Protecting Trade Secrets During (and After) a Global Pandemic: Practical Tips for Employers

by Russell Beck and Hannah Joseph

Practice Tips

 

The evolution toward a cloud economy has made it easy and often profitable for employees to misappropriate valuable data from their employers. Indeed, pre-pandemic estimates suggested that over 50 percent of employees take – and most of them are willing to use – their employer’s information when leaving a company.[1]

Against this backdrop, COVID-19 unexpectedly caused the world to shut down in early 2020, resulting in mass layoffs, the highest unemployment rates since the Great Depression, and a fundamental and perhaps permanent shift toward a predominately remote workforce.

Together, these factors have created a precarious environment for trade secrets, as well as customer relationships and other legitimate business interests. Employees working from home have more opportunity to convert company information and customers, and some, particularly those facing involuntary unemployment, may feel driven to do so. Moreover, the ongoing crisis has made preliminary injunctive relief (the judicial remedy most often used to protect trade secrets and other legitimate business interests) more elusive, as courts are typically less willing to restrain employees from competitive employment during economic downturns. See, e.g., All Stainless, Inc. v. Colby, 364 Mass. 773, 781 n.2 (1974).

Whether during or after the pandemic, it is vital for companies to have strong measures in place for protecting their trade secrets and other legitimate business interests, rather than to solely rely on after-the-fact litigation. Below are some practical tips for how to do so.

Tips for protecting trade secrets and other legitimate business interests during and after a global pandemic

Know your trade secrets. A remote workforce means that employees are developing, accessing, and using their employer’s trade secrets from home (and elsewhere). Accordingly, understanding the categories, sources, and life cycles of the company’s trade secrets, and the risks of exposure to which such information is most susceptible, is necessary for establishing and implementing policies and practices that are best suited to protect that information during and after the pandemic. Depending on the organization, the analysis will likely need to involve management, human resources, legal, corporate governance, sales, information technology, information management, research and development, manufacturing, and other relevant stakeholders.

Firm up policies and procedures. Once a company has categorized its trade secrets, both existing and under development, it must ensure that its policies and procedures are appropriately designed to protect the information against likely sources of risk. Such policies and procedures, which should be reviewed on a regular basis, are also critical to protecting other legitimate business interests, such as customer goodwill.

Among other things, employers should have policies that establish clear criteria, protocols, and expectations for the access, use, and disclosure of confidential information, including third-party information; working from home; the use of the employer’s devices, systems, and accounts (and, if applicable, the employer’s policies concerning monitoring such devices, systems, and accounts); the use of personal devices; the use of social media accounts, including as they relate to client communications; the use and protection of passwords; and the post-employment return of information and property. In addition, employers should have a policy that instructs employees to report incidents of unauthorized access, use, or disclosure of confidential information, and provides clear instructions for how to make such a report. This list is not comprehensive, and policies are not one-size-fits-all; they must be tailored to meet the unique needs of the employer and be reasonable in the context of the company’s needs, capabilities, and culture.[2]

Employers should also work closely with their remote employees to ensure that the employees’ at-home work environments are secured against both external threats and inadvertent disclosure. For example: home Wi-Fi routers should be secured with strong passwords; passwords, non-guessable meeting IDs, and other security settings should be used for video conference solutions like Zoom; confidential information should not be reviewed where others in the household may see or overhear it; and confidential information should not be left out in the open when the workspace is unattended. Employers should be prepared to run through a comprehensive checklist with their employees to make sure that employees are taking necessary precautions to protect their workspaces.

Finally, the unfortunate reality of increased furloughs and layoffs during the pandemic dictates that employers have a system in place for off-boarding employees remotely. The system should include, at the least, a mechanism for terminating exiting employees’ access to the employer’s information and information systems (including the remote wiping of company data from devices in the employee’s possession), for securing the full return of all equipment and confidential information, and for the employee to acknowledge their obligation to return (and not retain, use, or disclose) the employer’s confidential information (as well as to comply with their other post-employment contractual obligations).

