Keeping Trade Secrets Secret

Companies are incurring enormous losses from the misappropriation of their trade secrets. In a 2002 survey of more than 130 firms, 40% reported actual or suspected losses of trade secrets, and the data suggest the actual figure might be significantly higher. The study, published by the American Society for Industrial Security, also estimated that the companies represented by the survey participants —the Fortune 1000 corporations and 600 additional small and medium-sized companies — were likely to have experienced trade-secret and other intellectual-property losses of more than $50 billion during the time period of the study, from July 1, 2000, to June 30, 2001.

To investigate how organizations can protect themselves against such losses, I conducted an in-depth study of two U.S. high-tech companies: a relatively small (about 125 employees) fast-growing startup and a large (more than 70,000 employees) diversified global corporation. The two organizations were very different not only in size but also in structure and culture. Despite their differences, the companies shared a number of challenges and problems in dealing with the protection of their trade secrets. Specifically, although some of the policies enacted at the two firms were effective, others made no difference and some were actually counterproductive. After a broad review of other research studies in the field, I believe that my findings are representative of the types of mistakes firms commonly make when trying to protect their trade secrets.

What Are Trade Secrets?

Many people have only a vague idea of what exactly constitutes a trade secret. By definition, trade secrets are one type of intellectual property (the other types are patents, trademarks and copyrights). For information to be considered a trade secret, it must meet certain legal standards. In the United States, the criteria are threefold: (1) the trade secret must contain information, such as a formula, pattern, method, technique or process, (2) the information must be valuable to the organization that owns it and that value must be derived, in whole or in part, from the exclusive possession of the information, and (3) the organization must make reasonable efforts to protect that information. Some of the most famous examples include the formula for Coca-Cola Classic and the recipe of 11 herbs and spices for Kentucky Fried Chicken. But trade secrets also can include seemingly mundane information, such as a company’s marketing strategy or its customer list.

If a formula, process or other information is so valuable, why not protect it by filing for a patent? There are two reasons. First, when a company files for a patent it must disclose some of the subject matter and details to the public. Second, trade secrets can be protected in perpetuity, but patents lose their protected status after 20 years. If the Coca-Cola Company had chosen to patent its secret formula from the beginning, this information would now have been public knowledge for more than 50 years. Of course, patent protection is the wiser alternative in many cases — for example, when a company develops a new product that can easily be reverse-engineered by a competitor. Furthermore, a huge disadvantage of a trade secret is that once the information is made public (provided it wasn’t done so through illegal means, such as the unauthorized disclosure by an employee), the firm has no legal recourse. This crucial vulnerability is why companies must implement effective policies and practices to keep their trade secrets from leaking to the outside world.

The Threat Within

Research has shown that the biggest threat to a company’s trade secrets does not come from spying competitors but from within: current and former employees. Consequently, the protection of trade secrets is largely a managerial issue, and firms need to take the appropriate measures to ensure that employees keep trade secrets from leaking. But many organizations make a number of crucial mistakes here, sometimes failing to implement the right precautions or relying on a well-intentioned but ineffective practice — or, worse, a wrongheaded policy that only leads to more information being divulged.

Mistake No. 1: Giving Short Shrift to New-Employee Orientations

Companies typically try to protect their trade secrets by requiring employees to sign legally binding documents such as nondisclosure agreements (sometimes called confidentiality agreements), which prohibit employees from disclosing or using any of their firm’s trade secrets except when they are specifically authorized to do so; non-compete agreements (sometimes called restrictive covenants), which restrict the companies, geographic areas and industries in which employees can work following the termination of their employment; and assignment provisions, which require employees to relinquish to their employer all legal rights to any inventions, trade secrets or ideas they develop in the course of their employment. Another traditional means of protection are various rules, including access restrictions, which limit employees’ rights to enter certain areas of a company’s facilities, use or copy sensitive documents and use computers and certain means of communication; and handling procedures, which establish what employees can and cannot do with trade secrets when they have access to them.

