Strict Federal Protection for
Your Trade Secrets
Let's say -- just hypothetically -- that someone went
walking around muttering "This is why
I went to law school."
Would you think he was missing a few send-out slips?
Okay, it's me. Every decade or so it happens.
It happened in the 70's when our placement trade secrets act was passed into
law. It happened in the 80's when Paul Hawkinson and I founded Search Research
Institute. Then it happened again in the 90's at the groundbreaking of the National
Placement Law Center building.
Now it's happening again. Only more.
Our trade secret's out. It's time you knew.
I've never reported on anything so important to
maintaining your business. It
will revolutionize the entire area of placement file protection. We will, we
will rock you!
Today we're introducing the most powerful weapon ever invented in the fight against
misuse of your most valuable asset -- your information. Not just your "customer
list". E-v-e-r-y-t-h-i-n-g on your computers. It's the federal Computer
Fraud and Abuse Act (18 USC 1030, et seq.).
Before we get into the CFAA, let's review.
1. Traditional Legal Theories
Our offices and others have been successfully enforcing rights against misuse
of trade secrets for over 30 years. Enforcement can be and is effective in courts
everywhere every day.
However " 'Tis better to have not tried at all than to have tried and failed." If
your lawyer applies for a temporary restraining order (TRO) or preliminary injunction
and it's denied, your ex will figure he can do whatever he wants. Why? The judge just told him so! Along with everyone else you both know. So it's a high roll
and you absolutely must win. The burden of proof is the highest possible standard
"irreparable harm" if the judge waits.
You'll also be alleging a violation of the "restrictive covenants" in
your employment agreement. In the case of this breach of contract, there must
be proof of:
A valid agreement (see Section 9),
Reasonable efforts to maintain secrecy of the information, and
One or more violations of the agreement.
And there's much more to prove when you allege the traditional major money
theories like breach of fiduciary duty, conversion (civil
theft), fraud, inducing
breach of contract, interference with contractual relations, interference
with prospective economic advantage, slander (per se), trade
competition, conspiracy, etc.
You can also allege violations of the Uniform Trade Secrets Act (UTSA) that has
been enacted in 44 states. Under the UTSA, the employer must show that the information
sought to be protected (client names, contact information, names of hiring managers,
candidate specifications, position descriptions; candidate names, contact information,
job and career preferences, etc.) constitutes a "trade secret". (The
only exception is in California where passage of Business and Professions Code,
Section 16607 aka: "The Allen Law" defined them.)
The UTSA defines a trade secret as information that:
Derives independent economic value, actual or potential, from not
being generally known to the public or to other persons who can obtain
economic value from its
disclosure or use, and
Is the subject of efforts that are reasonable under the circumstances
to maintain its secrecy.
(Since there are 44 different state citations for every section of the UTSA,
I can't give them to you here. Check your local law library or ask your lawyer
for the statutes in your state.)
So "winning" means two things:
Stopping ("enjoining") the conduct,
and receiving money ("damages") to compensate
you, punish your ex; and
Make an example of him to discourage others
from similar wrongdoing.
2. Why the CFAA
is Such a Breakthrough
The CFAA was originally enacted by Congress in 1984 to protect classified, financial
and credit information. The 1996 amendments expanded its reach to include any
computer used in interstate commerce. That included any Internet connected computer.
It took until 2000 for the first decision to be published, but now over a hundred
federal ones are reported. Precedents are emerging that we can cite in our cases
and for TFL subscribers. (Certain published decisions are the only ones that
can be cited in another case.) There are only a few published state court decisions.
You'll see why as we discuss it further.
If there's any use of a computer to remove or copy data, the CFAA can be invoked.
It's a strict liability statute. In simple terms, all you need to show is that
Accessed your computer without authorization to do what he did,
Caused damages of at least $5,000.
[18 USC 1030(a)(2)C)]
"Unauthorized access" is now broadly defined by the federal courts.
One U.S. District Court in a published decision held that it included
e-mails transmitted through other computers until it reached
a final destination. (America Online, Inc. v. National Health
Care Discount, Inc.,
121 F Supp2d 1255).
So if you don't like what your ex did, it's probably unauthorized
The CFAA defines "damages" as "Any impairment to the integrity
or availability of data, a program, a system, or information that causes loss
aggregating at least $5,000 in value during any one-year period to one or more
individuals." [18 USC 1030(c)(8)] You'll define them as "WOW!" Most
small claims court limits are higher than that. A partial placement fee, a temp
markup, a lost search assignment, a computer data retrieval, etc.
In EF Cultural Travel BV v. Explorica, Inc. (274 F3d 577),
a U.S. Court of Appeals found that the award of consulting fees for
a forensic analysis of data was appropriate
even though there was no evidence that the company's web site
or data had been compromised!