Educate your employees. Policies and procedures are worthless, and can hurt more than help, if they are not disseminated, understood, and followed. This means that employers must, on an ongoing basis, educate their employees about company policies and practices. While in-person trainings are ill-advised in the era of social distancing, they may be easily replaced by online trainings, whether live or pre-recorded. Processes should be in place that require employees to not only read the policies and procedures, but also to acknowledge that they understand and agree to abide by them. Policies and procedures should provide an avenue for employees to ask questions and obtain answers that will be consistent throughout the company, either through legal or other channels. Employers are well-served by maintaining accurate records of policies and procedures and any amendments thereto, training dates, and employee acknowledgments. While training and acknowledgments will not necessarily prevent all willful misconduct, they may serve as a deterrent, help to limit incidents of inadvertent disclosure (or unauthorized solicitation) and, if litigation becomes necessary, help to establish the company’s reasonable efforts to protect its trade secrets and other legitimate business interests.

Monitor your workforce. Trade secret misappropriation and other forms of employee misconduct do not usually happen in a vacuum. Oftentimes, there will be warning signs that an employee is unhappy (e.g., a lack of engagement, an attitude shift or sudden change in behavior, increased activity on LinkedIn[3]). Moreover, employees who take their employer’s information with the intention of using it at their next place of employment frequently commit multiple acts of taking in the days and weeks leading up to their termination. Similarly, employees who plan to solicit customers may begin well before termination. For those reasons, employers should consider monitoring their employees’ email activity as well as their activity on other information systems to determine whether the employees are accessing information that they do not have a business need to know or are accessing appropriate information, but with unusual frequency. Periodic monitoring may enable an employer to detect and address internal threats earlier, thereby obviating the need for judicial intervention. Before engaging in any kind of monitoring, employers should disseminate policies that put employees on notice that the employers’ devices, systems, and accounts belong solely to the employer and may be monitored on a periodic or ongoing basis.

Conclusion

While these steps are intended to help employers protect their legitimate business interests, they are not comprehensive and are not guaranteed to protect against every threat of disclosure and other forms of misconduct. When implemented correctly, however, they should substantially reduce overall risk. In addition, where litigation is necessary, an employer that has implemented the above steps will have ample evidence to show that it both identified its legitimate business interests to its employees and notified them of their legal obligations to protect such interests. This can dramatically improve an employer’s chances of prevailing in court.

[1] SeeWhat’s Yours is Mine: How Employees are Putting Your Intellectual Property at Risk,” White Paper by the Ponemon Institute and Symantec Corporation (2013), available at https://www.ciosummits.com/media/solution_spotlight/OnlineAssett_Symantec_WhatsYoursIsMine.pdf.

[2] For a comprehensive checklist of steps employers can take, see “A primer and checklist for protecting trade secrets and other legitimate business interests before, during, and after lockdown and stay-at-home orders,” available at https://www.faircompetitionlaw.com/2020/05/17/a-primer-and-checklist-for-protecting-trade-secrets-and-other-legitimate-business-interests-before-during-and-after-lockdown-and-stay-at-home-orders/.

[3] See, e.g., “13 Signs That Someone Is About to Quit, According to Research,” by Timothy M. Gardner and Peter W. Hom, Harvard Business Review (Oct. 20, 2016), available at https://hbr.org/2016/10/13-signs-that-someone-is-about-to-quit-according-to-research.

 

Russell Beck is a founding partner of Beck Reed Riden LLP. He has authored books on trade secrets and restrictive covenants, assisted the Obama Administration on a Call to Action on noncompetes and trade secrets, drafted much of the Massachusetts Noncompetition Agreement Act, and revised the Massachusetts Uniform Trade Secrets Act. Russell teaches Trade Secrets and Restrictive Covenants at the Boston University School of Law and is President Elect of the Boston Bar Foundation.

