First 72 Hours After a Key Engineer Downloads Technical Files

A senior engineer at a Wuhan semiconductor equipment company resigns on Friday. On Monday, IT notices that the engineer downloaded a large volume of process files and source-code modules during the final week of employment. The company learns that the engineer will join a direct competitor. Management wants to confront the employee, send a warning to the new employer and file a lawsuit immediately.

That instinct can destroy evidence. The revised Anti-Unfair Competition Law, effective October 15, 2025, defines trade secrets and preserves burden-shifting mechanisms that reward a claimant able to present specific preliminary evidence. A successful case therefore begins with disciplined identification and forensic preservation, not accusation.

This article addresses the first seventy-two hours.

The specific issue#

First-response evidence preservation#

Freeze the evidence before confronting anyone. The first step is a legal hold. Preserve the employee's company laptop, source repositories, cloud logs, email, access records, USB activity, printing logs and relevant messaging data where lawfully available. The IT team should avoid changing original files or rebuilding the employee's machine before forensic copies are created.

If the new employer or employee is contacted too early, evidence may disappear or accounts may be cleaned. Preservation should normally precede confrontation unless an urgent operational threat requires immediate action.

Define the alleged secret precisely. Article 10 of the 2025 Anti-Unfair Competition Law defines a trade secret as technical, business or other commercial information that is not known to the public, has commercial value and is subject to corresponding confidentiality measures. A complaint that says “our semiconductor technology” is too broad.

The company should create a secret-identification schedule. Each row should describe one specific item: a process parameter, calibration method, source-code module, customer formula or engineering tolerance. The schedule should identify where the information exists, why it is non-public, its commercial value and which employees had access.

Separate public knowledge from confidential combination. Some elements of a process may be publicly known while the combination, sequence or specific parameters remain confidential. The technical team should explain exactly what is distinctive. Counsel should not claim secrecy over information visible in patents, published papers, product manuals or industry standards.

Overclaiming can weaken credibility. A narrower set of strong secret points is usually preferable to a sprawling claim over all company information.

Prove confidentiality measures before litigation. The statutory definition requires corresponding confidentiality measures. The company should collect employment NDAs, handbook rules, access permissions, file labels, repository controls, supplier agreements, visitor policies and exit procedures.

An NDA alone may not prove that the company treated valuable technical information as secret in practice. Strong cases show layered measures: only relevant engineers had access, downloads were logged, external sharing was restricted and departing employees received specific reminders.

Build the employee access map. For each secret point, identify whether the departing engineer could access it and when. Repository logs, project assignments and system permissions can establish opportunity. If the employee never had access to a claimed secret, including that item can undermine the case.

The map should distinguish ordinary access required for the job from unusual activity shortly before resignation. A spike in downloads can be relevant, but context matters: the employee may have been preparing a legitimate project handover.

Preserve chronology. Create a chronology covering the employee's project role, access changes, resignation, downloads, device return and new-employer information. Include exact timestamps where possible.

Chronology is critical because Article 39's burden-shifting framework can become relevant where the rights holder provides preliminary evidence indicating infringement, including evidence of access or opportunity combined with substantial similarity or other facts. A coherent timeline helps connect those elements.

Do not alter source repositories. Developers may want to rename files, improve confidentiality labels or remove the former employee's account. Disable access where necessary, but preserve the historical state and logs. The company should be able to show what the repository looked like before the incident.

If labels or permissions were weak, counsel should address the weakness honestly rather than “fixing” the record retroactively.

Employee data, devices and interviews#

Employee personal information still requires lawful handling. An internal investigation may involve personal information. The Personal Information Protection Law requires lawful, legitimate, necessary processing and appropriate protection. The employer should limit collection to information reasonably connected with the incident and restrict access to the investigation team. ^[2]

If overseas headquarters or foreign forensic consultants will receive employee data, analyze the cross-border transfer route before bulk export. A trade-secret emergency is not a blanket exemption from privacy rules.