These policies are usually communicated to people when they first join a company. But the typical new-employee orientation process doesn’t provide the necessary time. People are asked to sign nondisclosure agreements and other important legal documents along with all the other paperwork that is typically necessary for newcomers, and only perfunctory attention is paid to corporate practices regarding trade secrets. The result is that employees often have only hazy recollections of important policies. In my research study, numerous employees remembered signing some kind of agreement when they joined their company, but they couldn’t recall any details, and many knew their organization had access restrictions and handling procedures but didn’t really understand these policies. Of course, information overload for new employees is typical. Consequently, companies should consider delaying the discussion of corporate policies regarding trade secrets until after an individual has settled in. If a newcomer is likely to encounter sensitive information right off the bat (as is often the case for senior hires), the policies could be communicated at the orientation and then reiterated later.

Mistake No. 2: Not Communicating Regularly

Many companies make the mistake of relaying important information regarding trade-secret policies just once: during new-employee orientation. But educating employees about these policies is an ongoing process. Of course, regularly bombarding people with information is likely to be counterproductive, resulting in employees tuning out. But companies should consider holding meetings perhaps twice a year to provide employees with updates about trade-secret issues and to ensure that everyone is familiar with existing policies. Another approach is to send periodic e-mail or memos, and to provide manuals containing details of relevant policies. The goal is to keep trade-secret protection constantly in the back of employees’ minds. This will also ensure that everyone knows where to get the information they need. Otherwise, many people will pay little attention to trade-secret protection until they’re faced with a potentially risky situation, such as when a salesperson has to describe a prototype to a prospective customer.

Mistake No. 3: Signaling to Employees That They Aren’t Trusted

When educating employees about trade-secret protection, some companies focus on telling people what they can and cannot do, with threats of punishment for breaking any rules. But this approach can be counterproductive. Research has shown that employees who feel they aren’t trusted are less likely to feel obligated to protect their organization’s trade secrets.

With respect to specific policies, companies should be especially careful with access restrictions, which suggest to employees that they lack the necessary discretion to protect sensitive information. Clearly communicated handling procedures, on the other hand, imply to employees that they can be trusted with access to valuable information. In my research, I have found that employees who are more familiar with their company’s access restrictions are, in fact, less likely to feel obligated to protect trade secrets, whereas employees who are familiar with their firm’s handling procedures are more likely to feel obligated to protect these secrets.

Of course, access restrictions are necessary in many instances. When implementing them, though, a manager should explain to employees the reasons for the policy, citing the potential harm the company could incur if certain trade secrets were leaked to competitors. During this discussion, the manager could also point out the access employees do have to other sensitive information that is necessary for them to do their jobs.

Mistake No. 4: Punishing Instead of Helping

Studies have shown that employees tend to react negatively to corporate policies they believe are designed to catch and punish offenders, but they will obey a procedure they perceive is designed to help them do their jobs effectively. Thus, the goal of trade-secret protections should be to help and not to punish. And, at the very least, policies should avoid hindering people unnecessarily.

One way to achieve this is to ensure that employees get the information they need for their jobs as quickly as possible. At one company, each department has an individual with a technical background relevant to that group who has also received training in legal issues. These individuals are able to make relatively quick, informed decisions about whether an employee’s request for access to certain secrets is legitimate. At another firm in my study, all salespeople were required to check with the legal department before sharing with customers any information about upcoming products — a process that was viewed as unnecessarily obstructive. One salesman said it was much easier to ask for forgiveness and not permission, meaning that he would disclose information that helped him to make a sale and then plead ignorance later. On a related note, companies should consider having an annual review to declassify information that no longer needs to be protected.

Mistake No. 5: Not Practicing What is Preached

In a recent study, only 55% of the companies surveyed said that management was concerned about information loss and was taking the necessary precautions. Obviously, if managers want employees to take the protection of trade secrets seriously, they must practice what they preach. Otherwise, employees can quickly become cynical.

An egregious example comes to mind. At one company, employees were instructed to keep certain information confidential, only to read an article in Fortune magazine in which the company’s CEO shared those very secrets. Understandably, the employees wondered why they should bother devoting energy to protecting information when their CEO had been less than vigilant. To avoid such situations, a company can appoint a senior-level executive — perhaps the firm’s chief knowledge officer — to be the point person responsible for corporate policies and practices with respect to trade-secret protection. This person should have the authority to deal with all offenders, no matter how high up the corporate ladder.

