Intellectual Property (IP) Theft

Intellectual property (IP) theft is a crime that impacts copyrights, trademarks, patents, and trade secret material. This crime occurs when a person knowingly takes, uses, misappropriates, or otherwise steals property that is protected under intellectual property laws.

In the United States, most intellectual property theft is prosecuted as a federal crime. The penalties for intellectual property theft can be serious, including hefty fines and imprisonment.

The FBI and Intellectual Property Theft

With regard to intellectual property rights, the FBI’s objective is to disrupt and shut down individuals and organizations (i.e., international and domestic) that develop or sell counterfeit and pirated goods. The FBI also works to stop anyone who steals, distributes, or makes money from the theft of intellectual property and trade secrets. 

The FBI has a group dedicated to intellectual property theft, the Intellectual Property Rights (IPR) program. The IPR program is comprised of special agents and analysts who have extensive experience in various related areas, including intellectual property, money laundering, organized crime, cybercrime, national security, undercover operations, and data analytics. The IPR investigates theft of trade secrets, counterfeit products, and copyright and/or trademark infringement cases. 

The FBI’s IPR program is headquartered at the IPR Center, where FBI program managers have oversight over the FBI’s dedicated IPR field agents. These agents’ focus includes counterfeit goods that pose a health and safety threat and the theft of trade secrets.

In addition, the IPR Center brings together domestic and international law enforcement and government partners. Through the IPR Center, partners are able to engage with each other to leverage their various resources to interdict, investigate, coordinate referrals, and conduct training. The IPR Center team also engages with non-government organizations to stay up to speed on intellectual property theft issues, hosting events across the country and around the world.

Common Intellectual Property Theft Scenarios

Intellectual property theft results from both external threats and malicious insiders. While these attacks can be both opportunistic and targeted, intellectual property theft is primarily the result of highly-targeted attacks where the perpetrators are seeking specific proprietary information. Both foreign and domestic actors lead these attacks. 

Attack Vectors for Intellectual Property Theft

Human Errors
One of the most common causes of intellectual property loss is human error. Users can accidentally expose intellectual property through technology, such as:

• Collaboration tools (e.g., Asana, Slack)
• Email when IP is sent, because:
  • Email sent to the wrong address 
  • Hidden content in an attachment (e.g., an Excel tab)
  • IP forwarded to a personal email account   
  • Recipient of IP forwards the email
• File sharing (e.g., Dropbox, Google Drive) 
• SMS or instant messaging apps  

Insider Threat
One of the more dangerous intellectual property threats comes from malicious insiders. These people use their insider access to either exfiltrate intellectual property or help an external person or group gain access.

Malware Infiltrations
Malicious software is a common attack vector used to gain access to intellectual property. From trojans to worms, malware remains an effective point of entry for intellectual property theft. These attacks target both organizations’ systems as well as those of service providers. 

Privilege Abuse
An effective approach used for intellectual property theft is privilege abuse. When a user intentionally or accidentally misuses legitimate privileges that they have been granted, it is known as privilege abuse. Despite these privileges being legitimately granted, the privileges can be illicitly used to access intellectual property.

Best Practices for Preventing Intellectual Property Theft

• Define how third-party systems (e.g., business partners, suppliers, customers) must handle and secure intellectual property that is shared with them directly or through applications.  
• Educate employees about how to properly use personal devices when handling intellectual property.
• Educate employees about intellectual property theft and how to defend against it. 
• Have an accurate inventory of intellectual property to help employees understand what needs to be protected and keep this list up to date by regularly checking with those who create IP to ensure that new material is tracked.  
• Identify intellectual property by using watermarks, banners, or labels that make it clear that the information is proprietary.  
• Know where intellectual property is stored and used, paying close attention to printers, copiers, and scanners, which are fertile ground for intellectual property theft.  
• Restrict access to and monitor cloud applications and file-sharing services that are company-managed or part of shadow IT. 
• Secure intellectual property physically and digitally, using data security tools, systems, and procedures as well as locked doors, surveillance, and other techniques.
• Think like a spy; consider ways that spies would be able to gain access to intellectual property, so additional security measures can be put in place. 

Preventing Intellectual Property Theft by Malicious Insiders

• Foster a positive culture
  Create an environment where employees are satisfied with their jobs and work environment.    
• Know employees
  Conduct thorough candidate screenings to determine if an applicant has a criminal record or financial issues that could drive them to commit or facilitate intellectual property theft.
• Provide a mechanism for anonymous reporting
  Empower employees to share any indications that there might be intellectual property theft risks or incidents.    
• Share information about policies
  Have policies for enforcing intellectual property theft defense that are clearly defined and communicated to all employees.