Before we leave this area, I'd like to tell you about two published decisions
interpreting scenarios we see regularly in our offices:
The first is Shurgard Storage Center v. Safeguard Self-Storage (119 F Supp2d 1121). Employees of Shurgard left to work for Safeguard (a competitor). But before
they left, they accessed the Shurgard computers including sending e-mails using
Shurgard trade secrets. The Court held that they were therefore "without
authorization" to access the Shurgard computers and in fact were acting
as employees of Safeguard. This is what employer lawyers call "bad acts
during employment". The court found that they were already working for the
competitor while still collecting a paycheck from the current employer.
The second was U.S. Greenfiber v. Brooks (2002 WL 31834009). On the day she left
Greenfiber, the ex-employee accessed the company's e-mail system to solicit its
employees. She also refused to return company documents and electronic data.
The U.S. District Court granted a preliminary injunction:
Requiring return of all company information, and
Preventing use of the information, directly or indirectly.
(The issue of damages is taken up at a trial. This decision was reported only
after the pre-trial preliminary injunction hearing.)
3. What You Need in a Traditional Case that You Don't Need under the
As you can see, meeting your burden of proof in a traditional case is a challenge.
Just think about the difficulty and suicidal tendencies required to obtain affidavits
(formal statements under oath) from:
Past, present and prospective clients.
Past, present and prospective candidates.
Past, present and prospective temporary employees (if you place
Witnesses to removal of documents, hardware or other property (employees,
security guards, janitors, etc.).
Written policies regarding confidentiality in employee handbooks
General written warnings periodically circulated to employees?
Specific written warnings when breaches of security occur?
Copier and telephone monitoring procedures?
Exit interview checklists?
Warning letters upon termination?
It's difficult to run a happy hospice when you spend the workweek suffering from
an acute case of paranoia. So most owner-managers are unable to produce too many
nastygrams on the way to the courthouse. Still, as the plaintiff you have the
burden of proof by a "preponderance of the evidence".
Ex-employees who steal are likely to lie too. Therefore don't expect the primordial "discovery
process" to either "discover" or "process" anything
from your ex that you'd like to see or hear.
But under the CFAA, there is no requirement that the information
was used or even disclosed. Only that it was taken in some way (physically, downloaded, etc.).
4. Concurrent Jurisdiction
and the Abstention Doctrine
Concurrent jurisdiction simply means that both state and federal courts can hear
cases under the CFAA.
That means you have seven options on where to file your claim:
Your local state court.
Your closest U.S. District Court.
Your local state court along with traditional claims.
Your closest U.S. District Court along with traditional claims.
Your local state court if you're already litigating
there by "amending
the pleadings" (either by "stipulation" or
agreement with your ex, or an easily-granted court order).
Subsequently (then simultaneously) in your closest U.S. District
Court if you're already litigating in your local state court.
Simultaneously in your local state court as to the traditional
claims and your closest U.S. District Court as to the CFAA claim.
The last two options are subject to the abstention doctrine. (No -- it's not
what you tell your teenage daughter but will work just as well.) It simply means
that under certain limited circumstances, the federal court will "abstain" from
hearing a case when a state court action is pending.
The U.S. Supreme Court laid out abstention guidelines to the lower federal courts
in the seminal case of Colorado River Water Conservation
District v. United States (424 US 800). In doing so, it stated that abstention was an "extraordinary
exception" to the "virtually unflagging obligation [of federal courts]
to exercise the jurisdiction given them" (424 US 817).
Thus the "pendency" of an action in a state court, even when it concerns
the same matter as the federal action, is ordinarily no "bar" to the
federal action. The potential for a different result, or two courts simultaneously
deciding the same issues, does not warrant "staying" (suspending) or
dismissing the federal action.
5. Choosing Which Court to Use
Federal if you can prove computer abuse immediately (see Section 10). Issuance
of a U.S. District Court Preliminary Injunction? Like against Microsoft or something?
Enforceable by a uniformed, armed federal marshal? Oh, I think so. I really do.
Otherwise, the state courts are fine to obtain an injunction quickly under traditional
The reason there are only a few published state court CFAA decisions
should now be obvious: Anyone smart enough to use it is smart enough
to know that it's the
fastest, easiest, surest way imaginable to end-run around
the many barriers that prevent smaller, local cases from being considered
by federal courts. State
court judges stay away from deciding a "federal question" too,
because they're unfamiliar with the subject. The CFAA raises
federal questions (issues).
Most lawyers never experience the high-class world just beyond the federal courthouse
security checkpoints. The clerks are professional, the judges are the finest,
and the lawyers show respect. The courtrooms are huge and quiet. After two centuries
of activity, they're very efficient too. Every time I empty my pockets and take
off my shoes, I just wanna shout "This is why I went to law school!"
