Onboarding a Competitor's Employee Without Importing Its Secrets: A Practical Guide

Suppose it is the second Tuesday after a new director of analytics starts at a logistics software company in Columbus. In a team channel she writes, helpfully, "I have a pricing model template from my last job that would save us a month. Want me to drop it in?" Three people react with a thumbs up. Nobody at the company has done anything wrong yet. What happens in the next ten minutes, and whether anyone in that channel knows what to do, may matter more than every form she signed before she arrived.

This guide is about those ten minutes and everything that leads up to them. It assumes you are hiring someone from a competitor and would like to get the person without getting the person's old employer's files, or its lawyers. For the doctrine behind each step, read Hiring From a Competitor: Inevitable Disclosure, Employee Raiding, and the New Employer's Trade Secret Exposure. For a printable task list, use Competitor Hire Trade Secret Checklist: A Practical Checklist. The forms mentioned here are collected in Lateral Hire Toolkit: Candidate Certifications, Onboarding Instructions, and Cease-and-Desist Responses.

The short answer

• Run the hire as a project with an owner. Someone in legal or HR should own a short file for every competitor hire, opened before the offer, because a court may later ask what the company did and when.
• Find the paper early. Noncompetes and nonsolicits hide in equity plans, bonus plans, and sale documents. Learn what binds the candidate, and in which states, before you design the job.
• Interview for ability. Do not accept competitor plans, customer lists, or "first 60 days" documents built on old employer data, even if volunteered.
• Tell the recruit four things in writing: take nothing, delete nothing without advice, recruit nobody, and be truthful about the move. Candor has decided more of these cases than people expect.
• Prevent migration. Most contamination arrives through backup restores, sync clients, personal accounts, and old repositories, not cloak-and-dagger theft. Start with a clean machine, a blocked door, and a written instruction.
• Design the role, then prove the work. Recuse the hire from the most sensitive overlap for a set period, and keep contemporaneous records of independent development.
• If material arrives, freeze it. Stop using it, preserve it, call counsel, and do not delete it. "Cleaning up" is how defensible cases become terminating sanctions.
• Answer a cease-and-desist letter promptly and accurately. Issue a hold the same day, do not claim you have checked what you have not checked, and write for the judge who may later read it.
• If you are the former employer, gather facts before you write and watch the clock. Vague letters do little, inevitable disclosure theories can backfire, and three years can run faster than you think.

Step 1: Assign the work before the first conversation

A competitor hire crosses five functions, and the failures usually occur between them. The recruiter hears something the lawyer never learns about. IT provisions a laptop the way it does for everyone. The manager, thrilled to have an expert, asks how the old shop did it.

Treat outside headhunters as your agents for this purpose. In Comet Technologies USA, Inc. v. XP Power, LLC, No. 23-15709 (9th Cir. July 14, 2026), the evidence included a headhunter's recording of a candidate pitching a ready-made product design, which the recruiter forwarded to the hiring company's top executives. Whatever happens at the retrial the Ninth Circuit ordered, that kind of email is what knowledge looks like. A recruiter's engagement letter should say that no competitor information is to be requested or passed along, and that an offer of such information goes straight to counsel and no further.

Step 2: Screen the candidate and tier the risk

Ask what binds the candidate

Ask early, and ask broadly. A simple form works: "Please list any agreement that may limit your ability to work for us or to contact customers or employees of your current employer, including any employment agreement, confidentiality agreement, offer letter, equity or option agreement, bonus or deferred compensation plan, or sale of business agreement." Ask the candidate to provide the restrictive covenant language itself. If the candidate's agreement says its terms are confidential, have the candidate check with personal counsel before sending it, and accept a description until then.

Do not take "I'm sure there's nothing" at face value. In International Business Machines Corp. v. Johnson, 629 F. Supp. 2d 321 (S.D.N.Y. 2009), the threshold fight was over whether a noncompete had been duly executed at all, and it took expedited discovery and an evidentiary hearing to sort out.

Find the governing law

Identify four places: where the person lives, where the person will work, where the former employer sits, and what the contract says about governing law and forum. They may conflict. California law can apply to a nonresident recruited to work in California under Application Group, Inc. v. Hunter Group, Inc., 61 Cal. App. 4th 881 (1998), and Cal. Bus. & Prof. Code § 16600.5 now declares void covenants unenforceable "regardless of where and when the contract was signed," while New York federal courts have applied New York law to California-based employees, as in Estee Lauder Companies Inc. v. Batra, 430 F. Supp. 2d 158 (S.D.N.Y. 2006). Florida's CHOICE Act moves the other direction for covered senior employees. Washington's statutory ban takes effect June 30, 2027. The FTC's rule is gone, removed from the Code of Federal Regulations by 91 Fed. Reg. 6,507 (Feb. 12, 2026), so state law controls. For more background see Non-Compete Agreements Under Siege: FTC Rulemaking and State Law Developments, remembering that its federal discussion predates the removal.

