Competitive Intelligence Checklist: Source Classification, Reverse Engineering Documentation, Clean Room Procedures, Hiring and Onboarding Controls, and Contamination Escalation

By Casey Scott McKay · 2025-10-29

A ten-phase working checklist for building, running, and defending a competitive intelligence function. Phases one and two map who collects and classify every source. Phases three and four set the reverse engineering protocol and the clean room procedure. Phases five and six cover hiring controls and the contamination escalation that must be rehearsed. Phases seven and eight cover the competition-law review point and the constraints on use. Phases nine and ten cover the defensive mirror image and the file that has to exist before anybody asks for it. Each phase closes with a gate.

IP and Technology > Trade Secrets | Checklist | Published 29 October 2025 - Updated 14 March 2026 | Casey Scott McKay - marksy.us

How to use this checklist

Begin from the proposition that organises the whole area: the law does not restrict knowing, it restricts acquiring by improper means and using what was improperly acquired — 18 U.S.C. § 1839, with the claim at 18 U.S.C. § 1836.

That means this is a records discipline rather than a knowledge discipline. Almost everything the business wants to do is lawful; what creates exposure is doing it without being able to show how.

Phases one, two, and six are the minimum for any organisation. Phase three matters where products are analysed. Phase five matters where the company hires from competitors. Phases four, seven, and eight are conditional on the business model. Phases nine and ten apply to everyone eventually.

The doctrinal background is Learning About Your Competitor Lawfully; the operational treatment with worked engagements is Running a Competitive Intelligence Programme; the cluster is assembled in the Competitive Intelligence and Benchmarking Toolkit.

Phase 1. Map who actually collects

[ ] Interview the dedicated team, if one exists, and establish its methods and its records.
[ ] Interview product management, which researches constantly and works under deadline pressure — the combination that produces contamination incidents.
[ ] Interview sales, which is the highest-volume and least-governed channel in almost every organisation and hears competitor pricing, roadmaps, and complaints directly from customers who are comparing offers.
[ ] Interview strategy and corporate development, whose proximity to transactions brings competition-law and clean team questions alongside the trade secret ones.
[ ] Interview engineering about teardowns, which frequently happen without anyone outside the team knowing.
[ ] Identify every external agency and consultant collecting on the company's behalf, and establish whether anyone has asked how they collect.
[ ] Identify expert network usage, which presents the sharpest provenance question in the programme.
[ ] List at least one activity that should stop immediately, because the diagnostic almost always finds one and finding it is what justifies the rest of the work.
[ ] [Gate] The list of collecting functions is written down, and the policy that follows will bind all of them rather than only the specialists.

Phase 2. Classify every source

Green — permitted without escalation

[ ] Published material: websites, collateral, press releases, annual reports, and job advertisements. Hiring patterns disclose product direction and are systematically underused.
[ ] Regulatory and public records: securities filings, patent applications and prosecution histories, litigation dockets, permits, and procurement awards.
[ ] Products bought on the open market, subject to Phase 3.
[ ] Conference presentations, published papers, and trade show material. See Everything on the Stand Is a Disclosure.
[ ] Customers, about their own experience, which is the customer's information about its own affairs.
[ ] Suppliers and distributors, about their own business, subject to any confidentiality they owe.
[ ] Commercial data providers, subject to a provenance review recorded in the register.

Amber — permitted with defined controls

[ ] Web scraping, subject to a terms review and an access analysis. Van Buren v. United States narrowed 18 U.S.C. § 1030, and hiQ Labs, Inc. v. LinkedIn Corp. held that scraping public data does not violate it — but contract and state-law theories survive. See Who Owns the Data, Running or Defending a Data Scraping Program, and the Data Collection and Scraping Risk Checklist.
[ ] Expert networks and consultants, subject to a written instruction, issued before the first call, that the engagement does not extend to any former employer's confidential information.
[ ] Former employees of competitors, subject to Phase 5.
[ ] Mystery shopping, permitted only as an ordinary customer and only without misrepresentation of identity or purpose.
[ ] External agencies, subject to a contractual obligation to identify sources and comply with this policy.

