Trade Secret Litigation Toolkit: Identification, Seizure, Injunctions, and Trial

By Casey Scott McKay · 2025-04-02

A trade secret case is decided by evidence that expires within weeks of the departure that starts it and by an identification document written before anyone knows what was taken. This toolkit runs the matter from the first seventy-two hours through trial and remedies, from every chair, and routes each stage to the Marksy documents that do the work. It opens with forensic preservation and the log retention windows that decide whether a case exists at all, then the three-week assessment that answers whether one should be filed. It covers the notice letter and what it costs, pleading and the parallel claims that survive preemption, and the identification requirement that dominates the first six months and where most plaintiffs lose ground. Later sections cover emergency relief and why seizure is almost never granted, the protective order architecture that makes these cases triable, proving use against an independent development defense, and the three experts every one of these matters requires. It closes with summary judgment, trial presentation, and the remedies — avoided development cost, accelerated market entry, head start injunctions, and the fee exposure that runs against overreaching plaintiffs.

IP and Technology > Trade Secrets | Toolkit | Published 2 April 2025 - Updated 13 May 2025 | Casey Scott McKay - marksy.us

Summary. A trade secret case is decided by evidence that expires within weeks of the departure that starts it and by an identification document written before anyone knows what was taken. This toolkit runs the matter from the first seventy-two hours through trial and remedies, from every chair, and routes each stage to the Marksy documents that do the work. It opens with forensic preservation and the log retention windows that decide whether a case exists at all, then the three-week assessment that answers whether one should be filed. It covers the notice letter and what it costs, pleading and the parallel claims that survive preemption, and the identification requirement that dominates the first six months and where most plaintiffs lose ground. Later sections cover emergency relief and why seizure is almost never granted, the protective order architecture that makes these cases triable, proving use against an independent development defense, and the three experts every one of these matters requires. It closes with summary judgment, trial presentation, and the remedies — avoided development cost, accelerated market entry, head start injunctions, and the fee exposure that runs against overreaching plaintiffs.

Keywords: forensic preservation · log retention · chain of custody · notice letter · dtsa pleading · parallel claims · preemption · trade secret identification · reasonable particularity · temporary restraining order · ex parte seizure · preliminary injunction · inevitable disclosure · protective order tiers · attorneys eyes only · proving use · independent development defense · avoided development cost · head start injunction · bad faith fees

Start Here

Verity Coatings learns on a Tuesday that a process engineer who resigned six weeks ago is now employed by its closest competitor. Four facts emerge over the following days.

The engineer's laptop was reissued to someone else and reimaged.

Server access logs have a forty-five day retention window, which means eleven days remain before the intrusion window rolls off.

The confidentiality agreement the engineer signed does not contain the whistleblower immunity notice, which forfeits exemplary damages and fees against that person.

And the chief executive wants a lawsuit filed this week.

Four facts, one of which is recoverable, two of which are not, and a fourth that would make the first three worse.

This toolkit answers three questions.

Does a case exist? Forensic evidence of taking, secrets that can be described specifically, and reasonable measures that will survive examination. Three weeks of work, before filing.
What can be identified, and how narrowly? Identification dominates the first six months and it is where most plaintiffs lose ground.
How is use proven against an independent development story? The defendant's own records, the timeline, and the absence of a development trail.

If you read only one thing, read Trying a Trade Secret Case. It frames the two structural problems — describe it without destroying it, identify it before you know it — that organize the whole of the practice.

The First Seventy-Two Hours

Preserve devices forensically. The laptop, the phone, and any issued hardware, imaged by an examiner rather than examined by internal IT. Where the device was reissued, recover the prior image from backup before it is overwritten.

Preserve the logs first. Network and file server access, VPN, badge and building access, email including sent items and forwarding rules, cloud sync records, and USB device history. Several have retention windows measured in weeks, and Verity has eleven days.

Do not let internal IT investigate. Examination alters metadata and creates a chain-of-custody problem that is entirely avoidable. Preserve first, analyze second.

Issue the litigation hold to the security team, the owners of affected systems, executives, and anyone who communicated about the departure.

Interview colleagues promptly, with counsel, before recollections settle into a shared account.

