injunction is equally available, and the DTSA polices the outer edge. Section 1836(b)(3)(A)(i)(I) permits an order to prevent "actual or threatened misappropriation," but it forbids an injunction that would "prevent a person from entering into an employment relationship," conditioning any restraint on employment on "evidence of threatened misappropriation and not merely on the information the person knows." That proviso is Congress's guardrail against the aggressive form of the inevitable-disclosure doctrine, under which some courts (following PepsiCo, Inc. v. Redmond, 54 F.3d 1262 (7th Cir. 1995)) have enjoined a departing employee from taking a new job on the theory that he could not help but use what he knew. States split sharply on whether they accept that theory at all — California, for instance, rejects it — so the availability of the strongest injunctive relief in the insider case turns on choice of law as much as on the facts. Plan the injunction you can actually get, not the one you wish existed.

Why the choice of statute matters. The instinct to reach for the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, in the insider case has weakened considerably. In Van Buren v. United States, 593 U.S. 374 (2021), the Supreme Court held that a person who is authorized to access a computer system does not "exceed authorized access" under the CFAA merely by using that access for an improper purpose. So the classic disloyal insider — the engineer with legitimate credentials who copies the crown jewels on the way out — often falls outside the CFAA's "exceeds authorized access" clause after Van Buren, though the "without authorization" prong still reaches true outside intruders. The DTSA, built around breach of a duty of confidence rather than the fact of computer access, is the better-fitted tool for the authorized-insider theft. For the parallel unraveling of CFAA theory in the scraping context, see Web Scraping and the Law After hiQ v. LinkedIn: Where the CFAA, Contract, and Copyright Collide.

The EEA in practice. The criminal statute is not a museum piece. The government has secured § 1831 economic-espionage convictions in cases involving theft for the benefit of foreign state actors — the Walter Liew prosecution over DuPont's titanium-dioxide process, United States v. Liew, 856 F.3d 585 (9th Cir. 2017), is a leading example. And the statute's own history is a cautionary tale about scope: in United States v. Aleynikov, 676 F.3d 71 (2d Cir. 2012), the Second Circuit reversed the EEA conviction of a programmer who took Goldman Sachs high-frequency-trading source code, holding that the code was not "produced for" or "placed in" interstate commerce as the then-current § 1832 required — a gap Congress promptly closed with the Theft of Trade Secrets Clarification Act of 2012, Pub. L. No. 112-236. The point for an incident responder: the criminal fit depends on facts (foreign nexus, interstate commerce, the nature of the product) that your forensic record either captures or fails to. When the target is a foreign defendant or the data has already crossed a border, coordinate the civil and cross-border strategy early; see Service and Ex Parte Remedies Against Chinese Defendants in IP Litigation: A Practitioner's Guide.

Worked example — the border-crossing calculus. Cerulean's forensics show the catalyst spec was staged to a cloud bucket controlled from overseas and that the departing process engineer who staged it holds a one-way ticket dated four days out. This is close to the narrow band where § 1836(b)(2) seizure is designed to operate: irreparable harm is imminent, an ordinary injunction may not reach the offshore copy in time, and — crucially — Cerulean has not fired off a cease-and-desist letter that would "publicize the requested seizure." A single premature demand letter can foreclose the seizure entirely. If instead the engineer is a domestic employee with the files still on a laptop in the next county, the extraordinary remedy is unavailable, a Rule 65 TRO plus expedited forensic imaging is the right tool, and reaching for seizure would invite a wrongful-seizure counterclaim. Same statute; the facts decide.

Phase 6 — Coordinate notifications and protect insurance

Now the two clocks collide head-on. Breach-notification law pushes toward disclosure; trade secret law pushes toward silence. The job is to say exactly what each regime requires and not one detail more.

  • [ ] Put every disclosure through one coordinated review. Privacy counsel, trade secret counsel, securities counsel, and coverage counsel should work from the same facts, in the same room, so that no filing gratuitously compromises the secret to satisfy an unrelated regime.
  • [ ] Describe exposed proprietary information at the level of generality the law permits. "Certain proprietary technical information relating to a manufacturing process" — not the compound, the parameters, or the file names. Every regulatory or investor disclosure that specifies what secret was taken can itself contribute to the loss of secrecy.
  • [ ] Notify the right private parties, through counsel. Business partners bound by confidentiality agreements; identifiable recipients of the stolen material (a notice through counsel supports willfulness and deters use); and affected customers where the exposed secret bears on the products they bought.
  • [ ] Mind the SEC clock if you are public. The SEC's cybersecurity disclosure rules require a registrant to disclose a material cybersecurity incident on Form 8-K under Item 1.05 of Regulation S-K, generally within four business days of determining materiality. The materiality judgment and the drafting are where the paradox bites: an 8-K that describes the theft of "core proprietary technology" to satisfy investors can hand the misappropriation defendant an admission and, worse, further erode the secret.
  • [ ] Notify every potentially applicable insurer promptly. Cyber, crime, D&O, and E&O policies each may respond, and late notice is a leading basis for denial. Read each policy before the breach: IP theft is frequently excluded or sublimited, and "loss" definitions often reach remediation and notification costs but not the competitive harm from a stolen secret. Do not assume the cyber policy covers the one loss that actually hurt.