Tier the risk

A one-page tier decision keeps you from overprocessing a junior hire or underprocessing a senior one.

Those factors are not arbitrary. They track the considerations in EarthWeb, Inc. v. Schlack, 71 F. Supp. 2d 299 (S.D.N.Y. 1999) and Whyte v. Schlage Lock Co., 101 Cal. App. 4th 1443 (2002), which list direct competition, similarity of positions, value of the secrets, the new employer's safeguards, and the employee's forthrightness. A high-tier hire gets counsel's review of the covenants, a written role design, and the full onboarding protocol below. A low-tier hire gets the standard certification and day-one instruction.

Decide who advises the candidate, and who pays

The candidate's interests overlap with yours but are not identical. If something later goes wrong, they diverge, and Waymo LLC v. Uber Technologies, Inc., 870 F.3d 1350 (Fed. Cir. 2017) shows how that can undo privilege: communications with a forensic investigator hired by the acquirer's counsel were not protected because the engineer and the acquirer were found to be adverse. Encourage independent counsel for any candidate with a covenant or sensitive access, and consider paying for it. If your lawyer talks to the candidate, say clearly who the lawyer represents, in the spirit of Upjohn Co. v. United States, 449 U.S. 383 (1981).

Indemnification is a real tool, and a real trade-off.

Do not promise to indemnify trade secret theft. That sentence would read terribly, and such a promise may not be enforceable anyway.

If there is an enforceable covenant

Compare the covenant to the job, not the job title. Your options, in rough order of friendliness:

1. Restructure. Carve named customers, products, or regions out of the role for the restricted period.
2. Wait or bench. Delay the start, or pay the person to do something outside the covenant. In CAE Integrated, the salesperson waited out his covenant before joining the rival, a fact the court recounted in affirming denial of an injunction. See CAE Integrated, L.L.C. v. Moov Technologies, Inc., 44 F.4th 257 (5th Cir. 2022).
3. Have the candidate seek a waiver. The candidate should make that request personally, usually through personal counsel.
4. Proceed and defend. Assess enforceability under local law. An unreasonable covenant may not support interference in Texas under Juliette Fowler Homes, Inc. v. Welch Associates, Inc., 793 S.W.2d 660 (Tex. 1990), and a court in New York may trim instead of voiding.
5. Sue first. A declaratory action under 28 U.S.C. § 2201 can secure a preferred forum, but it also starts the fight. For forum tactics when state and federal claims travel together, see Getting Into or Staying Out of Federal Court: A Practical Guide to Jurisdiction and Removal.

Step 3: Keep the interview on ability

What you may ask

Ask about skills, experience, general methods, public product work, and how the person approaches problems. "Walk me through how you would design a pricing experiment for a marketplace" is a fair question. "What does their pricing model look like?" is not.

What you must not ask or accept

Language Line Services, Inc. v. Language Services Associates, Inc., 944 F. Supp. 2d 775 (N.D. Cal. 2013) is the cautionary tale. A candidate made a presentation to senior executives during the interview process, listing potential top accounts with names and financial data for the competitor's customers. Another sent a vice president a "60 Day Plan" estimating new business before he was hired. Every new hire signed an acknowledgment. The company still spent years explaining why it was not liable, and its "rogue employee" argument did not end the case.

Before each interview, give interviewers a short briefing:

"This candidate works for a competitor. We want to know about their skills, not their employer's business. Please do not ask about customers, pricing, margins, roadmaps, unreleased products, internal tools, code, formulas, or who else there might want to leave. If the candidate starts down that road, stop them politely, say we do not want that information, and let [counsel] know after the interview. Do not write it down."

And give the interviewer a stop script:

"Let me stop you there. We really don't want anything confidential from your current employer, and I don't want to put you in a bad spot. Can we go back to how you think about the problem generally?"

Work samples and take-home tests

Ask for work on a neutral problem you supply. Do not ask for code samples or decks from a current job. A candidate who offers one in the name of showing off should get a polite "no thanks," and the file should be deleted only after asking counsel, since it is now a preservation question if a dispute is foreseeable. If it arrives by email, forward nothing, mark nothing, and call counsel. That sounds excessive for a stray deck, and usually it will end with a simple confirmation that nobody opened it.

