Basics

Intellectual Property Protection: The Basics

Your company's intellectual property, whether that's patents, trade secrets or just employee know-how, may be more valuable than its physical assets. This primer covers everything from establishing basic policies and procedures to guarding against intellectual property loss or theft.

Tell me more about global differences. I suspect the legal protections you've mentioned in the U.S. won't apply overseas.

Correct. Over the years, France, China, Latin America and the former Soviet Union have all developed reputations as places where industrial espionage is widely accepted, even encouraged, as a way of promoting the country's economy. Many other countries are worse.

A good resource for evaluating the threat of doing business in different parts of the world is the Corruption Perceptions Index published each year by Transparency International (and made famous by The Economist).

In 2003, the Corruption Perceptions Index ranked the following 12 countries as being "perceived as most corrupt": Bangladesh, Nigeria, Haiti, Paraguay, Myanmar, Tajikistan, Georgia, Cameroon, Azerbaijan, Angola, Kenya, and Indonesia.

Another list ranked big countries where companies are most likely to pay bribes to win or retain business in emerging markets. The worst scores belonged to Russia, China, Taiwan and South Korea, followed by Italy, Hong Kong, Malaysia, Japan, USA and France. (To download the full results of the index, visit Transparency International at www.transparency.org.)

India is another country of increasing importance to American businesses because of the rapid rise of offshore outsourcing. The prevalence of outsourcing of IT functions introduces some vulnerabilities to companies that may not think of themselves as having a global presence. In legal terms, the most pertinent global standard is the World Trade Organization's intellectual property add-on, TRIPS (Trade-Related Aspects of Intellectual Property Rights). But TRIPS protections still must be enforced locally, and none of the countries prominent in software outsourcing, including India, have local laws covering theft of trade secrets. TRIPS signers or not, if a country's culture does not respect property, the courts are unlikely to enforce laws. Several sources interviewed for this article agreed, though not for attribution, that China, which signed the TRIPS aagreement, regards intellectual property (especially that of foreigners) as communal property. Experts say India's culture is generally more IP-friendly, but the legal status of intellectual property in India is in a state of flux.

Here are nine practical steps for protecting IP specifically where you're offshoring software work:

1. Send people to inspect the physical premises where the software will be written. Note whether buildings have basic security check-in procedures and the like. Find out what kind of access people have to key systems.
2. Look closely at the way networks function, particularly if you plan to use virtual private networks. These are good for cross-facility communications, but make it easier for remote employees to work from home or on notebook computers, which can increase vulnerability.
3. Protect important information, such as source code, with passwords and access codes, and make sure that these are not widely available, either in the United States or at the outsourcing location. Approvals do reduce flexibility, but not as much as they reduce risk.
4. Demand that the outsourcer have tight human resources screening. Look for employee retention figures, find out if competitors do business with the same companies, and if so, ensure that there is no contact between teams.
5. Know what risks your own organization can take. Regulated industries such as health care and financial services need to keep closer controls over data and software development than, say, packaged goods companies.
6. Work to understand the legal system and culture of both countries. Negotiate contracts that make the offshore company responsible for the actions of its employees.
7. Budget for greatly increased telecom costs, as well as for regular visits to the outsourcer.
8. Make sure that any test data being used does not expose real information traceable to real customers.
9. Always maintain an original copy of source code. This step seems obvious, but in one Y2K outsourcing case, a company was unable to prove a bug had been added to a program because it had not kept its source code.

Companies that don't have the resources to take these steps should think twice about what they are putting at risk by offshoring, whether it's software development or some other function like call centers involving sensitive customer data.

• Email
• Print
• Comments
• Digg This
• SlashDot

• Intellectual Property Security: Don't Lose Your Head
• Defining Intellectual Property
• I've Got a Trade Secret