The enactment of the Defend Trade Secrets Act (DTSA) of 2016 in the United States creates a new paradigm and is a watershed event in intellectual property law. Former U.S. President Barack Obama signed the bill into law on May 11, 2016, and the DTSA now applies to any misappropriation that occurred on or after that date. A trade secret is any technical or nontechnical information that can be used in the operation of a business or other enterprise and that is sufficiently valuable and secret to afford an actual or potential economic advantage over others.
The law allows trade secret owners to file a civil action in a U.S. district court for relief for trade secret misappropriation related to a product or service in interstate or foreign commerce. The term “owner” is a defined statutory term. It means “the person or entity in whom or in which rightful legal or equitable title to, or license in, the trade secret is reposed,” according to the DTSA. Under the DTSA, in extraordinary circumstances, a trade secret owner can apply for and a court may grant an ex-parte seizure order (which allows property to be seized, such as a computer that a stolen trade secret might be saved on) to prevent a stolen trade secret from being disseminated if three conditions are met.
First, the owner must demonstrate, in a sworn affidavit or a verified complaint, that the ex-parte seizure order is necessary. The owner must then prove that a temporary restraining order is inadequate. Second, that immediate and irreparable injury will occur if the seizure is not ordered. Third, that the person the seizure would be ordered against has possession of the trade secret and property that is to be seized. Once the ex-parte seizure order is granted, the court must take custody of and secure the seized property and hold a seizure hearing within seven days. Individuals can also file a motion to have the seized material encrypted.
With this development in the law, trade secret assets are no longer stepchild intellectual property rights. Trade secret assets are now on the same playing field as patents, copyrights, and trademarks. The DTSA reinforces that a trade secret asset is a property asset by creating this new federal civil cause of action.
And there is no preemption. The U.S. district courts have original jurisdiction over a DTSA civil cause of action, which coexists with a private civil cause of action under the Uniform Trade Secrets Act (UTSA), which codified common law standards and remedies from the state level for trade secret misappropriation. It also coexists with criminal prosecutions under the Economic Espionage Act of 1996 (EEA), which makes it a federal crime to steal or misappropriate commercial trade secrets with the intention to benefit a foreign power.
And if the losses from a stolen or misappropriated trade secret are severe, both the board of directors and senior executives of the company will be charged with malfeasance, including the willful failure to take reasonable measures to protect the corporate trade secret assets from insider theft or foreign economic espionage.
What the DTSA Means
A trade secret asset must be managed like other property assets. However, trade secret asset management differs because it first requires the identification of the alleged trade secret asset. Because millions of bits of information within a company can qualify as proprietary trade secrets, classification and ranking trade secret assets is a critical exercise.
Most companies focus on the protection phase of trade secret asset management without first identifying and classifying their trade secrets. This approach is doomed to fail without a thorough analysis. Unless the company knows what it’s protecting, there can be no effective protection. And all three phases—identification, classification, and protection—must occur before an accurate valuation of trade secret assets can be determined.
Additionally, information assets must be validated in a court of law as statutory trade secret assets. There is no public registry for trade secret assets. The courts require proof of existence, ownership, notice, and access (EONA). The first element requires proof of existence of the trade secret asset. The litmus test for proving the existence of a trade secret has six factors: the extent to which the information is known outside the business; the extent to which the information is known inside the business; the extent of measures taken to guide the secrecy of the information; the value of the information to the business and to competitors; the amount of time, effort, and money expended to develop the information; and the ease or difficulty with which the information could be properly acquired or duplicated by others.
For proof of ownership, the plaintiff must show that it is the person or entity in whom or in which rightful legal or equitable title to, or license in, the trade secret is reposed. A misappropriator cannot be the owner of a trade secret. However, a person who independently develops or independently reverse engineers the trade secret can be the owner of the trade secret. Further, an employee (who has not been assigned his or her intellectual property rights in the trade secret asset) may also be the lawful owner—instead of the employer.
For proof of notice, the plaintiff must show that the defendants had actual, constructive, or implied notice of the alleged trade secret. A former employee may use his or her general knowledge, skills, and experience. However, a former employee may not disclose or use the trade secrets of the former employer. The former employer cannot claim that “everything we do is a trade secret.” The court will take judicial notice that there is both unprotected and protected (trade secret) information in every company. If the line is unclear, the court will draw the line in favor of the ex-employee.
For proof of access, the plaintiff must prove that the defendant had access to the alleged trade secret. If the evidence shows that the defendant never had direct or indirect access to the trade secret, and there is no conspiracy claim (involving coconspirators that had access to the trade secret), there cannot be misappropriation. This is because misappropriation requires proof of unauthorized acquisition, disclosure or use of the trade secret by the alleged trade secret thief.
