Five Steps to Lower the Risk of Trade Secret Theft from Business Partners

As stories of international and domestic hacking and espionage dominate the news cycle, it’s easy to forget that when it comes to trade secrets, employees and business partners—not hackers—pose the biggest threat. See David S. Almeling et al., A Statistical Analysis of Trade Secret Litigation in Federal Courts, 45 Gonz. L. Rev. 291 (2009/2010).

In a recent webinar, Gordon & Rees addressed protection of trade secrets and proprietary information from employee theft. Here, we address some steps to help prevent business partners from misusing your trade secrets.

  1. Identify your trade secrets and control access to them

Before any agreements are drafted or any information or documents are exchanged, be sure you have identified your trade secrets (see also the definition under the Uniform Trade Secrets Act). You can’t protect them unless you know what they are. This sounds like common sense, but surprisingly, in the hustle and bustle of everyday work, not all companies take the time to do this until they’ve realized their trade secrets have ended up in the wrong hands. (Unless it is appropriate for your industry, referring to everything as a “trade secret” is not helpful, either—for example, your business partners are less likely to take your actual trade secrets seriously if you claim that information you have made public are also trade secrets.)

A trade secret “registry” could be considered favorable evidence in court—as long as it is timely updated and actually distributed to employees. See Schalk v. State, 823 S.W.2d 633, 643 (Tex. Crim. App. 1991). This registry will also help your own employees with the marking the proper designations when such information is exchanged with a business partner.

Securing your trade secrets in-house will not only help your case in court, it also helps when it comes to disclosure to third parties, particularly inadvertent disclosure. Chances are, not every employee will require access to every trade secret. Secure physical and electronic access to the appropriate trade secrets to the appropriate personnel.

What measures are appropriate will depend on the circumstances and will likely evolve with time and technology. Information stored on secure servers that had three layers of physical security passwords, 256-character PuTTY keys, with portions possessed by only a single person was found by a court sufficient evidence for a jury to conclude that a trade secrets owner took appropriate measures to protect its trade secrets. Xtec, Inc. v. CardSmart Techs., Inc., No. 11-22866-CIV-ROSENBAUM, 2014 U.S. Dist. LEXIS 184604, at *26 (S.D. Fla. May 15, 2014).

On the other hand, where information was distributed to 600-700 people where at most only 190 people signed confidentiality agreements, and where that same information was not stamped as “confidential,” a court found that no reasonable jury could conclude that “reasonable efforts” were made. Tax Track Sys. Corp. v. New Inv’r World, Inc., 478 F.3d 783, 788 (7th Cir. 2007).

  1. Draft tailored non-disclosure agreements (“NDAs”)

Before any information is exchanged with a business partner, have your attorneys help you draft a non-disclosure/confidentiality agreement tailored to the arrangement. Not only will this agreement help you in case you need to litigate the matter, it will provide the protocols for your business partner to follow.

Some provisions you and your attorneys will want to consider are the return/destruction of trade secrets at certain stages (and certainly when the relationship is terminated), a perpetual non-disclosure and non-use clause when it comes to trade secrets (as opposed to an expiring one), how trade secrets will be identified/marked (and the ability to later identify/mark previously exchanged documents), and requirements for the business partner’s employees to sign individual NDAs and/or obtain training on how to handle trade secrets.  This is not an exhaustive list—work with your attorney to flesh out the agreement.

Be wary of stock or template agreements; many of them may not contemplate the specific issues that may arise in your situation. Many “standard” agreements also contain language that relieve the business partner of its contractual obligations of non-disclosure and non-use as soon as the trade secrets are made public—without specifying that such public disclosure must have been authorized by the owner of the trade secret, and without giving the owner the chance to mitigate the effects and damage of the unauthorized disclosure.

But no matter how perfect the agreement, it won’t matter if it isn’t properly implemented.

  1. Train your own employees

Identify all the employees who will be corresponding with the business partner and make sure you train them. Let them know what information can be exchanged, what cannot, which individuals from the business partner they can exchange information with. Provide them with a written checklist and designate a person most knowledgeable—or better yet, a specialized team to direct their questions to. This team should also conduct some “spot checks” throughout the relationship to make sure protocols are being followed.

