Intellectual Property and Trade Secret Theft
5 minutes
5 Questions
Intellectual property (IP) refers to intangible creations of the mind that have commercial value and are protected by law. In the Certified Fraud Examiner (CFE) curriculum, IP falls into four main categories: patents (protecting inventions), copyrights (protecting original works of authorship), trademarks (protecting brand identifiers), and trade secrets (protecting confidential business information). Theft of IP is a significant fraud risk because such assets often represent the majority of a modern organization's value. A trade secret is any information—formulas, processes, customer lists, pricing strategies, source code, or business plans—that derives independent economic value from not being generally known and that the owner takes reasonable measures to keep secret. Unlike patents, trade secrets are not registered and have no expiration, but protection is lost once the information becomes public. Courts typically assess whether the owner implemented reasonable safeguards such as confidentiality agreements, access controls, and employee training. Trade secret theft, often called economic espionage when sponsored by foreign governments, occurs through several methods. Insiders—current or departing employees, contractors, or business partners—are the most common perpetrators, exploiting legitimate access to copy data to personal devices, email, or cloud storage. External methods include hacking, social engineering, pretexting, dumpster diving, and recruiting employees of a competitor. Misappropriation can also arise when a new employer knowingly benefits from secrets brought by a hired worker. In the United States, the Economic Espionage Act of 1996 criminalizes trade secret theft, while the Defend Trade Secrets Act of 2016 provides a federal civil remedy. State laws based on the Uniform Trade Secrets Act also apply. Penalties include fines, imprisonment, injunctions, and damages. Fraud examiners investigating IP theft must identify what was taken, how, and by whom, preserving digital evidence forensically, reviewing access logs, and documenting the protective measures in place. Prevention relies on classification of sensitive data, need-to-know access, exit procedures, monitoring, and a strong ethical culture.
Intellectual Property and Trade Secret Theft: A Complete CFE Exam Guide
Why This Topic Matters
Intellectual property (IP) and trade secret theft sits inside the Fraud Schemes section of the CFE Exam under Theft of Data and Intellectual Property. The ACFE treats it as a major fraud category because for many modern organizations, the most valuable assets are not cash, inventory or equipment but ideas: formulas, source code, customer lists, pricing strategies, research results and manufacturing processes. When these are stolen, the loss is often permanent, difficult to quantify and frequently undetected until a competitor suddenly launches a suspiciously similar product. Fraud examiners are expected to understand what qualifies as protectable IP, how thieves (insiders and outsiders) actually obtain it, what laws apply, how to investigate a suspected theft and, above all, how organizations can prevent it. Exam questions test all of these angles, so this is a topic where conceptual clarity pays off directly in points.
What Intellectual Property Is
Intellectual property refers to creations of the mind that the law protects from unauthorized use by others. The CFE material distinguishes four main categories:
1. Patents – Government-granted exclusive rights to an invention for a limited period, in exchange for public disclosure of how it works. Because a patent is published, the information is not secret; the protection lies in the legal monopoly, not in confidentiality.
2. Copyrights – Protection for original works of authorship (software, manuals, marketing materials, music, literature). Copyright protects the expression of an idea, not the idea itself.
3. Trademarks – Words, names, symbols or designs that identify the source of goods or services. Trademark fraud typically involves counterfeiting or brand infringement.
4. Trade Secrets – Confidential business information that provides a competitive advantage because it is secret. This is the category the exam emphasizes most heavily, because trade secrets are protected only as long as secrecy is maintained, which makes them uniquely vulnerable to theft.
What a Trade Secret Is
Under the Uniform Trade Secrets Act (adopted in some form by most U.S. states) and the federal Economic Espionage Act, information qualifies as a trade secret when it meets two tests:
- It derives independent economic value from not being generally known to, and not readily ascertainable by proper means by, other persons who could obtain value from it; and
- It is the subject of reasonable efforts to maintain its secrecy.