Why this matters. The disclosure paradox is not hypothetical. An admission crafted to meet one regime's standard — the SEC's materiality test, say — can be turned against the company in a coverage dispute or in the misappropriation litigation itself, and a filing that catalogs the stolen secret in loving detail can finish the job the attacker started by broadcasting the secret's existence and nature to the market. The discipline is to treat every outbound word as potential evidence and potential further disclosure. For the broader compliance architecture that should already govern this, see Building a Privacy Compliance Program: Governance, Data Mapping, and the Legal Patchwork, Standing Up a Privacy Compliance Program: A Practical Checklist, and the life-cycle Privacy and Data Protection Toolkit. Where the data implicates health information, the HIPAA overlay adds its own notification mechanics; see HIPAA in the Cloud: Business Associates, BAAs, and Protecting ePHI.

Worked example — the sentence that cost the secret. A draft 8-K for a public Cerulean reads: "The Company determined that attackers exfiltrated the complete formulation and process parameters for its XL-9 catalyst, the Company's principal product." Securities counsel likes it because it is candid and material. Trade secret counsel should stop it cold. That single sentence tells every competitor precisely what to look for on the dark web, concedes in a federal filing that the "complete formulation" is now out (undercutting the secrecy the company must assert in litigation), and may exceed what Item 1.05 actually requires. The compliant version discloses a material incident affecting "proprietary technical information relating to a key product line," discloses the financial and operational impact, and stops. Materiality is satisfied; the crown jewels are not gift-wrapped.

The common mistakes, gathered in one place

Each of these is a failure this checklist is built to prevent. Read them as the anti-pattern list to run against any live incident.

  • Privacy-only triage. The event is worked entirely as a personal-data breach and no one ever asks whether IP was hit. The crown jewels leave unnoticed.
  • The Capital One trap. A purely technical investigation is stood up in the first hours, generating frank written assessments with no privilege structure, using the standing security vendor under the pre-existing contract. The report becomes a trial exhibit.
  • Preservation lost to remediation. Compromised systems are re-imaged for a fast restore, wiping the evidence of the theft and exposing the company to spoliation sanctions under Rule 37(e).
  • The premature demand letter. A cease-and-desist is fired off first, "publicizing" the request and foreclosing the § 1836(b)(2) ex parte seizure the facts might otherwise have supported.
  • Cataloging the secret in a filing. A notification or 8-K describes the stolen secret in detail, broadcasting its existence and nature and undercutting the very secrecy the company must later prove.
  • Late notice to insurers. The one procedural step insurers most reliably enforce is missed, forfeiting coverage that would have funded the response.
  • The missing § 1833(b) notice. Exemplary damages and fees against the bound insider evaporate because the whistleblower-immunity language was never in the agreement.

The through-line: reasonable measures are a continuing story

Step back from the phases and the doctrine coheres around one idea. Trade secret protection is not a status you achieve and file away; it is a continuing demonstration that the owner treats the information as secret. The statute's text — "reasonable measures to keep such information secret," 18 U.S.C. § 1839(3)(A) — is written in the continuous present, and courts read it that way. The Supreme Court has long grounded trade secret law in the protection of the owner's investment and the encouragement of commercial ethics, Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470, 481-82 (1974), and has recognized the secret itself as a species of property, Ruckelshaus v. Monsanto Co., 467 U.S. 986, 1001-04 (1984). Property one abandons the moment it is threatened is not property the law will strain to protect.

That is why the after matters as much as the before. A company that responds to a breach with prompt containment, disciplined preservation, a tightened access footprint, a considered remedies analysis, and carefully calibrated disclosures is not just doing incident response — it is building, in real time, the evidentiary record that the information remained a protected secret through the worst thing that ever happened to it. A company that responds with a privacy-only shrug, an over-shared forensic report, an overwritten hard drive, and a detailed 8-K is building the opposite record. The intrusion is the same in both cases. The legal outcome is not.

Two clocks are running from the first alert. The loud one measures a fine. The quiet one measures whether you still own the thing that made the company worth breaching. This checklist exists to keep the team from beating the first clock while losing the second.

Primary authority and quick reference

Statutes and rules.

  • Defend Trade Secrets Act of 2016, Pub. L. No. 114-153, 130 Stat. 376 (codified at 18 U.S.C. §§ 1836-1839), including § 1836(b)(2) (ex parte seizure and its eight findings), § 1836(b)(3)(A)-(D) (injunctions, damages, exemplary damages, and fees), § 1837 (extraterritorial reach), § 1839(3) (definition and the reasonable-measures requirement), and § 1833(b) (whistleblower-immunity notice).
  • Economic Espionage Act, 18 U.S.C. §§ 1831 (foreign-benefit theft) and 1832 (commercial theft); Theft of Trade Secrets Clarification Act of 2012, Pub. L. No. 112-236.
  • Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (now narrowed for the authorized-insider case).
  • Uniform Trade Secrets Act (1979, amended 1985), as enacted in most states; Restatement (Third) of Unfair Competition §§ 39-45 (1995); Restatement (First) of Torts § 757 (1939).
  • Fed. R. Civ. P. 26(b)(3) (work product); Fed. R. Civ. P. 37(e) (ESI preservation and spoliation); Fed. R. Civ. P. 65 (injunctions); Fed. R. Evid. 702 and the Daubert line.
  • SEC cybersecurity disclosure rules, Regulation S-K Item 1.05 and Form 8-K (material-incident reporting).

Key cases.

Related UpLaw Resources

Related Checklists

Related Guides

Related Articles

Related Toolkits

This checklist is for general informational purposes only and does not constitute legal advice or create an attorney-client relationship. Cybersecurity, breach-notification, trade secret, securities, and insurance law vary by jurisdiction and continue to evolve. Consult qualified cybersecurity and intellectual property counsel about your specific circumstances.