• United States



Poor security practices can lead to loss of trade secret protection

May 02, 20073 mins
Data and Information SecurityIT LeadershipPhysical Security

When most people think of losses resulting from poor security practices, they generally think of damages relating to unauthorized access of their systems.  However, there is another, potentially far more significant, type of damage that may result from inadequate security:  poor security practices can result in a loss of trade secret protection for a business’ most valuable information.  In one case, a business sued a competitor for unauthorized use of its customer lists, vendor lists, pricing information, software, and marketing plans – all of which the business claimed were its trade secrets.  The business lost the litigation because it failed to establish that it had used reasonable efforts to protect the secrecy of its proprietary information. 

The business had failed to require its customers to sign software licensing agreements or confidentiality agreements and allowed customers to transfer software freely from one computer to another.   Technicians failed to change default passwords in the software.  Additionally, a bug in the software allowed customers to gain access to the software without using a password and the business did not act swiftly to correct the bug.  Finally, the business had failed to enter into appropriate agreements with its employees to protect the confidentiality of its trade secrets.

The lessons learned from cases such as the foregoing are those that any good security policy should address:

1.  Have each employee sign an appropriate agreement addressing confidentiality, intellectual property ownership, and non-competition.

2.  Institute procedures within the organization to educate employees about trade secrets and inform them of their obligations to protect such information.  These procedures should include specific instruction to employees regarding their obligation not to use trade secrets after they leave the company.

3.  Require customers to sign license and/or non-disclosure agreements to limit their use of proprietary information. 

4.  Adopt procedures to require employees to change default passwords and to promptly remedy security bugs in software.  Carefully document efforts to resolve security bugs.  If necessary, this documentation can be used to help establish that the business acted reasonably in addressing security flaws in its products.

5.  Do not post trade secret information in publicly accessible places like the Internet, unless every visitor is required to agree to terms and conditions regarding their use.  The classic example of this problem is when businesses post product user guides on the Internet.  These guides can, and frequently do, contain valuable trade secrets.  Unless access to the guides is subject to the acceptance of an on-line license or non-disclosure agreement, trade secret protection may be lost.


Michael R. Overly is a partner and intellectual property lawyer with Foley & Lardner LLP where he focuses on drafting and negotiating technology related agreements, software licenses, hardware acquisition, development, disaster recovery, outsourcing agreements, information security agreements, e-commerce agreements, and technology use policies. He counsels clients in the areas of technology acquisition, information security, electronic commerce, and on-line law.

Mr. Overly is a member of the Technology Transactions & Outsourcing and Privacy, Security & Information Management Practices. Mr. Overly is one of the few practicing lawyers who has satisfied the rigorous requirements necessary to obtain the Certified Information System Auditor (CISA), Certified Information Privacy Professional (CIPP), Certified Information Systems Security Professional (CISSP), Information Systems Security Management Professional (ISSMP), Certified Risk and Information System Controls (CRISC) and Certified Outsourcing Professional (COP) certifications.

The opinions expressed in this blog are those of Michael R. Overly and do not necessarily represent those of IDG Communications, Inc., its parent, subsidiary or affiliated companies.

More from this author