The second element is critical for the exam. If an organization fails to take reasonable protective measures (no confidentiality agreements, no access controls, information posted openly), courts will generally hold that no trade secret exists, and the organization loses its legal remedy. Reasonableness is judged by the circumstances; absolute secrecy is not required, but a demonstrable protection program is.
Common examples of trade secrets include customer lists, pricing and cost data, formulas and recipes, manufacturing processes, source code, business plans, merger and acquisition strategies, supplier terms and research and development results. Even negative information (knowing what does not work) can qualify.
Misappropriation: What Makes It Theft
Trade secret misappropriation occurs when a trade secret is acquired by improper means, or when it is disclosed or used without consent by someone who obtained it through improper means or who owed a duty to keep it confidential. Improper means include theft, bribery, misrepresentation, breach or inducement of a breach of a duty to maintain secrecy, and espionage through electronic or other means.
Equally important, the exam expects you to know what is not misappropriation. Proper means include independent discovery, reverse engineering of a lawfully obtained product, observation of items in public use or display, and gathering information from published literature. A competitor that buys your product and takes it apart has done nothing illegal; a competitor that bribes your engineer for the drawings has.
Key Legislation
Economic Espionage Act of 1996 (EEA) – The principal U.S. federal criminal statute. It creates two distinct offenses:
- Economic espionage (18 U.S.C. 1831): theft of trade secrets intended to benefit a foreign government, instrumentality or agent. This carries the heavier penalties.
- Theft of trade secrets (18 U.S.C. 1832): theft for the economic benefit of anyone other than the owner, with intent or knowledge that the owner will be injured, where the trade secret relates to a product or service in interstate or foreign commerce.
The EEA covers attempts and conspiracies, applies to conduct outside the United States in certain circumstances and allows for forfeiture.
Defend Trade Secrets Act of 2016 (DTSA) – Amended the EEA to create a federal civil cause of action for trade secret misappropriation, allowing owners to sue in federal court, obtain injunctions, damages (including exemplary damages for willful misappropriation) and, in extraordinary circumstances, ex parte seizure orders. The DTSA also contains whistleblower immunity provisions for confidential disclosures to government officials or attorneys.
Uniform Trade Secrets Act (UTSA) – The model state law providing civil remedies (injunctions, actual loss, unjust enrichment, reasonable royalties, punitive damages up to twice actual damages for willful misappropriation, and attorney fees).
Internationally, the TRIPS Agreement (Trade-Related Aspects of Intellectual Property Rights) requires member nations to protect undisclosed information, and many jurisdictions have adopted national trade secret laws modeled on these concepts.
Corporate Espionage vs. Competitive Intelligence
The exam repeatedly tests the line between legal and illegal information gathering. Competitive intelligence is the lawful, ethical collection and analysis of publicly available information about competitors: annual reports, regulatory filings, patents, trade show displays, press releases, job postings, websites, published articles and analyst reports. Corporate (industrial) espionage crosses the line by using improper means: theft, bribery, misrepresentation, electronic surveillance, hacking or inducing employees to breach confidentiality duties.
A useful point from the ACFE material: the vast majority of what a corporate spy needs is available from open sources. Espionage typically proceeds in escalating stages, often described as an intelligence pyramid. The spy begins with open-source collection, moves to human intelligence (talking to employees, suppliers, customers, former staff) and resorts to technical or clearly illegal methods only to fill the remaining gaps. Fraud examiners should therefore recognize that an organization leaking small pieces of information through many channels can be just as exposed as one suffering a single dramatic break-in.
How IP and Trade Secret Theft Works: Who Does It
Insiders are the single greatest threat. Current and former employees, contractors, consultants and business partners already have authorized access and knowledge of where valuable information resides. Typical insider scenarios include:
- Departing employees copying customer lists, designs or code to take to a new employer or start a competing business.
- Disgruntled employees selling information or leaking it for revenge.