Who you are interviewing, and why

Recruiting all your finalists from one rival can be benign, but be able to explain it. The trial court in PepsiCo, Inc. v. Redmond, 54 F.3d 1262 (7th Cir. 1995) drew an inference from the fact that everyone interviewed for the job came from PepsiCo, although the appeals court noted the innocent explanation that the manager knew they were good.

Candidates should not use current employer email, phones, or calendars for your conversations, partly because of the duty of loyalty and partly because that is how the former employer later reads the whole story.

Step 4: Tell the recruit how to leave

Once you are serious, send a short letter, usually with the offer. This is where the hiring company has the most influence over the most damaging evidence: what the person does in the last two weeks. The former employer's security team may be watching those two weeks in detail, and its forensic expert certainly will later. The other side of this process is described in Employee Departure Trade Secret Protection Checklist: A Practical Checklist.

Four instructions

Take nothing. Nothing means paper, files, screenshots, photos of whiteboards, code, customer lists, emails to yourself, and contacts exported from company systems. "My own work" still counts. Personal items are fine. Personal contacts are a gray area governed by the employer's policy and the state's law, so ask.

Do not wipe or delete without advice. This is the instruction most people get wrong, because the natural instinct is to tidy up. In WeRide Corp. v. Kun Huang, 379 F. Supp. 3d 834 (N.D. Cal. 2019), the departing director erased a laptop and reinstalled the operating system, deleted files from another, and cleared browser history, and the court counted all of it as evidence of misappropriation. If the candidate finds old employer material in a personal account or device, the right sequence is to stop, not use it, call personal counsel, and arrange return in a way that leaves a record. The answer is not necessarily "keep everything forever," and it depends on counsel's advice about preservation.

Recruit nobody, solicit nobody, before the last day. An employee may prepare to compete. She may not use her position to move colleagues or clients. See Bancroft-Whitney Co. v. Glen, 64 Cal. 2d 327 (1966), which also explains that a new employer who cooperates in a breach and takes the benefit shares the liability. Even after departure, check any nonsolicit and the state's law.

Be truthful, and resign promptly after accepting. This last one surprises people, but three of the leading opinions turn on it. In PepsiCo, the court noted that the executive told colleagues he had an offer after he had already accepted one. In Whyte, the executive attended confidential meetings after accepting. In Bimbo Bakeries USA, Inc. v. Botticella, 613 F.3d 102 (3d Cir. 2010), the executive stayed nearly three months in the room with the plans after committing to Hostess, and the court relied on that fact. Encourage the candidate to give notice soon after signing, and to step out of sensitive meetings. No one has to volunteer where they are going unless a contract says so, but no one should lie about it.

Sample good leaver paragraph

"We are hiring you for your skills and experience. We do not want and will not use any confidential information belonging to [Current Employer]. Before you leave, please return all of its property and do not copy, forward, download, photograph, or retain any of its documents or data. Please do not delete anything from any device or account to comply with this instruction without first talking to your own lawyer, whom we will pay for up to [$X]. Until your last day, please continue to act loyally toward [Current Employer], do not encourage any colleague or customer to leave, and do not use its systems to communicate with us. Nothing in this letter limits any right you have under law to report a suspected violation of law to a government agency or to your lawyer."

The last sentence nods to the whistleblower protections of 18 U.S.C. § 1833(b), which is not an obligation on you here but is good hygiene, and the immunity notice requirement will matter for your own agreements.

Step 5: Paper the offer

The offer letter becomes an exhibit, so write it for a judge. The essential terms are representations that the candidate has disclosed all restrictions, that the job can be performed without breach, and that the candidate holds no former employer material, along with a covenant not to bring or use any. Add consequences: a false certification is grounds for termination, and it ends any indemnity. The toolkit has clauses for this.

Then be realistic. A form like the one Hostess used in Bimbo Bakeries expressly disclaimed interest in the "know-how" for the product at issue, and the Third Circuit still affirmed the injunction. The paper supports good faith. It does not do the work of the steps below.