If the relationship with the business partner will span more than a couple months, also have a plan in place to retrain your employees in regular intervals.

  1. Train the business partner’s employees

Even if you require individuals from the business partner’s company to sign an NDA, that may not be enough. You may want to provide the partner’s employees with the necessary training, or at least provide the partner with the necessary materials to provide the training themselves (and require them to do so as part of the NDA). Regularly communicate with the partner to make sure they are protecting your trade secrets, and have your employees and your specialized team pay attention to how the business partner is using this information as well.

  1. Create a contingency/emergency plan

Did an employee send a trade secret to the business partner without marking it as such? Has the business partner communicated plans that may violate the NDA?  Has the relationship with the business partner begun to go sour?

Your team should already have a contingency plan in place to deal with these—and other—situations, and protocols to continually improve security and access. Make sure you follow through on enforcing contractual provisions, and make sure you act swiftly.

In closing, remember that when dealing with trade secrets or handling other proprietary, confidential or otherwise private information, nothing beats being prepared.

DMCA Safe Harbor and Takedown Notice Checklists

The Digital Millennium Copyright Act (DMCA) offers protection against liability for website owners from third-party content. Copyright owners can also demand removal of their copyrighted works by following the rules provided by the DMCA.

Below are some checklists for website owners as well as copyright owners.

Website Owners: Do You Need Protection from the DMCA Safe Harbor Provisions?

Should you set up DMCA notification policies? If the answer to any of the following questions is “yes,” you likely want to ensure that the DMCA safe harbor provisions will protect you.

  • Is your site reliant on or otherwise focused on user-provided content?
  • Are users likely to post infringing materials in the comments section, discussion boards, or forums?
  • Do you link to other sites that could be posting infringing material without your knowledge?

Keep in mind that there may be other less-typical circumstances where you would also want to consider DMCA safe harbor protection — the key is whether your site will feature a lot of third-party content that may be infringing.

Website Owners: Protecting Yourself Under the DMCA Safe Harbor Provisions

Once you have decided that you will likely need protection under the DMCA safe harbor provisions, below are the conditions you must satisfy.

  • If you have the right and ability to control the infringing activity, you must not receive a financial benefit directly attributable to that activity.
“Right and ability to control” has been interpreted by many courts to mean something more than just the ability to locate infringing material and terminate users’ access. It has been found where:

  • a site owner organized torrent files with specific search terms describing material likely to be infringing (e.g., “screener,” “PPV”), personally assisted users in locating infringing files, or personally screened files to remove fake, infected, or bad torrents; and
  • a service provider gave participating websites detailed instructions regarding issues of layout, appearance, and content, refused access to its system until the sites comply with its requirements, or monitored images to ensure that the sites did not primarily consist of celebrity images;

“Right and ability to control” has not been found where:

  • the site owner could have implemented and did implement automatic filtering systems and could have merely searched for potentially infringing content.

“Financial benefit” can include advertising revenue.

  • You must not have actual knowledge that the material is infringing.
Generally, knowledge is not imputed on the website owner simply due to the material’s existence on the website.
  • Upon learning that the material is infringing, you must expeditiously remove such material.
What constitutes “expeditious” has not been further explained in the statutes, and likely depends on the circumstances. Courts have generally found that removing infringing materials within a few days is “expeditious”; for DMCA notices identifying 170 videos, 3.5 weeks has been considered “expeditious.” A processing time of four to 17 months, on the other hand, may not be “expeditious” — the court left the issue up to a jury to decide.
  • You must designate an agent to receive DMCA notifications; this agent’s name, address, phone number, and email must be on file with the U.S. Copyright Office and available on your own site.
Make sure to:

  • keep this information updated and current;
  • have someone regularly check correspondences, preferably daily;
  • for email, double-check your spam filters; and
  • for online forms, double-check that these work.

If the forms are forwarded to an email address, double-check spam filters. Certain email providers will flag online form emails as a “spoofed” email.

If you need to provide certain instructions to the copyright holder (e.g., how to provide a link to a comment or bulletin board post that will be specific enough for you to identify the infringing material), make that information available as well.