- Employees recruited by competitors or foreign intelligence services (sometimes called moles or sleepers), motivated by money, ideology, coercion or ego.
- Careless employees who disclose information inadvertently through conversations, social media, conference presentations or unsecured devices.
Outsiders include competitors, foreign governments, organized criminal groups, professional information brokers and hackers. Outsiders frequently work through insiders rather than around them.
How IP and Trade Secret Theft Works: Methods
The CFE material catalogs a wide range of collection techniques. Expect questions that describe a scenario and ask you to identify the method:
- Social engineering and pretexting – Manipulating employees into revealing information by posing as a colleague, vendor, auditor, researcher, journalist or IT technician. Pretext phone calls are a classic example.
- Fake job interviews and recruiting – Inviting a competitor's employee to interview in order to pump them for details about projects, or placing a spy as a job applicant or new hire.
- Dumpster diving (trash cover) – Retrieving discarded documents, drafts, printouts and media from trash and recycling.
- Surveillance and eavesdropping – Listening devices, wiretaps, hidden cameras, monitoring conversations in restaurants, airports, hotel bars and on airplanes near company offices.
- Computer intrusion – Hacking, malware, credential theft, exploiting unpatched systems and intercepting email.
- Physical intrusion – Tailgating into facilities, posing as maintenance or cleaning staff, after-hours entry, stealing laptops and portable media.
- Trade shows and conferences – Collecting brochures, asking leading questions of engineers at booths, photographing prototypes.
- Bribery and blackmail of employees or vendors.
- Exploiting business relationships – Joint ventures, licensing negotiations, due diligence reviews and vendor relationships used as cover to extract information that is never returned or is misused.
- Observation – Watching shipments, counting cars in the parking lot, monitoring hiring patterns and tracking patent filings to infer strategy.
Favorite Targets
Spies concentrate on departments where the most valuable information is concentrated and controls are often weakest: research and development, marketing and sales (pricing, customer data, product launch plans), manufacturing (processes, costs, capacity), human resources (organizational charts, salary data, identities of key personnel to recruit) and executive offices (strategy, merger plans). Travelling executives and employees working remotely are especially vulnerable.
Red Flags of Insider IP Theft
- Employee accessing or downloading unusually large volumes of files, particularly outside normal duties or hours.
- Use of personal email, cloud storage or USB devices to move company data.
- Sudden interest in projects outside the employee's area.
- Resignation shortly after major data access, or an employee who has accepted a job with a competitor but remains on the job.
- Unexplained wealth or lifestyle changes, contact with competitors, frequent unexplained travel.
- A competitor releasing a product or bid that mirrors confidential plans.
- Working late alone, excessive photocopying or printing, removing documents from the premises.
Preventing IP and Trade Secret Theft
Because trade secret protection depends on reasonable efforts, prevention is both a security issue and a legal necessity. A sound protection program includes:
Identify and classify. Inventory the organization's proprietary information and classify it by sensitivity (for example public, internal, confidential, restricted). You cannot protect what you have not identified.
Limit access on a need-to-know basis. Role-based access controls, segregated networks for R&D, and physical access restrictions to sensitive areas.
Legal agreements. Nondisclosure and confidentiality agreements with employees, contractors, vendors and partners; invention assignment agreements; non-compete and non-solicitation agreements where enforceable; clear IP ownership clauses in contracts.
Policies and training. Written information security policies, acceptable use policies, clean desk policies, rules on discussing business in public places and on social media, and regular employee awareness training on social engineering and espionage tactics.
Employment lifecycle controls. Background checks before hiring; onboarding briefings on confidentiality; monitoring of privileged users; prompt revocation of access at termination; exit interviews that remind departing employees of continuing obligations and recover devices, badges and documents.
Physical security. Visitor logs and escorts, badge systems, secured storage, shredding and secure destruction of documents and media, controls over copiers and printers.