Step 6: Prepare the first day before the first day

Give the person a clean start

Contamination in ordinary companies is usually mundane. Walk through it with IT:

• Backups and migration. Do not let anyone restore from a personal backup or run a migration tool from an old machine. A migration utility dutifully moves everything, including folders the person forgot existed.
• Personal accounts on the work machine. Block personal cloud storage sync. Consider prohibiting personal browser profile sign-in, since a synced profile brings bookmarks to old intranet pages and saved passwords with it.
• Password managers. Ask the hire to confirm that any former employer credentials are gone or will not be used. Logging in after access ends is the classic remaining 18 U.S.C. § 1030 problem even after Van Buren v. United States, 593 U.S. 374 (2021), and it hands the plaintiff an easy theory. The access revocation side of this appears in Bringing or Defending a Civil Computer Fraud and Abuse Act Claim: A Practical Guide.
• Developer environments. No cloning personal forks, no importing dotfiles or snippet libraries without review, and no adding a personal GitHub account with old private repositories to company tooling.
• Phones. Corporate apps in a managed container. Contacts syncing is a real source of customer lists.
• AI tools. A personal chatbot account may hold months of prompts containing old code and documents. Instruct the hire not to carry them over and to use only approved tools. See Trade Secrets and Generative AI: Reasonable Measures, Prompt Leakage, and Vendor Terms.
• Removable media. Block USB mass storage by default, and log exceptions.

Deliver the instruction in person

Read the day-one memo aloud, ask questions, and sign it together. Have the manager there. A signed form attached to a 40-page handbook does not persuade anyone. A dated record that a real person sat down with the hire does more.

Teach this one script to every new lateral and every manager:

Hire: "We did it a different way at my last company. I can't talk about how they did it. What I can say is here's how I'd approach it from general principles."

Manager: "Thanks. Please stick to that."

Design the role

Conditions on the job are strongest when they fit what the hire actually knows. A firewall is a set of written limits on what the person works on and who they talk to about it. Some examples:

• A sales leader stays off accounts he personally handled for 6 to 12 months, or a period tied to any covenant.
• An engineer works on the next-generation platform instead of the module he built last year.
• A strategist does not join pricing discussions until the old annual plan is out of date. PepsiCo's injunction ran about five months, a useful data point for how long some plans stay hot.

Consider a wall on both sides. If a team needs to replicate a feature your competitor has, staff it with people who have never worked there, document that, and keep the lateral out. Remember, too, that 18 U.S.C. § 1839(6)(B) says improper means does not include reverse engineering or independent derivation. Those defenses depend on records.

Keep records of independent development

WeRide found misappropriation likely partly because the defendant's capabilities emerged too quickly to be plausible, and in Mallet & Co. v. Lacayo, 16 F.4th 364 (3d Cir. 2021), the plaintiff's theory rested on speed. Keep dated design documents, commit history, test results, vendor quotes, and notes of false starts. If you are moving fast for a legitimate reason (the work was already underway, or you licensed a component), write that down at the time.

Run the 30, 60, and 90 day check-ins

Manager and HR ask three questions: have you been asked for anything from your old employer, have you found any old material on anything you use, and has anything come up that makes you uneasy? Record that the conversation took place. Make it easy to answer yes. A hire who fears being fired for an honest answer will quietly delete, and you have seen what follows.

Step 7: Monitor without overreaching

Security teams can search your own systems for the old employer's name and domain, project code names supplied by the hire, foreign copyright headers in new commits, and bulk uploads in the first weeks. Keep the logs longer than default for the first 90 days. Monitoring should follow a written policy, and several states have notice rules for employee electronic monitoring, including New York (N.Y. Civ. Rights Law § 52-c), Connecticut (Conn. Gen. Stat. § 31-48d), and Delaware (Del. Code tit. 19, § 705). Do not go into the person's personal email or cloud account, even if a password is saved on a company device. That is a separate federal issue under 18 U.S.C. § 2701. If you need to know what is in those accounts, ask, with counsel involved, and get consent in writing.

Step 8: When you discover material came in

This is the moment that decides the most. It might be the logo on a spreadsheet, a colleague's report, or a filename in a commit. Here is the sequence.

The first hour

1. Stop use. Whoever found it stops, does not open more, does not forward, and tells counsel or the designated contact by phone.
2. Do not delete. No one deletes the file, closes the channel, rewrites the Git branch, or asks the employee to "get rid of it."
3. Do not read it to find out if it matters. Every person who reads it becomes a new problem. Scoping happens through a vendor and through file metadata, not by circulating the document.