Mistake No. 6: Forgetting to Clarify Ownership Issues

When employees generate ideas, they can develop a sense of ownership toward them, and as a result they may feel they have the legal right to do what they want with these ideas. They might feel free to tell colleagues, share the information with outsiders and even leave the company and pursue the ideas themselves. To prevent this, companies can take a number of steps to clarify ownership issues.

First, a firm can require all employees to sign assignment provisions, which stipulate that any ideas they come up with at work will legally belong to the organization. Second, the company can ensure that employees are knowledgeable about the policies for handling trade secrets in the work-place. Research has shown that employees who are more familiar with handling procedures are more likely to cede ownership of their ideas. Third, when applicable, the firm should inform employees that part of their job is to generate new ideas. This responsibility could be included in the formal description of a position. If employees believe that generating ideas is part of what they are paid for doing, they are more likely to cede the ownership of these ideas to the company. Finally, the firm might consider offering financial or other incentives to reward people for ideas that it implements, and it could relinquish to employees the rights to other ideas that it doesn’t pursue.

Mistake No. 7: Defining Too Narrow a Scope

Employees are much more likely to cede ownership of ideas they feel are closely related to their company’s business than ideas they consider only remotely related. So, for example, someone working for a chemical company is likely to relinquish legal ownership of the formula for a new compound but not the concept for a novel type of fishing reel. Thus, a firm should communicate to employees the widest range of its current businesses as well as the potential breadth of its future ones.

On a related note, organizations often forget that trade secrets can include “negative information” — knowledge about what doesn’t work. Many employees are more likely to share negative than positive information, even though both kinds of knowledge can be extremely valuable. A company should remind workers that, for instance, information about technological dead ends can provide a tremendous competitive advantage, but only when rival firms don’t have access to this knowledge and are forced to pursue avenues of research that will waste their resources.

Mistake No. 8: Failing to Address Departing Employees

At one or more times in their careers, most people will move from one organization to another. Unfortunately for companies, departing employees often take with them knowledge of valuable trade secrets. It is important to remember that people’s feelings of obligation to their company are likely to continue after they have left. A firm should capitalize on this by gently reminding departing employees of their ongoing legal responsibility to protect the organization’s trade secrets. Managers should be careful here not to alienate people by implying that they aren’t trusted. A good approach is to emphasize that the discussion is standard procedure given to all departing employees in order to protect the company’s assets (specifically, its trade secrets).

A company can also ask departing employees to submit inventories of all the sensitive information they possess. Obviously, such a process is inherently tedious and prone to oversights, but many organizations already have a knowledge management system in place through which employees routinely record valuable information electronically. For such companies, the exit interview could merely review and highlight the sensitive information to which a departing employee has had access. Even if a firm lacks such a system, the process of requiring departing employees to submit a knowledge inventory will help to remind them that the company is serious about protecting its trade secrets, and that leaked information could potentially be traced.

For employees who are fired, laid off or otherwise leave on acrimonious terms, a company should consider special precautions because of the greater risks these individuals present. When someone possesses crucial information and leaves on particularly bad terms, the firm might consider preemptive measures, such as sending the legal department of the new employer a letter stating that if this person divulges certain trade secrets in his or her possession, the hiring company could potentially be liable for any damages.

COMPANIES WILL LIKELY ENCOUNTER RESISTANCE when implementing steps to protect their trade secrets. After all, employees usually don’t like spending time dealing with corporate matters that are not directly related to their work. But an organization that makes little effort to protect its trade secrets only increases its likelihood of losing that information, and once that knowledge becomes public, the firm might have little legal recourse. Remember that, by definition, information can’t be considered a trade secret unless the organization has made reasonable efforts to protect it. What is “reasonable” can be a matter of interpretation, but a company that takes the necessary precautions not only stands a better chance of keeping trade secrets from being divulged, it also will have a better shot at legal remedies if that information does leak through unauthorized or unlawful disclosure.