Facilitating the resolution of an intellectual property dispute
KordaMentha Partner Nigel Carson reflects on the work of the Forensic Technology team in uncovering critical electronic evidence that facilitated the resolution of an intellectual property (IP) dispute between two large mining companies in the Federal Court of Australia.
’The two companies involved in this dispute were ACME Mining Limited (ACME) and MACE Limited (MACE).
ACME is an international supplier of technology and services for the mining industry with a footprint in Australia. Among other things, it manufactures the massive crushing and grinding mills that enable the separation and extraction of ores and minerals.
MACE is also a supplier of technology and services for the mining industry. Until recently it operated by sourcing the mills from third party manufacturers, including ACME, and then supplying them to its customers - the large mining companies.
For several years, ACME’s Research and Engineering division had been developing schematic drawings for the grinding and crushing mills. These schematic drawings represent a significant material investment and value to ACME. In the hands of a competitor, the schematic documents could also reduce a large barrier to market entry. The drawings are stored on ACME’s file server in a proprietary format, but employees authorised to local computers also had access to them and could potentially copy them on to a portable storage device, such as a USB key.
There were several warning signs that indicated that ACME’s drawings were being leaked:
- ACME had been contracted to supply grinding and crushing mills to MACE
- ACME was surprised when MACE, without notice, advised that it intended to manufacture the mills itself
- this development followed shortly after MACE had recruited former senior employees of ACME
- the former senior employees of ACME were known to have had access to the schematic drawings
- ACME was very concerned schematics would be used by, or disclosed to MACE.
Concerned by these warning signs, ACME’s Board of Directors engaged lawyers who valued the power of using computer forensics techniques to preserve and analyse potential electronic evidence. This included the notebook computers previously used by the former senior employees.
KordaMentha Forensic Technology experts went onsite at ACME’s head office where notebook computers had been secured. Our team used specialist tools to create a forensic image, giving us an exact verifiable copy of each computer hard drive. A forensic image preserves not only active and accessible data but also deleted data that may be recoverable in part or whole - even where the computer’s hard drive has been formatted. Using forensic analysis of that data, we identified a great deal of electronic evidence to support our contention that the former employees had been colluding to move to MACE for some time.
Forensic analysis of multiple forensic artefacts, including shortcut link files, recently accessed documents and Windows system restore snapshots, also facilitated the creation of a clear timeline of each former employee’s activities in the period prior to their departure.
We were able to corroborate multiple forensic artefacts on both the former employees’ notebook computers and the ACME File Server to show that former employees copied a large amount of schematic drawings from ACME’s File Server to USB keys. As part of this process, we identified the specific make, model and serial number of each USB key.
On the basis of this electronic evidence, ACME’s lawyers successfully applied to the Court for a Search Order (also known as an Anton Piller Order) at each of the former employees’ homes to seek the specific USB keys and any additional related electronic evidence.
Through these legal searches, the KordaMentha team obtained a significant amount of electronic evidence. This was preserved from storage devices including many of the USB keys that had earlier been identified as those used to store the schematic drawings from ACME’s File Server.
The dispute settled for a substantial sum and the client advised that this was largely attributed to the timely and comprehensive electronic evidence put forward by KordaMentha’s Forensic Technology experts in support of ACME’s claim.’