Use This Checklist of “Reasonable” Efforts to Protect Your Trade Secrets

This session, we’re going to talk about trade secret law. Trade secret is an area of intellectual property law that is very much grounded in company culture, company processes, ethics, and human behavior. The purpose of Trade Secret Law is indeed, as the court said 50 years ago, to protect the standards of commercial morality. Honest commerce. It also encourages innovation and invention, and as the court says, it helps to maintain the public interest in free and open competition of unpatented goods, and protects relationships based on trust. So let’s walk through this again. The notion that it protects standards of commercial morality is because trade secrets are not registered.

There isn’t any official public office that confers a trade secret on your business processes. The only way that you can maintain your trade secret is through your people. And so they need to behave in a way that is ethical. By saying it encourages innovation, means that to the extent a company can develop data. Or processes or procedures and ultimately products that have a component of them that deal with secrecy and that give you a competitive advantage, trade secret will protect that product. It does not need to be patented. The concept of keeping the public interest in free and open competition means if something isn’t patented, others are free to copy it, unless it violates trade secret law.

Or, unless the name they’ve chosen for that product violates trademark law.

The Economic Espionage Act was the first time in the United States that trade secret law became criminalized. Meaning it wasn’t simply a violation that your former employer could enforce. It was a violation where you could go to law enforcement, and you could seek assistance from the police or from the Federal Bureau of Investigation. Here’s a definition that’s used in this federal act. A trade secret means all forms and types of financial, business, scientific, technical, economic, or engineering information. So right there you see that it isn’t just medical or engineering or scientific information, but indeed some kinds of data that we might consider purely strategic. Financial information, business plans.

And this includes patterns, plans, compilations meaning collections of information, program devices such as technologies, formulas, designs, prototypes, methods, techniques, processes, procedures, programs or codes. Meaning, almost anything could qualify in the form that it’s embodied, whether it’s tangible or intangible. By referring to intangible we mean, even if it’s just in your head, even if it’s not fixed or embodied in something. And whether or how stored, compiled or memorialized, physically, electronically, graphically, photographically or in writing. Notice how broad this is, meaning it can apply to virtually any company.

And here’s your requirements if you want to claim trade secrets over those data, formulas, plans, and processes. You have to take reasonable measures to keep the information secret. Reasonable measures, and the information has to provide economic value to the company because it’s not generally known and it isn’t something that can be more easily reverse-engineered. So really two requirements here. You need to take reasonable measures. And, this is the kind of information that we couldn’t fairly easily reverse-engineer, or indeed with a great deal of expense, independently develop.

So what are not trade secrets? Well indeed, any information that’s already publicly known. Or generally known in a field, or as it says, are reasonably ascertainable, meaning we can figure it out if we work at it, or we can reverse engineer it. Those are not trade secrets, so how might you be able to acquire information lawfully? One way, you could hire an expert, you could go to somebody who has been in that particular industry a long time and has a great deal of experience. You do not have to necessarily hire someone with a PhD, college education, an MD. You can develop a trade secret because you work with someone who is very experienced in the field and has developed know-how.

When we talk about trade secret misappropriation, we talk about unlawful conduct, wrongful conduct. The definition of misappropriation is, when someone uses a trade secret or discloses the trade secret of another company without the consent of that company.

The statute identifies certain ways that that can happen. One would be, you use improper means to acquire the knowledge of the trade secret. Improper means could be, you have a stealth attack on a computer system. It could mean that you bribe an employee, could mean that you go on to a facility and you hide recording equipment in your clothing. Could mean that you physically remove materials from the place of employment, of the place the company has its business operations. We all have a pretty good instinctive understanding of what improper means would be. Next, a company can get into trouble, if it knew or had reason to know that information was derived from someone who used improper means to acquire it.

I had a circumstance not long ago, where a client was reviewing a laptop of a former employee, who was no longer with the company. And the company was reviewing the content of the laptop, and indeed found information from a competitor on that laptop, that the employee should not have gathered and that the company didn’t want to possess. And indeed, it contacted its counsel to figure out what do we do with information on our laptop, we didn’t request it, we haven’t used it, we haven’t disclosed it. Do we have any obligations to notify a third party? And finally the third point is that if information is acquired by accident or mistake, a company cannot use that information.

