Trade Secret Theft Client Poaching Demand Letters
The DTSA (18 U.S.C. § 1836) provides a private federal cause of action for trade secret misappropriation. Key requirements:
- Trade secret must be related to a product or service used in interstate or foreign commerce
- Allows for ex parte seizure orders in extraordinary circumstances (rare but powerful)
- Remedies include injunctive relief, damages (actual loss or unjust enrichment), and exemplary damages up to 2× for willful/malicious misappropriation
- Attorneys’ fees available for willful/malicious conduct or bad faith assertions
California Civil Code § 3426 et seq. defines and protects trade secrets under state law:
| Element | Requirement |
|---|---|
| Definition of trade secret | Information (technical or business) that: (1) derives independent economic value from not being generally known, and (2) is subject to reasonable efforts to maintain secrecy |
| Misappropriation | Acquisition by improper means OR disclosure/use in breach of a duty to maintain secrecy |
| Reasonable protective measures | NDAs, password protection, access controls, “need-to-know” policies, confidentiality markings, exit procedures |
| Remedies | Injunction, damages (actual loss or unjust enrichment), exemplary damages (up to 2×), attorneys’ fees for willful/malicious conduct |
Even in California (which strongly protects employee mobility post-employment), employees owe a duty of loyalty while still employed:
- Cannot actively divert clients or opportunities to a competing business they’re planning to start
- Cannot use employer’s resources (time, equipment, contacts) to build a competing venture
- Cannot download or copy confidential information in anticipation of departure
- Cannot recruit colleagues to leave while still employed (California allows post-departure recruitment, but not while on the payroll)
Violation of the duty of loyalty can support claims for breach of fiduciary duty, even without a written contract.
California’s strong anti-noncompete policy (Bus. & Prof. Code § 16600) means customer non-solicitation agreements are generally unenforceable for regular employees. However, client poaching is still actionable when it involves:
| Scenario | Actionable? | Legal Basis |
|---|---|---|
| Using trade secret customer lists or confidential business info | ✅ Yes | CUTSA/DTSA misappropriation |
| Soliciting clients while still employed | ✅ Yes | Breach of duty of loyalty |
| Using employer’s confidential pricing/margin data to undercut | ✅ Yes | Trade secret misappropriation |
| Downloading CRM data, proposal templates, client files before leaving | ✅ Yes | Trade secret theft, breach of contract |
| Competing for clients after departure using general knowledge | ❌ No (generally) | Protected by § 16600—employees can compete |
| Non-solicit in sale-of-business context (owner selling equity) | ✅ Yes (narrow exception) | Bus. & Prof. Code §§ 16601, 16602 |
- The exodus: Employee downloads entire CRM database, emails it to personal account, resigns, and starts competing business with former clients within weeks
- The slow build: Employee spends final 3–6 months using work time to build competing business, recruit colleagues, and line up clients to transition immediately upon departure
- The poacher: Former employee contacts clients using confidential contact info, pricing, and project details they copied before leaving
- The team defection: Multiple employees coordinate departure, taking client lists, templates, source code, and proprietary processes to new competing venture
Document exactly what confidential information or trade secrets the former employee or contractor accessed, copied, or used:
| Type of Information | Examples | How to Prove It Was Taken |
|---|---|---|
| Customer/client lists | Contact info, purchasing history, preferences, account managers | System logs showing CRM exports, emails to personal accounts, USB transfers |
| Pricing & margins | Price lists, discount structures, cost data, profitability by client | Downloads of pricing spreadsheets, screenshots, printed materials |
| Source code & technical data | Proprietary code, algorithms, databases, technical specs | Git logs, GitHub commits to personal repos, file downloads |
| Business strategy | Roadmaps, marketing plans, supplier lists, go-to-market strategies | Document downloads, emails forwarding decks/presentations |
| Templates & work product | Proposal templates, pitch decks, SOPs, training materials | File copies, cloud syncing to personal Dropbox/Google Drive |
To qualify as a “trade secret,” you must show you took reasonable steps to maintain secrecy:
- NDAs: Did the employee/contractor sign a confidentiality or non-disclosure agreement?
- Access controls: Password protection, role-based permissions, VPN requirements, two-factor authentication
- Confidentiality markings: Documents labeled “Confidential,” “Proprietary,” or “Trade Secret”
- Need-to-know policies: Restricted access to sensitive data on a business-need basis
- Exit procedures: Return-of-property checklists, exit interviews, certification of data deletion
- Employee handbook/policies: Written policies prohibiting unauthorized copying or disclosure
If you had no protective measures, courts may find the information wasn’t a protectable trade secret. However, even minimal measures (NDAs + password protection) can suffice if the information derives real value from secrecy.
