Is Corporate Espionage Illegal? Federal Laws and Penalties

Corporate espionage is illegal under federal law when it involves stealing trade secrets, and the penalties are serious: up to 15 years in prison and $5 million in fines for an individual, with far larger fines for companies. Two separate tracks apply. Prosecutors can bring criminal charges, and the victim can sue in federal court for money damages and court orders stopping further use of the stolen information. A single incident often triggers both.

The law doesn’t punish competitive research itself. It punishes the methods used and the type of information taken. Studying a rival’s public filings, products, and marketing is fair game. Hacking their servers, bribing their engineers, or walking out with their prototypes is not.

What Counts as a Trade Secret

Not every piece of business information is protected. Federal law defines trade secrets broadly to cover formulas, processes, designs, prototypes, customer data, source code, and similar proprietary material, in digital or paper form.¹ But two things have to be true.

First, the information has to get its economic value from being secret. If a competitor could figure it out through legitimate means or if it’s already public, it isn’t protected.

Second, the owner has to take reasonable steps to keep it confidential. Courts look for concrete measures: non-disclosure agreements, access limited to people who actually need the information, password protection, encrypted communications, and physical security for sensitive documents.¹ With remote work, “reasonable” has expanded to include multi-factor authentication, endpoint monitoring, and clear data-handling rules across personal devices and home networks.

If a company doesn’t guard the information, it loses the legal argument that it was a secret at all.

The Line Between Competitive Research and Illegal Espionage

Analyzing public financials, patent filings, press releases, and marketed products is legal. Attending trade shows is legal. The problem starts when someone uses what the statute calls “improper means”: theft, bribery, misrepresentation, or breach of a duty of confidentiality.¹

Reverse engineering is on the legal side. Federal law specifically excludes reverse engineering and independent derivation from “improper means.”² Buy a competitor’s product at retail, take it apart, figure out how it works. That’s fine, even if the product contains valuable secrets. The question is how you got access. Retail purchase and disassembly: proper. Stealing a prototype, bribing an engineer, hacking a server: not.

The tactics that cross the line usually fall into a handful of categories:

Hacking into a competitor’s systems to steal files, databases, or communications.
Physical theft of documents, prototypes, or storage devices.
Bribing or recruiting a competitor’s employee to hand over confidential information.
Posing as a customer, vendor, or consultant to gain access to sensitive data.
Unauthorized surveillance such as wiretapping or covert recording.

Receiving stolen trade secrets creates liability too. If you knew or had reason to know the information was taken improperly, using it puts you in the same legal position as the person who stole it.

The Federal Laws That Apply

Three federal statutes do most of the work. A single incident can violate all three.

Economic Espionage Act

The Economic Espionage Act of 1996 made trade secret theft a federal crime. It has two separate offenses. One targets espionage that benefits a foreign government or foreign agent and carries the harshest penalties.³ The other covers commercial trade secret theft for anyone’s economic benefit other than the rightful owner, which is the provision that applies to most domestic cases.⁴ Both reach not just completed theft but also attempts and conspiracy.

Defend Trade Secrets Act

The Defend Trade Secrets Act of 2016 opened a federal civil lawsuit route. Before the DTSA, trade secret owners seeking damages were mostly stuck in state court. The DTSA lets a company file directly in federal court to recover financial losses and stop a thief from continuing to use the information.⁵ It supplements state trade secret laws rather than replacing them, and nearly every state has its own version based on the Uniform Trade Secrets Act.

Computer Fraud and Abuse Act

When corporate espionage involves hacking, the Computer Fraud and Abuse Act adds another layer. The CFAA makes it illegal to access a computer without authorization or to exceed authorized access to obtain information.⁶

A 2021 Supreme Court decision narrowed the CFAA. The Court held that “exceeds authorized access” covers people who access areas of a system off-limits to them, like restricted files their credentials don’t authorize. It does not cover employees who have legitimate access to information but use it for improper purposes.⁷ So the CFAA generally won’t reach a departing employee who copied files they had permission to view. The Economic Espionage Act still can.

Criminal Penalties

The numbers split based on whether the theft benefited a foreign power or was purely commercial.

