Video Blog: Start-Up Trade Secrets

TRANSCRIPT & LINKS:

Welcome to Protecting Trade Secrets. I’m Eric Ostroff. I’m a partner at Meland Russin & Budwick and I’m coming to you from my office in Miami Florida. I’m doing something new here on the Protecting Trade Secrets blog. Obviously, I’m on video right now, and I’ll be using video to create blog posts for at least some of the blog posts in the future. I’ll also go ahead and post a transcript of the video down below.

Today I want to talk about issues facing start-up companies who are looking to protect their proprietary information and trade secrets. I recently read an article on inc.com and I’ll go ahead and post a link to the article in the transcript below.

This article told the story of a company called HIDEit Mounts. They had a product that mounted video game consoles and camouflaged them so you didn’t have wires and things sticking out all over your living room.

When this company started out, it was a husband-and-wife team. They didn’t have any experience with product development, product design, or manufacturing, so they did with a lot of startup companies do; they partnered with a manufacturing company and worked with that company to design a prototype and then manufacture these products.

Things were going great. They were selling a lot of products; there were no direct competitors, and the company seemed like it was going to be successful. But then they hit a problem. Another company all of a sudden started selling very similar products, except they were actually a little bit better. And the HIDEit company thought that they might have to go out of business.

They did some research and were able to figure out that it was actually their manufacturer who was behind this competing company. Now thankfully for HIDEit, they went ahead and had their manufacturers sign a nondisclosure agreement early in the relationship. And they were able to use that contract to protect their IP rights and to protect their business. But a lot of startup companies just either ignore, try and use self-help, or don’t give enough thought to potential ways that having a lawyer or using legal solutions can protect against major problems down the road. A lot of companies will use forms off the internet or just won’t use lawyers at all.

The reality is that an extremely modest investment on the front end for a startup company in a competent lawyer who can can create agreements and give advice about ways that this company can protect its proprietary information can go a tremendous way to mitigate against and to deter really serious issues in the future.

So the lesson from this inc.com article for start-up companies is: Don’t think that you’re too early or you don’t have enough money to hire a lawyer. Speak with a lawyer early on in the process. Doing that can solve a lot of really terrible problems in the future.

That’s all for today. I appreciate your time.

 

Florida Companies: Are Your Non-Competes Missing This Critical Provision?

Under Florida’s restrictive-covenant statute, Section 542.335(f), a restrictive covenant is only enforceable by a successor entity or third-party beneficiary if the agreement so provides. This provision can become very important following corporate merger or sale transactions. Or in the due-diligence period leading up to those transactions.

In a recent Florida case, Collier HMA Physician Mgmt, LLC v. Menichello, the plaintiff almost fell victim to this statutory requirement. A copy of the opinion can be downloaded here.

In this case, the plaintiff owns a healthcare business employing approximately 40 doctors. It also operates two hospitals and clinics. The defendant, a physician, previously worked for the plaintiff, where he signed a non-compete agreement prohibiting him from working for certain of the plaintiff’s competitors. After his departure, he accepted a position with one of those competitors, and the plaintiff filed suit.

The physician argued that a merger transaction involving the plaintiff’s corporate parent triggered the statutory provision above. Per the physician, since the agreement did not expressly provide for enforcement by successors, the merger invalidated the non-compete. The trial court agreed and granted summary judgment in the defendant’s favor.

The appellate court reversed. To reach that conclusion, it interpreted the term “successor” in the statute as “a corporation that, through amalgamation, consolidation, or other assumption of interests, is vested with the rights and duties of an earlier corporation.”

The court found that “the status of [the plaintiff] after the merger does not comport with the standard definition of a successor as it relates to corporations or other business entities.” In particular, there were several tiers of corporate entities between the plaintiff and the parent company that was subject to the merger. While the ownership of the ultimate parent company changed, “nothing about the corporate structure or ownership of [the plaintiff] was different after the merger”; it “continued in existence as a single member limited liability company.”

In the end, the plaintiff here was able to enforce its non-compete agreement. But all of this trouble could have been avoided. This leads to a very simple takeaway: when drafting restrictive covenants in Florida, include a provision allowing their enforcement by successors and assigns. Florida companies with existing restrictive-covenants should have a lawyer review them for compliance with this statute.

Similarly, anyone considering acquiring or merging with a company with Florida employees/independent contractors needs to have a lawyer review any restrictive covenants for this purpose.