The DTSA also requires that the trade secret owner take reasonable measures to protect the secrecy of trade secret assets. This is a much more challenging task today because trade secret assets are no longer at rest in a locked file cabinet in an engineer’s office. Today, trade secrets are in motion and in use via computer systems and networks with access points all over the world.
This presents a huge challenge. Companies must actively monitor the access and movement of critical trade secret assets throughout the corporate enterprise, or risk the serious consequences of forfeiting trade secret assets by failing to take the reasonable efforts necessary to protect these assets.
The Valspar economic espionage case in 2009 is a case in point. In this incident, a 52-year-old senior scientist, David Yen Lee, suddenly resigned from Valspar on March 19, 2009, and bought a one-way ticket to Shanghai, scheduled to leave on March 27. Fortunately for Valspar, a coworker discovered irregularities in Lee’s work computer. Upon further investigation, an unauthorized program called “Sync Toy” was uncovered in invisible Windows files. It showed that Lee downloaded 44 gigabytes of paint and coating formulas, product and raw material data, sales and cost data, and product development and test information.
The FBI was informed and brought in to investigate. The bureau raided Lee’s Arlington Heights apartment and recovered the stolen trade secret assets before Lee’s flight left for Shanghai. Valspar escaped a major disaster because of the alertness of one coworker who spotted irregularities on Lee’s work computer. Like most companies, Valspar’s security readiness was directed to protection against outside intrusions. However, there was little security in place to guard against trade secret theft by insiders and trusted employees.Valspar now faced the reality that a trusted employee could steal a vast amount of trade secrets due to access to computer data and files. The solution: Valspar set up an internal identification and classification system for trade secrets called the CPR (Classify, Protect, Report) model. Valspar now tracks the movement of all critical trade secret assets within the various computer environments with triggers that are activated if unauthorized activities are detected.
The reasonable measures necessary for the protection of trade secret assets continues to grow as the risk of sensitive data loss increases by various means: unauthorized uploading of trade secret assets to an insecure cloud or Web application; unauthorized email communications disclosing trade secret information; unauthorized acquisition of highly classified trade secret assets onto USB drives; and undetected incoming malware, phishing emails, and corrupted Web software all facilitating foreign economic espionage and theft of corporate trade secret assets.
The DTSA provides powerful provisions for ex parte seizure orders, but companies cannot take advantage of these provisions unless effective trade secret asset management protocols are in place before the actual or threatened misappropriation occurs. A court can issue an ex parte seizure order, according to the DTSA, “in extraordinary circumstances” to “prevent the propagation or dissemination of the trade secret” or to “preserve evidence.” These circumstances exist when a trade secret thief is attempting to flee the country, if he or she is planning to disclose the trade secret to a third party, or if it can be shown that he or she will not comply with court orders.
The Valspar case is an excellent example of the necessity for ex parte seizure orders. However, the FBI will not always be there, and the window of time to protect against the loss of trade secret assets and destruction of the evidence will often be shorter than the eight-day period in the Valspar case. This is why a DTSA civil cause of action and an ex parte seizure order are so important to protect U.S. trade secret assets.
The protection of trade secret assets in these circumstances requires emergency actions. Once lost, a trade secret is lost forever. The DTSA requires that the plaintiff (the trade secret owner) file suit (with verified pleadings and affidavits filed under seal) and successfully obtain a DTSA ex parte seizure order before the defendants know the suit has been filed. Otherwise, without the element of surprise, the defendants—often with several clicks of a computer mouse—can transfer the trade secrets outside the country and destroy the evidence of trade secret theft by running data and file destruction software.
Therefore, to take advantage of the robust provision of the DTSA, the trade secret owner must be able to move faster than the trade secret thief. This will require a sea change since most companies have no internal trade secret asset management policies, practices, or procedures in place. Instead, most companies react after the fact by retaining outside counsel to investigate and litigate a long-gone trade secret.
The DTSA creates a new paradigm. If management waits until the trade secret theft occurs to identify what the trade secret is and investigate the evidence of misappropriation, the actual trade secret assets will be long gone before counsel can provide the U.S. district court with the proofs necessary to obtain an ex parte seizure order. The result: if the losses from the trade secret theft are severe, both the board of directors and senior executives of the company will be charged with malfeasance, including the willful failure to take reasonable measures to protect the corporate trade secret assets from insider theft or foreign economic espionage.
What are the next steps in view of the DTSA? Every organization is different. There are no one-size-fits-all solutions. Each trade secret asset manager must audit existing approaches to protecting trade secret assets, the resource allocations within the organization, and any budgeting issues with protecting trade secrets. However, the catchphrase “we are working on it” will no longer provide adequate cover now that there is a federal civil cause of action specifically designed to protect the trade secret assets of 21st Century, new economy companies.
