This article is the second installment in our four-part Trade Secrets at Risk: A Business Owner’s Guide series. Read Part One, and check back each Friday in September for the remaining installments.
When an employee is about to steal your most valuable business information, the signs are usually there.
Most North Carolina businesses miss them, wait too long to act, and, as a result, lose valuable legal options.
What to Watch For
One of the clearest early signals of potential trade secret misappropriation is unusual download or access patterns. If an employee who normally accesses ten files a week suddenly downloads five hundred in a day, immediate attention is necessary and warranted. While most IT systems generate logs that capture this kind of activity, this critical data is only useful if someone is reviewing it.
The single most common smoking gun in North Carolina trade secret litigation is when an employee emails company documents to a personal account. This does not automatically mean misappropriation is underway, as an employee may be saving their own personal documents or working remotely and grabbing something for convenience. However, case after case, this is the first visible sign that information is about to leave your company’s orbit. Simply put, nine times out of ten, this is one of the first red flags you see when a trade secret misappropriation is about to occur.
While unusual download and transfer activity is a common smoking gun, there are numerous red flags to watch out for. Mass deletion of files or wiping of a device before departure tells you someone is cleaning up tracks. A competitor suddenly matching your pricing or technical specifications with unusual precision suggests they may be working from your internal documents. Former employees contacting your customers with apparent insider knowledge, knowing specific details they could only have learned while working for you, is another sign worth investigating without delay.
To round out the list, pay attention for unexplained access to restricted systems or areas.. This is the digital equivalent of someone entering a locked file room without authorization. Each of these on its own may have an innocent explanation, and not all scenarios are the same, a call to a trade secret attorney the same day is well worth it when your company’s competitive edge is at risk.
A Real Case: What the Warning Signs Looked Like
Gavin Parsons, a Raleigh IP litigator at Ward and Smith, described a case from his practice that shows how these signals accumulate. It started hoe it so often does: an employee left the company. As a matter of routine, the company retrieved the laptop and ran a standard scan to review recent activity. However, what they found was far from routine: emails forwarded to a personal account in the days before departure, and evidence that thumb drives had been plugged into the employee’s company laptop and data transferred out. What’s worse, none of it had been flagged while the employee was still on the payroll.
To add another layer of complication and concern, , as the employee had gone to work for a competitor. By the time the original employer had pieced together what happened and engaged counsel, the case had become full-blown federal litigation, and the new employer was pulled in as a defendant for conduct it had not directed and had not known about. Seemingly innocent actions when viewed individually, such as small unexplained things, a hesitation in returning the laptop, and a delay without a good reason, became the thread that unraveled into a serious legal dispute for everyone involved.
The lesson Parsons draws from it: the warning signs were there before anyone was looking for them. The scan that caught the problem only happened because the company had a habit of checking returned devices. Most North Carolina companies do not have that habit, so building it before you need it is a huge part of what makes the difference.
Why Waiting Makes Everything Worse
The statute of limitations under the federal Defend Trade Secrets Act is three years from when the misappropriation was discovered or when it should have been discovered with reasonable diligence. That second part matters more than most people realize. If you see warning signs and do nothing, a court may find that the clock started when you first noticed something, not when you finally decided to act. North Carolina’s Trade Secrets Protection Act has its own limitations period with similar accrual rules. The critical understanding is that waiting does not buy time; it consumes it.
Courts take delay seriously for a second reason tied to injunctive relief. If you go to court seeking an injunction to stop someone from using your trade secrets, the court will examine how long you waited after seeing the red flags. Time and time again, companies are on the receiving end of that scrutiny in federal court, and the outcome is not pleasant: judges who hear that a company waited months to act after seeing clear warning signs are skeptical that the harm was truly urgent, and they deny relief accordingly. The injunction is often the most valuable remedy in a trade secret case, and delay can forfeit it entirely.
Additionally, evidence disappears over time. Electronic data gets overwritten. Devices get wiped or replaced. A digital forensics professional brought in early can preserve evidence that will be gone six months later. Every month you wait makes it harder and more expensive to reconstruct what happened. The cost of an initial consultation and a preliminary forensic review is a fraction of what it costs to engage experts after the fact to recover data that may no longer be recoverable.
What Happens When You Call a Trade Secret Lawyer
Trade secret matters move fast, and clients are usually angry, frightened, and want immediate action. Both reactions are understandable, but there is necessary groundwork before going to court, and skipping it creates real problems.
The first meeting requires the right people in the room: the business owner or lead executive who understands the commercial value of what was taken, someone from IT who can explain how your systems work, and someone from HR who has the personnel file, the employment agreements, and the history of the employee’s access. The IT person is often the most important person in that first conversation, as they will know what access logs exist and what the forensic picture looks like
The HR component matters for a specific legal reason. If the departed employee signed a confidentiality agreement, a breach of that agreement may be easier to prove in court than a full trade secret misappropriation claim. Trade secret claims require meeting all the statutory elements under the DTSA or the North Carolina Trade Secrets Protection Act. A contract breach requires showing a signed agreement and a violation of its terms. Having both options available is better than having only one, and knowing which agreements exist before filing shapes the entire litigation strategy.
After that initial meeting, the process typically moves through a preservation letter to the former employee or their new employer, putting them on notice that litigation is possible and that evidence must not be destroyed. Soon after, initial negotiations begin. Then, if necessary, a motion for a temporary restraining order and preliminary injunction. Courts can act within days when the evidence is clear and the legal team has done the groundwork. What kills urgency in court is appearing unprepared: judges have little patience for attorneys who rush to the courthouse without fully understanding the technology, the value of what was taken, or how it was kept secret.
When Should a North Carolina Business Call an Attorney?
Business owners wait too long because they are not certain misappropriation has occurred, but certainty is not the standard. You do not need certainty, you just need reasonable suspicion. We apply this same standard to our everyday lives: going to the doctor when you notice a symptom is always cheaper than waiting until you are in crisis. If you are seeing two or more of the warning signs described above, that is enough to pick up the phone. If investigation reveals nothing happened, you have bought peace of mind. If something did happen, you have bought time and a substantially stronger legal position. The cost of doing nothing, measured in lost evidence, expired options, and a weakened case, is nearly always higher than the cost of acting on reasonable suspicion.
Trade Secrets at Risk: A Business Owner’s Guide