Hannah Joseph is senior counsel at Beck Reed Riden LLP and focuses her practice on trade secrets and restrictive covenants law. Hannah regularly publishes and speaks on the topics of intellectual property law and restrictive covenants, including at the American Intellectual Property Law Association, Boston Bar Association, and Practising Law Institute. In addition, Hannah co-teaches the course Trade Secrets and Restrictive Covenants at Boston University School of Law.


Go Solo, You (Probably) Won’t Starve!

mehta_tejalby Tejal Mehta

The Profession

You may have a great boss. You may have a lucrative job. You may work at a law firm or a public agency, with job security and benefits. You may have all of the above. But haven’t you ever wondered how great life would be if you could call your own shots? Your. Own. Firm.

Of course it is daunting. You will ask yourself, “What will be my  niche?” “How will I find clients?” “What if my clients become unhappy and sue me?” “Will a home office do?” “Who will buy my paperclips?”

Relax and take a deep breath. Thanks to countless new websites, online products and phone applications, hanging out a shingle is easier, safer, and even more rewarding than was possible even a few years ago. If you are even considering taking the leap, read on.

Budget

One lesson learned the hard way by many new solo practitioners is that you don’t want to start off by spending too much money. Because you will be on your own, you will probably have a few lean months in the beginning. Your necessary expenses will include marketing, malpractice insurance, bar dues, a post office box, office supplies, travel and parking. Create a startup business operating budget of $5,000-$10,000 for your first year, and stick to it.

Your Business Plan

You will already have thought about this, in the course of deciding to go solo. But while you are working through your startup list, keep thinking critically about your niche. What do you like to do? What are you good at? And where do you want to practice? If you want to practice criminal defense and be in court regularly, perhaps apply to be a bar advocate. Starting up a civil practice may be a little more challenging, but that is where marketing comes in.

Your Marketing Plan

Network, network, network. A professional support system is crucial. Start by drawing upon the colleagues and connections you already have. Join the local bar association of the geographic area where you plan to practice, and attend events as regularly as you can. Call your colleagues from your prior firm or from law school, and let them know they can send you cases and you will give them a portion as a referral fee. You will start building your practice and your reputation.

As you continue to network, you will likely meet attorneys who are willing to send you their overflow cases. Do not be afraid to ask for this, and for general advice. Before I launched my solo practice, I scheduled a dinner meeting with a solo practitioner colleague who walked me through his startup, informed me how he handled his billing and taxes, and provided me sample fee agreements and boilerplate motions for court.

Join the Massachusetts Bar Association or the Boston Bar Association and attend events or section meetings. The Massachusetts Bar Association has a valuable “Lawyer Referral Service” through which you can receive case referrals for your legal specialty.

Is there a legal topic you know well enough to teach to others? Write a letter to the MCLE programming coordinators and explain that you would like to volunteer your time, by chairing a panel or speaking as a panelist, on that particular topic. This will make you more visible in the legal community.

Websites such as Avvo.com are gaining popularity among attorneys. You can create a basic profile, with your photo, for free. They also have services to make you highly visible online and help you stand out in your desired geographic area and practice niche. This can be more of an investment, so do your research on these sites before diving in. Another widely used networking tool is LinkedIn.com, which allows you to create an online profile for free and connect with lawyers and other professionals who are on this platform.

Do you have a Facebook account? Make your Facebook page your business page! Use your logo and bio, provide details of your expertise, and broadcast your new venture to the network you have already established. It is free advertising, and even if it brings in one new client it will be worthwhile in your first six months. Keep it professional and you can use it along with your business website to reach out to Facebook users. I would suggest using it in addition to, not in lieu of, your business website, as the audience you connect with on Facebook may be different from the audience you would reach through a customary website.

The Nuts and Bolts of Your Actual Startup – In Order

Plan your start date for 30 to 60 days out. Then set the wheels in motion.

Contact information. Set up a free Google voice number or use a similar service, as your work line on your existing phone. Use caution when giving out your personal cell phone number. Clients will call you at all hours of the day and night. Also set up a work email – a professional name on a gmail account will work. Courthouses still send and receive faxes, so it may be worthwhile to set up an efax on your computer at some point.