Personal devices require special caution. If the employee used a personal phone or laptop, the company should not assume it may search the device. Review employment policies, consent, ownership and applicable law. Where evidence is likely to be on a personal device, counsel may need to seek preservation or judicial measures rather than self-help.

The company should also identify whether its own BYOD practices contributed to weak secrecy controls.

Decide whether to interview the employee. An exit or investigation interview can obtain useful admissions or explanations, but timing matters. Before the interview, counsel should know what objective evidence exists so questions can be focused. The interview should not reveal every technical detail of the company's forensic analysis.

Record the questions, participants and answers carefully. Avoid coercive tactics or unsupported criminal accusations.

Investigate the new employer lawfully. Article 10 also addresses third parties that know or should know of misappropriation and nonetheless obtain, disclose or use trade secrets. The company should gather lawful evidence of the employee's new role, the competitor's product line and any public indication that the new employer is using similar technology.

Hiring a competitor's employee is not itself proof of trade-secret infringement. The case needs evidence connecting the secret, access and use.

Technical comparison and Article 39 evidence strategy#

Technical similarity analysis should use the smallest provable set. If the competitor product is available, engage an appropriate technical expert to compare relevant features. For software, preserve code versions and repository history. For manufacturing processes, compare performance, design or reverse-engineered characteristics where feasible.

The expert should not be asked to conclude that “the products are similar” in the abstract. The comparison should map to the identified secret points.

Article 39 changes the evidence strategy. The revised law's Article 39 provides burden-shifting mechanisms in civil trade-secret litigation. Where the rights holder provides preliminary evidence of confidentiality measures and reasonably indicates infringement, the alleged infringer may bear the burden of proving the information is not a trade secret. Further burden shifting can arise where the rights holder provides specified preliminary evidence indicating infringement.

This makes the first seventy-two hours valuable. The claimant should build the preliminary case deliberately rather than rushing to file with vague allegations.

Non-compete and trade-secret claims are separate. The company may also have a post-employment non-compete. The 2025 Labor Dispute Interpretation II emphasizes actual access to trade secrets or IP-related confidential matters and proportionality of scope. A valid non-compete can provide a separate employment remedy, but it is not a substitute for proving trade-secret misappropriation. ^[3]

The legal team should analyze both routes independently and avoid assuming that a broad non-compete proves the information is secret.

Consider civil preservation early. If there is evidence of imminent disclosure or use, counsel should evaluate available civil preservation and injunctive mechanisms. The application needs a clear description of the protected information, urgency and supporting evidence.

A court is less likely to be persuaded by a claim that seeks to prohibit an employee from using undefined “company know-how.” Precision prepared in the first hours improves the chance of meaningful relief.

Criminal referral should not be used as negotiation pressure. Serious trade-secret theft can implicate criminal law, and Dan He's public practice includes civil-criminal crossover work. But a company should consider criminal referral only where the facts and legal thresholds support it.

Preserve evidence, quantify loss where possible and coordinate factual statements across civil and criminal strategies. Threatening criminal action merely to force a settlement can create legal and reputational risk.

Worked employee-defection scenario#

Case study: unusual downloads before resignation. Assume the engineer downloads 18 GB of files in three days. Half are routine project materials, while the rest include a confidential process recipe accessible only to six people. The engineer sends one archive to a personal cloud account. Two months later, the competitor begins recruiting suppliers for a product using a similar process.

The strongest case is not the total download volume. It is the precise recipe, restricted access, evidence of export to a personal account, the employee's opportunity and later technical similarity. Counsel should build around those facts.

Twenty-four-hour evidence package and remediation#

Prepare a 24-hour evidence package. By the end of day one, the company should ideally have: resignation documents, confidentiality agreements, device custody, relevant access logs, a list of sensitive projects and an initial timeline. By forty-eight hours, technical owners should identify likely secret points and IT should preserve corresponding repositories. By seventy-two hours, counsel should have a preliminary litigation and investigation strategy.

This package allows management to choose among monitoring, warning letters, employment remedies, civil action and criminal referral on an informed basis.