Technical controls. Encryption, data loss prevention (DLP) tools, email and endpoint monitoring, restrictions on removable media, logging and review of access to sensitive repositories, and technical surveillance countermeasures (TSCM) sweeps for listening devices in sensitive areas.
Marking and handling. Labeling documents as confidential or trade secret and controlling distribution strengthens both security and the legal position in later litigation.
Incident response. A plan for rapid investigation, preservation of evidence and legal action when theft is suspected.
Investigating Suspected IP Theft
Fraud examiners should approach these cases with a focus on both proving the theft and preserving the legal status of the trade secret:
- Act quickly; delay can undermine injunctions and signal that the information was not truly valued.
- Involve legal counsel early to maintain privilege and evaluate civil and criminal options.
- Preserve and forensically image computers, phones and storage used by the suspect; review access logs, file transfer records, email, print logs, badge records and cloud activity.
- Document the organization's protective measures to demonstrate reasonable efforts.
- Interview witnesses and, with care, the subject; coordinate with law enforcement where EEA violations are suspected.
- Consider obtaining temporary restraining orders or seizure orders to stop further use or dissemination.
Exam Tips: Answering Questions on Intellectual Property and Trade Secret Theft
1. Memorize the two-part trade secret test. Economic value from secrecy plus reasonable efforts to maintain secrecy. If a question describes information that was never protected, the correct answer is usually that it does not qualify as a trade secret.
2. Know what is legal. Reverse engineering, independent development and gathering publicly available information are proper means. Questions that describe a competitor buying and disassembling a product are testing whether you will wrongly label legal activity as theft.
3. Distinguish competitive intelligence from espionage. The dividing line is the use of improper means (theft, bribery, misrepresentation, breach of confidence, surveillance), not the fact that information was gathered about a rival.
4. Separate the two EEA offenses. Section 1831 requires intent to benefit a foreign government (economic espionage); Section 1832 covers theft for any other economic benefit (theft of trade secrets). If the fact pattern mentions a foreign state, choose economic espionage.
5. Remember the DTSA created a federal civil remedy. Before 2016, civil trade secret claims were primarily state law (UTSA) matters; the EEA was purely criminal.
6. Insiders are the biggest threat. When asked who poses the greatest risk to proprietary information or how most IP theft occurs, the ACFE answer points to employees and other trusted insiders, often departing employees.
7. Open sources come first. If a question asks where a corporate spy obtains most of their information or the first step in an intelligence collection effort, the answer is open or public sources, not illegal methods.
8. Match scenarios to methods. A caller posing as an IT technician is pretexting / social engineering; someone searching the trash is dumpster diving; a competitor inviting your engineers to interview to extract details is a fake job interview; a planted employee is a mole.
9. Prevention questions favor comprehensive programs. The best answer typically involves identifying and classifying information, restricting access on a need-to-know basis, using nondisclosure agreements and training employees, rather than relying on any single control. Exit interviews and prompt access termination are frequently tested as controls for departing employees.
10. Patents are public. Do not confuse patents with trade secrets; an invention cannot be both patented and a trade secret, because patent protection requires disclosure. Trade secret protection can last indefinitely as long as secrecy is maintained, while patents expire.
11. Read for the qualifier. Watch for words like most, best, primary, not and except. Many questions in this area are structured as all-of-the-following-except, listing several improper means alongside one proper means.
12. Think like a fraud examiner, not just a lawyer. When a scenario asks what the organization should do upon suspecting theft, prioritize evidence preservation, involving counsel, acting quickly and documenting protective measures, because these steps serve both the investigation and the organization's legal position.
Quick Review Summary
- IP categories: patents, copyrights, trademarks, trade secrets.
- Trade secret = valuable because secret + reasonable efforts to protect.
- Misappropriation = acquisition by improper means or breach of duty; reverse engineering and independent discovery are lawful.
- EEA 1996: economic espionage (foreign government benefit) and theft of trade secrets; DTSA 2016 adds federal civil action; UTSA governs most state civil claims.
- Competitive intelligence is legal; espionage uses improper means.