  • You must have adopted and reasonably implemented, as well as informed users, a policy that terminates the accounts for repeat infringers in appropriate circumstances.
The statute does not define “appropriate circumstances.” The key here is to craft a reasonable policy, adhere to that policy, and inform users of that policy.In the Ninth Circuit, the website/service owner must also not actively prevent copyright owners from collecting information necessary to issue DMCA notifications. For example, a peer-to-peer file-sharing network that encrypted data as to which user was sharing which files was found not to have a reasonably implemented repeat infringer policy.
  • You and your site must accommodate and not interfere with standard technical measures.
The statute defines “standard technical measures” as “technical measures that are used by copyright owners to identify or protect copyrighted works” and

  • “have been developed pursuant to a broad consensus of copyright owners and service providers in an open, fair, voluntary, multi-industry standards process”;
  • “are available to any person on reasonable and nondiscriminatory terms”; and
  • “do not impose substantial costs on service providers or substantial burdens on their systems or networks.”

Congress attempted to think ahead with this provision, but to date, nothing has qualified as “standard technical measures.”

At least one court has rejected the argument that providing an online image-cropping tool that could potentially crop out copyright watermarks would constitute interference with “standard technical measures.”

Copyright Owners: Issuing DMCA Takedown Notices

Before issuing a DMCA takedown notice, here are some questions to consider:

  • Do you own the copyright? If not, are you authorized by the copyright owner to issue the takedown notice? You must answer “yes” to one of these questions.
  • Keeping in mind fair use, is the material infringing?
Misrepresentations of infringement may make you liable for damages suffered by the other party, including the attorneys’ fees and costs they incurred.Whether a use constitutes fair use can be a complicated issue, but usually the following uses are not considered infringing: criticism, comment, news reporting, teaching, scholarship, research, or parodies.

Have you completely filled out the DMCA notice? If you do not, then the infringing material may not be removed.

    • You must identify the work being infringed upon (e.g., copyright registration number, URLs for the official work, or title/author information).
    • You must identify the infringing material with specificity such that it can be easily located by the host (e.g., URLs of pages or images).
    • You must provide your contact information, including address and telephone number, and email address if available.
    • You must state that you have “a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law.”
    • You must also state that “that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.”
    • You must provide a signature, electronic or otherwise.

If the host refuses to act, or if the user issues a counter-notification, would you want to litigate the issue in courts? If so, your copyrighted material may have to be registered with the U.S. Copyright Office.

If there is a counter-notification and you would like to keep the infringing material off the website, you only have 10-14 days to file a lawsuit. Some federal districts require only that you have begun the registration process; others hold that you will need an issued registration at the time of filing the lawsuit. As case law is continually updated, you will have to verify the applicable law before issuing the DMCA takedown notice if litigation is a possibility.


What Octane Fitness Means for Determining “Exceptional” Patent Cases

While many argue that the U.S. Supreme Court’s recent opinion in Octane Fitness LLC v. Icon Health & Fitness Inc. means bad news for so-called patent “trolls” (i.e., entities that buy patents solely for the purpose of suing others for infringing the claims of the patent), the reality may be that the new, relaxed standard for proving an “exceptional” patent case will result in little change to the legal landscape.

The Patent Act, specifically 35 U.S.C. § 285, authorizes district courts to award attorneys’ fees to prevailing parties in “exceptional” cases.  In 2005’s Brooks Furniture Mfg., Inc. v. Dutailier Int’l, Inc., the U.S. Court of Appeals for the Federal Circuit defined an “exceptional” case as one that involves material misconduct related to litigation, or misconduct related to securing the patent.  Absent such misconduct, sanctions could be “imposed against the patentee only if both (1) the litigation is brought in subjective bad faith, and (2) the litigation is objectively baseless.”  The parties must also establish the “exceptional” nature of the case by “clear and convincing evidence.”

On April 29, however, the Supreme Court rejected the standard set by the Federal Circuit, finding it unduly rigid.  Instead, the Supreme Court found that “an ‘exceptional’ case is simply one that stands out from others with respect to the substantive strength of a party’s litigating position (considering both the governing law and the facts of the case) or the unreasonable manner in which the case was litigated.  District courts may determine whether a case is ‘exceptional’ in the case-by-case exercise of their discretion, considering the totality of the circumstances.”

