Trade secret protection is essential for two reasons.
- Instituting trade secret protection best practices reduces the risk of theft.
- Following these best practices provides legal protection should a theft occur.
What is a Trade Secret?
According to the US Patent and Trademark Office, a trade secret is:
- is information that has either actual or potential independent economic value by virtue of not being generally known,
- has value to others who cannot legitimately obtain the information, and
- is subject to reasonable efforts to maintain its secrecy.
Your legal claim to protection of your trade secrets lasts as long as these conditions are met. As the US Patent and Trademark Office puts it, “if any element ceases to exist, then the trade secret will also cease to exist. Otherwise there is no limit on the amount of time a trade secret is protected.”
That said, your trade secret is not necessarily protected. The Economic Espionage Act requires that you take PROACTIVE cybersecurity and other security measures to protect your trade secrets.
Trade Secret Protection Best Practices
The following checklist is a best practices starting point, not a definitive list. It is also not legal advice. Work with your corporate counsel, or company law firm, to fill in any gaps which might be unique to your business. Just understand you can’t show up in court and whine, “They stole my trade secrets,” if you haven’t taken “reasonable measures to keep such information secret.” 18 U.S.C. § 1839 (3).
Following these guidelines will help you to legally protect your trade secrets, and your business.
Written Confidentiality Policy
Create a written company confidentiality policy. It should describe specifically what is considered confidential, and what is not. How and where employees may (and may not) use and store the information should be stated is also important. Make sure the policy is in alignment with and does not conflict with other company policies, such as your Recording in the Workplace policy.
Nondisclosure Agreements
Obtain nondisclosure agreements from employees, visitors, and vendors. Without this basic trade secret protection document, the chances of winning your case in court are slim and… (you know the rest of the saying).
Proactive Security Measures
Locks, alarms, and guards are fine, but they are considered average and minimal protection for the general business environment. Elevated security for confidential information, including the spoken word, requires special protection to obtain trade secret status in court. Here’s why…
Many of the technologies used in businesses these days are information sieves, literally bugs in a box, and hacking them isn’t the only concern. Business espionage is thriving, and employee spies are just as active as outsiders. The sophistication of bugging devices is up, and the prices are way down. Add to this, all the classic spy tricks still work, and are being used.
The solution to keeping the business environment free from hack-able office technologies, electronic eavesdropping, and detecting the classic spy vulnerabilities is the Technical Surveillance Countermeasures (TSCM) survey. Documentation of these periodic surveys goes a long way in court to show extra due diligence. Think of it as cheap security insurance, but better… TSCM surveys can prevent losses in the first place!
Document Classification
Not all information is created equal. You just can’t stamp TOP SECRET on everything and expect to be taken seriously. Figure out just how secret all your information is, and classify it accordingly. A common classification scheme is: Top Secret, Secret, Confidential, and Unclassified.
Employee Education
Once you have a written policy and procedures, and a classification scheme, the next step is to make sure employees know about it. Ensure they know their specific responsibilities and obligations when it comes to protecting trade secrets and sensitive company information. Include it in the employee handbook, new employee orientation, and periodically via a company-wide training session. Document your efforts.
Password Protection
Although password protection is a universally accepted security basic, some people still refuse to take it seriously. Some people use easy-to-guess passwords, some write them on post-it notes, and some refuse to use them at all. Your TSCM security survey will spot many of these loopholes, but make sure password protection is part of the written policy and employee education process.
Encryption
Employ encryption when storing confidential data, and whenever sensitive communications take place between the same two points on a regular basis (e.g. between the office and regular clients; mobile phones, homes of executives, field offices, etc.).
Need-to-Know Access
The CIA has a policy of compartmentalization, and for good reason, not everybody needs-to-know everything. Also, when there is a leak, they know where to start looking for the leaker. Need-to-know access needs to be implemented even-handedly if it is to be viewed as smart security rather than exclusionary.
Consider Recommendations
Pay attention to employee, vendor, and consultant suggestions about improving your trade secret information security. You don’t want your IT manager being cross-examined on the witness stand saying, “I tried to tell them, but nobody listened.”
Employee Exit
Employees come and go, but when they go, make sure they are not taking anything with them. Have a standard exit procedure that includes a review of their nondisclosure agreement and a written statement acknowledging they understand obligations. If there is any doubt about their honesty, or it is a for-cause firing, consider confiscating their company-provided electronics and doing a data extraction inspection.
Following this list of trade secret best practices is a great start towards the development of proactive security measures needed to protect your trade secrets. To learn more, or to make an appointment for a Technical Surveillance Countermeasures consultation with our information security advisors, contact us today.
###
Murray Associates is an independent security consulting firm, providing eavesdropping detection and counterespionage services to business, government and at-risk individuals.
Headquartered in the New York metropolitan area, a Murray Associates team can assist you quickly, anywhere in the United States, and internationally.
EXTRAS:
• More security tips, spy and privacy news at spybusters.blogspot.com. Be sure to sign up for the free email updates.
• Concerned about Spy Cameras? Learn how to detect them.
