Intellectual property theft is not one single offence or one type of investigation. A counterfeit product, copied photograph, stolen source code, leaked formula, misused customer database and patent dispute all involve different rights, evidence and enforcement routes. The first task is therefore to identify exactly what asset is protected and what conduct is alleged to have happened.
At Trojan Investigations, we support businesses, brand owners and legal teams with evidence gathering, corporate intelligence and surveillance where suspected IP misuse has an investigative dimension. We do not determine whether a patent or trade mark is legally valid or provide intellectual-property legal advice; those questions belong with qualified IP advisers and, ultimately, the relevant court or tribunal.
Originally published: 26th August 2024 | Updated: 7th September 2026
What does an IP theft investigation need to prove?
It should identify the protected asset, the suspected person or organisation, the alleged act of copying, disclosure, sale, possession or use, the chronology, the source of the evidence and the connection between the subject and the infringement. The legal test then depends on the particular IP right or confidentiality regime.
Start by Identifying the Right You Are Protecting
The Intellectual Property Office distinguishes patents, trade marks, designs and copyright, while confidential know-how and trade secrets can receive different protection. These rights overlap but are not interchangeable.
| Asset | What it protects | Typical investigation question |
|---|---|---|
| Trade mark | Brand identifiers such as names and logos | Who is manufacturing, importing, advertising or selling suspected counterfeit goods? |
| Copyright | Original creative works, software, photographs and certain databases | Where did the copied material come from and who published or distributed it? |
| Registered design | Visual appearance of products | What product is being made or sold and how is it linked to the subject? |
| Patent | Protected inventions in the jurisdictions where granted | What product or process is alleged to use the protected invention? |
| Trade secret / confidential information | Secret commercially valuable information subject to protection steps | How was the information accessed, copied, disclosed or used? |
“Theft” Can Be a Misleading Shortcut
Clients understandably use the word theft, but many IP disputes are civil infringement or breach-of-confidence matters rather than conventional theft of a physical object. Counterfeiting and piracy can involve criminal offences, while misuse of trade secrets or confidential information may lead to civil remedies and can overlap with other offences depending on how the information was obtained.
That distinction matters because the investigation should be designed for the likely legal route. Evidence needed for an online marketplace takedown may differ from evidence required for an injunction, Trading Standards referral, police investigation or High Court claim.
UK Enforcement Is Active Across Physical and Online Markets
The Intellectual Property Office's Trading Standards survey for 2024/25 reported responses from 132 of 189 local authorities. Among locations investigated for counterfeit, pirated and design-infringing goods, ordinary shops were reported by 83% of responding Trading Standards departments, social media by 43% and websites by 29%. The figures show why modern IP investigations frequently need to join physical evidence with online intelligence.
Preserve the Infringement Before It Changes
Online listings can disappear within minutes of a complaint. Usernames can change, seller pages can move and stock can be relocated. Evidence should therefore be preserved before overt contact where lawful and appropriate.
Useful early evidence may include:
- full URLs, usernames, seller IDs and timestamps;
- screenshots showing the complete context, not just cropped images;
- product listings, descriptions, prices and claimed origin;
- business names, addresses, contact details and payment identifiers lawfully visible;
- test-purchase records where the legal team has approved that approach;
- packaging, labels, serial numbers and delivery information;
- communications with the seller or distributor;
- company and domain information; and
- records showing the client's ownership or authorised use of the relevant IP.
Investigating Counterfeit Goods
Counterfeit investigations often aim to move beyond the individual listing to the supply chain. One seller may be supplied by a wholesaler, storage unit, importer or network of connected accounts. Open-source intelligence can help identify common phone numbers, addresses, company connections, usernames, photographs, fulfilment patterns and other links.
Physical surveillance can sometimes corroborate deliveries, storage locations or movements in public where there is a defined purpose. Our surveillance services are used only where the proposed observation is lawful, proportionate and likely to answer a material question.
