Posts Tagged: "James Pooley"

“Need to know” is a bedrock tenet of information security. You only get to see it if you need to see it. The reasoning is that the fewer people who know the details, the lower the risk that information will be compromised by reaching the competition. Another term used among professionals is the “principle of least privilege,” borrowed from the notion in computer science that a user account should be given only that level of privilege that is absolutely necessary to its operation within the system, making failures less likely. By whatever name, the principle increases control by limiting access. The idea that any one person in an organization probably doesn’t need to know much is rooted in the industrial revolution. When we moved from the age of craftsmen who made an entire product to the assembly line, the worker mounting the wheel didn’t have to know anything about the rest of the car…. Keeping secrets has long been viewed through the same lens: compartmentalization helps keep things under control. But interestingly, it doesn’t always make things more efficient or productive.

In over 40 years of handling trade secret disputes, I have seen plenty of “successful” results, but never a time when my client said, “Gee that was fun; let’s do it again!” They may tell me they’re happy with the outcome, but hey, I know that it also feels good to stop hitting yourself with a hammer. It’s a fact that more than 90% of trade secret cases settle without a trial. But too often those settlements only happen after years of litigation. There are ways to make that process less painful, and in an earlier article we looked at the advantages and limitations of arbitration and private judging as means to recapture some amount of control over the dispute. But unless the parties already had an arbitration agreement before the problem arose, one of them will probably see an advantage to playing it out in court….This is precisely why that other form of alternative dispute resolution, mediation, is the perfect method for resolving trade secret disputes.

My head was turned by the recent news of President Trump’s final-day pardon of Anthony Levandowski, the former head of Google’s self-driving car unit who was recruited into Uber with full knowledge that he had downloaded 14,000 confidential files on his way out, and who was later convicted of trade secret theft. I was struck by the White House statement of justification. It said that Levandowski – who hadn’t yet served a day of his 18-month sentence – “has paid a significant price for his actions.” I have no doubt that Levandowski has “paid a significant price” for his misdeeds, but it caused me to think about the price paid by others who were involved in this fiasco of a hiring, most specifically Uber. Salacious stories like this one serve as a reminder of all the things that can go wrong when we hire someone from the competition. Especially when we stop thinking about risk and see only upside. So, let’s talk about that risk and what you can do to keep yourself out of trouble – and never, ever need a presidential pardon.

One of the uniquely fascinating aspects of trade secret disputes is that they are laced with unbridled emotions, accusations of treachery, and actors who angrily disagree over basic facts. In other words, they provide a perfect metaphor for the year 2020. Let’s take a look back at the cases this year that are worthy of comment, either because they involved some unusual set of facts or because they provide useful guidance for behaving better in 2021.

The conversation begins, “Can you keep a secret?” “Yes, of course,” they say. What happens next? Naturally, you tell them what it is that you are going to trust them with. That’s the way it happens in personal relationships. In business, it’s usually more complicated. And it depends a lot on who you’re talking to. Let’s first consider the employee confidentiality agreement. In some smaller businesses, especially in the “low tech” economy, employee non-disclosure agreements (NDAs) may not be necessary, because workers neither create nor are they exposed to company secrets. But if you’re making things from a private recipe, or if employees learn sensitive information about customers, it’s a good idea to have these contracts. And if you’re in a knowledge-based industry, they’re more or less essential.

In the wake of urban unrest in the early 1960s, local governments imposed nightly youth curfews, and a Massachusetts legislator suggested that all radio and television stations begin their 10:00 evening programming with an announcement: “It’s 10:00 PM. Do you know where your children are?” The phrase was quickly picked up across the country and became a common (and sometimes mocked) cultural artifact of the era…. For modern business, if you can indulge the metaphor, we may think of data assets as the children of the enterprise, at least in the sense that valuable information is vulnerable to loss or compromise. Reminding companies of the need to be vigilant makes a lot of sense.

Tuning in to the recent sentencing of Anthony Levandowski for criminal trade secret theft, I was reminded of the wise observation about relationships, that remembering the ending is a way to forget about the beginning. But while that way of thinking can be a salve for the heart, it’s not so helpful when it comes to the kind of critical self-analysis that we need to improve our behavior, or at least certain outcomes, in business. It’s natural for us to be attracted to the drama of trade secret litigation. These cases typically involve claimed treachery of some kind, contrasted against an alternate narrative of entrepreneurship and helpful market disruption. Indeed, as I have often remarked to my students, trade secret cases are a trial lawyer’s dream, because you are dealing with the kind of emotional issues that can draw in a jury and make it easy to keep attention focused on the story you’re trying to tell.

Back in ancient times, in this case 1990, John Gray, an obscure “relationship counselor” with a correspondence degree in psychology, was perplexed. The communication problems of the heterosexual couples he worked with were so serious that he couldn’t explain them by individual circumstances. His clients seemed to be talking past each other, almost as if they were coming from different planets. With that tired metaphor in mind, he penned the book Men Are from Mars, Women are from Venus, generalizing what he thought were the universal, contrasting communication styles of the sexes…. In effect, [Gray] has become rich by talking about how incompatible men and women are, despite eons of evidence to the contrary. In our world of intellectual property, it once was like this between patents and trade secrets.