The failure to include this provision could lead to all sorts of problems. For example, it could impede a later merger or sale of the company. But any Florida company can avoid these problems by having a lawyer conduct a simple review.

 

ABA Ethics Opinion: Trade-Secrets Lawyers Need to Encrypt Emails

By definition, lawyers working on trade-secrets issues, whether in litigation or otherwise, have access to their clients’ most confidential information. And, of course, these lawyers routinely communicate with clients via email, including about the trade secrets. Sometimes, even the trade secrets themselves are exchanged via email.

This raises ethical issues. Recently, the ABA Committee on Ethics and Professional Responsibility issued a formal opinion addressing lawyers’ ethical obligations when transmitting confidential client information. The opinion can be downloaded here.

All lawyers who deal with trade-secrets issues should read the opinion. But here are some highlights:

The opinion recognizes that law firms are hacking targets because:

(1) they obtain, store and use highly sensitive information about their clients while at times utilizing safeguards to shield that information that may be inferior to those deployed by the client, and (2) the information in their possession is more likely to be of interest to a hacker and likely less voluminous than that held by the client.

It then discusses applicable ethical rules, concluding that “lawyers must exercise reasonable efforts when using technology in communicating about client matters.” So what are reasonable efforts?

What constitutes reasonable efforts is not susceptible to a hard and fast rule, but rather is contingent upon a set of factors. In turn, those factors depend on the multitude of possible types of information being communicated (ranging along a spectrum from highly sensitive information to insignificant), the methods of  electronic communications employed, and the types of available security measures for each method.

The opinion specifically mentions lawyers who deal with trade secrets, since those matters “may present a higher risk of data theft.” The fact-based analysis is often relatively simple in trade secrets cases: if you are transmitting your client’s trade secrets or related information, you may need to use “particularly strong protective measures”:

A fact-based analysis means that particularly strong protective measures, like encryption, are warranted in some circumstances. Model Rule 1.4 may require a lawyer to discuss security safeguards with clients. Under certain circumstances, the lawyer may need to obtain informed consent from the client regarding whether to the use enhanced security measures, the costs involved, and the impact of those costs on the expense of the representation where nonstandard and not easily available or affordable security methods may be required or requested by the client. Reasonable efforts, as it pertains to certain highly sensitive information, might require avoiding the use of electronic methods or any technology to communicate with the client altogether, just as it warranted avoiding the use of the telephone, fax and mail in Formal Opinion 99-413.

There is a simple takeaway for all trade-secrets lawyers: think very carefully about how you are transmitting confidential client info. This requires an open dialogue with the client. You need to figure out how you will be protecting this data while in transit (and at rest, but that’s a separate issue). At my firm, we have the capacity to encrypt individual emails on-demand, which can allow for secure transmission of sensitive data.

But this sensitive data isn’t only shared with clients. Often, it will need to be produced in litigation. Lawyers spend a lot of time negotiating protective/confidentiality orders with attorney’s eyes only (AEO) protections. But don’t forget to securely transmit AEO documents to the other side. For example, my firm uses a secure/encrypted document sharing platform.

Trade-secrets cases often move fast. But this ABA opinion shows that regardless of how intense the litigation becomes, lawyers must be cognizant of their obligations to protect clients’ confidential information.

The Cybersecurity Article that Every Executive Should Read Immediately

I love this article, titled Why America’s Current Approach to Cybersecurity Is So Dangerous. It should be required reading for all executives at companies at risk of a cyber attack — in other words, all companies. While the whole article is great, its core message can be reduced to a single sentence: People, not technology, are the key to reducing the risk of cyberattacks. I could not agree more, as I’ve written about before. Every company needs to ask: what can we do to create a culture of protection?

The article starts by identifying the problem:

We should be concerned that, as a society, our minds go mushy when it comes to “digital literacy,” “information security,” “online safety,” or whichever name we choose. In fact, that mushiness is a major reason why America’s current approach to cybersecurity is so dangerous. We’re ignoring the behaviors of the overwhelming majority of actual users, and therefore leaving the largest attack surface undefended. . . . To the extent we are all part of the contest in cyberspace, we’re essentially deploying our troops without armor, our submarines without sonar.