The first day

Counsel takes over and issues a litigation hold, because the duty to preserve attaches once litigation is reasonably foreseeable, without waiting for a demand. See Micron Technology, Inc. v. Rambus Inc., 645 F.3d 1311 (Fed. Cir. 2011) and Silvestri v. General Motors Corp., 271 F.3d 583 (4th Cir. 2001). The hold must reach IT, including anything automatic. That means email auto-delete, chat retention, device refresh, and the policy that wipes departing employees' laptops. In WeRide Corp. v. Huang, No. 5:18-cv-07233 (N.D. Cal. Apr. 24, 2020), the email auto-delete setting, the move to an ephemeral chat app, and the exit policy of wiping laptops each figured in the record, and the result was terminating sanctions under Rule 37(b) and Fed. R. Civ. P. 37(e), the rule on lost electronically stored information. MC Law's Litigation Hold and Evidence Preservation Checklist: A Practical Checklist sets out the mechanics.

Then isolate without altering:

The first week

Interview the employee, with care. Counsel conducts it, gives an Upjohn warning that counsel represents the company and that the company controls the privilege, and recommends that the employee have separate counsel. The goal is to learn what came in, how, who saw it, and where it went.

Bring in a forensic vendor through counsel. Scope is the main decision: which company devices and accounts, in what order, using what search method. Courts are wary of overbroad imaging, as John B. v. Goetz, 531 F.3d 448 (6th Cir. 2008) shows, and you should apply the same discipline to your own employee's privacy. Understand that a report could be discoverable. In Waymo, the diligence report that everyone thought was protected ended up in the plaintiff's hands. Under Fed. R. Civ. P. 26(b)(3), work product protection depends on purpose and on not sharing with adversaries. A written engagement and limited distribution help.

Assess use. Did the material influence anything? Note how broadly "use" reaches: Oakwood Laboratories LLC v. Thanoo, 999 F.3d 892 (3d Cir. 2021) includes reliance that assists or accelerates research. Separate a stray file nobody opened from a template that became the basis of your own model. The answer will drive everything that follows.

Remediate. If there was use, a clean-room fix is the classic response. In Computer Associates International, Inc. v. Altai, Inc., 982 F.2d 693 (2d Cir. 1992), the company took the tainted programmer off the project, locked up his copy of the code, and had eight programmers who had not worked on the old version rebuild from a description of what the software must do. It took about six months, and the rewritten product withstood a copyright claim, though past liability did not vanish. Engineering teams will object to the cost. Compare it to the injunction alternative.

Decide about the employee. Options include removing the person from the affected work, leave, or termination. A rushed termination can lose you a cooperating witness, while keeping a person who lied looks like ratification. Decide after the facts are in, and make the decision consistent with your written policy.

Decide about disclosure. There is usually no general duty to self-report to the former employer, but there are good reasons to consider it.

One sensible default is to lean toward disclosure, once the scope is known, when material actually reached company systems, and to consider a quieter internal fix when a single file on a single device went unopened and is promptly resolved. Both are judgment calls, neither justifies deletion without a record, and the decision belongs with counsel.

Return, destruction, and the hash exchange

Do not unilaterally destroy material that is the subject of a likely dispute. The safer sequence is image, then segregate, then agree on return or destruction, then certify. Use a neutral vendor where the parties do not trust one another. A hash exchange, in which the former employer's counsel supplies cryptographic fingerprints of the files and a vendor checks for matches without exposing content, avoids either side seeing the other's documents. Ask for a stipulation or a Fed. R. Evid. 502(d) order if a case is pending, so the process does not waive privilege.

Step 9: When the cease-and-desist letter arrives

Sort the letter

Some letters are reminders, stating that a former employee has obligations and asking that you respect them. They allege nothing and need little more than a calm note, or perhaps none. Others accuse. Note what the letter identifies. In Bombardier Inc. v. Mitsubishi Aircraft Corp., 383 F. Supp. 3d 1169 (W.D. Wash. 2019), generic warnings without any specific secret did not establish knowledge. A letter that names files, dates, and devices does. After that kind of letter, the "reason to know" clock has started for anything you keep using. For the general process of reading and answering a demand, see Responding to a Cease and Desist Letter: A Practical Guide.

The same-day list

• Log the receipt time, and send to counsel.
• Issue the hold. Suspend deletion. Include the hire, the manager, the team, HR, recruiters, and IT.
• Tell the hire not to delete anything, and advise personal counsel.
• Do not contact the former employer's employees about it.
• Do not reply yet, unless a very short acknowledgement buys time.

In WeRide, the employee returned a personal laptop to the manufacturer the very day a demand reached his chief collaborator. The court drew the obvious inference.

The investigation before the reply

Check what you can in the time available, and be candid in your letter about what you have and have not done. Two sins are common: overstating ("we have confirmed no information was taken") and overlawyering ("your covenant is void in every respect"). If the letter gives a two-day deadline, respond within it with a holding note and a commitment to a substantive reply on a stated date.