One of the most common ways that this can happen is that a company hires a new employee, and that new employee has had previous employment in that industry or with a competitor. And sometimes former employees do not realize they can not disclose trade secrets even if they haven’t signed a non-disclosure agreement. And although we’re going to talk about non-disclosure agreements in a moment, it reminds me of a time some years ago. I was working with a client who was in the field of aviation engineering and had hired a new engineer to work on a particular project. And the engineer said I haven’t signed any nondisclosure agreements so I’m not under any obligations of nondisclosure.

And as an attorney, of course, that sounds like nails on a chalkboard because indeed you are still under those obligations. And that’s because there is a fiduciary duty, an ethical duty when one is employed, or one is a contractor and learns information that’s a secret. The obligation not to disclose it to others, or not to use it improperly begins right then, whether or not a document is ever signed. Many individuals with whom I’ve worked, including very educated individuals, do not know this. So let’s look at that first bullet point that we have to meet, if we want to claim trade secret in our information. We have to exercise efforts that are reasonable under the circumstances.

So let’s sort of begin with what kinds of circumstances? Imagine that there are trade secrets that are highly confidential, very important to the company. An example might be the formula for a new drug, the formula for Coca-Cola, which we’ll talk about later. If something is very valuable, you need to act as though that information is so valuable. That you have implemented procedures that are even more detailed than you might use with information which is going to become public in a few days, a few weeks, a few months. Which is not to say that, even with information that’s going to become public soon, that you wouldn’t want to implement certain protocols.

But if you want to later claim that information is highly sensitive, highly valuable, you need to act as though that’s true. So here are a couple of slides that talk about measures that many companies undertake. The first is incredibly important if a company does business worldwide, or at least outside of the United States, and that is contracts. And that’s because not all industrialized countries recognize trade secret law in the way that the United States recognize trade secret law. So therefore, the ability of a company to claim that it has a proprietary interest, a property interest in information will often depend on how well-written their contracts are. And these contracts need to be with employees, whether full-time or part-time, independent contractors.

And think about independent contractors, they are often working with one company, then another company, then another company. And they are often in circumstances where they have a great deal of confidential information about many different companies. Consultants, volunteers, and strategic partners. And we often don’t think of having contracts with volunteers or with interns, sometimes because we’re not paying them a wage. But indeed they are in possession of information just by virtue of working with the company, working on projects, working with company employees. And often a volunteer can be a younger person, who’s not yet been introduced to the ethics of the business community. They may not realize that certain information has strategic value because it’s confidential.

So, you need to think about your communications with your volunteers and your employees. You want to think about how you use policies that may be circulated, for example, by email. In my own law firm occasionally my law firm chairman will circulate an email and state that we need to reply to that email and state we have read it and we understand it and it can go into our files. So, next is company policies and there’s really two kinds of company policies. The kind that people write and then they put on a shelf and no one reads them, and no one knows they’re there.

And the company pulls them out at some point in the future when they want to try to enforce them. You want to be sure that you are the other kind of company, the kind that drafts the policies, posts them, circulates them, for example, by email. Occasionally reminds employees of the existence of certain policies and how employees can conform their behavior. Another approach, notices, posting them conspicuously. Having a notice that says people cannot walk past this point, unless they’re escorted. People cannot walk past this point, unless they have a badge, or some other kind of identifier. And, to send reminder notices to staff.

Remember, of course, that you’re probably always bringing on new people, and you may have had this very same discussion with your employees six months ago. But you may have a 5% turnover and you’ll have new people on board who don’t know about these policies, so staff education is very important. And what that does, it begins to create a culture where your employees and your staff are mindful of the fact that there is indeed confidential information within the company. That this information gives the company a value, it’s a way of keeping the company competitive. It’s a way of creating additional value if the company is going to partner up with another company or be acquired in the future.