- Insiders, especially departing employees, are the greatest risk; most collected information comes from open sources.
- Methods: social engineering, pretexting, fake interviews, dumpster diving, surveillance, hacking, physical intrusion, bribery, exploiting business relationships.
- Prevention: classify information, need-to-know access, NDAs, training, exit interviews, physical and technical controls, document destruction, incident response.
Master these distinctions and you will be well prepared to handle any question the CFE Exam presents on intellectual property and trade secret theft.
Intellectual property (IP) and trade secret theft sits inside the Fraud Schemes section of the CFE Exam under Theft of Data and Intellectual Property. The ACFE treats it as a major fraud category because for many modern organizations, the most valuable assets are not cash, inventory or equipment but ideas: formulas, source code, customer lists, pricing strategies, research results and manufacturing processes. When these are stolen, the loss is often permanent, difficult to quantify and frequently undetected until a competitor suddenly launches a suspiciously similar product. Fraud examiners are expected to understand what qualifies as protectable IP, how thieves (insiders and outsiders) actually obtain it, what laws apply, how to investigate a suspected theft and, above all, how organizations can prevent it. Exam questions test all of these angles, so this is a topic where conceptual clarity pays off directly in points.
What Intellectual Property Is
Intellectual property refers to creations of the mind that the law protects from unauthorized use by others. The CFE material distinguishes four main categories:
1. Patents – Government-granted exclusive rights to an invention for a limited period, in exchange for public disclosure of how it works. Because a patent is published, the information is not secret; the protection lies in the legal monopoly, not in confidentiality.
2. Copyrights – Protection for original works of authorship (software, manuals, marketing materials, music, literature). Copyright protects the expression of an idea, not the idea itself.
3. Trademarks – Words, names, symbols or designs that identify the source of goods or services. Trademark fraud typically involves counterfeiting or brand infringement.
4. Trade Secrets – Confidential business information that provides a competitive advantage because it is secret. This is the category the exam emphasizes most heavily, because trade secrets are protected only as long as secrecy is maintained, which makes them uniquely vulnerable to theft.
What a Trade Secret Is
Under the Uniform Trade Secrets Act (adopted in some form by most U.S. states) and the federal Economic Espionage Act, information qualifies as a trade secret when it meets two tests:
- It derives independent economic value from not being generally known to, and not readily ascertainable by proper means by, other persons who could obtain value from it; and
- It is the subject of reasonable efforts to maintain its secrecy.
The second element is critical for the exam. If an organization fails to take reasonable protective measures (no confidentiality agreements, no access controls, information posted openly), courts will generally hold that no trade secret exists, and the organization loses its legal remedy. Reasonableness is judged by the circumstances; absolute secrecy is not required, but a demonstrable protection program is.
Common examples of trade secrets include customer lists, pricing and cost data, formulas and recipes, manufacturing processes, source code, business plans, merger and acquisition strategies, supplier terms and research and development results. Even negative information (knowing what does not work) can qualify.
Misappropriation: What Makes It Theft
Trade secret misappropriation occurs when a trade secret is acquired by improper means, or when it is disclosed or used without consent by someone who obtained it through improper means or who owed a duty to keep it confidential. Improper means include theft, bribery, misrepresentation, breach or inducement of a breach of a duty to maintain secrecy, and espionage through electronic or other means.
Equally important, the exam expects you to know what is not misappropriation. Proper means include independent discovery, reverse engineering of a lawfully obtained product, observation of items in public use or display, and gathering information from published literature. A competitor that buys your product and takes it apart has done nothing illegal; a competitor that bribes your engineer for the drawings has.
Key Legislation
Economic Espionage Act of 1996 (EEA) – The principal U.S. federal criminal statute. It creates two distinct offenses:
- Economic espionage (18 U.S.C. 1831): theft of trade secrets intended to benefit a foreign government, instrumentality or agent. This carries the heavier penalties.
