The document discusses electronic forensic examinations in trade secret theft cases. It covers the legal basis for forensic examinations under In re Weekley Homes, L.P., selecting a qualified forensic expert, drafting forensic protocols, examining target devices and data, reviewing extracted information, international collection considerations, and DTSA notice requirements for employment agreements.

1. Trade Secret Theft
in the Digital Age
Houston Young Lawyers Association
Cyber Evidence, Kasi Chadwick, Alejandra Hamilton

2. What we will
Cover…

3. PAGE
Overview
• Legal authority for forensic examinations
• The life of a forensic examination and the best practices
for completing a forensic examination
• Drafting considerations
3

4. Trade Secret Cases in 2017

5. PAGE 5

6. PAGE
What is an Electronic Forensic Examination?
• Electronic forensic examinations can be used to
review the contents of an individual’s:
 Computer;
 Cell phone;
 Cloud-based e-mail system (Hotmail; Gmail);
 USB device; or
 Generally any medium upon which data is stored.
• Generally, an inventory of the content of the
target device, called a file listing, is provided to
the requesting party.
6

7. PAGE
What is an Electronic Forensic Examination?
• Three types of electronic forensic examinations
– Examination of devices in your possession
– Agreed examination of devices outside of your
possession
– Court-ordered examinations
7

8. Legal Basis

9. PAGE
In re Weekley Homes, L.P.
• Alleged discovery abuse  Trial court ordered a forensic
protocol
• In re Weekley Protocol:
 Four forensic experts identified.
 Experts to take an evidentiary image of the hard drives in
question using “procedures that is generally acceptable as
forensically sound.”
 From the images, experts would search for deleted emails from
the relevant year using specified search terms.
 Owner of data then had opportunity to review the responsive
data.
 Responsive data was to be provided to requesting party.
• Responding party sought mandamus relief.
9

10. PAGE
• Supreme Court concluded the trial court abused its
discretion.
• Made this finding because the requesting party’s
“conclusory statements that the deleted emails it
seeks ‘must exist’ and that deleted emails are in
some cases recoverable is not enough to justify the
highly intrusive method of discovery the trial court
ordered…”
• In order to obtain a court-ordered forensic protocol,
more must be shown.
• Case-by-case analysis.
10
In re Weekley Homes, L.P.

11. PAGE
In re Weekley Homes, L.P. - Dicta
• The Supreme Court contrasted their decision with In
re Honza, 242 S.W.3d 578, 583 (Tex. App.—Waco 2008).
• The Supreme Court distinguished In re Weekley from
Honza:
 Honza sought forensic review to obtain the
metadata for a document. No question of
document’s existence.
 There was a direct relationship between the hard
drives sought and the plaintiff’s claims.
 There was extensive testimony as to the forensic
expert’s experience and qualifications prior to
granting the forensic review.
11

12. PAGE
In re Weekley Homes, L.P. – Legal Standard
• Per Rule 196.4 of the Texas Rules of Civil Procedure:
• Employing Rule 196.4, the In re Weekley outlined the
legal standard for a court-ordered electronic forensic
examination sought to remedy an alleged discovery
abuse.
12

13. Selecting Your Forensic
Expert

14. PAGE
Selecting Your Forensic Expert
• Selecting a qualified forensic expert is critical.
 Qualified and experienced forensic experts help ensure
proper collections and processing of data.
 In the world of forensics, there are many way to skin
the cat.
 Using an inexperienced expert can cause omissions of
critical evidence—and in some cases—destruction of
the evidence altogether.
• Per In re Weekley, your expert’s credentials are
important in obtaining a court-ordered forensic
protocol.
14

15. PAGE
• Involve forensic expert as early in process as
possible.
– Protocols put in place without expertise often create
unrealistic expectations with respect to the practical
limits of forensic analysis.
– You can't order an examiner to fly.
• Clear delineation of examiner's ethical responsibilities
is essential. Obligations to Court and opposing party
should be made manifest, where applicable, to avoid
inherent conflicts.
15
Selecting Your Forensic Expert

16. PAGE
Selecting Your Forensic Examiner
• No affiliation guarantees competency. Look closely at
the examiner, not the company.
• Referrals from colleagues helpful.
• Know what licensure requirements apply to the
examiner.
• Examiners should be experienced in writing
intelligible reports.
16

17. What is an Electronic
Forensic Protocol

18. PAGE
What is an Electronic Forensic Protocol?
• An electronic forensic protocol is a set of procedures
through which the harvesting, review, and
(sometimes) the destruction of electronic content is
conducted.
• Used to examine devices outside of your possession
• Agreed forensic protocols can be drafted pursuant
Rule 11 of the Texas Rules of Civil Procedure and/or in
conjunction with injunctive relief.
• Alternatively, court-ordered forensic discovery can be
issued—generally to remedy discovery abuses.
18

19. PAGE 19
• Be careful when
seeking to deploy a
found or form protocol.
• Each case presents
unique considerations
for forensic
assessment.
• Each requires a
protocol tailored to the
needs, sources, parties
and risks attendant to
the matter.