A fundamental first step should be the creation of an internal trade secret control committee (TSCC). The TSCC should be charged with the responsibility to adopt policies and procedures for the identification, classification, protection, and valuation of the company’s trade secret assets. The next step should be the creation of an internal trade secret registry (TSR). This is a trade secret asset management system that can be deployed as a cloud-based solution, a corporate server, or a stand-alone work station.
The TSR should operate like a library card catalogue storing necessary trade secret asset information with hash codes and block chaining (a database that sequences bits of encrypted information—blocks—with a key that applies to the entire database) to ensure the authenticity of the data stored in the TSR and to meet the required evidentiary standards in a trade secret misappropriation lawsuit.
Another necessary step is trade secret asset classification, the foundation of a successful trade secret asset management program. This allows trade secret assets to be identified and ranked, so that the level of security matches the level of importance of the trade secret asset. There are now automated trade secret asset management tools available to assist companies with the classification and ranking of trade secret assets. Security, without identification and classification, is doomed to fail. In contrast, securing data after identification and classification of the trade secret assets makes it much easier for the internal security ecosystem to enforce trade secret protection policies and to prohibit unauthorized access, unauthorized disclosure, and unauthorized use.
Today, software tools can protect the company from mistakes that lead to the forfeiture of classified trade secret assets. If a user attempts to email a trade secret document to unauthorized recipients, the software program will immediately alert the user so the mistake can be corrected. Further, classified trade secret assets can be monitored. Administrators can track abnormal or risky behavior that otherwise cannot be tracked until the trade secret is compromised.
Developing a trade secret incident response plan (TSIRP) is another critical requirement. The flow of trade secret assets throughout the corporate enterprise should be tracked with built-in red flags, designed to trigger the TSIRP and activate a designated outside counsel SWAT team to proceed immediately to the courthouse to seek a DTSA ex parte seizure order (and other necessary relief) before the bad actors can destroy the evidence or transfer the stolen trade secret assets outside the court’s jurisdiction.
There are other best practices for trade secret assets now that companies are focusing on the various stages of identification, classification, protection, and valuation. Building a trade secret culture from the top down, with required training and compliance with TSCC policies, practices, and procedures, is at the top of the list. Companies must promote a trade secret culture by prompting employees and users to stop, think, and consider the business value of proprietary, internal information they are creating, handling, an reviewing. A major loss of trade secret assets can put the company out of business. Employees must understand that their jobs depend upon the identification, classification, and protection of the company’s trade secret assets. Onboarding procedures for new employees and offboarding procedures for departing employees are also very important.
The new employee interview process should include protections to prevent his or her former employer’s trade secrets from being exposed. This could include an inquiry to determine if the potential new employee is subject to post-employment restrictions with his or her former employer. If so, there should be a separate review by the company’s intellectual property counsel before the employee is hired.
Further, the new employee hiring process should include an investigation and certification by the new employee that no proprietary, trade secret information of any previous employer is being brought to the company or is being stored electronically in his or her personal email system or other electronic storage locations.
Finally, the prospective new employee should sign an employment agreement with patent and trade secret assignment provisions. He or she should also receive and review the company’s required trade secret policies and procedures. When an employee leaves the company, off-boarding procedures should include a mandatory trade secret exit interview. The interview should be conducted under strict procedures adopted by the TSCC, including execution of a trade secret acknowledgement at the conclusion of the interview certifying that all company devices, documents, and materials, including electronic copies, paper copies, and physical embodiments have been returned. It should also certify that all proprietary and confidential information, stored on any personal computer or mobile device, has been identified and preserved, returned, or deleted under the company’s instructions.
The enactment of the DTSA will usher in a new era. It requires trade secret owners to identify, classify, and protect trade secret assets as property assets. In time, the DTSA will become a precursor for new accounting systems that will provide valuations for trade secret property assets.
This development will unleash the reservoir of untapped intellectual property assets, which will fuel the growth of new economy companies in the Information Age.
by Mark Halligan, partner at FisherBroyles LLP, is recognized as one of the leading lawyers in trade secrets litigation in the United States by Legal 500 and Chambers USA: America’s Leading Lawyers for Business. He is an accomplished trial lawyer who focuses on intellectual property litigation and complex commercial litigation, including antitrust and licensing issues. He is also the lead author of the Defend Trade Secrets Act of 2016 Handbook and coauthor of Trade Secret Asset Management 2016: A Guide to Information Asset Management Including the Defend Trade Secrets Act of 2016.