- Theft of trade secrets (18 U.S.C. 1832): theft for the economic benefit of anyone other than the owner, with intent or knowledge that the owner will be injured, where the trade secret relates to a product or service in interstate or foreign commerce.
The EEA covers attempts and conspiracies, applies to conduct outside the United States in certain circumstances and allows for forfeiture.
Defend Trade Secrets Act of 2016 (DTSA) – Amended the EEA to create a federal civil cause of action for trade secret misappropriation, allowing owners to sue in federal court, obtain injunctions, damages (including exemplary damages for willful misappropriation) and, in extraordinary circumstances, ex parte seizure orders. The DTSA also contains whistleblower immunity provisions for confidential disclosures to government officials or attorneys.
Uniform Trade Secrets Act (UTSA) – The model state law providing civil remedies (injunctions, actual loss, unjust enrichment, reasonable royalties, punitive damages up to twice actual damages for willful misappropriation, and attorney fees).
Internationally, the TRIPS Agreement (Trade-Related Aspects of Intellectual Property Rights) requires member nations to protect undisclosed information, and many jurisdictions have adopted national trade secret laws modeled on these concepts.
Corporate Espionage vs. Competitive Intelligence
The exam repeatedly tests the line between legal and illegal information gathering. Competitive intelligence is the lawful, ethical collection and analysis of publicly available information about competitors: annual reports, regulatory filings, patents, trade show displays, press releases, job postings, websites, published articles and analyst reports. Corporate (industrial) espionage crosses the line by using improper means: theft, bribery, misrepresentation, electronic surveillance, hacking or inducing employees to breach confidentiality duties.
A useful point from the ACFE material: the vast majority of what a corporate spy needs is available from open sources. Espionage typically proceeds in escalating stages, often described as an intelligence pyramid. The spy begins with open-source collection, moves to human intelligence (talking to employees, suppliers, customers, former staff) and resorts to technical or clearly illegal methods only to fill the remaining gaps. Fraud examiners should therefore recognize that an organization leaking small pieces of information through many channels can be just as exposed as one suffering a single dramatic break-in.
How IP and Trade Secret Theft Works: Who Does It
Insiders are the single greatest threat. Current and former employees, contractors, consultants and business partners already have authorized access and knowledge of where valuable information resides. Typical insider scenarios include:
- Departing employees copying customer lists, designs or code to take to a new employer or start a competing business.
- Disgruntled employees selling information or leaking it for revenge.
- Employees recruited by competitors or foreign intelligence services (sometimes called moles or sleepers), motivated by money, ideology, coercion or ego.
- Careless employees who disclose information inadvertently through conversations, social media, conference presentations or unsecured devices.
Outsiders include competitors, foreign governments, organized criminal groups, professional information brokers and hackers. Outsiders frequently work through insiders rather than around them.
How IP and Trade Secret Theft Works: Methods
The CFE material catalogs a wide range of collection techniques. Expect questions that describe a scenario and ask you to identify the method:
- Social engineering and pretexting – Manipulating employees into revealing information by posing as a colleague, vendor, auditor, researcher, journalist or IT technician. Pretext phone calls are a classic example.
- Fake job interviews and recruiting – Inviting a competitor's employee to interview in order to pump them for details about projects, or placing a spy as a job applicant or new hire.
- Dumpster diving (trash cover) – Retrieving discarded documents, drafts, printouts and media from trash and recycling.
- Surveillance and eavesdropping – Listening devices, wiretaps, hidden cameras, monitoring conversations in restaurants, airports, hotel bars and on airplanes near company offices.
- Computer intrusion – Hacking, malware, credential theft, exploiting unpatched systems and intercepting email.
- Physical intrusion – Tailgating into facilities, posing as maintenance or cleaning staff, after-hours entry, stealing laptops and portable media.
- Trade shows and conferences – Collecting brochures, asking leading questions of engineers at booths, photographing prototypes.
- Bribery and blackmail of employees or vendors.
