The threat of trade secret theft from U.S. businesses is real and complex. No business sector is immune. Understanding the nature of the problem with a keen focus on a strong compliance culture and accessing the available government resources can assist companies in managing this risk. Companies should also be poised to access the civil and law enforcement resources available to them if a threat occurs. Congress, the White House and federal law enforcement agencies have prioritized the investigation and prosecution of trade secret theft. In announcing the Administration’s strategic plan to combat trade secret theft, U.S. Attorney General Eric Holder stated that there are only “two categories” of companies affected by trade secret theft — “[T]hose that know they’ve been compromised and those that don’t know yet.”
With trade secret theft against U.S. corporations on the rise, the government has promised an increase in enforcement efforts using existing laws and two new federal laws designed to strengthen the Economic Espionage Act (EEA). More specifically, the Theft of Trade Secrets Clarification Act of 2012 expands the EEA’s coverage beyond products sold in interstate or foreign commerce and clarifies that the EEA also applies to trade secrets relating to products and services that a company uses internally. The Foreign and Economic Espionage Penalty Enhancement Act of 2012 increases the maximum penalties for the theft of trade secrets with an intent to benefit a foreign government or instrumentality. For organizations, the maximum fine is now either $10 million or three times the value to the organization of the stolen trade secret.
This article will provide some tips that companies can take proactively to help prevent the loss of these valuable corporate assets. However, as thieves can foil even the most robust attempts at deterring them, we will also summarize steps that companies can take if, despite their best efforts, they become the victim of this common and damaging crime.
Tips to prevent theft of trade secrets
#1: Cut off or tighten access: Many employees are using portable devices to store and save proprietary data, and corporate e-mail systems are not properly protected. One way to hamper the use of thumb drives and other external devices is to place limitations on the amount of data that can be electronically copied, and possibly even disable the use of USB and DVD ports on employees’ computers entirely. Companies should also enhance their information security policies by requiring multiple passwords and maintaining thorough records of who is accessing certain networks and downloading files.
#2: Create a culture of compliance: In addition to taking steps to tighten IT security, companies must also prioritize compliance and training programs that educate employees’ possibilities of compromise from foreign governments, the existence of the EEA, and its penalties. Companies should establish clear guidelines for what constitutes a trade secret and make employees aware that the company’s policy requires them to report suspicious behavior by co-workers, supervisors and direct reports. Having an anonymous compliance hotline in place will encourage employees to report illicit trade secret activity that may save the company from criminal liability down the road. Companies should not underestimate the need for a strong compliance program and policies in this area. Recently, a U.S. company entered into a non-prosecution agreement with the U.S. Attorney’s Office settling allegations of trade secret theft and accepting responsibility for their actions and pledging to continue a culture of corporate compliance.
#3: Hire carefully: Companies may not be aware that they could be subjected to an enforcement action for theft in this regard if stolen trade secrets find their way into their companies. The EEA allows for the prosecution of a company that “receives, buys, or possesses a trade secret, knowing the same to have been stolen or appropriated, obtained or converted without authorization.” Thus, a company can be on the hook for violation of the EEA even if it did not steal the secret — it is enough that one of its employees encountered the secret information in the course of his work. As a compliance measure, therefore, when on-boarding new employees from competitors, particularly if the new employees were all part of team or group with a competitor, care should be taken to make sure that there is a documented business need for the hire and trade secrets learned in the prior job do not creep into the new employer’s systems.
#4: Exit right: Last, companies should have a substantive and robust exit interview of departing employees who had access to confidential and proprietary information. Securing detailed information from employees as they leave for a competitor can prove helpful to civil or criminal enforcement remedies down the road.
Responding if a breach occurs
What steps should a company take if, despite its best efforts, a trade secret breach occurs?
#1: Commence an investigation: Immediate action is required and necessary. The company should immediately commence an investigation to determine the identity of the culprit and the breadth of the compromise. If a civil lawsuit is contemplated, the law requires that the company provide specific information identifying the threat and compromise.
#2: Seek back-up: If criminal resources are needed, enlist the support of the Federal Bureau of Investigation. The FBI has made intellectual property theft a priority in its criminal investigative program. Using the EEA and other federal laws, federal law enforcement can reach and investigate conduct that occurs outside the U.S. involving both products or services intended to be used in interstate commerce. Moreover, the Department of Justice has assembled a Task Force on Intellectual Property that is part of a Department-wide initiative to confront the growing number of domestic and international intellectual property crimes. The Task Force is chaired by the deputy attorney general.
#3: Consider filing an ITC claim: If the theft occurs outside the U.S., a company should also consider filing a claim with the U.S. International Trade Commission (ITC). As evidenced by an increase in recent filings before the ITC, it has become a popular forum for combating international trade secret theft as a result of a Federal Circuit decision affirming that Section 337 of the Tariff Act of 1930 applies to trade secret misappropriation where the unfair act occurs exclusively outside the U.S. In order to bring a successful trade secret misappropriation case before the ITC, a claimant must establish the existence, ownership and compromise of a trade secret together with evidence of importation of an item or the sale of imported articles that utilize the trade secret.
While the remedies before the ITC do not include money damages, another powerful tool is available: an exclusion order enjoining the respondent from importing the offending articles into the United States and/or a cease and desist order enjoining domestic manufacture or sale of the relevant articles by the respondent within the United States. It is important to note that an ITC exclusion order is enforced by federal agencies such as U.S. Customs and Border Protection and blocks the U.S. importation of any of the goods incorporating — or even manufactured in accordance with — the misappropriated trade secrets. In addition, ITC cases move fairly quickly and must be concluded within 16 months.
Even the most sophisticated companies can fall victim to trade secret theft. Therefore, it is essential for all companies to regularly evaluate their security systems and compliance programs and become educated on the various ways in which thefts occur, so that they may prevent them from happening in the first place.