Red — prohibited

[ ] Misrepresentation of identity or purpose, including pretexting a competitor's sales line.
[ ] Inducing anyone to breach a duty, including asking a customer for a document it promised to keep confidential.
[ ] Unauthorised access to systems, premises, or devices.
[ ] Payment for confidential material, however characterised.
[ ] Acceptance of anything from a source you know or suspect has no right to provide it.
[ ] Retention of anything a competitor's employee offers spontaneously that is plainly confidential, which is a contamination event rather than a windfall.
[ ] Note the criminal layer at 18 U.S.C. § 1832 and, where a foreign government benefits, 18 U.S.C. § 1831.

Writing the register

[ ] Use operational language, not statutory paraphrase. A salesperson needs an instruction, not a definition.
[ ] Include examples, because the abstractions do not transfer.
[ ] Name one escalation owner who answers within one working day, since a review that takes a week will be bypassed.
[ ] Set a review cycle, since the register goes stale within a year.
[ ] [Gate] Every source in use has a classification, and every classification has a reason recorded.

Phase 3. Reverse engineering protocol

[ ] Start from the rule. Reverse engineering a lawfully obtained product is a proper means — Kewanee Oil Co. v. Bicron Corp. — and states may not prohibit it for unpatented articles, following Bonito Boats, Inc. v. Thunder Craft Boats, Inc.. The protocol exists to prove that is what happened.
[ ] Record the acquisition before the unit is opened: source, date, price, invoice retained.
[ ] Screen for contractual restriction. Software licences, click-through terms, and enterprise agreements routinely prohibit reverse engineering, and this kills more teardowns than any doctrine does.
[ ] Screen for technical protection measures under 17 U.S.C. § 1201, noting the interoperability exception at § 1201(f) and the triennial exemptions.
[ ] Separate the mechanical work from anything requiring circumvention, and proceed with the first while the second is analysed.
[ ] Record the personnel with dates, so exposure can be traced years later.
[ ] Record the method — tests, instruments, analysis — showing the conclusions derived from the product itself.
[ ] Mark the output as teardown-derived, so it can be distinguished later from information acquired by other routes.
[ ] Address intermediate copying where software is involved, under 17 U.S.C. § 107 with Sega Enterprises Ltd. v. Accolade, Inc., Sony Computer Entertainment, Inc. v. Connectix Corp., and Google LLC v. Oracle America, Inc.. See Taking It Apart, Running a Reverse Engineering or Interoperability Program, and the Interoperability and Reverse Engineering Checklist.
[ ] Keep the test data where any public comparative claim will be made from the results.
[ ] [Gate] Every teardown has an acquisition record dated before the unit was opened.

Phase 4. Clean room procedure

[ ] Decide whether one is justified: a directly competing product, a team staffed from the competitor, foreseeable litigation, or remediation after contamination.
[ ] Use the classic structure. A specification team examines the source material and writes a functional description; counsel reviews it to remove protected expression; an implementation team that has never seen the original builds from the specification alone.
[ ] Keep the personnel list with dates and team assignment.
[ ] Keep the material inventory showing exactly what each team saw.
[ ] Keep the specification with its review history, including what counsel removed.
[ ] Keep the development record showing the implementation team's independent work.
[ ] Prohibit movement between teams, and record that none occurred.
[ ] Explain the cost honestly — duplicated effort, slower delivery, real friction — because a client that does not understand why it is paying will erode the discipline within a quarter.
[ ] [Gate] The clean room has four records, or it is an expensive gesture rather than a defence.

Phase 5. Hiring and onboarding controls

[ ] State the principle to the business. General skill and knowledge belong to the employee; specific confidential information does not. The line turns on specificity, treatment as confidential, and whether material was taken.
[ ] Ask in writing what obligations the candidate is under, and obtain copies of any agreements before the offer is finalised.
[ ] Instruct in writing that no confidential material of a previous employer may be brought or used, and obtain a signed acknowledgement.
[ ] Check devices at onboarding and record the result whether or not anything is found, since the archetypal fact pattern is a departing employee forwarding documents to a personal account.
[ ] Consider a voluntary role restriction where the overlap is direct, and document the decision and reasoning either way.
[ ] Assess inevitable disclosure exposure by jurisdiction, since PepsiCo, Inc. v. Redmond supports injunctive relief in some places and is rejected in others.
[ ] Do not rely on covenants, whose enforceability is narrowing, particularly for lower-wage workers. See Where an Employee Can Go.
[ ] Decline any portfolio or sample containing a previous employer's material, and record that it was declined.
[ ] Document independent development contemporaneously for everything the new hire contributes to, since it cannot be reconstructed later.
[ ] Apply the controls consistently, not only to senior hires, because the person who copied the files is more often mid-level.
[ ] [Gate] Every hire from a competitor in the past year has a complete onboarding control record.