And as a result, “cybersecurity has transformed what is actually a ‘people problem with a technology component’ into its exact opposite.” Yes! Technology is not a panacea for preventing cyber attacks. Technology can’t protect your company’s biggest vulnerability: the people working there. “Until we embrace a vision of public cybersecurity that sees all people, at all ranges of skill, as essential to our collective security, there will be no widespread cybersecurity.” The same goes with your company. You can spend millions or more on tech-based protections, but if you ignore the human risk, your security is virtually certain to fail. And of course, if you are at risk of a cyberattack, you are at risk of trade-secret theft.

The article finishes with a great analogy between cybersecurity and public health:

We need to get better to increase our herd immunity against botnets. We need to see that cybersecurity—like all aspects of safety, security, and resilience—is a shared responsibility. Better devices and apps won’t save us, since there are myriad other ways that individuals—even highly trained ones—become the weak link allowing bad guys to access personal, corporate, and government information assets. And almost all efforts at online safety, while well-meaning, are so poorly designed as to preclude knowing whether they work. It’s not magic: As with health or safety education, we need to start with basic steps and repeatable behaviors—like hand-washing or looking both ways before crossing.

This is the key. In a mature organization that has fully embraced and achieved a culture of protection, the employees will treat cybersecurity as second nature. Good habits will have become routine. Unfortunately, I have yet to encounter a company that has reached this point. For a variety of reasons—dependence on technology first among them—just about all employees have a host of bad habits that put the company at risk.

Creating this culture is not easy. To the contrary, it will require repeated, sustained effort, initiated and supported from the very top of the organization down, over a long period of time. Nor will it guarantee that all cyberattacks will be thwarted. But I see no viable alternative. Any company that has not made employee-level protection a top priority is virtually certain to suffer repeated cyberattacks.

Federal Court Denies Expedited Discovery In Defend Trade Secret Act Case

Trade-secret-misappropriation cases can move fast. Often, the plaintiff files a motion for temporary restraining order alongside its complaint. Sometimes, the plaintiff has enough evidence already to justify a TRO. Other times, the plaintiff needs to take discovery before the TRO hearing.

But the typical discovery deadlines in the rules of civil procedure are not well suited for these TRO proceedings. Thus, plaintiffs regularly seek expedited discovery. In my experience, the parties are often able to agree to an expedited discovery schedule, since defendants usually want to take discovery as well. But when the parties cannot agree, the court needs to get involved. A recent case out of the Middle District of Florida shows the importance of narrowly tailoring expedited discovery requests, particularly when asking a judge to permit this type of discovery.

In Digital Assurance Certification, LLC v. Pendolino, the plaintiff works with municipal bond issuers to comply with various SEC regulations. The plaintiff alleges that the defendant, a former employee, left to work for a competitor. And in his final week of work, according to the plaintiff, the defendant used a USB drive to access every document on the plaintiff’s shared drive. Thus, the plaintiff brought claims for violations of the Defend Trade Secret Act and the Florida Uniform Trade Secrets Act, among others, and filed a motion for a TRO.

In advance of the TRO hearing, the plaintiff filed a motion for expedited discovery. The court denied the motion. A copy of the order can be downloaded below.

The court first set forth the standard for determining whether the plaintiff had demonstrated good cause for expedited discovery:

Factors the Court considers in deciding whether a party has shown good cause include: (1) whether a motion for preliminary injunction is pending; (2) the breadth of the requested discovery; (3) the reason(s) for requesting expedited discovery; (4) the burden on the opponent to comply with the request for discovery; and (5) how far in advance of the typical discovery process the request is made.

Here, the court focused on the second factor, the breadth of the plaintiff’s requests. The court took issue with the scope of the plaintiff’s requests, noting that “while these matters may be relevant to the issues raised in DAC’s complaint, they go far beyond what is needed for the hearing on the motion for a temporary restraining order.”

Take away: When bringing a motion for a TRO, the plaintiff’s lawyers need to figure out quickly whether the parties will be able to agree to an expedited discovery schedule. If not, the plaintiff needs to draft discovery requests that are laser focused on the issues relevant to the TRO hearing. In my experience, judges will allow this type of discovery, as long as the requests are reasonable. Conversely, judges will protect defendants from overbroad discovery.

Digital Assurance Certification, LLC v. Pendolino

Florida Loves Non-Compete Agreements

Florida’s restrictive-covenant statute, Section 542.335, is one of the most employer-friendly in the country. A recent case from Florida’s Fourth District Court of Appeal, Transunion Risk and Alternative Data Solutions, Inc. v. Reilly, shows how this statute favors an employer trying to enforce a restrictive covenant against a former employee. A copy of the opinion can be downloaded below.