Collect every agreement — employment, confidentiality, invention assignment, restrictive covenant, and onboarding acknowledgments — and check for the immunity notice under 18 U.S.C. § 1833(b) while collecting.

Deliverable. A forensic report identifying what was accessed, copied, or transmitted, and when.

Does a Case Exist

Three weeks, before filing, and the answer is frequently no.

Is there forensic evidence of taking? Without it, the case rests on similarity and timing, which is difficult to try and easy to lose. Suspicion is not a claim.

Can the secrets be described specifically? If nobody can articulate what was taken in terms a technical person could evaluate, the identification requirement will be fatal.

Were the measures actually reasonable? 18 U.S.C. § 1839(3). Look from the defendant's chair: information shared with suppliers without agreements, distributed company-wide when a dozen people needed it, or held by departing employees nobody asked to return anything.

Is the information genuinely not public? Search the literature, the patents, competitors' documentation, and the company's own conference presentations first. A plaintiff surprised by its own published paper has spent a great deal to learn something a week of searching would have shown.

What is the realistic remedy? An individual with limited resources and a hiring employer that behaved correctly may yield a modest recovery and a narrow injunction. That can still be worth pursuing for deterrence, knowingly.

What does filing cost beyond fees? It publicizes the existence of valuable information and puts the plaintiff's own security program into discovery.

Is the fee exposure understood? 18 U.S.C. § 1836(b)(3) permits fees against a claim made in bad faith, and cases built on categories rather than secrets are where it is invoked.

The Notice Letter

What it accomplishes. It reminds the individual and the hiring employer of the obligations, creates knowledge supporting a later inducement claim, and occasionally resolves the matter.

What it costs. It triggers the other side's preservation obligation, which prevents spoliation and ends any prospect of catching further deletion.

Send it to both, identifying the agreements and the categories without disclosing the secrets themselves.

Read the response carefully. A competitor that confirms a clean-hire instruction and offers a neutral examination has made a seizure application unavailable and made itself an unattractive target — which is useful information and which changes the case.

Pleading

Plead both statutes. The federal claim under 18 U.S.C. § 1836 and the state claim, because the federal statute does not preempt state law and the elements differ at the margins.

Plead the interstate commerce nexus, easily satisfied and required.

Plead the elements specifically. Independent economic value from not being generally known and not readily ascertainable, reasonable measures, and acquisition, disclosure, or use through improper means or breach of duty. 18 U.S.C. § 1839(5).

Plead acquisition as well as use, because acquisition by improper means is actionable without use and use is the hardest element to prove.

Plead the parallel claims that survive preemption. Breach of contract, breach of fiduciary duty and duty of loyalty, tortious interference against the hiring employer, and copyright where the taken material is code or documents — a claim that is underused and that carries registration and statutory damages advantages.

Be careful with the computer access claim. 18 U.S.C. § 1030 reaches access to areas of a system the person was never entitled to enter, not misuse of files the employee accessed daily.

Do not plead conversion and unjust enrichment on the same facts as the statutory claim; they are usually preempted and dismissed.

Satisfy the pre-filing inquiry. Fed. R. Civ. P. 11.

Identification

This dominates the first six months and it is where cases are won and lost.

Describe secrets, not categories. A specific formulation with its parameters. A process step with its conditions. A customer compilation with the specific data that makes it valuable. "Our manufacturing processes" is not a trade secret.

Test each description against two questions. Can the defendant say whether it has this? Can the defendant show it was already public?

State five things per secret. What it is, precisely enough that a technical person could evaluate it. Why it has value — the independent economic value element, which is the one most often omitted. Why it is not generally known. What measures protected it, element-specific rather than a recitation of general policy. And how the defendant obtained it.

Number them separately so each can be proven or disproven on its own, and attach the supporting exhibits by reference.

Reserve narrowly. A right to supplement on facts learned in discovery, tied to categories the plaintiff has reason to believe were taken. A blanket reservation makes courts distrust the whole document.

Amend once, deliberately, after the defendant's production. Four amendments tell the court the plaintiff never knew what was taken.

Three well-described secrets beat thirty categories, at identification, at summary judgment, and at trial.

Defense side, do not over-win. A plaintiff forced to be specific arrives at trial with a clean claim. The better use of the motion is to establish what is in the case and hold the plaintiff to it.