Fix the compliance weakness exposed by the incident. Every incident should produce a remediation plan. If permissions were too broad, narrow them. If supplier access was uncontrolled, redesign the process. If source repositories do not retain adequate logs, improve retention. If exit interviews are generic, create a high-risk technical employee procedure.

The goal is not only to win one case. It is to make the next case easier to prove and less likely to occur.

Secret-by-secret proof and commercial value#

Build a secret-by-secret evidence table. For each alleged secret, use a table with columns for description, non-public evidence, commercial value, confidentiality measure, employee access, suspected acquisition method, suspected use and supporting documents. This forces legal and technical teams to speak about the same information.

The table also helps management decide which secret points are strong enough for immediate litigation and which require more investigation.

Quantify commercial value without exaggeration. Commercial value can be supported by R&D cost, time saved, licensing value, profitability or the competitive advantage of the information. The company should avoid arbitrary headline numbers disconnected from the specific secret.

Where a criminal route may be considered, loss calculations require especially careful treatment because they can affect legal thresholds and credibility.

Supplier access should be investigated. An employee may not be the only source of leakage. If the secret was shared with tooling suppliers, contract manufacturers or consultants without strong controls, the defendant may argue that the information was not effectively secret.

Collect supplier NDAs, access records and disclosure logs. If controls were weak, include that fact in the litigation risk analysis.

Defendant-side contamination controls and development evidence#

New-hire contamination controls can protect the alleged infringer. A competitor hiring an engineer should instruct the employee not to bring former-employer materials, quarantine external files and document independent development. If the new employer can show a clean-room process and contemporaneous R&D history, it may rebut an inference of misuse.

This is relevant to both sides of a trade-secret dispute and should be considered when evaluating the likely defense.

Preserve product-development history. The claimant should preserve its own invention and development chronology, not only evidence of theft. Lab notebooks, code commits, engineering change records and test results can show when the secret was created and why it was proprietary.

The defendant may claim independent development or public knowledge; the claimant needs evidence addressing both.

Avoid contaminating technical experts. An expert should receive a controlled evidence set and understand which materials are alleged secrets. If the expert reviews unrelated confidential information or modifies original files, the evidentiary record can become more difficult.

Counsel should document what the expert received, when and for what purpose.

Remedies, settlement and board reporting#

Plan the civil complaint around a usable remedy. The company should decide whether its priority is stopping use, preserving evidence, recovering damages or forcing return/deletion of information. The requested relief should match the strongest evidence.

A broad lawsuit seeking every available remedy can be less effective than a focused case built around a small number of critical secrets and urgent misuse.

Settlement terms should protect future secrecy. A settlement should address return or deletion, certification, restrictions on future use, treatment of copies, confidentiality and consequences of breach. If the employee has moved to a competitor, the company may also need a practical method for confirming that files are no longer being used.

Damages alone may not solve the business problem.

Board reporting should separate fact, inference and unknowns. Management often wants a quick conclusion that theft occurred. Counsel should report three categories: verified facts, reasonable inferences and unresolved questions. This helps the board decide whether to litigate without overstating the evidence.

A disciplined report also reduces the risk of defamatory internal or external communications.

Seventy-two-hour checklist. Hour 0-12: disable access, secure device, issue legal hold and preserve logs. Hour 12-24: identify projects and likely secret points; collect confidentiality records. Hour 24-48: build access chronology, conduct targeted forensic review and assess employee data issues. Hour 48-72: complete technical triage, evaluate non-compete, determine civil preservation and decide whether criminal consultation is justified.

At seventy-two hours, the company does not need every answer. It needs a defensible evidence base and a controlled next step.

Ownership, confidentiality and forensic chain of custody#

Trade-secret ownership must be established. If the secret was developed jointly with a customer, university, affiliate or contractor, the company should confirm that it has standing to enforce the information. A strong secrecy system cannot cure uncertain ownership. Review development contracts, project funding, employee assignments and any restrictions on enforcement.