The Supreme Court also rejected the “clear and convincing evidence” burden on the movant, finding that “Section 285 demands a simple discretionary inquiry; it imposes no specific evidentiary burden, much less such a high one.  Indeed, patent-infringement litigation has always been governed by a preponderance of the evidence standard.”

In Highmark Inc. v. Allcare Health Mgmt. Sys., 134 S.Ct. 1744 (2014), a Supreme Court opinion issued the same day that is in line with the notion that district courts are to be given more discretion in determining § 285 issues, the high court found that district courts’ § 285 decisions must be reviewed by appellate courts under an “abuse of discretion” standard rather than a de novo standard.

In Octane Fitness and Highmark, the Supreme Court remanded the cases in light of the new standards.

While the district court presiding over Octane Fitness adopted the prior, more rigid standard under Brooks Furniture, nothing in its Sept. 6, 2011, decision denying attorney’s fees and costs under § 285 indicates that the district court would change its mind under the new Octane Fitness standard.  Although the district court ultimately found the infringement theory unpersuasive, it did not find the claims frivolous.  The district court was unmoved by the fact that the patentee never commercialized the patent at issue (though the patentee appears to have commercialized other fitness equipment). The district court also was unmoved by email records from stray employees stating that the lawsuit would bring a competitive advantage, as patentees are entitled to exclude all infringers, and “[s]imply bringing suit to gain a competitive advantage is not evidence of bad faith.”  Therefore, even under the new, less rigid standard, the court may nevertheless find that the Octane Fitness case is not “one that stands out from others with respect to the substantive strength of a party’s litigating position . . . or the unreasonable manner in which the case was litigated.”

Indeed, courts, having been given more rather than less discretion, may very well arrive at the same result under the old and new standard.  On May 12, a U.S. District Court in Texas was unwilling to modify its pre-Octane Fitness decision that denied attorney’s fees under § 285.  In Bianco v. Globus Med., Inc., Case No. 2:12-CV-00147-WCB, 2014 U.S.Dist.LEXIS 64805 (E.D.Tex. May 12, 2014), the court had previously found that the plaintiff should not be listed as a co-inventor of certain patents. However, the plaintiff’s claims regarding co-inventorship were not frivolous, nor did the case otherwise “set itself apart”: The plaintiff did provide a set of drawings reflecting his ideas to the defendant, and the defendant admitted receiving and examining them.  Further, the court found that “[i]t is common ground between the parties that the drawings, in the context in which they were submitted, constitute the contribution [plaintiff] made to the development of the disputed products.”  The defendant’s claim for § 285 “exceptional” fees as to the co-inventorship issue also was likely unconvincing given that a jury had found the defendant otherwise liable for misappropriating the plaintiff’s trade secrets.

Legal experts and commentators have opined that the relaxed standards of Octane Fitness may apply mostly to lawsuits filed by patent trolls.  Given the White House’s stance on such trolls, and the heightened joinder requirement for patent lawsuits under the America Invents Act (targeting the fact that patent “trolls” were filing one lawsuit against multiple, unrelated defendants), it’s not unreasonable to think that the Supreme Court feels similarly wary (and weary) of patent trolls.  But if the Supreme Court does feel that way, Octane Fitness does little to propel patent troll lawsuits to “exceptional” cases warranting attorneys’ fees.  Cases must still stand out “from others with respect to the substantive strength of a party’s litigating position (considering both the governing law and the facts of the case) or the unreasonable manner in which the case was litigated.”  In other words, what’s at issue is still the strength of the case or other misconduct.  Absent a commercial use requirement for patentee-plaintiffs (which would present its own set of problems), patent trolls appear to be held to the same standards as any other patentee-plaintiffs.

Given the relaxed standards of proof, and the Supreme Court’s reiteration of the district court’s ability to decide § 285 issues with discretion, the real impact of the Octane Fitness decision may simply be that fewer parties will decide to appeal § 285 rulings.  Time will tell if Octane Fitness will affect patent trolls more so than other patentee-plaintiffs.