The reply

Match author to author: in-house to in-house, outside counsel to outside counsel. Write for a judicial audience. A good reply does these things:

• States that you take the matter seriously and do not want the former employer's information.
• Describes the instructions you gave, with copies if appropriate.
• Reports what you investigated and what you found, limited to what you truly know.
• Offers specific assurances: role limits, a sworn statement, a forensic protocol.
• Asks the sender to identify the specific information of concern, and to provide hash values or file names.
• Notes that a hold is in place, and asks that the sender preserve too.
• Leaves the door open.

If the demand rests on an unenforceable covenant in a jurisdiction like California, say so briefly, and note the statute. Save the long argument for later.

If an emergency motion comes

Have a declarant ready: someone who can testify to the onboarding steps, role design, and what the investigation found. Key defenses:

• Standard. A plaintiff must clearly show likely success and irreparable harm under Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008). Under Fed. R. Civ. P. 65(d), the order must be specific.
• Identification. Mallet vacated an injunction against competing because the order did not specify the secrets. Insulet Corp. v. EOFlow, Co., 104 F.4th 873 (Fed. Cir. 2024) reversed one for lacking tailored analysis.
• The DTSA employment limit. 18 U.S.C. § 1836(b)(3)(A)(i) bars an order preventing employment and requires evidence, beyond what the person knows, for any condition.
• Inference from success. CAE Integrated rejected the idea that growth proves use.
• Burden. Under the DTSA, Comet puts the burden of showing that information is not readily ascertainable on the plaintiff.
• Timing. Delay undercuts irreparable harm, and Insulet II may give a limitations defense.
• State doctrine. See the jurisdiction table in the companion article.

Consider offering a narrow stipulated order. Courts like them, they cost less than losing, and they let you shape the terms. In Bayer Corp. v. Roche Molecular Systems, Inc., 72 F. Supp. 2d 1111 (N.D. Cal. 1999), periodic discovery substituted for an injunction, and you can propose something like that. The drafting side is in Preliminary Injunction and TRO Application Checklist: A Practical Checklist. Be aware also of the rarely granted ex parte seizure procedure in 18 U.S.C. § 1836(b)(2), limited to extraordinary circumstances.

Settlement terms that work

Certifications from the employee and company; return or destruction under protocol; a role restriction for a stated time; a limited nonsolicit of named customers; a dispute resolution path. Avoid blanket no-hire promises, which raise issues under 15 U.S.C. § 1. Keep any such term narrow and individualized, and get antitrust review. Remember, too, what Deslandes teaches about relying on an ancillary label at an early stage. Deslandes v. McDonald's USA, LLC, 81 F.4th 699 (7th Cir. 2023).

The other chair: evaluating a claim as the former employer

Gather facts first

Before writing anything, secure the departing employee's machine. Do not reissue it. Image it, and preserve mail, cloud, VPN, and repository logs, since many of them age out quickly. Bimbo Bakeries shows how much a good examiner can reconstruct. Note what a pattern proves and what it does not.

Ask the hard questions

1. What exactly is the secret? Could you write it down in a way that separates it from general knowledge? See Trade Secret Identification and Discovery Checklist: A Practical Checklist.
2. What are the reasonable measures? Would your access logs and agreements survive scrutiny?
3. What evidence do you have of acquisition or use? Separate actual copying from fear.
4. What about the new employer? Is there evidence it knew, or had reason to know? Bombardier says recruitment alone is not enough.
5. Where would you sue, and what law helps? Inevitable disclosure may be gone under the DTSA and in many states, so if that is your only theory, reconsider.
6. What do you actually want? Return of files is far cheaper than an injunction against a product.

Watch the clock

Under Insulet Corp. v. EOFlow, Co., No. 25-1807 (Fed. Cir. May 28, 2026), the plaintiff knew former employees had gone to a competitor, saw similar devices at trade shows, and looked at the competitor's website repeatedly. That was enough, in the majority's view, to start the three-year period under 18 U.S.C. § 1836(d), and a very large verdict was erased. Whether or not you agree with the dissent, calendar the date from the moment you see the combination of access and similarity. Treat "we are monitoring the situation" as an event with a deadline.

Write a letter that does something

Name the person, the files or categories, dates, and devices. Say what you want done. Ask for preservation. Avoid threats you do not intend to carry out. Think about whether the letter goes to the employee, the employer, or both, and who should sign. Writing a Demand Letter: The Basics and Drafting a Demand Letter: A Practical Checklist cover the basic structure. A precise letter creates knowledge. A vague one does not.