This is particularly important where the claimant is a China subsidiary but the overseas parent claims ownership of group technology.

Confidentiality labels should match actual sensitivity. If every internal file is marked confidential, the label may provide little evidence that the company treated the claimed secret specially. A mature system uses meaningful classification levels tied to access and handling controls.

During litigation, the company should explain why the particular information received stronger treatment than routine internal material.

Customer-specific information can create separate obligations. The downloaded material may include a customer's confidential drawings or specifications. The company should notify the customer where contractually required and coordinate the response. Misuse can create both the company's trade-secret claim and a contractual liability to the customer.

Do not disclose customer information in public pleadings without considering confidentiality protections.

Digital forensics should preserve chain of custody. Forensic images, extracted logs and devices should be documented by custodian, collection time, tool and hash or other integrity method where appropriate. This helps an expert later explain that evidence was not altered.

A rushed internal screenshot may be useful for triage but should not be the only evidence of a major download event.

Witnesses, communications and litigation economics#

Witness selection matters. The company may need testimony from the technical owner of the secret, IT personnel who explain access records and managers who describe commercial value. Counsel should identify these witnesses early, especially if they may leave the business.

Witness preparation should focus on facts within personal knowledge and avoid scripted technical conclusions.

Public communications should be tightly controlled. A company should not announce that a former employee “stole trade secrets” before the facts are established. Public accusations can complicate settlement and create separate claims. One authorized spokesperson should handle external questions.

Internal communications should also use neutral language such as “suspected unauthorized transfer” until the investigation supports a stronger conclusion.

Litigation budget should reflect technical cost. Trade-secret cases can require forensic experts, technical experts, preservation applications and extensive document review. Management should budget for those costs before filing. A weakly funded case may fail to develop the evidence needed to use Article 39 effectively.

The decision to litigate should compare expected business protection with legal and expert cost.

Post-incident employee training. After the event, technical employees should receive concrete training on file classification, approved transfer methods, external storage and exit obligations. Training should use anonymized facts from the incident rather than abstract policy language.

Evidence of regular training also supports the company's broader claim that confidentiality measures were real and understood.

Supplier and JV audits. If the same secrets are shared externally, conduct a targeted review of suppliers and joint ventures. Confirm that access remains necessary, agreements are current and terminated partners have returned or deleted information.

An employee case can expose a wider information-governance weakness that should be addressed immediately.

Final safeguard. By the end of the initial investigation, counsel should rank each possible route—employment claim, civil trade-secret action, patent or copyright claim, criminal referral, commercial settlement—by evidence strength, urgency, business objective and cost. The company should choose the smallest combination of remedies that protects the technology effectively.

Business context and final preservation steps#

Preserve the original business context. Trade-secret litigation can last long after the product team has changed. The company should preserve the commercial documents showing why the secret mattered at the time of the incident: product roadmap, R&D budget, customer requirements and internal valuation. Those materials can help explain commercial value without relying on hindsight or inflated litigation estimates.

Final safeguard. The company should also preserve licensing, patent and technical-contract records that explain why the disputed information was not already publicly disclosed or contractually available to the competitor.

Conclusion#

Trade-secret enforcement under the 2025 Anti-Unfair Competition Law is evidence-intensive. The first seventy-two hours should be used to preserve original systems, define specific secret points, prove confidentiality measures, map employee access and decide which civil, employment or criminal route fits the facts.

The practical rule is: freeze first, define second, accuse last.

Legal and regulatory sources#

^[1] Anti-Unfair Competition Law of the PRC (2025 Revision), especially Articles 10 and 39, effective October 15, 2025: https://www.npc.gov.cn/npc/c2/c30834/202506/t20250627_446247.html

^[2] Personal Information Protection Law of the PRC: https://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html

^[3] SPC Interpretation II on Labor Disputes, effective September 1, 2025: https://www.court.gov.cn/zixun/xiangqing/472691.html

General legal information only; not advice on a specific trade-secret matter.