Foreign Economic Espionage

Stealing trade secrets to benefit a foreign government, foreign agent, or foreign entity is the most severely punished form. An individual faces up to 15 years in prison and fines up to $5 million. An organization can be fined up to the greater of $10 million or three times the value of the stolen trade secret, counting research, design, and reproduction costs the organization avoided by stealing instead of developing the information.³

Commercial Trade Secret Theft

For theft motivated by commercial gain rather than foreign espionage, an individual faces up to 10 years in prison.⁴ The statute doesn’t set its own fine ceiling for individuals; it defaults to the general federal sentencing framework, which caps felony fines at $250,000.⁸ Organizations face fines up to the greater of $5 million or three times the value of the stolen trade secret.

Courts can also order criminal restitution requiring the defendant to compensate the victim for property losses. When stolen property can’t be returned or return would be inadequate, restitution equals the greater of the property’s value at the time of theft or at sentencing.⁹

Civil Damages and Court Orders

A criminal case isn’t the only exposure. Under the DTSA, a trade secret owner can sue in federal court, and the financial stakes for defendants can be substantial.

Damages can cover the victim’s actual losses plus any profits the thief earned from using the information. In the alternative, the court can calculate damages as a reasonable royalty for the unauthorized use. When the theft was willful and malicious, exemplary damages can be added up to twice the base award, and the losing side can be ordered to pay the winner’s attorney’s fees.⁵ Most state trade secret laws allow similar exemplary damages, typically capped at twice actual damages.

Courts can also issue injunctions ordering the thief to stop using or sharing the information. One guardrail: a DTSA injunction cannot prevent someone from taking a new job, and any employment restrictions have to be based on evidence of threatened misappropriation, not just the fact that the person knows confidential information.⁵

In extraordinary cases, a court can order seizure of property containing the stolen secrets before the defendant even knows about the lawsuit. To get this ex parte seizure, the owner has to show that a normal restraining order wouldn’t work because the defendant would evade or ignore it, that irreparable harm is imminent, and that the trade secret was likely taken through improper means.⁵ Courts rarely grant these. Even evidence of attempts to hide misconduct hasn’t always been enough.

How Long You Have to Act

A civil DTSA lawsuit has to be filed within three years of the date the owner discovers the misappropriation, or should have discovered it through reasonable diligence. A continuing misappropriation counts as a single claim for deadline purposes.⁵ The clock starts on discovery, not on the theft itself, which matters because trade secret theft can go undetected for years.

Criminal prosecution under the Economic Espionage Act runs on the general federal statute of limitations of five years for non-capital offenses. State trade secret claims have their own deadlines, commonly in the three-to-five-year range.

Reporting Corporate Espionage

If a company discovers it’s the target of trade secret theft, the FBI is the primary federal agency that investigates. For cyber-enabled espionage, including hacking and electronic data theft, the Internet Crime Complaint Center is the central intake point and is run by the FBI.¹⁰ A local FBI field office may be the better route for physical theft, insider threats, or suspected foreign government involvement.

Reporting to law enforcement doesn’t block a parallel civil lawsuit under the DTSA. The two tracks run independently, and many companies pursue both at once. Speed matters on the civil side, because a court is more likely to grant emergency relief when there’s evidence the defendant might destroy or disseminate the information.

1
Office of the Law Revision Counsel. 18 U.S. Code 1839 – Definitions
2
Legal Information Institute. 18 U.S. Code 1839(6) – Definition of Improper Means
3
Office of the Law Revision Counsel. 18 U.S. Code 1831 – Economic Espionage
4
Office of the Law Revision Counsel. 18 U.S. Code 1832 – Theft of Trade Secrets
5
Office of the Law Revision Counsel. 18 U.S. Code 1836 – Civil Proceedings
6
Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection with Computers
7
Supreme Court of the United States. Van Buren v. United States
8
Office of the Law Revision Counsel. 18 U.S. Code 3571 – Sentence of Fine
9
Office of the Law Revision Counsel. 18 U.S. Code 3663A – Mandatory Restitution to Victims of Certain Crimes
10
Internet Crime Complaint Center. IC3 Home Page