How to Respond to Intellectual Property Theft

There are several ways to respond to intellectual property theft. In cases where it is believed that the incident was accidental or not malicious, the matter can often be handled without taking legal action. Following are the main steps that are often taken in response to intellectual property theft or misuse.

Cease-and-Desist Letter

A cease-and-desist letter is used in cases where it is believed that the incident is either accidental or not malicious. The letter conveys that intellectual property has been misused or taken without permission and that this must stop or legal action will be taken. 

Cease-and-desist letters are not private or confidential. They usually include these items, at a minimum:

• Information about the intellectual property in question  
• Details outlining the type of infringement (e.g., patent, copyright, trademark)
• What actions are expected to solve the issue (e.g., remove material from a website, stop using trademarked material)
• Time period that the offender has to respond 
• Next steps that will be taken if the matter is not addressed 

Mediation

Mediation (a.k.a. alternative dispute resolution or ADR) is commonly used in lieu of taking an intellectual property theft dispute to court. This approach can be relatively quick—scheduled within a few weeks and finished in anywhere from a few hours to several days. 

In addition, mediation is private and completely confidential. Mediation also gives the parties a great deal of control over the process and outcome, unlike courts, where decisions lie in the hands of a judge or jury.

This is often the approach taken when parties to contracts or relationships are involved in intellectual property theft disputes. Examples include trademark licenses, franchises, technology contracts, multimedia contracts, distribution contracts, joint ventures, research and development contracts, employment contracts, mergers and acquisitions where intellectual property assets assume importance, sports marketing agreements, and publishing, music, and film contracts. 

In these cases, mediation offers several advantages in these scenarios, including helping parties:

• Expedite settlement 
• Maintain confidentiality
• Preserve their relationship
• Prevent damage to brands and reputations
• Retain control over the dispute settlement process

Legal Action

The type of intellectual property theft will dictate whether a case is handled a civil case, criminal complaint, or both. Copyright, trademark, and patent infringement can all be handled in civil court. Criminal cases are pursued for intellectual property theft that is clearly malicious and for gain, such as stealing trade secrets. 

In the event that legal action is taken, victims of intellectual property theft can receive varying levels of compensation, including the following.

• An injunction to stop the use of the intellectual property, including removing a product from the market
• Payment for losses
• All or a share of the offender’s profits from the use of the intellectual property
• Attorneys’ fees

Criminal penalties can be severe, including fines ranging from $250,000 to $5 million and/or between three and twenty years in prison. In addition, stolen property, documents, and material can be seized. Perpetrators of intellectual property theft also risk the loss or suspension of operating licenses—personal and business, including disbarment or loss of a franchise.

Recourse Under the Digital Millennium Copyright Act (DMCA)

If the intellectual property theft involves material being posted on the internet, additional avenues for remediation are available under the Digital Millennium Copyright Act (DMCA). In these cases, the takedown notices can be sent directly to the offender’s web hosting and other service providers, such as search engines and ad networks that promote the website. 

The content of the message is similar to a cease-and-desist letter. However, it should also include the URL where the intellectual property is posted and the expected response from the service provider, such as removing the material from circulation, removing it from the index, or taking the site offline.

Suggestions for identifying service providers

• Search WHOIS to find the name of the domain’s registrant, who will often also be the owner 
• Send a DMCA notice to the service provider if the owner’s information is listed as private  
• Pursue a federal court order, which is made possible under DMCA, if the service provider will not facilitate contact with the offender   

Patent Infringement Initial Next Steps

In cases where patented intellectual property has overlaps causing infringement, a Request for Reexamination can be submitted to the United States Patent and Trademark Office (USPTO). The request for reexamination has to be based on the belief that the patent was wrongfully granted, because the intellectual property was already covered in another patent.

Protect the Most Sensitive Data from Theft

All sensitive data must be protected as a breach can lead to fines, reputational damage, and loss of revenue. Intellectual property represents what is arguably the most valuable of all sensitive data. A strong defense against intellectual property theft requires the involvement not just of IT and security teams, but the entire organization—from staff to executives. 

The frequency and costs of intellectual property theft continue to rise. Across all organizations, it is imperative to raise awareness, implement controls, and engage all users in defensive efforts.

Egnyte has experts ready to answer your questions. For more than a decade, Egnyte has helped more than 16,000 customers with millions of customers worldwide.

Last Updated: 21st February, 2022

Get started with Egnyte.

Request Demo