If you run a business that depends on data to drive success — and what business doesn’t these days? — this tendency of information assets to escape is a major, perhaps existential, risk. Given that those assets are handled by human beings, the management challenge can feel a lot like trying to contain . . . a virus. The metaphor is not perfect. After all, a virus, unlike bacteria, is rarely considered valuable or helpful. But I believe the comparison is apt and useful in many ways, not least as a mnemonic device to help us stay focused on the difficult but necessary discipline of caring for the integrity of the company’s most valuable property, just as we care for our individual health. So stay with me as we look at several main areas of overlap between trade secret management and pandemic response. To begin with, let’s recognize that our concerns are not only about our own information propagating outwards, but also about blocking unwanted information from infecting our data systems. So our control systems are naturally tuned toward containment: keeping our data in and others’ data out.

In last month’s post, Part 1 of this series, we considered the view of European academics that trade secrets are not “intellectual property” because they don’t give the power to exclude others, like patents, copyrights and trademarks do. But considering that trade secrets are treated throughout the world like a kind of property – they can be transferred and taxed, and stealing them is considered theft – we concluded that what matters is not exclusion, but control. It is the ability to control access to secret data that can give companies an advantage over others that don’t know about it. We considered the example of an Armenian family that has managed to keep – and profit from – the secrets of making the very best orchestral cymbals for four centuries. They did this by sharing only within the family, where presumably they had available some compelling ways to enforce trust. For the rest of us in the modern, globalized and digital economy, we have what looks like an impossible task. How do you protect the company’s secrets when they are zooming around the globe at the speed of light and accessible by thousands of employees, contractors, partners and vendors, each with a small supercomputer in their hands? More specifically, what do you do when those people go home in the evening and use those same little devices to participate in various forms of social media, where they are relentlessly instructed to share the most molecular details of their lives with hundreds or thousands of “friends”?

Sometimes it seems that trade secrets are always fighting for respect. I recently ran into a friend who teaches at a European university. He somehow found a way to squeeze into the conversation a pronouncement: “You know, trade secrets are not property.” Stay with me; this gets interesting. I sighed, because I knew what was coming. I’d heard it many times before. “The essence of property,” he said, “is the ability to exclude others, and that doesn’t exist with trade secrets. Anyone is free to discover the same information, or to reverse engineer a product to learn how it is made.” I acknowledged that trade secret rights are not exclusive, and it’s easy to reverse engineer some things. “But what about secret formulas, like Coca-Cola’s, and secret algorithms, like Google’s? And companies often make products using processes that you can’t figure out by looking at what’s public.” He was ready with the ultimate squelch: “Sure, but all of that is not property, because you can’t exclude anyone; you might not even know when someone is using the same so-called secret. If you can’t order them off, it’s not property.”

According to Merriam-Webster, the “Word of the Year for 2019 is “they” when used in the singular, typically to avoid ascribing a gender to the person being referred to. The larger point is this: language matters. Since this is a space dedicated to secrecy, let’s consider how we use language to determine who gets access to our trade secrets. For today, we’ll be looking specifically at how government does this. After all, they write the laws and so should be practiced at defining exceptions to property rights. Why should the government care at all about business secrets? Examples will help us here. Locally, the fire department needs to know what hazardous chemicals you might be storing at your plant, in case they have to come and put out a fire there. For different but equally compelling reasons, the Food and Drug Administration (FDA) insists on knowing exactly how drugs are made, and the Environmental Protection Agency (EPA) requires submission of pesticide ingredients. And then there is the government as consumer: last year the U.S. spent over $550 billion on purchasing goods and services from the private sector, and with all that economic clout comes the right to demand access to a lot of related data.

The spectacular failure of blood-testing firm Theranos is the subject of a riveting book, Bad Blood by investigative reporter John Carreyrou, and an engaging documentary, “The Inventor” on HBO, focusing on Elizabeth Holmes, the once-celebrated wunderkind who dropped out of Stanford at age 19 to “change the world” with a device that would perform hundreds of diagnostic tests with a few drops of blood from a finger stick. It’s a story made for Hollywood (Jennifer Lawrence will play Holmes in the forthcoming movie), filled with lies, deception, threats and sex, set in a Silicon Valley startup. But even the Theranos story doesn’t mean that trade secret law is inherently dangerous. Consider Apple, one of the world’s most secretive companies. (Holmes famously modeled her clothing and business habits after Steve Jobs.) Apple has consistently used NDAs and secrecy management to protect products under development, to great effect when they are ultimately unveiled, all without touting non-existent technology. And it’s easy to imagine how Theranos might never have happened if investors and business partners had been less credulous and more insistent to understand the technology.

Management of trade secrets is fraught with competing interests. There is the tradeoff between security and inconvenience—for example, the annoying wait for a special code to allow “two-factor identification” when you already have your password handy. There is trusting your employees while knowing they might leave to join a competitor. And there is the tension between corporate secrecy and the public interest, such as when the fire department insists on knowing what toxic chemicals are used in your facility. And now we have the cloud (like “internet,” its ubiquity merits lower case), which offers unparalleled convenience and flexibility to outsource corporate data management to others. But moving IT functions outside the enterprise creates new vulnerabilities for that data, which happens to be the fastest growing and most valuable category of commercial assets. So understanding this environment has to be a high priority for business managers.