Phase 6. Contamination escalation

[ ] Write the protocol as six steps on one page: stop, isolate, report, assess, dispose, firewall and record.
[ ] Stop means do not read, because every subsequent proceeding turns on who saw what and when.
[ ] Isolate means preserve unread in a location only counsel can reach.
[ ] Report means to one named person, immediately, under a policy everybody has been trained on.
[ ] Assess means with counsel: what is it, who has seen it, is it in fact confidential.
[ ] Dispose means a recorded decision — return with a covering letter is frequently strongest, because it creates a contemporaneous record and retaining the material serves no lawful purpose.
[ ] Firewall means the exposed people leave the relevant project for a defined period, documented with dates.
[ ] Record means the contamination log, which is the document that answers the allegation.
[ ] Rehearse it, since a protocol that exists only on paper fails at the moment it is needed.
[ ] Train the people most likely to receive material first — sales and product, not legal.
[ ] [Gate] The last person to receive an unsolicited competitor document knew what to do without being told.

Phase 7. The competition-law review point

[ ] Route any direct competitor contact through a review, since the trade secret and competition analyses are independent and the second carries heavier consequences.
[ ] Prohibit direct exchange of competitively sensitive information — current or forward-looking pricing, output, costs, customer allocation — regardless of consent, which makes the problem worse rather than better.
[ ] Test trade association benchmarking for aggregation, historicity, anonymisation, participant count, and independent administration.
[ ] Set protocols for standards bodies and joint ventures, which give competitors legitimate reasons to be in a room. See The Promise You Made to the Standards Body.
[ ] Use clean teams in transaction diligence, walled from the operating business, reporting conclusions only — which is what prevents diligence on an abandoned deal from becoming a contamination event. See the IP Due Diligence Toolkit.
[ ] Give both analyses to one escalation owner, so they are not conducted by people who never speak.
[ ] [Gate] No competitor meeting occurs without somebody having decided in advance what may be discussed.

Phase 8. Constraints on use

[ ] Substantiate every comparative claim before publication, since a competitor may challenge it under 15 U.S.C. § 1125 with standing under Lexmark International, Inc. v. Static Control Components, Inc. and industry compliance is no defence following POM Wonderful LLC v. Coca-Cola Co.. See False Advertising Under the Lanham Act and Bringing and Defending a Lanham Act False Advertising Claim.
[ ] Disclose test conditions where they materially affect the result.
[ ] Use the competitor's mark truthfully, in comparative advertising and generally in keyword purchasing, where the reference is necessary and non-suggestive of sponsorship. See Buying a Competitor's Name, Running a Keyword and Paid Search Trademark Program, and the Keyword Advertising, SEO, and Search Marketing Toolkit.
[ ] Do not reproduce copyrightable material — manuals, code, images, marketing copy — since lawful acquisition is not a licence to copy.
[ ] Copy unpatented functional design freely, subject to non-functional trade dress and design registrations. See Trade Dress and the Functionality Doctrine and Three Ways to Own a Shape.
[ ] Run freedom to operate as a separate exercise, since learning of a patented invention from its published patent does not permit practising it.
[ ] [Gate] Nothing goes to market from intelligence work without a use review as well as a collection review.