Emergency Relief

Move quickly or explain the delay. Fed. R. Civ. P. 65. A plaintiff that waits three months will be asked why, and the irreparable harm showing suffers.

Ask for narrow relief. Return of materials, an order against use or disclosure, and preservation. These are granted.

Do not seek an order barring employment outright. It activates every judicial instinct against restraints on mobility and it costs credibility for the rest of the case.

Ex parte seizure is available and almost never granted. 18 U.S.C. § 1836(b)(2) requires extraordinary circumstances, inadequacy of an ordinary injunction because the target would evade it, immediate and irreparable injury, a favorable balance of harms, likelihood of success, actual possession by the target, particularity in describing what is to be seized, and a showing that notice would prompt destruction. A wrongful seizure exposes the applicant to damages and the hearing follows within seven days.

Inevitable disclosure is jurisdiction-specific. Permitted in some states, rejected in others, prohibited by statute in several, and limited by the federal statute to injunctions based on evidence of threatened misappropriation rather than on what a person knows.

Post the required security.

The Protective Order

Negotiate it before producing anything, because a production made under an inadequate order cannot be recalled.

Tiers. Confidential, attorneys-eyes-only, and frequently a third tier for source code or formulations.

Attorneys-eyes-only is the workhorse. Opposing counsel and retained experts see the secrets; the competitor's employees do not.

Prosecution bars, preventing lawyers who see technical secrets from drafting claims in the same area for a period. Negotiated and contested.

Source code terms. Standalone machine, no network, printing limits, inspection location, and access list. Fed. R. Civ. P. 34.

Sealing and courtroom closure. Public redacted filings, sealed originals, and closure of portions of hearings on a good cause showing. Fed. R. Civ. P. 26(c).

Tell the client its executives may be excluded from parts of its own trial. The most common unpleasant surprise in these cases.

Proving Use

Forensic evidence of taking is the strongest material available and it is created by the defendant.

Idiosyncratic similarity. Shared errors, arbitrary parameter values, identical naming conventions, and design choices with no functional reason to match. A dimension wrong in the same peculiar way in both products is worth more than general resemblance.

Timeline compression. A competitor that solved in four months what took the plaintiff four years, with no corresponding change in team or resources.

Absence of a development record. The independent development defense requires documents. A defendant with a finished product and no development trail has a problem; one whose trail begins the week after the hire has a worse one.

Inspection of the defendant's systems, framed narrowly and usually through a neutral examiner.

Spoliation. Fed. R. Civ. P. 37. Sanctions matter more here than in ordinary litigation because the destroyed evidence is exactly what the plaintiff cannot obtain elsewhere, and an adverse inference on use is functionally a verdict.

The Defenses

Independent development. Contemporaneous, dated design records showing the path including the dead ends. The best defense available, and it exists only if someone decided to keep the records.

Public availability. A published patent, a technical paper, a competitor's product, a trade publication, or the plaintiff's own conference presentation. Readily ascertainable by proper means defeats the claim entirely.

Reverse engineering. Expressly proper under 18 U.S.C. § 1839(6), documented with the purchased product and the teardown records.

Failure of reasonable measures, proven from the plaintiff's own practices obtained in discovery.

General skill and knowledge. An employee's accumulated expertise is not the former employer's property, and this argument resonates with juries more than any other.

Limitations. Three years from discovery under 18 U.S.C. § 1836(d), with continuing misappropriation treated as a single claim.

Experts, Summary Judgment, and Trial

Three experts. Technical, addressing similarity, general knowledge, and what independent development would have required. Forensic, addressing what was copied and when, and owning the chain of custody. Damages, addressing loss, unjust enrichment, and the royalty alternative. Fed. R. Evid. 702.

The damages model needs a technical foundation. Avoided development cost requires an expert who can say what development would have taken.

Summary judgment clusters on three questions. Whether the information qualifies, which is won in the library from published sources. Whether the measures were reasonable, which is won from the plaintiff's own documents. And whether there is evidence of use, remembering that acquisition alone may still be actionable. Fed. R. Civ. P. 56.

Partial motions are worth filing. Knocking out fifteen of twenty asserted secrets forces the plaintiff to lead with its best material.

At trial, lead with conduct. Juries understand taking. A forensic timeline showing files copied to a personal drive the week before resignation converts an abstract dispute into a concrete story about a person.