Gather forensic evidence showing the former employee/contractor took or used your trade secrets:
| Evidence Type | What to Collect |
|---|---|
| System logs | IT audit logs showing file downloads, email forwards, cloud uploads, USB connections, printing activity |
| Email forensics | Emails to personal accounts, attachments with confidential files, messages coordinating client transitions |
| Device imaging | Forensic snapshots of company laptops/phones before return (if you can legally access them) |
| Third-party reports | Clients reporting contact from former employee using your confidential info, LinkedIn messages, competitor intelligence |
| Comparative analysis | Side-by-side comparison of your materials vs. competitor’s (e.g., identical proposal language, pricing structures, code snippets) |
| Witness statements | Co-workers who observed suspicious behavior, heard plans to take clients, or saw data being copied |
Calculate your actual losses and unjust enrichment to determine the stakes:
- Lost revenue: Clients who defected to the former employee’s new venture, using your confidential information
- Unjust enrichment: Value the former employee gained by using your trade secrets (e.g., faster time-to-market, lower customer acquisition costs)
- Development costs avoided: What it would have cost them to develop the information independently (e.g., years of R&D, customer relationship building)
- Competitive advantage lost: Diminished market position, eroded pricing power, loss of first-mover advantage
Leverage factors:
- Strength of forensic evidence (smoking-gun emails, clear download logs)
- Egregious conduct (mass data theft, coordinated team departure, lying during exit interview)
- Availability of injunctive relief (can you stop ongoing use and prevent further damage?)
- Former employee’s financial resources and reputational sensitivity
Your cease-and-desist letter should accomplish multiple goals simultaneously:
- Immediate cessation: Stop all use and disclosure of specific categories of confidential information
- Return and destruction: Require return of all misappropriated materials and certification of deletion from all devices
- Disclosure of recipients: Identify everyone to whom the information was disclosed (new employer, clients, partners)
- Preservation of evidence: Prohibit deletion of emails, wiping devices, or altering cloud data
- Customer de-solicitation: Demand they cease contact with specific clients (when supported by trade secret theory, not just noncompete)
- Create settlement leverage: Signal serious intent and exposure to injunctive relief and damages
Choose your tone strategically based on the relationship and desired outcome:
| Approach | When to Use | Language Style |
|---|---|---|
| High-threat | Egregious theft, ongoing harm, former employee unresponsive or combative | “We will seek emergency injunctive relief, exemplary damages, and attorneys’ fees if you do not comply within 48 hours.” |
| Cooperative | Valued former employee, potential for negotiated resolution, relationship preservation desired | “We believe this situation can be resolved amicably. We’re prepared to work with you to unwind the use of confidential information without litigation.” |
| Hybrid | Most common—firm on legal rights but open to settlement | “While we are prepared to pursue all available legal remedies, we would prefer to resolve this matter promptly and without the cost of litigation.” |
- Identification of trade secrets: Be specific—”client contact information, pricing data, and proposal templates,” not just “confidential information”
- Evidence of misappropriation: Reference specific acts (e.g., “On [date], you downloaded 15,000 customer records to a USB drive”)
- Contractual and statutory violations: Cite the NDA, employment agreement, and CUTSA/DTSA
- Immediate demands:
- Cease all use and disclosure
- Return all materials (physical and electronic)
- Certify deletion from personal devices and cloud storage
- Identify all recipients of the information
- Preserve all evidence (no deletion or destruction)
- Deadline: Typically 48 hours to 7 days depending on urgency
- Consequences of non-compliance: TRO/preliminary injunction, damages, exemplary damages (2× actual), attorneys’ fees
- Settlement opening (optional): “We are willing to discuss a resolution that avoids litigation if you take immediate corrective action.”
Dear [Former Employee/Contractor]:
I represent [Company Name] in connection with your misappropriation of trade secrets and confidential business information in violation of your Confidentiality Agreement dated [date], the California Uniform Trade Secrets Act (Civil Code § 3426 et seq.), and the federal Defend Trade Secrets Act (18 U.S.C. § 1836 et seq.).
Our investigation has revealed that, prior to your resignation on [date], you engaged in a systematic effort to misappropriate [Company]’s proprietary information, including:
- Customer contact information, purchasing history, and account details for over [X] clients;
- Confidential pricing structures, margin data, and discount schedules;
- Proprietary proposal templates, marketing materials, and business development strategies; and
- [Other specific trade secrets].