This opinion is short on facts, but the plaintiff sued the defendant for violating a non-compete agreement and sought a temporary injunction. At the injunction hearing, the trial court ruled in the defendant’s favor after the plaintiff finished its case in chief, before the defendant put on any evidence.

The appellate court reversed. First, it looked at the likelihood of irreparable injury, citing the statute’s presumption of irreparable injury that arises when the plaintiff shows a violation of an enforceable restrictive covenant. Here, the appellate court reversed because the defendant did not present evidence:

As the trial court’s ruling was issued before Reilly presented any evidence, Reilly could not have met his burden of presenting evidence overcoming the presumption.

This doesn’t sound right. A defendant should have the right to rebut this presumption simply by cross-examining the plaintiff’s witnesses. That’s what the trial court apparently thought happened here. But the presumption so strongly favors the plaintiff that this appellate court was unwilling to allow the defendant to rebut it without putting on affirmative evidence.

The trial court also concluded that the plaintiff had an adequate remedy at law. But the appellate court reversed this finding, noting that even when a plaintiff has suffered actual money damages,

the continued breach of a non-compete agreement threatens a former employer’s goodwill and relationships with its customers, and nothing short of an injunction would prevent this loss.

This finding essentially eliminates the adequate-remedy-at-law prong of the injunction analysis in restrictive-covenant cases.

Finally, the appellate court reversed the trial court’s finding that the plaintiff had not demonstrated a substantial likelihood of success on the merits. On this point, the appellate court relied on the trial court’s “implied finding” that the defendant violated a restrictive covenant. So once a court finds that the defendant breached, the plaintiff has automatically shown a substantial likelihood of success.

This case shows how Florida’s restrictive-covenant statute provides employers with the upper hand in litigation. As a result, these agreements are a very effective tool for protecting proprietary information and trade secrets. All Florida companies should consult with an attorney to determine whether to implement these types of agreements.

Transunion Risk and Alternative Data Solutions, Inc. v. Reilly

What’s Worse Than Having Trade Secrets Stolen? Waiting Too Long to Do Something About It.

If you discover that your trade secrets have been stolen, you must act immediately. That’s the lesson from a recent case in the Middle District of Florida, Dyncorp International LLC v. AAR Airlift Group, Inc. A copy of the order can be downloaded below.

The Plaintiff, Dyncorp, has been providing aviation services to the State Department under a contract going back more than 20 years. Apparently, the State Department is now re-bidding that contract. The Defendant, AAR, is one of the bidders. Dyncorp alleges that AAR hired former Dyncorp employees and “coerced” those employees into disclosing Dyncorp’s trade secrets, which AAR used in its bid.

Dyncorp filed suit for, among other things, violating the Florida Uniform Trade Secrets Act. About three weeks later, Dyncorp filed a motion for preliminary injunction that sought to enjoin AAR from using Dyncorp’s trade secrets.

The district court denied the motion, finding that Dyncorp did not satisfy any of the injunction prerequisites. Of particular note, the court found that Dyncorp’s delay in filing suit showed that it had not suffered irreparable injury:

Dyncorp admits that it was notified of AAR’s alleged misappropriation of trade secrets in April 2015 but let more than four months pass without filing suit. Dyncorp attempts to explain the delay away by arguing that it complained to the State Department and AAR and conducted its own investigation during this time, but offers no explanation as to why those undertakings and this suit could not proceed simultaneously – particularly if, as Dyncorp asserts, it was facing the prospect of irreparable injury.

This case shows that once you discover—or even suspect—that your trade secrets are being improperly used, you must act fast. Any delay can be cited by a defendant as a reason for denying injunctive relief, just as AAR did here. While not every case will demand the immediate filing of a lawsuit, you need to at least consult with an attorney right away. Then, your attorney can advise you of your various legal options, and the risks and benefits of each.

Dyncorp v. AAR — Order Denying Preliminary Injunction

Can Periscope Broadcast Your Trade Secrets to the World?

Periscope is an app that allows users to broadcast live video using their smart phone. This technology has the power to transform the delivery of media and information. Essentially, every person can now effortlessly create live video content, whether it’s sharing a family event with those who can’t attend or witnessing a newsworthy event.