Online Evidence Must Be Attributed Carefully
A social-media account is not automatically proof of the person behind it. Screenshots show what was visible, not necessarily who controlled the account. Investigators should therefore look for corroborating identifiers such as business registrations, public contact details, reused usernames, domain records, payment or delivery information obtained lawfully and consistent behaviour across platforms.
Do not hack an account to “prove” ownership
Unauthorised access is not a legitimate investigative shortcut. The Computer Misuse Act 1990 can apply to unauthorised computer access. Evidence should be obtained through lawful open-source, commercial, witness, documentary or other properly authorised routes.
Trade Secrets Are Different From Registered IP
Current UK government guidance describes a trade secret as confidential business information that is unknown in the relevant business circles, has commercial value because it is secret and has been subject to reasonable steps to keep it secret. Protection can arise through the Trade Secrets (Enforcement, etc.) Regulations 2018 alongside the common law of breach of confidence.
Examples can include formulas, manufacturing methods, source code, pricing, research, internal commercial data and certain customer information. The investigation therefore needs to examine not just copying, but how the organisation protected the information before the dispute.
Employee and Former-Employee Cases Need Insider-Risk Evidence
Many trade-secret disputes arise around departures, recruitment by competitors or new competing businesses. NPSA identifies exit as a significant personnel-security stage because confidentiality, integrity and availability of critical assets may be at risk during notice periods and beyond.
Our business investigations can help establish the wider facts: associations, public business activity, relevant movements and other lawful intelligence. Device or system-level analysis should be handled by digital-forensics and IT specialists where appropriate.
What About Source Code and Digital Files?
Software can engage copyright, contract, confidentiality and trade-secret issues. Investigators should preserve repository access, commit history, account logs, export events and the allegedly copied material without unnecessarily altering original evidence. It is important to distinguish access, copying, possession and actual reuse.
If a former employee uses credentials after authority has ended or accesses material outside permission, the Computer Misuse Act may also require consideration. That is a legal question that should be assessed on the facts rather than assumed from a download alone.
Test Purchases Can Produce Strong Evidence
In product-counterfeiting cases, a controlled test purchase can establish what is actually supplied, packaging, seller communications, return addresses, payment route and delivery details. The process should be planned so that the item, transaction record and continuity can later be explained reliably.
Where litigation or criminal referral is contemplated, legal advisers should guide the evidential purpose and any disclosure implications. An investigator should not create unnecessary transactions merely to generate a larger case.
Intellectual Property Crime Can Connect to Wider Criminality
The IPO's 2024/25 Trading Standards survey notes that IP crime is often linked with wider offending, with respondents observing links including organised crime, money laundering, modern slavery, drug dealing and benefit fraud. That does not mean every counterfeit seller is part of organised crime, but it reinforces the need for investigators to recognise when a commercial enquiry may require referral to enforcement agencies rather than private escalation.
Evidence for Civil Litigation Must Be Collected With the Court in Mind
A court, not the investigator, decides admissibility and weight. The investigator's job is to make evidence understandable and traceable: what was observed, when, by whom, from what source and what happened to the material afterwards. Reports should separate direct observation from information supplied by the client or third parties.
Where proceedings are contemplated, our legal and litigation support can work to the solicitor's defined evidential requirements.
Prevention Makes Enforcement Easier
Businesses should maintain an IP register, know who owns key rights, record licence arrangements, use appropriate NDAs and confidentiality terms, restrict access to trade secrets, retain creation and development records, control supplier disclosures and monitor marketplaces proportionately. Those steps do more than prevent leakage: they make ownership and confidentiality easier to prove.
Reasonable secrecy measures are part of the evidence
If a business later relies on trade-secret protection, it should be able to show what it did to keep the information secret. Access controls, confidentiality markings, NDAs, security policies and staff training can all become relevant.
How We Structure an IP Investigation
1. Identify the right and objective
Clarify the asset, ownership evidence, suspected conduct and whether the client needs intelligence, preservation, a test purchase, surveillance or litigation support.
2. Preserve public and client-held evidence
Capture online and documentary evidence before notices, takedowns or overt contact change the position.