Specifically, our IT audit logs show that on [dates], you:
- Downloaded [X] files containing customer data to a USB drive;
- Forwarded [Y] emails containing confidential pricing information to your personal email account ([email]);
- Copied [Z] proprietary documents to your personal Dropbox account; and
- Accessed and exported the entire CRM database on [date], three days before your resignation.
You have since used this misappropriated information to solicit [Company]’s clients and compete directly against us in violation of your legal obligations.
IMMEDIATE DEMANDS:
To avoid immediate legal action, you must comply with the following within 48 hours of receipt of this letter:
- Cease and desist from all use, disclosure, or dissemination of [Company]’s trade secrets and confidential information.
- Return all confidential materials, documents, files, and data in any form (physical, electronic, cloud-based) to [Company] at [address].
- Certify in writing that you have:
- Deleted all copies of confidential information from your personal devices (computers, phones, tablets, USB drives, external hard drives);
- Deleted all copies from personal cloud storage accounts (Dropbox, Google Drive, iCloud, etc.);
- Deleted all emails containing confidential information from personal email accounts; and
- Not disclosed any confidential information to third parties.
- Identify all individuals and entities to whom you disclosed [Company]’s confidential information, including your new employer, clients, business partners, and investors.
- Preserve all evidence related to your access, use, and disclosure of [Company]’s information. Do not delete, alter, or destroy any documents, emails, text messages, or electronic files.
- Cease all contact with the following [Company] clients: [list specific clients if appropriate and legally supportable].
LEGAL CONSEQUENCES:
If you fail to comply fully with these demands, [Company] will immediately seek:
- A Temporary Restraining Order and preliminary injunction prohibiting your use of trade secrets;
- Monetary damages for actual losses and unjust enrichment;
- Exemplary damages of up to twice the amount of actual damages under CUTSA and DTSA;
- Attorneys’ fees and costs for willful and malicious misappropriation; and
- All other relief available under state and federal law.
We expect your full written response and compliance by [specific date and time]. Direct all communications to me at [attorney contact info].
[Optional settlement language:] While we are prepared to pursue all available remedies, we are willing to discuss a resolution that avoids protracted litigation if you take immediate corrective action and demonstrate good faith.
Sincerely,
[Attorney Name]
Counsel for [Company Name]
The strongest trade secret cases are built on clear digital evidence of theft:
| Evidence Type | How to Obtain | What It Proves |
|---|---|---|
| IT audit logs | System administrator pulls logs showing file access, downloads, emails, cloud syncs, USB connections | Former employee accessed and copied specific files on specific dates |
| Email server data | Review emails sent to personal accounts, especially with attachments or large file transfers | Forwarding of confidential documents to non-company email |
| Cloud storage logs | Check Dropbox, Google Drive, OneDrive admin consoles for sharing/syncing activity | Syncing company folders to personal cloud accounts |
| Device imaging | Forensic image of company laptop/phone before return (requires legal right to access) | Deleted files, browser history, application usage showing intent |
| Print logs | Network printer logs showing unusual printing activity (hundreds of pages in final week) | Physical removal of confidential documents |
Interview current employees who may have knowledge of the former employee’s activities:
- Co-workers who observed suspicious behavior: Staying late, working on personal devices, downloading files, taking photos of screens
- Managers who had exit conversations: What did the employee say about their plans? Did they lie about where they were going?
- IT staff: Unusual help desk tickets (password resets, access requests, complaints about locked-out USB drives)
- Clients who were contacted: Did they receive calls/emails from the former employee using your confidential information?
Compare your materials to the former employee’s new work product to show copying:
| What to Compare | Red Flags |
|---|---|
| Proposal templates | Identical formatting, section headings, boilerplate language, even your company’s typos |
| Source code | Identical variable names, comments, code structure, proprietary algorithms |
| Marketing materials | Same color schemes, imagery, taglines, positioning language |
| Pricing structures | Identical tier names, suspiciously similar price points, same discount schedules |
| Client lists | Contacting exact same clients in same order as your CRM database |
Create side-by-side exhibits showing the similarities. The more identical the materials, the stronger the inference of copying.
Build a chronological timeline showing premeditation:
- 3–6 months before departure: Incorporation of new competing business, domain registration, trademark filings
- Final weeks: Spike in data access and downloads, meetings with clients positioned as “farewell” but actually transition discussions
- Final days: Mass email forwarding, CRM exports, printing of confidential documents
- Resignation: Short or no notice, vague about future plans or outright lies about new role
- Post-departure: Immediate launch of competing business, client announcements, identical service offerings
This timeline shows the theft was intentional, planned, and willful—supporting claims for exemplary damages and attorneys’ fees.
