Motives sit behind most industrial espionage files, even when companies care more about containment than psychology. Understanding why someone moved trade secrets helps prioritize who to interview, which systems to preserve, and which theory of the case counsel should test. This is Fact #7 in Investigation Hotline’s industrial espionage series: a practical look at motives, using the well-known Harold Worden and Kodak trade-secrets case as a teaching file, then translating those patterns for Ontario and GTA organizations. For the series overview, start with Industrial Espionage Issue #1.
Motive analysis is not a substitute for evidence. A clean file still needs access maps, timelines, device and document trails, and dated interviews. Motive hypotheses simply stop teams from treating every departing employee as identical risk and every consultant as a villain by default.
What the Kodak trade-secrets case is used to teach
Public reporting on the Worden matter describes a long-tenured Kodak employee who retired, kept proprietary materials after leaving, later pled guilty to transporting stolen property involving trade secrets valued in the millions, and received a prison sentence and fine. Related civil pleadings and news coverage also describe a consulting firm built after Kodak, recruitment of retired colleagues with knowledge of sensitive processes, and an FBI seizure of a large volume of documents from residences and offices in South Carolina.
Treat those summaries as cautionary history, not a checklist that every Canadian leak will match. What travels well across decades and borders is the pattern stack: retained documents after exit, a consulting wrapper, retiree networks with retained knowledge, a technical project that could shortcut expensive R&D, and delayed discovery that allowed volume and distribution to grow. For more on how espionage shows up on home soil beyond one company story, see Fact #8 on espionage on home soil.
Motive clusters investigators actually test
Most motive talk collapses into one word: greed. Real files usually hold layered incentives. Investigators and counsel benefit from naming clusters early so collection plans match the story the evidence might support.
Financial gain. Sale of documents, paid consulting that depends on someone else’s know-how, equity in a competing venture, or side contracts that compensate for “technical shortcuts” competitors could not buy openly.
Status and professional unfinished business. Some people keep files because they believe a project still “belongs” to them, or because recognition never matched their self-image. That does not justify retention of confidential materials. It does explain why someone may rationalize theft as unfinished work.
Grievance. Perceived unfair promotion, layoff bitterness, dispute over IP credit, or conflict with management can turn access into leverage. Grievance files need careful interview planning so emotion does not rewrite documents.
Competitive help as identity. Helping a favored competitor, former colleague, or new employer can feel like loyalty to people rather than betrayal of a corporation. Motives stay personal even when victims are companies.
Pressure and debt. Blackmail, family financial stress, addiction, or vendor capture can move people who would not invent a scheme alone. Pressure motives change how interviewers watch for coercion signals and who else may be in the circle.
Naive entitlement. Some people leave with manuals “for reference,” sync personal drives by habit, or recruit retirees without meaning to build an underground market. Intent may be lighter than a classic heist story. Harm and civil exposure can still be serious.
In the Kodak teaching file, public accounts leave room for more than one cluster: consulting revenue, pride around machine and process know-how, networks of retirees, and the sheer convenience of materials already in private possession. Investigators should list competing motive theories and mark which facts would raise or lower each one. They should not force a single movie villain into the report when evidence is mixed.
Why motive matters to the investigation plan
Motive changes the first 72 hours of work. If gain or sale is plausible, early focus often includes communications that show offering, pricing, or delivery of materials, plus buyers or intermediaries. If grievance dominates, interview sequencing and workplace history records matter more, and flashy surveillance may waste budget. If naive retention is plausible, offboarding gaps and shadow IT may be the centre of gravity rather than a criminal conspiracy of dozens.
Motive also affects stop rules. Leadership sometimes wants a confession about “why.” Counsel often needs a narrower product: who had access, what left, where it went, and what still risks ongoing leakage. Investigation Hotline scopes civil and workplace documentation so facts stay usable. Motives appear in interview summaries when witnesses volunteer them or when contemporaneous messages show them. We do not invent psychology to fill report pages.
For U.S. statute context that sometimes frames how companies discuss economic espionage even when Canadian civil path governs a local file, see Fact #2 on the Economic Espionage Act.
Retiree networks, consulting wrappers, and “trusted alumni”
Civil claims around Worden and related parties highlighted how a consulting firm and retired Kodak talent could become a knowledge distribution system. That pattern still appears in manufacturing, pharma, software, and advanced materials firms: alumni groups, technical mentors, weekend consulting, and informal “just a quick look” reviews for competitors.
None of those activities is automatically illegal. Problems arise when confidential information is retained without authorization, when agreements are ignored, when need-to-know boundaries collapse, or when competitors buy insight that can only come from protected trade secrets. An investigation plan that ignores alumni channels often misses the true pathway while staff panic about the newest intern.