And it can help people change their own behavior to conform to those requirements. You’ll want to think about your procedures for checking in and checking out information. If it’s electronic, you can have an audit trail so you know who has access to information. You’ll want to be sure that people log in and log out. And that when people are accessing your technology remotely, you have the kind of technology trail that first of all can limit who has access and can require of course authentication procedures. Here’s another list of procedures you should at least consider. I want to take a moment to say that it isn’t a requirement that you use all of these procedures.

It’s a reminder that you have to think about, which of these make sense, in light of the value of that trade secret, how large or small your company is, how much of a burden it will be to implement these procedures. And indeed, later down the road, when there has been a misappropriation, how much you will wish that you had actually implemented these procedures. So again, another method that you can use is to restrict visitor access. Is there really a need for visitors to come on site and see your manufacturing floor, to see what kind of equipment you’re using. To see the design and the layout and the workflow. Think of physical security.

Indeed, many trade secrets are lost because people indeed, physically remove digital storage devices, remove documents, have physical access to areas of the company. They should not have physical access.

The need to know is a concept where even if there are perfectly ethical people within the company, it doesn’t mean that you give them access to everything the company has. You want to allow access to those company secrets and processes, where employees need to know them to do their job. But you don’t need to give access to everyone merely by virtue of the fact that they happen to be an employee or an officer or a director. Of course, shredding, deleting, and destroying documents is a perfectly lawful way to eliminate the likelihood that certain materials with confidential information will fall in to the wrong hands. This is an act that you’ll want to work with your attorneys closely.

Because there are circumstances where shredding, deleting, and destroying documents is illegal because it can be the destruction of evidence. There’s also certain documents where you need, for legal reasons, to retain them for four years or six years or eight years. So, work closely with your lawyers on that point. The next issue, disclosing only what is absolutely necessary. Let’s say you’re having some initial business discussions with a potential strategic partner or perhaps a company that might be a manufacturer for you. You probably don’t need to disclose the entire manufacturing process and the ingredients. And the sources of supply if you merely need to know whether that particular company has the capacity to meet your demand.

Also, you’ll disclose as little as possible, so only what is necessary, as little as possible. But of course you want to disclose what you need to disclose to accomplish a business goal. Exit interviews, this is a great opportunity for a business to work with their human resources director and their attorney. Exit interviews are great for HR purposes. Meaning develop a check list, walk through the check list and make sure you have all of the information you need from any departing employee. And much of it is just administrative. What’s their current address? How do you reach them to send them their final paycheck? Information you may need for taxes.

But we also use exit interviews as a way of reminding people as they’re leaving the company that there are obligations that continue even after they leave. And those obligations certainly include trade secret. And depending on the contracts you have with your employees, they may also include obligations not to solicit customers, not to solicit your workforce. So use your exit interviews as a check to keep track of that information. And indeed I had a situation a couple of years ago where my client was very worried about a particular engineer who was leaving the company. He was leaving on bad terms, he was quite hostile, I was invited to the exit interview.

And as you might expect, this employee refused to sign any document indicating that he had been present at that interview. But I, myself, conducted the part of the interview dealing with trade secrets. And about 45 minutes later after the interview I received a phone call from the company’s CEO that the IT department had detected that a technological back door had been built into the technology. And certain company documents were being removed from the company server and redirected to another location. Moments later I was on the phone to the Department of Justice seeking the intervention of the FBI. And their first question was, how confident are you that it’s this employee, and that he knew this information was a secret?

And I was able to talk about the exit interview, the checklist, and my own participation in that interview. And one of the reasons that law enforcement cares very much about the procedures that you take to protect your information is their burden of proof is beyond a reasonable doubt. Beyond a reasonable doubt. That’s a very high standard and so if you ever need law enforcement to assist you, you need to conduct your business protocols at that very high standard. And indeed the FBI got involved and all of the information was retrieved. And finally, when people are leaving, don’t forget to retrieve documents or materials from them. And don’t forget to ask whether they have any materials at home on home computers.

Because, indeed, who isn’t working at home these days or on a mobile device?