I keep hearing more and more about Periscope. For example, I’ve seen media members use it to share press conferences or behind-the-scenes info. At first blush, this may seem irrelevant to your company’s trade secrets. But that may not be the case.

Right now, through Periscope and similar apps, every one of your employees can instantaneously broadcast live video to the world. It’s much easier to share exactly what’s going on, in real time, at your company.

This raises multiple levels of concern. To start, employees may inadvertently transmit proprietary information. For example, an employee could be sharing a broadcast from work intended for his friends and family, while other employees discuss proprietary information within earshot. Even though there was no intent, this information was still shared outside the company.

Even worse, Periscope is a powerful tool in the hands of someone with malicious intent. There has long been a risk that malicious actors can easily capture video. But now, that video can be shared live. For example, an employee could surreptitiously broadcast a company meeting. Or live video of a proprietary process or system.

Periscope is another example of how rapidly evolving technology is constantly creating new risks to your trade secrets. Your trade-secrets policy needs periodic review to make sure it addresses new technology. Depending on the nature of your business, it may make sense to ban live broadcasts completely. Most importantly, you should discuss these issues with an attorney who can help you decide what protections are appropriate for your business.

 

 

The DOJ Announced Another Trade-Secrets Prosecution. What Does That Mean For Your Company?

There has been a lot of news coverage of the DOJ’s charges against Chinese professors for trade-secrets theft and violations of the Economic Espionage Act. Stories like this have become more common, as the DOJ has increased its focus on prosecuting trade-secrets theft. Often, these cases involve defendants with connections to foreign governments, and China in particular. As these cases have become more prevalent, the federal government has dedicated more resources to combating them.

Unfortunately, this will have little effect on most companies that fall victim to trade-secrets theft. The DOJ appears to have little interest in prosecuting run-of-the-mill trade-secrets theft, even though there may have been violations of a federal statute like the Economic Espionage Act. The DOJ simply does not have the resources to deal with the huge number of these cases. Thus, the vast majority of trade-secret misappropriation cases will be handled through civil lawsuits.

So what should you do if you believe your company has been the victim of trade-secrets theft? The answer is simple: you need to consult with an attorney specializing in this area of the law as soon as possible. Time is of the essence, and even a delay of a day or two could cause serious problems. Your attorney can advise you of your options. If your case is a good candidate for federal prosecution, your attorney should let you know. More likely, your options will involve civil remedies. Either way, you will need to make important decisions very quickly.

When It Comes to Trade Secrets, Ignorance Is Not Bliss

Trade-secret misappropriation cases often involve bad actors who deliberately steal trade secrets. But perhaps just as frequently, trade-secrets are misappropriated by people who simply don’t know better. Many don’t even understand what a trade secret is, let alone that there are laws or other obligations prohibiting inappropriate use or disclosure of trade secrets.

I’ve personally seen this happen over and over. An employee leaves one company to join another in the same industry. He takes many of the documents he created at his old job. These documents contain trade secrets. In his mind, they are his documents. He created them, after all! And at his new job, he uses those documents on behalf of his new employer.

Now both companies have a problem. The former employer’s trade secrets are in a competitor’s hands. And the new employer has unwittingly exposed itself to significant liability.

Both companies are to blame for their problems. The first company did not educate its employees about their responsibilities and legal obligations regarding trade secrets and proprietary information, both while working for the company and after they leave. The second company failed to make sure that the new employee did not bring his prior employer’s trade secrets with him.

There are three primary tools for preventing this situation: contracts, training, and exit/intake interviews. Employees with access to proprietary information should sign a non-disclosure agreement that requires them to keep the information confidential. The agreement should provide that all information belongs to the company even if created by the employee, and must be returned upon termination of employment. And the contract should acknowledge that the employee is not bringing any proprietary info or trade secrets from her prior job.

But employees too often don’t read contracts before signing them. That’s where training comes in. During the on-boarding process, and periodically thereafter, use training sessions to reiterate your trade-secret policy.

Finally, use exit interviews to again instruct the departing employee about his post-employment obligations. Consider having him sign an acknowledgement that he has returned all info and is aware of these obligations. When hiring a new employee, talk with them up front about what info they have from their prior employer. Be sure to consult with an attorney if that discussion raises concerns.

I really believe that many misappropriation cases can be avoided by simply making sure that employees understand these issues. Too often, they do not.