Phase 9. The defensive mirror

[ ] Assume the company's own product will be torn down, and place genuinely important information where secrecy does not have to carry it — frequently meaning filing rather than withholding.
[ ] Run the exit process: enumeration, access logs, device collection, and a record of what the departing person could reach. See Building a Trade Secret Program That Survives Litigation and the Trade Secret Protection and Departure Checklist.
[ ] Train sales in both directions, since the most common leak in any organisation is a salesperson being helpful to a prospect.
[ ] Flow confidentiality down the supply chain, since the easiest route to a company's specification is its own contract manufacturer. See The Factory That Knows Everything and the Contract Manufacturing IP Checklist.
[ ] Control the trade show stand, which is a disclosure event most companies treat as marketing.
[ ] Enumerate what is claimed as secret, since the reasonable measures required by 18 U.S.C. § 1839 require somebody to have written it down. See Trade Secrets and the DTSA.
[ ] Keep the two sides consistent, since a company that collects aggressively and protects loosely is the one most likely to be sued and least able to counterclaim.
[ ] [Gate] The company could bring the claim it would want to bring, on the records it currently holds.

Phase 10. The file that must exist first

[ ] The source register, classified, in operational language, with an owner and a review date.
[ ] The contamination protocol, one page, with evidence that training occurred and when.
[ ] The contamination log, every incident and its disposition, dated.
[ ] Reverse engineering records for every teardown: acquisition, licence screen, circumvention screen, personnel, method, output.
[ ] Onboarding control records for every hire from a competitor.
[ ] Clean room documentation where one has been used: personnel, materials, specification, development record.
[ ] Agency instructions and contract terms requiring source identification and policy compliance.
[ ] Competition-law review records for direct competitor contact.
[ ] Independent development records for anything a competitor might allege was copied.
[ ] [Gate] All nine exist now, because every one of them is impossible to create retrospectively and each is decisive in the dispute it prevents.

The one-page card for the business

The most-used artefact is not the policy. It is the card that sits with sales and product, and it should say this.

[ ] You may read anything published, buy and examine any product, attend any public event and take notes, ask customers about their own experience, read regulatory and patent filings, and hire people and use their skill.
[ ] You may not pretend to be someone you are not, ask anyone to break a promise made to somebody else, pay for confidential documents, access anything you have not been given access to, or keep material that arrives from a source with no right to send it.
[ ] If something arrives that you should not have, stop reading, do not forward it, and call the named contact today.
[ ] Whatever you collect, write down where it came from.
[ ] If you are unsure, ask — and get an answer within one working day.
[ ] [Gate] The card has been distributed, explained in person, and refreshed since the last sales turnover.

The escalation questions, pre-answered

[ ] "A customer offered to send us the competitor's proposal." Decline; the customer almost certainly owes confidentiality. Ask instead what the customer actually needs, which was the useful information.
[ ] "Can we register for the competitor's webinar?" Yes if registering truthfully; no if it requires claiming to be somebody else.
[ ] "Our consultant used to work there." Permitted for general industry knowledge, prohibited for that employer's confidential information; send the instruction letter before the first call.
[ ] "Can we buy this dataset?" Ask how it was collected, in writing. A vendor that will not answer has answered.
[ ] "A candidate brought their previous employer's material." Decline it, do not copy it, record the declination, continue the process.
[ ] "We already read it." Run the protocol from where you are: identify, isolate, firewall, record. Reading is not fatal; failing to act after reading is.
[ ] "Marketing wants to claim we outperform them by forty per cent." Only with test data supporting the claim as stated.
[ ] "The competitor does this to us." A separate matter, and not a reason to relax the company's own standards — refuse that argument explicitly.
[ ] [Gate] Each of these has a standing answer, so the escalation owner is deciding new questions rather than the same eight repeatedly.

Common failures and their fixes

[ ] The policy that governs only the specialists. Fix: one policy, every collecting function, sales included.
[ ] The agency nobody has asked about. Fix: contractual source identification and an annual assurance.
[ ] The teardown documented afterwards. Fix: acquisition record before the unit is opened.
[ ] The protocol nobody has been trained on. Fix: a rehearsal, not a memorandum.
[ ] The expert network engagement with no written scope. Fix: an instruction letter before the first call.
[ ] The clean room with no records. Fix: personnel and material logs from day one, or do not build one.
[ ] Onboarding controls applied only to executives. Fix: consistency across levels.
[ ] Independent development records started after the letter arrived. Fix: contemporaneous engineering notes as standing practice.
[ ] Two reviews that never meet. Fix: one escalation owner holding both questions.
[ ] [Gate] None of the ten is currently true of this organisation.