Practical documentation habits for this risk include:
- Exit inventories that treat marked manuals, drawings, tooling notes, and process recipes as controlled property
- Written reminders of confidentiality after retirement, not only on the last workday
- Clear rules for alumni consulting with competitors and for referring other retirees
- Access logs for former staff who still enter facilities as visitors or contractors
- Separate contract language when a former specialist is hired back as a vendor
If the centre of your file is building defensive habits rather than reconstructing one historical case, pair this article with Fact #11 on defending your business and Fact #15 on defending trade secrets.
Project pride, “401 machine” style ventures, and unfinished R&D
Reporting on Worden’s collaboration around the “401 machine” acetate project is often used to illustrate how a technical ambition can sit next to a secrecy breach. People who spent years on a process can treat that know-how as personal craft even when contracts say otherwise.
Ontario innovation companies see similar dynamics in prototypes, recipe cards, CAD libraries, pricing algorithms, and clinical protocols. When a star engineer leaves and a near-clone product appears, motive talk spreads in the cafeteria before anyone freezes logs. A better response is to write a decision sentence: contain accounts, preserve devices, map vendors, interview with purpose, and decide whether counsel wants civil support or a police report discussion. Motive remains a hypothesis until messages, transfers, or admissions support it.
Soft limits apply. Investigators do not hack competitor systems, bribe staff for passwords, or plant illegal trackers to “prove” envy. Lawful open-source research, workplace interviews under policy, physical observations where permitted, and digital work through authorized channels remain the lane. Results can be incomplete when data is overseas or destroyed. Incomplete is still better than evidence ruined by impulsive shortcuts.
Document volume and delayed discovery
Accounts of roughly forty thousand documents seized in the Worden matter underscore a painful truth: volume grows when retention goes unnoticed. Delayed discovery does not always mean sophistication. Sometimes it means nobody checked garage boxes, home offices, personal email, or old hard drives after retirement.
For current Canadian employers, delayed discovery often shows up as:
- Personal cloud sync that continued after role change
- USB or portable media inventories that were never reconciled
- Shared drives where “owner” left years ago and permissions lingered
- Printer and plotter logs ignored until a competitor demo appeared
- Customer lists exported “for a handover” that never returned
When discovery finally begins, resist a purge. Preservation instructions should reach IT, facilities, and key witnesses before anyone “cleans up to look responsible.” Chain of custody and retrieval dates matter for later counsel review. Motive theories built after destruction of sources become speculation dressed as analysis.
Warning signs that motive-aware teams watch
No single behaviour proves industrial espionage. Clusters deserve a scoped review:
- Departure accompanied by mass downloads, unexplained printers, or sudden interest in repositories outside normal duties
- Consulting firm announcements that target former-employer markets within months of exit
- Retired specialists gathering peers who still hold badge access or informal technical influence
- Competitor products that mirror unreleased features with unusual speed
- Side messages that joke about “bringing the manuals along” or “helping the other side”
- Vendors asking for more drawings than their contract scope needs
Separate messy human exits from intentional theft. People leave awkwardly. People keep notebooks by mistake. Treating every awkward exit as betrayal burns culture and waste budget. Treating every warning as drama also fails. A private investigator helps turn rumour into a plan with stop rules, not into a workplace rumour mill with cameras.
What good motive-aware reporting looks like
A useful report separates observed facts from inferred motives. It can say a subject retained marked drawings after exit and later marketed related consulting. It should not declare “pure greed” unless the person said so or contemporaneous records compel that reading. It should list alternative explanations that remain open. Counsel can argue characterization; investigators should not overclaim it.
Good packages also name what was searched, what could not be searched, and which leads need legal process next. They preserve retrieval dates. They keep interview impressions out of the same paragraph as verbatim quotes. They avoid posting debt or shame narratives about named employees online while a civil or employment process is unfinished.
For hiring lanes when the risk is whether a candidate already carries baggage from a competitor fight, use service-level diligence through background checks. When the centre is internal fact-finding under workplace policy, see workplace investigation. When devices and logs dominate, route into digital investigations.
Intake preparation when motive is part of your question
- Write one decision sentence: contain, preserve, interview, discipline support, litigate support, or report
- List who had access to the allegedly compromised secrets and which vendors overlapped
- Capture exit dates, consulting announcements, and competitor product timelines without baking motive language into timestamps
- Freeze destructive cleanup until IT and counsel agree on preservation
- Agree update cadence and audience for the report before hours begin
Bring marked document lists, employment agreements if counsel allows sharing, and any messages already collected through authorized means. Better inputs raise the chance of useful leads. They still do not guarantee every recipient or overseas copy will be found.
If your Ontario organization needs lawful documentation around a suspected industrial espionage or trade-secret leak, Investigation Hotline can review the objective and outline options in a confidential intake. Call (416) 205-9114 or use our contact.
To learn more, contact Investigation Hotline at
