Are Dark Web Personas Trade Secrets? A Silicon Valley Court Says Maybe
Apollo Information Systems Corp. sells dark web intelligence. The company runs more than 1,000 undercover personas through criminal marketplaces, feeds what those personas collect into a data lake and a proprietary platform called CTOS, and employs analysts to make sense of the haul. Its entire business depends on that tradecraft staying hidden from the criminals it targets.
According to its own complaint, two employees dismantled that secrecy from the inside. The resulting case, Apollo Information Systems Corp. v. St. John, is pending before Judge P. Casey Pitts in the Northern District of California. On September 28, 2026, the court denied most of a motion to dismiss. Nothing has been proven, and no jury has heard a word of it. But the trade secret ruling is worth ten minutes of any security leader’s time, because the disputed assets are the tools of the intelligence trade itself.
The alleged scheme
Both defendants arrived through Apollo’s June 2022 acquisition of Cyber Defenses, Inc. Monty St. John became Apollo’s Senior Director of Intelligence, while Reynaldo Ramon worked as a threat intelligence analyst. According to the first amended complaint, the two quietly formed their own company, North Tools, LLC, while still collecting Apollo paychecks.
| Date | Product | Amount | Where it went |
|---|---|---|---|
| Dec 2024 | Northumbria Intelligence Platform | $50,000 | Sultrani merchant account tied to St. John |
| Oct 2025 | DataSchism | $47,790 | North Tools entities, domains registered Sept 15, 2025 |
| Nov 2025 | CyberGestalt | $81,000 | North Tools entities, domains registered Oct 31, 2025 |
Roughly $179,000 in documented payments, assuming the Northumbria figure covers one year.
That works out to roughly $179,000 in documented payments, assuming the Northumbria figure covers one year, and the strangest allegation explains where the product came from. Ramon told Apollo executives that he and St. John had used Apollo’s own subscription to a third-party vendor, KeLa, to gather dark web information, repackaged it, and sold it back through DataSchism and CyberGestalt. If accurate, Apollo paid for intelligence it already owned, separated from its own money only by a shell and a markup.
December 2025, in sequence
- Dec 2 to 4. Strained knowledge-transfer meetings, with St. John defensive about requests for information and calling the questions “accusatory.”
- Dec 5. St. John resigned effective immediately, after Apollo says he wiped his computer before returning it.
- Dec 10. An unknown “admin” changed the credentials to Apollo’s encrypted password locker to an email in the format . Apollo says it remains locked out, and the locker allegedly holds persona credentials and other highly confidential data.
- Later that day, Ramon confessed to executives that he and St. John were “business partners” in North Tools, then took a nearly two-week Hawaiian vacation before resigning Dec 23.
- Dec 19. Apollo learned someone had filed a fraudulent Washington State business license application using CFO Kathleen Thomas’s name, date of birth, Social Security number, and cell number, for a new entity bearing Apollo’s own name. Nothing in the public filings ties that to the defendants, so treat it as potential context, not accusation.
The defense’s argument
The motion to dismiss called the complaint “an unprincipled response to former employees, attempting to transform Apollo’s internal business breakdown into a federal trade secrets case.” Counsel argued Apollo identified its six asserted trade secrets, which include the persona compilation, the data lake, and the CTOS product, only by category, never specifying what files were copied, when, how, or what CTOS features appeared in a competing product. Ninth Circuit precedent requires that particularity, and vague compilations are supposed to be fatal at pleading.
“Personas deployed on the dark web to interact with cybercriminals are not trade secrets.”
A persona, the argument ran, operates openly, transacts with strangers, and derives value from trust built inside a criminal community. The value, the argument ran, comes from trust built inside a criminal community, which is the opposite of secrecy. The defense also flagged an apparent contradiction within the complaint itself. Apollo described the password locker St. John built as containing “unhelpful and unusable information,” while simultaneously claiming that same locker holds irreplaceable persona credentials and leaving Apollo locked out, an odd foundation for a misappropriation claim.
Additionally, St. John’s employment agreement includes a thirteen-page Exhibit A disclosing pre-existing intellectual property, including work connected to Sultrani, that predates his employment and sits outside the invention-assignment provision. If genuine and scoped correctly, that exhibit could seriously undermine Apollo’s ownership claims, and the defense accused Apollo of hiding it from the court entirely.
The ruling
Judge Pitts dismissed two of the claims. The fiduciary duty claim against Ramon is gone, because a threat intelligence analyst holds no fiduciary office regardless of skill, and Apollo’s lawyers didn’t oppose the point. The “Sensemaking LLM” declaratory judgment, an AI-analysis claim, is also gone, after Apollo’s own counsel conceded at the hearing they weren’t seeking it, a quiet retreat for an asset that starred in the prayer for relief while appearing nowhere in the factual allegations. Everything else survives.
The persona holding
This is the part of the suit worth reading closely. Judge Pitts reasoned that while the personas transact publicly, the surrounding material does not, since “not all of the information that goes into the personas is disclosed to third parties.”
“Indeed, the value of the personas almost certainly derives from the fact that Apollo does not disclose to others on the dark web that the personas are associated with a cybersecurity firm.”
Think of undercover police, who walk public streets and build credibility in the open while their identities remain among the most closely guarded information a department holds. Judge Pitts applied the same intuition to commercial methods, and the Defend Trade Secrets Act (DTSA) backs him up. The statute defines trade secrets to include compilations and methods whenever the owner takes reasonable secrecy measures and the information gains economic value from not being generally known, and the court leaned on the Ninth Circuit’s Experian decision holding that compilations of publicly available sources can qualify.
On misappropriation, the lockout itself carried the claim. Handing yourself admin credentials to your employer’s encrypted vault and locking the owner out was enough, at the pleading stage, for a jury to consider later.
The wider stakes
Public-facing methods can still be protected, and that goes beyond this docket. A majority of security work tends to feature visible outputs concealing invisible sources and methods, and if public operation destroyed secrecy, most of it would lose legal protection overnight.
The compilation doctrine matters too, because the KeLa allegation mirrors the structure of a licensed-data AI pipeline, where inputs are purchased or public and then curated and refined into something worth more than the sum. If curation and assembly can be trade secrets, and Experian says they can, then data pipelines and their surrounding methods may be defensible assets in ways patent law can’t touch. Where the boundary sits between protectable curation and generic plumbing is a question no court has squarely answered.
Apollo conducts professional-grade operational security against sophisticated criminals, but the complaint reads like an offboarding-gone-wrong training video. The law offers a federal backstop with exemplary damages and fee awards for willful misappropriation, but Apollo went for emergency relief on day one anyway, filing a temporary restraining order (TRO) alongside the complaint on January 16, 2026, which Judge Pitts denied on February 3.
What happens next
Fact discovery closes July 30, 2027, dispositive motions are due November 18, 2027, and the trial-setting conference lands April 11, 2028, with mediation extended twice and no settlement reflected on the docket. Nine attorneys were admitted pro hac vice across both sides within two months of filing, so this is not a low-stakes fight for either side. Amended pleadings are permitted through December 30, 2026, meaning Apollo could try the Ramon fiduciary claim again.
This remains one judge’s plausibility call on a contested record. Exhibit A hasn’t been tested, and the defense narrative of an “internal business breakdown” has been delayed rather than defeated. But for anyone whose security operation depends on operational craft functioning in public, a federal court in San Jose just said the protection is real, but it arrives on litigation’s timeline, not an incident responder’s.