The annual review

[ ] Re-run the "who collects" interview, since new functions start without telling anybody.
[ ] Refresh the source register for new tools, providers, and platforms.
[ ] Re-read the agency contracts and obtain a current method assurance.
[ ] Audit the contamination log for incidents handled outside the protocol.
[ ] Re-train sales, which turns over faster than any other function.
[ ] Review teardown records for completeness, since the discipline erodes under delivery pressure.
[ ] Re-check onboarding controls against the past year's competitor hires.
[ ] Reconcile collection against defence, since inconsistency between the two is what makes a company both a likely defendant and a poor claimant.
[ ] [Gate] Nothing in the file is more than twelve months old and unverified.

Three worked applications

The unsolicited document

[ ] Establish who has seen it and when, in writing, while memories are fresh — before anything else.
[ ] Stop circulation and isolate the material with counsel.
[ ] Assess whether it is in fact confidential, since not everything that looks internal is.
[ ] Return it with a covering letter in most cases, because that produces the best contemporaneous record.
[ ] Firewall the recipient from relevant decisions for a defined period, with dates.
[ ] Consider telling the competitor, particularly where the source appears to be one of its own employees — a fact it will eventually discover.
[ ] Ask why the protocol did not operate. Usually the recipient had never been trained, which is a programme finding rather than an individual one.

The teardown with a licence attached

[ ] Record the acquisition and retain the invoice.
[ ] Split the work: mechanical analysis proceeds; firmware analysis waits for the licence and circumvention review.
[ ] Read the click-through terms, which are where most teardowns of connected products actually stop.
[ ] Assess 17 U.S.C. § 1201 and whether the interoperability exception or a current exemption applies.
[ ] Log personnel and method from day one, since a teardown documented from the start is defensible and one reconstructed afterwards is not.
[ ] Decide whether a clean room is needed before any implementation work begins, not after.

The competitor hire into a competing project

[ ] Before the start date: written enquiry, agreement copies, written instruction, signed acknowledgement.
[ ] On day one: device check, documented, result recorded either way.
[ ] In the first week: decide the voluntary role restriction and record the reasoning.
[ ] In the first month: assess inevitable disclosure under the applicable law and scope the role accordingly if the jurisdiction recognises it.
[ ] Throughout: contemporaneous independent development records, and a clean room where the overlap justifies one.
[ ] Expect a letter from the former employer, and note that a company with all of the above answers it in a page while one without them cannot answer it at all.

Scaling the programme

[ ] Minimum for any organisation: Phases 1, 2, and 6, plus the one-page card. An afternoon of work covering the realistic exposure.
[ ] Add Phase 3 where the company buys and analyses competitor products.
[ ] Add Phase 5 where the company hires from competitors into overlapping roles.
[ ] Add Phase 7 where anyone meets competitors in associations, standards bodies, or transactions.
[ ] Add Phase 4 where products compete directly and the risk of a copying allegation is real.
[ ] Everyone eventually needs Phases 9 and 10.
[ ] Record why the excluded phases were excluded, since the business changes and nobody revisits the decision unless the reasoning is written down.
[ ] [Gate] Client and adviser have agreed in writing which phases are in scope and why.

What good looks like

[ ] Somebody can name every function that collects competitor information, including the ones outside the dedicated team.
[ ] Every source in use has a written classification.
[ ] Every teardown has an acquisition record predating the disassembly.
[ ] Every competitor hire in the past year has a complete control record.
[ ] The last contamination incident was isolated within an hour and logged.
[ ] Every comparative claim in market traces to test data.
[ ] The company could bring its own misappropriation claim on the records it holds today.

Seven statements. The organisations that can make all seven are the ones whose competitive intelligence function is an asset rather than a contingent liability, and getting there costs a fraction of the first dispute it prevents.

Sector variations

[ ] Regulated industries publish more than most, making lawful collection unusually productive through approval filings, inspection reports, and licensing records.
[ ] Hardware and consumer products live on teardowns; Phase 3 is effectively the whole programme.
[ ] Enterprise software lives on licence terms and circumvention screens, which makes most competitive analysis contractual rather than technical.
[ ] Professional services have nothing to tear down and everything to lose through hiring; Phase 5 dominates.
[ ] Life sciences publish extensively through regulatory and patent channels, leaving clinical and manufacturing know-how as the sensitive material that moves only with people.
[ ] Financial services carry an additional confidentiality obligation running to customers, constraining what employees may repeat about their own dealings.
[ ] Platform businesses face the scraping question at both ends and are better served by one consistent position than by an opportunistic one.
[ ] [Gate] The programme reflects the sector's actual collection channels rather than a generic template.