3. Attribute activity
Corroborate accounts, sellers, premises and connected entities rather than relying on one username or address.
4. Follow the supply or disclosure chain
Where lawful and proportionate, identify the relationships that explain where goods or information originated and where they moved.
5. Report facts for the chosen legal route
Present findings, source context, continuity and limitations so advisers or enforcement bodies can decide the next step.
Concerned about copied IP, confidential information or counterfeiting?
We can help define an evidence-led investigation and coordinate with your legal advisers. Book a confidential consultation.
Intellectual Property Rights Are Territorial
Many IP rights are territorial. A UK trade mark or patent does not automatically give identical protection in every country, and an online seller may operate through platforms, companies or fulfilment centres in several jurisdictions. Before an investigation expands overseas, the client should confirm with its IP advisers which rights apply where and what evidence is needed for the intended enforcement route.
That can change the investigative priority. In one case the key question may be where goods are physically entering the UK; in another it may be who controls a UK-facing website; in another it may be whether a former employee is using confidential know-how in a competing business abroad. International work should therefore be planned around jurisdiction rather than assuming the same legal test follows the subject everywhere.
Preserve Before Takedown
Marketplace and social-media reporting tools can remove infringing listings quickly, which is useful for harm reduction but can also remove evidence. Where legal action is being considered, the client and its advisers should decide what needs to be preserved before submitting takedown notices. That can include page context, seller identity indicators, transaction history available to the client, communications, product images and evidence linking repeat accounts.
A removed listing is not the end of the investigation
Repeat sellers often change usernames, move platforms or create new storefronts. A well-preserved baseline allows later accounts to be compared using lawful indicators such as reused contact details, photographs, product descriptions, packaging, addresses and trading patterns.
Map the Network, Not Just the Front-End Seller
IP infringement can involve separate roles: manufacturer, importer, wholesaler, storage operator, online seller, payment recipient and delivery contact. Investigators should avoid assuming that the visible seller performs every role. A relationship map can help identify which links are evidenced and which remain hypotheses.
Useful network questions include:
- Which accounts advertise the same goods?
- Which businesses share addresses, directors or contact details?
- Do separate sellers use the same product photography or descriptions?
- Where are goods dispatched or returned?
- Are test purchases fulfilled from the same location?
- Which premises appear connected to storage or distribution?
- Are there repeated phone numbers, email addresses or public payment identifiers?
Keep Civil, Platform and Criminal Routes Distinct
The same evidence can have different uses. A platform may act on brand-owner documentation and a preserved listing. A civil solicitor may need evidence of ownership, infringement, attribution and loss. Trading Standards or police may need a different package focused on suspected criminality, scale, supply and public harm. Investigators should therefore label evidence by source and avoid rewriting the facts to fit a preferred route.
Where several routes are possible, early legal advice can prevent one action from undermining another. For example, overt contact may identify the client too soon, while immediate takedown may remove a useful opportunity to make a controlled purchase. The best sequence depends on the objective and risk.
Report Confidence, Not Just Conclusions
Attribution is often the hardest part of an online IP case. A final report should distinguish a confirmed company connection from a probable link and a speculative similarity. If two accounts use the same image but no other identifier matches, that is weaker than two accounts sharing a return address, telephone number and test-purchase packaging. Explicit confidence levels help the legal team decide what needs further corroboration.
Sources and References
- Intellectual Property Office — IP Basics.
- Intellectual Property Office — IP crime and enforcement for businesses; updated 21 July 2026.
- Intellectual Property Office — The UK IP Crime Group; updated 21 July 2026.
- Intellectual Property Office — Trading Standards IP crime survey and successes 2024 to 2025, published 10 June 2025.
- GOV.UK — Knowledge Asset Management Guide: Intellectual property management; current 2026 guidance on trade secrets.
- Trade Secrets (Enforcement, etc.) Regulations 2018.
- Computer Misuse Act 1990.
- National Protective Security Authority — Ongoing Personnel Security and Exit Procedures guidance.