20. What are we Examining?

21. PAGE
What are we Examining?
• The easy targets:
 Computers (personal and company devices)
 External storage devices
• The more complex:
 Cell phones
 Cloud-based storage systems (e.g. cloud-based e-mail
accounts, DropBox)
21

22. PAGE
What are we Examining?
• Where is the target
information kept?
• While forensic
examinations of cell
phones and cloud-
based accounts do not
normally produce
reviewable documents,
these extractions can
provide important clues
to the rest of the puzzle.
22

23. What will be Pulled from the
Target Devices?

24. PAGE
What will be Pulled from the Target Devices?
• Question: What is the universe of data to be
extracted?
• Will the forensic expert be harvesting:
 Active files (e.g. .docs, .pdfs, .xls)
 Deleted file identification
 Device connection log
 Internet artifacts
24

25. Additional Front-End
Considerations

26. PAGE
Additional Considerations to be Decided Before
Execution
• Who will hold the devices while the protocol is
executed?
 For how long will the devices be sequestered?
 How will the devices be kept secure?
• How will the forensic images be maintained?
• Deletion after protocol complete?
• Confidentiality? AEO?
26

27. PAGE
Additional Considerations to be Decided Before
Execution
• Consider an iterative process to keep the case
moving forward.
– A few key issues examined first, then a few more.
Don't boil the ocean.
• Address whether the examiner can assess the
integrity of the evidence. If the digital books have
been cooked (e.g., drives swapped, wrong machine
supplied, drive wiping seen, etc.), can the examiner
address this as a threshold matter?
27

28. Harvesting the Data

29. PAGE
Harvesting the Data from the Target Devices
• After the protocol is executed by the parties, the
forensic expert’s work comes into play.
• Selecting the right expert is critical.
 There are a number of tools forensic experts can use.
The forensic expert’s expertise is important.
• Example: Different data extraction programs work
best on different devices.
 Incorrect collection methods or incorrect tools can
destroy critical metadata (e.g. creation date, last
accessed date).
29

30. Data Review

31. PAGE
Review of Target Information
• Most experts generate
reports containing the
target information.
• Information in reports
from the file listings
• File listings and
extractions are
generally produced in
.xls format.
31

32. PAGE
What are we Reviewing?
• Files
– Names
– Sizes
– Creation dates
– Last accessed dates
– Last modified dates
– Whether files are deleted
and
– Whether a file is
overwritten
• Web Information
– Browser history
– Web bookmarks
– Cookie history
• Mobile Devices
– Call logs
– Text messages
– SMS messages
– Applications
– Contacts
32
With the careful review of a listing or extraction, the
expert can see:

33. Additional Notes

34. PAGE
Spoliation
• Because a file listing can show the life and death of a
file, improperly preserved evidence can present
significant problems to a responding party.
• Whether a deleted file is recoverable dictates the
degree of any spoliation implications.
• Many times, spoliation happens inadvertently.
– Especially in more protracted litigation, paralegals can help monitor a
case’s activity to help their lawyers.
34

35. PAGE
International Collections
• Because we are searching for electronically
misappropriated information, it is common for target
devices to be located in different countries.
• International Collections
 Kits
 On-site collections
• Compliance with international laws
 EU laws are different.
 Sometimes, if the information is personal in nature, the
information belongs to the employee, even if the
information is located on the employer’s devices.
 There are exceptions.
35

36. PAGE
Defend Trade Secret Act of 2016
• The DTSA was signed into law by President Obama on May
11, 2016.
• The DTSA creates a “civil seizure” mechanism to collect
and sequester electronic storage devices believed to
contain a stolen trade secret soon after filing suit.
• The DTSA—and the “best practices” expected to be
created under the DTSA—may have implications on how
forensic discovery is conducted in the future.
36

37. Drafting Considerations for
Employee Related Agreements
under the DTSA

38. PAGE
The DTSA Notice Requirement
• The DTSA, like the Texas Uniform Trade Secret Act,
allows for recovery of exemplary damages and
attorney fees.
• As a condition to recovery of such remedies, the
DTSA imposes a duty on the employer to notify all
“employees” of the immunity and anti-retaliation
protection provisions of the DTSA in any contract or
agreement that protects or governs the use or
disclosure of trade secrets or other confidential
information entered into, or updated, after May 11,
2016 .
38

39. PAGE
Who is an Employee under the DTSA?
• The term “employee” under the DTSA is broadly
defined to include traditional W-2 employees and “any
individual performing work as a contractor or
consultant for the employer.”
• As a result, employers are required to incorporate the
DTSA notice language in all contracts and agreements
with employees, independent contractors,
consultants and any other vendors who are granted
access to or help develop the employer’s confidential
information and trade secrets.
39

40. PAGE
What Types of Contracts are Covered?
• The DTSA notice provisions apply to any contract or
agreement that governs the use of trade secrets or
other confidential information.
• Examples of these types of agreements are:
• Offer Letters or Employment Agreements
• Restrictive Covenant Agreements
• Confidentiality and Propriety Rights Agreements
• Independent Contractor or Consultant Agreements
• Separation and Release of Claims Agreements
• Technology/Invention Assignment Agreements
• Work-for-Hire Agreements
40

41. PAGE
What Type of Notice is Required?
The notice must provide the immunity and anti-
retaliation protection provisions of the DTSA, as seen in
the example below:
41

42. PAGE
Is there an Alternative to the Notice Requirement?
• Employers can comply with the notice requirement by
updating their form agreements to include a cross-
reference to a written policy provided to the
employee, contractor or consultant that sets forth the
employer’s reporting policy for a suspected violation
of law.
• To fully comply, the written policy must contain the
immunity and anti-retaliation protection provisions
provided for under the DTSA.
42

43. PAGE
Consequences of Non-Compliance
• There is no statutory penalty for failing to provide
notice.
• Failure to comply with the notice requirement will
result in a forfeiture of the ability to recover
exemplary damages and attorneys fees in an action
for misappropriate under the DTSA.
• Employer may recover exemplary damages and
attorney fees under the Texas Uniform Trade Secret
Act.
43

44. Additional Resources

45. PAGE
Questions?
Kasi Chadwick
BoyarMiller
kchadwick@boyarmiller.com
Alejandra Hamilton
Boyar Miller
ahamilton@boyarmiller.com
David Brown and Paul brown
CyberEvidence
david.brown@cyberevidence.com
paul.brown@cyberevidence.com
45