Avoid the fee trap

18 U.S.C. § 1836(b)(3)(D) allows fees for a bad faith claim. FLIR Systems, Inc. v. Parrish, 174 Cal. App. 4th 1270 (2009) upheld a seven-figure award, and Molon Motor & Coil Corp. v. Nidec Motor Corp., No. 1:16-cv-03545 (N.D. Ill. Nov. 30, 2020) shows a weak inevitable disclosure theory contributing to a bad faith finding. Pleading requires facts under Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007) and honesty under Fed. R. Civ. P. 11. Under Quintara Biosciences, Inc. v. Ruifeng Biztech, Inc., 149 F.4th 1081 (9th Cir. 2025) a DTSA plaintiff need not identify secrets with California-style particularity before discovery begins, but it will need to do so before it gets far.

Be careful about the California problem

If the employee works in California, a letter threatening to enforce a noncompete may itself be a civil violation under section 16600.5. Lead with trade secret facts, not the covenant.

Common mistakes

Treating the certification as the protocol. It is one document. Language Line and Bimbo Bakeries both feature one.

Asking the hire to "clean up." Well-meaning managers say this every week. It can turn a stray file into spoliation.

Reading the material to see how bad it is. Now the manager knows. Let the vendor and counsel scope it by metadata and hashes.

Letting automatic deletion run. WeRide's email server kept deleting, and its exit process kept wiping laptops, long after the company knew better. Your IT defaults do not read hold notices.

Sharing a forensic report with the employee. After Waymo, assume that sharing with someone whose interests are adverse risks waiver.

Using one lawyer for everyone without thinking. A joint representation can be proper at the start and impossible a week later.

Overstating in the reply letter. "We have confirmed nothing was taken" will be Exhibit 1 if a USB device turns up.

Hiring the team through the team. A current employee recruiting colleagues for you is the raid fact pattern. Have each person come to you separately.

Writing excited emails. "They will never catch up now that we have her" reads poorly next to a product launch.

Copying the competitor's roadmap in the name of competitive intelligence. Use public materials and reverse engineering of purchased products, and keep the lateral out of it.

Forgetting independent contractors and acquisitions. Consultants and acquired teams raise the same issues. Waymo began as an acquisition. E.I. du Pont de Nemours & Co. v. Kolon Industries, Inc., 803 F. Supp. 2d 469 (E.D. Va. 2011) arose from a consulting arrangement with a former DuPont employee, and its deletion problems were expensive.

Assuming only big companies get sued. Small competitors are often the most dependent on one hire, and their files look the most similar. Rohm & Haas Co. v. Adco Chemical Co., 689 F.2d 424 (3d Cir. 1982) was a small company case.

Former employers: sending a form letter to every new employer. It proves little. It also trains recipients to ignore you, and in some states it creates its own risk.

Worked hypothetical 1: a regional sales head with no noncompete

Suppose Marisol runs the Midwest territory for Ferncroft Packaging and has been courted by Calder Corrugated, her company's direct rival. She has a confidentiality agreement and no noncompete, and she lives and will work in Illinois.

Risk tier. High. Illinois recognizes inevitable disclosure under PepsiCo and Strata Marketing, Inc. v. Murphy, 317 Ill. App. 3d 1054 (2000), and the role is close to identical. A federal claim would face the DTSA limit, but a state claim would not, in the same way.

Interview. No talk of Ferncroft's customers' pricing. Calder's vice president uses the stop script when Marisol starts to explain Ferncroft's rebate program.

Leaving. Marisol accepts on Friday and resigns Monday. She does not attend Ferncroft's annual planning meeting scheduled for the following week. She leaves her CRM reports where they belong.

Role. For nine months, she runs the Southeast. She does not call on her top 15 former accounts, which are reassigned. Her new manager keeps a note of that.

The letter. Ferncroft's lawyer writes to remind Calder about her obligations. Calder replies in two paragraphs. It describes the role, confirms the instructions, and offers to discuss. No lawsuit follows, or if one does, Calder has a credible distinction from the facts that drove PepsiCo: no concealment, no copying, and a role built around the concern.

Worked hypothetical 2: ten days in a biotech startup

Suppose Larchmere Bio, a 40-person company in San Diego, hired a process scientist from a larger rival three months ago. A letter arrives on a Wednesday afternoon from the rival's outside counsel. It says forensic review shows the scientist uploaded 212 files to a personal cloud account two weeks before leaving. It lists the file names, and it demands return, a written assurance, and a response in five days.