If ongoing misappropriation is causing irreparable harm, seek immediate court intervention:
| Remedy | Timing | Standard |
|---|---|---|
| Temporary Restraining Order (TRO) | Issued within days, sometimes same day (ex parte) | Immediate and irreparable injury; likelihood of success on the merits |
| Preliminary Injunction | Hearing within 2–3 weeks; can last duration of case | Likelihood of success + balance of hardships + public interest |
| Permanent Injunction | After trial or summary judgment | Actual success on the merits; ongoing need for relief |
What the court can order:
- Immediate cessation of use of trade secrets
- Return and destruction of all misappropriated materials
- Prohibition on soliciting specific clients (if trade-secret-based, not just noncompete)
- Forensic imaging of devices to verify deletion
- In extreme cases under DTSA: ex parte seizure of devices and materials
| Damage Type | Calculation | Notes |
|---|---|---|
| Actual loss | Lost profits, lost business opportunities, diminished value of trade secret | Requires proof of causation (losses directly caused by misappropriation) |
| Unjust enrichment | Profits defendant gained from using trade secrets | Alternative to actual loss if defendant profited but you can’t prove your losses |
| Reasonable royalty | What defendant would have paid to license the information | Used when actual loss and unjust enrichment are hard to quantify |
| Exemplary damages | Up to 2× actual damages for willful/malicious misappropriation | Requires showing intentional, deliberate theft (easy to prove with download logs, emails) |
| Attorneys’ fees | Reasonable fees and costs | Available for willful/malicious misappropriation OR bad faith claim (cuts both ways) |
Most trade secret cases settle before trial. Common settlement structures:
- Standstill agreement: Defendant agrees to stop using trade secrets; plaintiff agrees not to sue for past conduct; mutual release
- Negotiated license: Defendant pays royalty or lump sum to continue using information under defined constraints
- Return and destroy: Defendant certifies return/destruction of all materials; plaintiff releases past claims
- Client carve-out: Defendant agrees not to solicit specific clients for defined period (if legally supportable)
- Monetary payment: Lump sum to cover damages, attorney fees, and avoid admission of liability
- Non-disparagement and confidentiality: Both sides agree not to discuss the dispute publicly
| Jurisdiction | Claim | Statute of Limitations |
|---|---|---|
| Federal (DTSA) | Misappropriation | 3 years from discovery or when should have discovered (18 U.S.C. § 1836(d)) |
| California (CUTSA) | Misappropriation | 3 years from discovery or when should have discovered (Civ. Code § 3426.6) |
| California | Breach of contract (NDA) | 2 years (oral) or 4 years (written) |
Continuing violation doctrine: If misappropriation is ongoing (e.g., defendant continues to use stolen client list), the statute of limitations may not begin to run until the use ceases.
I represent companies in trade secret misappropriation, unfair competition, and breach of fiduciary duty cases involving former employees and contractors. I handle matters from demand letters through emergency TROs and full litigation under CUTSA and DTSA.
- Forensic investigation coordination: Work with IT and forensic experts to document data theft and preserve evidence
- Cease-and-desist demand letters: Aggressive, legally sound letters demanding immediate cessation, return of materials, and preservation of evidence
- Emergency injunctive relief: File for TROs and preliminary injunctions to stop ongoing misappropriation
- Trade secret litigation: Prosecute claims under CUTSA and DTSA for damages, exemplary damages, and attorneys’ fees
- Settlement negotiation: Secure favorable standstills, licenses, or monetary settlements without protracted litigation
- California § 16600 compliance: Ensure demand letters and litigation strategy comply with California’s anti-noncompete laws
- Rapid response: Time is critical in trade secret cases. I move quickly to stop ongoing harm and preserve evidence before it’s destroyed.
- Forensic-driven strategy: I work with IT and forensic experts to build airtight evidence of theft—download logs, email trails, side-by-side comparisons.
- Aggressive demand letters: My cease-and-desist letters are detailed, evidence-based, and designed to create immediate settlement pressure while preserving your right to emergency relief.
- California law expertise: I navigate the tension between protecting your trade secrets and complying with California’s strict anti-noncompete laws (§ 16600, SB 699).
- Emergency litigation readiness: If the former employee doesn’t comply, I’m prepared to file for a TRO within 24–48 hours, with declarations, exhibits, and proposed orders ready to go.
Contact me immediately for a consultation. I’ll assess your evidence, draft a cease-and-desist letter, and if necessary, seek emergency court intervention to stop the bleeding.
Email: owner@terms.law