Prepare the plain-English explanations. Why something can be secret while three hundred employees know it. Why reverse engineering is permitted but reading a document is not. Why general expertise is the employee's and a specific formulation is not.

Defense: show the dated development record, and the plaintiff's own conference presentation, and do not overreach on mobility.

Remedies

Actual loss and unjust enrichment, or a reasonable royalty in lieu of both. 18 U.S.C. § 1836(b)(3).

Avoided development cost and accelerated market entry are the distinctive recoveries here, and both are provable from the defendant's own project records — what it would have spent and how long it would have taken to develop independently, and the profit earned during the period it was in the market earlier.

Exemplary damages up to twice the award, plus fees, for willful and malicious misappropriation — forfeited against an employee if the immunity notice was omitted from the agreement, which is Verity's problem. 18 U.S.C. § 1833(b).

Fees against the plaintiff for a claim made in bad faith, which is a real check on overreaching assertions.

Head start injunctions. Many injunctions run for the period the defendant saved rather than forever, restoring the plaintiff to the position it would have occupied. Estimating that period is a technical question and it frequently decides the remedies phase.

Royalty in lieu of injunction where an injunction would be inequitable.

Verity's Four Facts

The reimaged laptop. Recoverable, sometimes. Backup images, shadow copies, and enterprise imaging systems frequently retain the prior state, and a forensic examiner should look before anyone concludes the evidence is gone. Where it is genuinely gone, the case rests on server-side logs and on the competitor's own records.

The eleven-day log window. The most urgent item on the list and the one that determines whether a case exists. Preserve today — authentication, file server access, VPN, cloud sync, email including forwarding rules, and badge records — and preserve them by imaging rather than by exporting a report, because the report is a summary and the underlying data is the evidence.

The missing immunity notice. Not recoverable. 18 U.S.C. § 1833(b) conditions exemplary damages and fees against an employee on notice of the whistleblower immunity being given in the agreement, and its absence forfeits both against this engineer. Fix the template for everyone else today, and reset the client's expectations about remedies now rather than at the damages phase.

The demand to file this week. The worst available idea. A complaint filed before the forensics return produces an identification written from anxiety, exposes the company to a bad-faith fee claim under 18 U.S.C. § 1836(b)(3), and forfeits the chance to learn that the engineer took nothing — which happens more often than clients expect. Three weeks of assessment costs a fraction of one month of litigation.

What to tell the chief executive. That the evidence that will decide the case expires in eleven days and is being preserved today; that whether a case exists will be known in three weeks; and that filing before then makes every outcome worse, including the good one.

The Hiring Employer's Position

The competitor is usually the deep pocket and frequently the party that did nothing wrong. Advising it is a distinct engagement.

Establish the clean-hire record. What the candidate was asked about existing agreements, what they were instructed to bring, and what verification occurred. A written instruction to bring nothing, followed by an attestation and an actual device check, is close to dispositive on intent.

Produce a good development record early. A contemporaneous, dated trail showing the path including the dead ends ends most of these cases. Holding it back to spring at trial wastes the leverage entirely, because settlement value drops the moment the plaintiff reads it.

Segregate immediately on notice. Where the new hire's role overlaps, reassignment while the dispute is pending costs a fraction of the litigation and removes the plaintiff's best equitable argument.

Preserve aggressively. Fed. R. Civ. P. 37 sanctions land harder here than in ordinary cases, and an adverse inference on the question of use is functionally a verdict.

Attack identification and reasonable measures together, because both are testable from documents rather than from testimony and both support summary judgment.

Signal the fee claim early where the plaintiff has asserted secrets it cannot describe.

Watch the tortious interference exposure separately. It requires knowledge of the agreement and intentional inducement, and the evidence is usually internal email from the hiring manager — which is why the instruction not to ask about the former employer's technology has to come from management and be repeated.

And get separate counsel for the individual where interests may diverge, because they frequently do at settlement and the individual's professional reputation is what is at stake.

Cases That Do Not Begin With a Departure

Most of this toolkit assumes an employee left. A meaningful share of these matters do not, and each variation changes the analysis.