Day 0. General counsel calls outside counsel. A hold goes out by evening, covering the scientist, her group, and IT, and turning off 90-day chat retention. She is told not to delete anything and to get a lawyer, which Larchmere will pay for under its existing commitment. The file list goes to the vendor, not the team.

Day 1. The vendor searches company systems using file names, sizes, and keywords, and asks the rival's counsel for hash values. Outside counsel sends a short holding note, promising a response by Monday. The scientist's lawyer says she uploaded the files to study for a transition and never used them, and that the account is still intact.

Days 2 to 4. The vendor finds two matching files on her company laptop, opened once, and no matches on shared drives. Counsel interviews her with an Upjohn warning. The two documents were an old batch record and a vendor list. A colleague says she referred to "a buffer that worked better." Her assignment is changed that day, away from that process step.

Day 5. The reply goes out, signed by outside counsel. It says Larchmere has no interest in the rival's information, describes the hold, reports what was found on company systems so far, states that the scientist has been reassigned, and proposes a protocol: a neutral vendor images the personal account with the employee's consent, the rival's counsel receives a list of matches, files are returned and then deleted on agreement, and all parties certify.

Days 6 to 10. The rival agrees to the protocol, and asks for a technical review of the buffer point. Larchmere has its process lead, who never worked at the rival, document the buffer's selection from published literature and the company's own experiments, with dates. The review is the delicate part, because Oakwood treats reliance on a secret to speed development as use. If the records had shown that the buffer came from her memory, Larchmere would consider a redesign and a negotiated resolution.

California's rejection of inevitable disclosure in Whyte means the rival's claim depends on what she did with the files, not on what she knows. That helps. But the DTSA and California's statute both reach acquisition, and she uploaded them. Her own exposure may differ from Larchmere's. Her separate lawyer is not a formality.

Costs and trade-offs in brief

Closing the file

At day 90, the owner closes the hire's file with the tier decision, covenant notes, signed documents, check-in notes, role design, and any incident history. Retain that for at least the likely limitations period, which under the DTSA may run three years from discovery. For more on the protections you should have in place for your own information, see Building a Trade Secret Protection Program from Scratch and Building a Trade Secret Protection Program Checklist: A Practical Checklist. For a broader view of filed disputes, see Trade Secret Misappropriation Litigation Under the Defend Trade Secrets Act: A Practical Guide and Managing Discovery in a Trade Secret Case: A Practical Guide.

This guide is general information and is not legal advice for a specific situation. If a letter arrives or a file surfaces, an early call to counsel can usually keep a manageable problem from growing.

Related Documents

Related Articles

• Hiring From a Competitor: Inevitable Disclosure, Employee Raiding, and the New Employer's Trade Secret Exposure: the doctrine, cases, and system-level detail behind each step here.
• Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case: how preservation duties and Rule 37(e) work in depth.
• Non-Compete Agreements Under Siege: FTC Rulemaking and State Law Developments: background on federal and state noncompete policy.
• Tortious Interference and Unfair Competition Claims Between Businesses: the interference theories a raid can trigger.
• Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court: the emergency motion standard you may face.

Related Guides

• Responding to a Cease and Desist Letter: A Practical Guide: a broader approach to demand letters received.
• Trade Secret Misappropriation Litigation Under the Defend Trade Secrets Act: A Practical Guide: what follows if the matter is filed.
• Proving or Defending Against Trade Secret Damages: A Practical Guide: how exposure would be measured.
• Bringing or Defending a Civil Computer Fraud and Abuse Act Claim: A Practical Guide: when computer access claims come along.
• Getting Into or Staying Out of Federal Court: A Practical Guide to Jurisdiction and Removal: forum options when you are sued in state or federal court.

Related Checklists

• Competitor Hire Trade Secret Checklist: A Practical Checklist: the phased task list for this guide.
• Employee Departure Trade Secret Protection Checklist: A Practical Checklist: what the other company is doing at the same time.
• Litigation Hold and Evidence Preservation Checklist: A Practical Checklist: for issuing the hold without gaps.
• Trade Secret Identification and Discovery Checklist: A Practical Checklist: for a former employer defining its secrets.

Related Toolkits

• Lateral Hire Toolkit: Candidate Certifications, Onboarding Instructions, and Cease-and-Desist Responses: certification, offer clauses, day-one memo, quarantine protocol, and letters.
• Trade Secret Protection Toolkit: Building and Defending a Confidentiality Program: confidentiality program forms for your own information.
• Trade Secret Litigation Toolkit: Identification Statements, Two-Tier Protective Orders, and Forensic Protocols: forensic protocols and protective order forms for filed cases.