If the company is the one complaining

[ ] Establish what was actually taken before writing to anybody, since an overstated demand invites a response that narrows the claim permanently.
[ ] Enumerate the secrets with specificity, because identification is where these claims most often collapse and it is better discovered internally. See Trying a Trade Secret Case.
[ ] Test the reasonable measures record honestly, since information kept on an open share supports a weak claim whatever the defendant did.
[ ] Issue the litigation hold and preserve devices, access logs, and messaging before any external step.
[ ] Assess the forensic picture, since evidence of bulk copying or personal-account forwarding before departure is what carries these cases.
[ ] Decide the outcome actually wanted — return and destruction, a role restriction, a licence, or damages — before choosing the procedural route.
[ ] Assess the counter-risk, because suing on thin facts invites discovery into the company's own collection practices. See Litigating a Trade Secret Misappropriation Claim, the Trade Secret Litigation Checklist, and the IP Discovery and Source Code Review Toolkit.
[ ] [Gate] The company has looked at its own house before opening a dispute about somebody else's.

The evidence habits behind the file

The nine artefacts in Phase 10 are outputs. These are the habits that produce them, and they belong to operating teams rather than to legal.

[ ] Attach a source note to every intelligence output. One line at the top of every competitor analysis saying where the underlying information came from. It costs nothing at the time and it is the record that answers everything later.
[ ] Photograph and date the unit before the teardown begins, with the invoice in the frame if possible.
[ ] Timestamp the contamination log entry at the moment of the report, not at the end of the assessment, because the interval between receipt and isolation is the number that matters.
[ ] Keep engineering notebooks or their digital equivalent as standing practice, since independent development is a factual assertion requiring contemporaneous records and no amount of later testimony substitutes.
[ ] Record onboarding control results even when clean, since a documented clean device check is affirmative evidence and an undocumented one is nothing.
[ ] Log the clean room personnel roster on the day teams are formed, not at project completion.
[ ] Keep the agency's periodic method assurance as a dated document rather than an email thread.
[ ] Retain the test data behind every published comparative claim for as long as the claim runs, plus the limitation period.
[ ] [Gate] Eight habits, each owned by an operating team, each producing one of the artefacts the programme depends on.

A closing note on posture

[ ] Resist the instinct to over-restrict. A programme that prohibits too much gets bypassed, and a bypassed programme produces no records — leaving the company exactly where the programme existed to prevent, with no visibility into what its people are actually doing.
[ ] Lead with permission. Most of what the business wants is lawful, and saying so first buys the credibility needed for the small number of genuine prohibitions.
[ ] Make escalation fast. An answer in a day gets used; an answer in a week gets guessed at.
[ ] Report the programme's activity, including incidents handled well, so the function is not perceived only as an obstacle.
[ ] Remember what the whole thing is for. This is a records discipline, not a knowledge discipline. A company that can document its sources is largely safe; a company that cannot is exposed regardless of how it actually behaved.
[ ] [Gate] The business routes its difficult questions here rather than answering them itself at four o'clock on a Friday.

Six misconceptions to correct in the first training session

[ ] "If it is on the internet, we can use it." Publication defeats secrecy, but the terms under which you accessed it, any technical measure you defeated, and the copyright in the material are separate questions with separate answers.
[ ] "They gave it to us voluntarily." Voluntariness by the wrong person is the problem. A competitor's employee handing over a document has breached a duty, and a recipient who knew or should have known has misappropriated.
[ ] "We only used it for validation, not for the design." A distinction juries find unconvincing and which the discovery record rarely supports. If the material was in the room, it informed the work.
[ ] "Our agency did it, not us." Agency conduct is attributable in practice and frequently in law, which is why the contract must specify the method rather than only the deliverable.
[ ] "It is only benchmarking." Benchmarking with competitors engages competition law regardless of how the trade secret analysis resolves, and the two exposures are independent.
[ ] "We can always argue independent development." Only with contemporaneous records. A company that starts building them after the letter arrives has already lost the argument.
[ ] [Gate] Each misconception has been corrected out loud, with an example, in a room containing sales.