The failed transaction. A party received confidential information in diligence, walked away, and later launched something similar. The duty comes from the non-disclosure agreement rather than from employment, the disclosure was deliberate and documented, and identification is easier because the data room index records exactly what was shared. The trap is a residuals clause permitting use of information retained in unaided memory, which many parties sign without reading and which can defeat the claim entirely.

The supplier relationship. Specifications, tooling, or process information shared to enable manufacturing, later used for the supplier's own product. The agreement usually addresses ownership of improvements and tooling, and the dispute is as much about contract interpretation as about misappropriation. The trap is information shared before the agreement was signed.

The joint development relationship. Both parties contributed, one commercialized, and nobody drew the boundary between background and foreground. Both sides have legitimate claims to overlapping information and the case turns on the agreement's definitions rather than on wrongdoing.

The outright intrusion. Improper means is not contested, the criminal provisions become relevant under 18 U.S.C. § 1832 and 18 U.S.C. § 1831, and the seizure remedy is more realistic than in an ordinary departure case.

The acquisition. A company bought a business and received information it should not have, or discovered the target had misappropriated from a third party. Acquisition of a secret knowing it was obtained improperly is itself misappropriation, so the buyer inherits exposure it did not create — and diligence should ask the question.

What stays constant. The preservation discipline, the identification requirement, and the fact that the strongest evidence sits in the other side's records. What changes is where the duty comes from and which document defines it.

Budget and Staffing

The forensics. The first and most important expenditure, and comparatively modest. It buys the answer to whether a case exists.

The three-week assessment. Forensics, agreement review, public-availability search, and a candid look at the company's own reasonable measures. A fraction of one month of litigation and it prevents the most expensive category of matter — the case brought on principle and abandoned at summary judgment.

The emergency motion. Front-loaded, compressed into days, expensive per day, and it sets the tone for everything after.

The identification fight. Several rounds of briefing in most cases, consuming the first half of the schedule.

Discovery. Systems inspection, source code review where relevant, and a moderate document production. Smaller than a patent case and more contentious per page.

Three experts, each with a report and a deposition.

Trial, complicated by sealing logistics and by the need to try a case in front of people who cannot be told everything at once.

Staffing note. These matters need a lawyer who can talk to a forensic examiner and a lawyer who can talk to a jury, and they are not always the same person. The forensic narrative has to survive translation from a technical report into a timeline a juror follows, and that translation is where cases are won.

And a posture note. These disputes carry more emotion than any other category of intellectual property litigation, because they are about a person rather than a document. Counsel earn their fee by keeping the matter about evidence, and the cases that go badly are almost always the ones where that discipline failed in the first month.

Settlement Terms

Most of these cases settle, and the terms are unusual enough to be worth listing.

Return and certification of all copies, under oath, by the individuals who had access. This is the term that makes settlement possible for a plaintiff.

Forensic verification. A neutral examiner confirms deletion from devices and cloud accounts. More expensive than a certification and far more reassuring, and it is frequently what closes the gap.

A time-limited use restriction, framed around the head start rather than around forever. A perpetual restriction on an individual's use of what they know is unenforceable in substance and it stalls negotiations.

Personnel provisions. Reassignment away from the overlapping project for a period. Narrow and enforceable, unlike a bar on employment.

A carve-out for general skill and knowledge, because it is the individual's and a settlement pretending otherwise will not hold.

Mutual releases and non-disparagement. These cases are personal, and the last term is often the one that closes the deal.

Confidentiality of the settlement, with carve-outs for a court and for auditors.

No admission, which matters more here than in ordinary commercial disputes because a professional reputation is at stake.

And a separate agreement with the hiring employer where it is a party, addressing its own conduct going forward, its verification obligations for future hires from the plaintiff, and its indemnity of the individual.

Eighteen Failure Modes

Internal IT investigates first. Metadata altered, chain of custody broken, and the strongest evidence in the case now contestable.

Logs expire. Forty-five days is common and nobody remembers until they are gone.

The device was reissued and nobody looked for a backup image.

Filing before the forensics return, producing an identification written from anxiety and a bad-faith fee exposure.

The immunity notice missing from the agreement, discovered at the remedies stage.

Forty categories identified instead of four secrets.

A description that teaches the secret, sent in a notice letter to a competitor or filed unsealed.

Emergency relief sought at month four, denied on timing rather than merit.