- Exploiting business relationships – Joint ventures, licensing negotiations, due diligence reviews and vendor relationships used as cover to extract information that is never returned or is misused.
- Observation – Watching shipments, counting cars in the parking lot, monitoring hiring patterns and tracking patent filings to infer strategy.
Favorite Targets
Spies concentrate on departments where the most valuable information is concentrated and controls are often weakest: research and development, marketing and sales (pricing, customer data, product launch plans), manufacturing (processes, costs, capacity), human resources (organizational charts, salary data, identities of key personnel to recruit) and executive offices (strategy, merger plans). Travelling executives and employees working remotely are especially vulnerable.
Red Flags of Insider IP Theft
- Employee accessing or downloading unusually large volumes of files, particularly outside normal duties or hours.
- Use of personal email, cloud storage or USB devices to move company data.
- Sudden interest in projects outside the employee's area.
- Resignation shortly after major data access, or an employee who has accepted a job with a competitor but remains on the job.
- Unexplained wealth or lifestyle changes, contact with competitors, frequent unexplained travel.
- A competitor releasing a product or bid that mirrors confidential plans.
- Working late alone, excessive photocopying or printing, removing documents from the premises.
Preventing IP and Trade Secret Theft
Because trade secret protection depends on reasonable efforts, prevention is both a security issue and a legal necessity. A sound protection program includes:
Identify and classify. Inventory the organization's proprietary information and classify it by sensitivity (for example public, internal, confidential, restricted). You cannot protect what you have not identified.
Limit access on a need-to-know basis. Role-based access controls, segregated networks for R&D, and physical access restrictions to sensitive areas.
Legal agreements. Nondisclosure and confidentiality agreements with employees, contractors, vendors and partners; invention assignment agreements; non-compete and non-solicitation agreements where enforceable; clear IP ownership clauses in contracts.
Policies and training. Written information security policies, acceptable use policies, clean desk policies, rules on discussing business in public places and on social media, and regular employee awareness training on social engineering and espionage tactics.
Employment lifecycle controls. Background checks before hiring; onboarding briefings on confidentiality; monitoring of privileged users; prompt revocation of access at termination; exit interviews that remind departing employees of continuing obligations and recover devices, badges and documents.
Physical security. Visitor logs and escorts, badge systems, secured storage, shredding and secure destruction of documents and media, controls over copiers and printers.
Technical controls. Encryption, data loss prevention (DLP) tools, email and endpoint monitoring, restrictions on removable media, logging and review of access to sensitive repositories, and technical surveillance countermeasures (TSCM) sweeps for listening devices in sensitive areas.
Marking and handling. Labeling documents as confidential or trade secret and controlling distribution strengthens both security and the legal position in later litigation.
Incident response. A plan for rapid investigation, preservation of evidence and legal action when theft is suspected.
Investigating Suspected IP Theft
Fraud examiners should approach these cases with a focus on both proving the theft and preserving the legal status of the trade secret:
- Act quickly; delay can undermine injunctions and signal that the information was not truly valued.
- Involve legal counsel early to maintain privilege and evaluate civil and criminal options.
- Preserve and forensically image computers, phones and storage used by the suspect; review access logs, file transfer records, email, print logs, badge records and cloud activity.
- Document the organization's protective measures to demonstrate reasonable efforts.
- Interview witnesses and, with care, the subject; coordinate with law enforcement where EEA violations are suspected.
- Consider obtaining temporary restraining orders or seizure orders to stop further use or dissemination.
Exam Tips: Answering Questions on Intellectual Property and Trade Secret Theft
1. Memorize the two-part trade secret test. Economic value from secrecy plus reasonable efforts to maintain secrecy. If a question describes information that was never protected, the correct answer is usually that it does not qualify as a trade secret.
2. Know what is legal. Reverse engineering, independent development and gathering publicly available information are proper means. Questions that describe a competitor buying and disassembling a product are testing whether you will wrongly label legal activity as theft.