Firm name. This is a personal choice. You can be creative, or just use your last name, e.g., Smith Law Offices.

Office/Post Office Box. Having a physical office can be expensive and is not really necessary in the beginning. Wait and see what your needs are. You will need a space where you can meet clients, so in the meantime, you can meet them in a courthouse conference space or in public establishments such as coffee houses or the library. To keep your relationships professional, do not meet clients at your home or theirs. Also, you can ask a colleague to lend you a conference room and pay them for that day. Or, you could pay to have use of a virtual office and conference space, on an as-needed basis. You can list it on your business cards and thus have a mailing address at a professional building. If you do not initially rent an office or use a virtual office, you will still need a mailing address. Rent a post office box in a convenient location. The small or medium sized post office boxes offered should suffice, and will cost about $100-$160 annually.

Bank Account. Go to the bank of your choice. Take your checkbook. There will be a minimum balance requirement, likely at least $1,500, to set up the business account. Inform the bank you need a small business checking account and an Iolta account with a low minimum balance and no fees. The bank will need your firm name. If you have not incorporated, then you can call your firm a “dba” (“doing business as”), e.g., John Smith dba Smith Law Offices.

Do you need to incorporate your business? Not immediately. Many attorneys do it, but not all. The key question to answer is, what assets do you want to protect? The purpose of incorporating is to shield your business from liability in the event of a lawsuit. If you have very little to protect, you may not need to incorporate right away. It costs approximately $500 to $1000 to incorporate with the Secretary of State. You can defer that cost at the onset of your new practice. You may also seek to obtain a higher liability insurance policy initially, while deciding whether to incorporate.

Malpractice Insurance. Massachusetts Lawyers Weekly contains liability insurance recommendations. Or, you can ask a colleague for a recommendation. Do not be afraid to shop around. You should purchase a minimum of $100k/$300k coverage.  A basic policy should cost approximately $600 for your first year. It will rise after that.

Business cards.  Look at colleagues’ cards for ideas. Create a simple design – logo optional – and limit the text. Use an easily legible font. A business card that is handsome and easily readable is an asset – one that is too busy or uses type too small to read is useless. You can find economical printing options at Staples or Costco. You can print 500 cards for as little as $15.

Letterhead. Again, look at your colleagues’ letterhead for ideas. You can easily tailor yours and print it from your own computer.

Website. The vast majority of potential clients look for their attorneys online, or, if they have been referred to an attorney, they Google that attorney to see what they can learn about him or her. Get a professional headshot. Or, take a friend to a law library, stand in front of the reporters, and have the friend take your photo. Then create a website and post your photo on it. A site such as WordPress will construct a basic website for $100. As time goes on, you may want to make it more expansive, with client testimonials, information about cases you have handled, and even a blog. Some of my colleagues use professional website companies that engineer the site to put them at the top of the list in online search engines. I nearly fell over when I found these services cost upwards of $15,000 per year. This type of cost can be deferred until later.

Essential items. You will need a computer, printer, office supplies, and a datebook or online calendar to keep track of appointments and payment dates. You will need access to a scanner and a fax machine, either in your home or at a place such as Staples. You may also wish to purchase a credit card reader from a service such as Lawpay, in the future. Make sure to save all of your receipts for tax time.

The Rest Is History

Starting your own law practice takes guts, and the beginning may be a bit rocky. But if you set up your firm with care, have a vision of your practice, and plug away at networking, you will begin to enjoy success. Before you know it, your name will be out there and new attorneys will be asking you for advice on how to launch. Good luck!

Note:  this article reflects the author’s personal opinions and experiences, and is not to be construed as an endorsement of any specific services or companies set forth herein.  If you have any specific questions relating to starting your own practice, please feel free to email the author at tmehta.law@gmail.com.

Tejal Mehta, a trial attorney, has worked at civil litigation firms and the Middlesex District Attorney’s Office, and now operates a thriving solo practice.  She is a former member of the Boston Bar Association.