An injunction sought against employment outright.

Production made before the protective order was negotiated.

The computer access count overpleaded and dismissed.

Conversion and unjust enrichment pleaded on the same facts and preempted.

The plaintiff's own conference paper describing the secret.

Reasonable measures defeated by the plaintiff's own documents.

The defendant holding back a good development record until trial, spending a year of fees to make a point available in month three.

A damages model of avoided development cost with no technical foundation.

Thirty secrets taken to trial, so the best one competes with the weakest.

The individual and the hiring employer sharing counsel until their interests diverged at settlement.

What the Jury Hears

These cases are tried to people who have never signed a confidentiality agreement and who arrive with two competing intuitions.

Taking is wrong. An employee who copied files to a personal drive on the way out looks like a thief regardless of what the files contained, and a jury will find its way to a verdict on that basis if given the chance. Forensic evidence of downloads is therefore worth more than its strict legal significance, because it converts an abstract dispute about information into a concrete story about conduct.

People should be able to change jobs. An engineer with fifteen years in an industry cannot unlearn what they know, and a jury shown a former employer trying to prevent someone from working will look for a reason to say no. Plaintiffs who assert forty categories, seek to bar employment, or describe general skill as proprietary activate this intuition and lose cases they should have won.

What confuses juries. That something can be secret while three hundred employees know it. That reverse engineering is permitted but reading a document is not. That accumulated expertise belongs to the person and a specific parameter set does not. Each needs a plain-English explanation prepared in advance, and each is a place where the simpler story wins.

What persuades. A short list of specific secrets a juror can hold in mind. A timeline showing what the defendant could not have done alone. An idiosyncratic similarity with no functional explanation. On the defense side, a development record with dates on it, and the plaintiff's own presentation describing the supposedly secret method.

The instruction that follows. Reduce the case. Three secrets a juror can name beat thirty they cannot, and the reduction should happen at identification rather than in closing.

A Suggested Reading Path

In the first week:

For the underlying doctrine:

For the agreements the case runs on:

Primary Authorities

| Authority | Proposition | |---|---| | 18 U.S.C. § 1836 | Civil action; seizure; remedies; limitations | | 18 U.S.C. § 1839 | Definitions; improper means; reverse engineering | | 18 U.S.C. § 1833(b) | Immunity and required notice | | 18 U.S.C. § 1832 | Criminal theft of trade secrets | | 18 U.S.C. § 1831 | Economic espionage | | 18 U.S.C. § 1030 | Computer Fraud and Abuse Act | | Fed. R. Civ. P. 11 | Pre-filing inquiry | | Fed. R. Civ. P. 26(c) | Protective orders | | Fed. R. Civ. P. 34 | Inspection of systems and code | | Fed. R. Civ. P. 37 | Spoliation sanctions | | Fed. R. Civ. P. 56 | Summary judgment | | Fed. R. Civ. P. 65 | Restraining orders and injunctions | | Fed. R. Evid. 702 | Expert testimony | | 17 U.S.C. § 106 | Copyright in taken code and documents | | 17 U.S.C. § 411 | Registration as a precondition |

Forms and Templates

The Assignment Agreement Template carries the present-tense assignment and invention provisions that determine what the company owns when an employee leaves, and the immunity notice under 18 U.S.C. § 1833(b) belongs in the same document — its absence, as in Verity's case, forfeits exemplary damages and fees against that person and nothing can be done about it afterward. The Cease and Desist Template is the notice letter, and its drafting is a genuine problem: specific enough to establish knowledge, general enough not to teach the secrets to a competitor. The License Agreement Template is the instrument where a case resolves into a use restriction and a payment rather than an injunction. The Portfolio Inventory Template doubles as the trade secret inventory, which is what makes identification take days rather than months.

Related Toolkits and Checklists

For the program that determines whether a case exists at all, the Trade Secret Protection Toolkit covers reasonable measures, onboarding, and exit. For the agreements the claim runs on, the Confidentiality and NDA Toolkit. For departures and mobility disputes, the Employee, Founder, and Mobility IP Toolkit. Where the information is also patentable, the Choosing Your Protection Toolkit runs the comparison. And where a collaboration produced the information, the Patent Licensing and Technology Transfer Toolkit covers the know-how terms.