3. Distinguish competitive intelligence from espionage. The dividing line is the use of improper means (theft, bribery, misrepresentation, breach of confidence, surveillance), not the fact that information was gathered about a rival.
4. Separate the two EEA offenses. Section 1831 requires intent to benefit a foreign government (economic espionage); Section 1832 covers theft for any other economic benefit (theft of trade secrets). If the fact pattern mentions a foreign state, choose economic espionage.
5. Remember the DTSA created a federal civil remedy. Before 2016, civil trade secret claims were primarily state law (UTSA) matters; the EEA was purely criminal.
6. Insiders are the biggest threat. When asked who poses the greatest risk to proprietary information or how most IP theft occurs, the ACFE answer points to employees and other trusted insiders, often departing employees.
7. Open sources come first. If a question asks where a corporate spy obtains most of their information or the first step in an intelligence collection effort, the answer is open or public sources, not illegal methods.
8. Match scenarios to methods. A caller posing as an IT technician is pretexting / social engineering; someone searching the trash is dumpster diving; a competitor inviting your engineers to interview to extract details is a fake job interview; a planted employee is a mole.
9. Prevention questions favor comprehensive programs. The best answer typically involves identifying and classifying information, restricting access on a need-to-know basis, using nondisclosure agreements and training employees, rather than relying on any single control. Exit interviews and prompt access termination are frequently tested as controls for departing employees.
10. Patents are public. Do not confuse patents with trade secrets; an invention cannot be both patented and a trade secret, because patent protection requires disclosure. Trade secret protection can last indefinitely as long as secrecy is maintained, while patents expire.
11. Read for the qualifier. Watch for words like most, best, primary, not and except. Many questions in this area are structured as all-of-the-following-except, listing several improper means alongside one proper means.
12. Think like a fraud examiner, not just a lawyer. When a scenario asks what the organization should do upon suspecting theft, prioritize evidence preservation, involving counsel, acting quickly and documenting protective measures, because these steps serve both the investigation and the organization's legal position.
Quick Review Summary
- IP categories: patents, copyrights, trademarks, trade secrets.
- Trade secret = valuable because secret + reasonable efforts to protect.
- Misappropriation = acquisition by improper means or breach of duty; reverse engineering and independent discovery are lawful.
- EEA 1996: economic espionage (foreign government benefit) and theft of trade secrets; DTSA 2016 adds federal civil action; UTSA governs most state civil claims.
- Competitive intelligence is legal; espionage uses improper means.
- Insiders, especially departing employees, are the greatest risk; most collected information comes from open sources.
- Methods: social engineering, pretexting, fake interviews, dumpster diving, surveillance, hacking, physical intrusion, bribery, exploiting business relationships.
- Prevention: classify information, need-to-know access, NDAs, training, exit interviews, physical and technical controls, document destruction, incident response.
Master these distinctions and you will be well prepared to handle any question the CFE Exam presents on intellectual property and trade secret theft.
Test mode:
CFE - Intellectual Property and Trade Secret Theft Example Questions
Test your knowledge of Intellectual Property and Trade Secret Theft
Question 1
Which of the following BEST describes the characteristics that qualify business information for legal protection as a trade secret?
Question 2
Unlike patent protection, trade secret protection lasts for a fixed statutory term, after which the information passes into the public domain even if its owner has kept it secret.
Question 3
A manufacturer restricts access to a product formula and requires staff to sign confidentiality agreements. A competitor buys the product at retail and chemically analyzes it to derive the formula. Separately, a departing engineer emails the formula design notes to a personal account before joining that competitor. A fraud examiner is assessing which conduct amounts to trade secret misappropriation. Which conclusion is BEST supported?
Unlock Premium Access
Certified Fraud Examiner (CFE)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3404 Superior-grade Certified Fraud Examiner (CFE) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CFE: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Intellectual Property and Trade Secret Theft questions
14 questions (total)