Where the law is moving

[ ] Covenant enforceability continues to narrow, shifting weight onto trade secret claims and the documentation supporting them. Employers relying on covenants should build the secrecy record instead.
[ ] Computer access doctrine has stabilised after Van Buren and hiQ, pushing scraping disputes towards contract and state-law theories rather than federal criminal exposure.
[ ] Expert networks and alternative data providers are drawing scrutiny in adjacent regulatory contexts, making the provenance question harder to leave unasked.
[ ] Machine analysis of public information — satellite imagery, hiring data, app telemetry, shipping records — is expanding what can be inferred lawfully, which makes improper routes less necessary and correspondingly harder to justify.
[ ] Criminal enforcement has hardened, particularly under 18 U.S.C. § 1831, changing the risk calculus for conduct once treated as purely civil.
[ ] [Gate] The programme is reviewed against these trends annually rather than assumed to be static.

Key Authorities at a Glance

The organising distinction between proper and improper means comes from 18 U.S.C. § 1839, with the civil claim at 18 U.S.C. § 1836 and the criminal layer at 18 U.S.C. § 1832 and § 1831. Reverse engineering is protected by Kewanee Oil Co. v. Bicron Corp. and Bonito Boats, Inc. v. Thunder Craft Boats, Inc.; the improper means standard comes from E.I. duPont deNemours & Co. v. Christopher, which asks whether the acquisition falls below generally accepted standards of commercial morality rather than whether it was independently unlawful.

The software overlay is 17 U.S.C. § 107 with Sega Enterprises Ltd. v. Accolade, Inc., Sony Computer Entertainment, Inc. v. Connectix Corp., and Google LLC v. Oracle America, Inc., plus 17 U.S.C. § 1201. Computer access runs through 18 U.S.C. § 1030, Van Buren v. United States, and hiQ Labs, Inc. v. LinkedIn Corp.. Hiring runs through PepsiCo, Inc. v. Redmond, and use through 15 U.S.C. § 1125, Lexmark International, Inc. v. Static Control Components, Inc., POM Wonderful LLC v. Coca-Cola Co., and 15 U.S.C. § 45.

| Authority | Phase | | --- | --- | | 18 U.S.C. § 1839 | 2, 9 — improper means and reasonable measures | | 18 U.S.C. § 1836 | 2 — the federal civil claim | | 18 U.S.C. § 1832 | 2 — criminal theft of trade secrets | | 18 U.S.C. § 1831 | 2 — economic espionage | | E.I. duPont deNemours & Co. v. Christopher | 2 — the operative standard | | Kewanee Oil Co. v. Bicron Corp. | 3 — reverse engineering is proper | | Bonito Boats, Inc. v. Thunder Craft Boats, Inc. | 3 — states may not prohibit it | | 17 U.S.C. § 1201 | 3 — circumvention screen | | 17 U.S.C. § 107 | 3 — fair use for intermediate copying | | Sega Enterprises Ltd. v. Accolade, Inc. | 3 — intermediate copying | | Sony Computer Entertainment, Inc. v. Connectix Corp. | 3 — compatible products | | Google LLC v. Oracle America, Inc. | 3 — interface declarations | | 18 U.S.C. § 1030 | 2 — unauthorised access | | Van Buren v. United States | 2 — narrowed authorisation | | hiQ Labs, Inc. v. LinkedIn Corp. | 2 — scraping public data | | PepsiCo, Inc. v. Redmond | 5 — inevitable disclosure | | 15 U.S.C. § 1125 | 8 — comparative claims | | Lexmark International, Inc. v. Static Control Components, Inc. | 8 — standing | | POM Wonderful LLC v. Coca-Cola Co. | 8 — compliance is no defence | | 15 U.S.C. § 45 | 2 — pretexting and deceptive collection |

Further reading is collected at source classification competitive intelligence, teardown documentation, contamination protocol, clean room records, and competitor onboarding controls.