Case1

Investigation of operation logs related to the Unfair Competition Prevention Act for taking confidential corporate information out of the company

Background and Outline of the Case

Background of the discovery:
Two years after former employee A moved to a competing company, it was discovered that products similar to the company's own products were being manufactured without permission and sold overseas. An internal investigation was conducted.

Details of the internal investigation:
The logs of the PC used by A were checked, and it was confirmed that a large amount of copies had been made a few days before his resignation, but due to the large amount of data, it was not possible to determine whether or not this was related to the taking out of information.

Results of Internal Investigation:
According to the court's opinion, "it is necessary to identify the person and the operation of the trade secret" in order to identify the criminal act of taking out information, and it is difficult for the client's IT staff to accurately extract unauthorized copies and deletions from a large amount of record information (over 1 million records ), and the lack of third party nature was a concern. The client's IT staff would not be able to accurately extract unauthorized copies and deletions from over 1 million records.

case1_img01

FRONTEO Survey

Third-party assurance:
On-site (at the client company) preservation of the work logs themselves to ensure third-party integrity

Support for large volumes of data:
We have built our own database to examine large volumes of log data (external HDDs and USBs). (external HDDs and USBs are examined)

Results

We confirmed that he copied approximately 300,000 items of data onto a USB memory device, deleted the external HDD in question a few days later after unplugging the network cable, and repeatedly wrote and deleted unrelated program files several times for approximately 120 hours.

case1_img02_.png