6. Selecting the Right Lawyer
If you think My Cousin Vinny was a documentary, change lawyers. If you're going
to star in anything, let it be a rockumentary!
Remember " 'Tis better to have not tried at all . . ." You
can't afford to make a mistake in choosing representation.
If your lawyer really practices federal law, great. You can usually tell by calling
him. Say "18 USC 1030". If he replies "Go Trojans!", you're the one who should pass. Other clues are gibberish about needing "diversity
of citizenship", proving at least $75,000 "in controversy", or
a request for directions on how to get to the courthouse. Asking a lawyer whether
he practices in the federal courts is like asking a recruiter if he does retained
You don't want to have your lawyer starting a federal case without a working
knowledge of how the substantive law, federal procedure and local court rules
work. Knowing the local "federal bar" helps too, since the judges are
Federal judges are lifetime appointees of the President of the United States
and approved by the United States Senate. Most are picked because they were the
best judges in the state courts. They sit up high and far away. They look down
at you. In black robes. With armed guards. They can be brutal if you're unprepared,
waste their time or try to fool them. It's bad enough that you'll be paying your
lawyer's tuition to the College of Placement Knowledge, but he's got to know
the rules of the road on the U.S. highways. And his GPS system must be locked
on that red octagon marked "STOP".
As I noted in The Employee Termination Handbook:
The public has the impression that a court is like a giant automated teller machine.
Just plug in the right facts and law, and the cash will appear. Trial lawyers
are disabused of this impression rather violently during their first court appearance.
This is the difference between science and art in the practice of law. The proof and interpretation of the law are critical.
So check around and find someone who has a reputation for winning. Ideally someone
with at least 10 years of federal plaintiff business litigation experience. A
firm of five lawyers or so (less means poor coverage, more gets confusing). If
your calls are not returned within a few hours, find someone else. Don't obsess
about hourly rates. Hourly rates are a lawyer's game since he's keeping track
of the time. The key isn't effort, and it certainly isn't time. It's results.
Expect to pay for them, but expect them!
7. Checking Out the Judge
As soon as your case hits the courthouse, you'll be assigned a judge and possibly
a "magistrate" (assistant judge) to hear less critical matters. You
will then begin to learn why I say "Fear not the law but the judge."
This is particularly true in the almighty federal courts. The judges have well-known
proclivities, everyone in the courthouse knows them, and gossip reigns.
You owe it to your future to wander those halls of justice, talk to the clerks
and bailiffs, and familiarize yourself with the lay of the land. You might go
into a few open courtrooms and sit in the back too. If your judge is holding
court, listen well. Don't wait until your first hearing to go, either. It could
be your last.
While you're there, go to the law library and ask for the Almanac
of The Federal Judiciary. Volume 1 contains the U.S. District Court "Profiles and Evaluations
of All Judges of the United States District Courts". Read it and take notes
as though you were reference-checking a CEO candidate.
Was your judge a "Carter appointee"? A "Reagan appointee"?
Those two Presidents chose very different judges. More recent Presidents chose
judges a bit more centrist in their views, but where do they come from? Where
did they go to school? Were they criminal prosecutors or insurance defense counsel?
What are their values? Their hobbies? Who are their heroes? What do they like
about the lawyers who appear before them? What do they want to see from them?
What makes them bang their gavel? Have they written any landmark decisions? Which
ones? Are they "reversed on appeal" (dinged by the Court of Appeals
for making a bad call) often?
If lifetime-appointed federal judges are anything, they're outspoken. It's all
there in the Almanac just for the looking. It even has comments from attorneys
who appeared before the judges. (Not necessarily a good referral source though,
since it's not the judges evaluating them.)
Ask the librarian for articles about the judge, legal treatises he may have written,
and anything else that will help you understand him. Career law librarians are
so helpful. Many know every syllable in the library. Just asking will usually
get you all the information you need.
If it doesn't work, go over to the stacks and whisper confidently "This
is why I went to law school." Your subconscious believes
everything so itwill give you the confidence tolook for the
Why is checking out the judge such a trade secret? I'm still stupified silly
by the number of lawyers who enter a courtroom without knowing at least as much
about the judge as they do about the case. Even pre-schoolers know to study the
teacher before they study the blocks! Go figure.
Don't leave it to chance. Share your findings with your lawyer. It'll lower your
fees if he thinks you're hip. And it could win your case.
8. CFAA Criminal Penalties Too
If you're not already dancin' on your desktop, this should do it:
The CFAA also has a long list of criminal penalties. Violations can
have devastating consequences. They include massive fines and up
to 10 years imprisonment in a
federal penitentiary. [18 USC 1030(7)(c)(1)(A)]
This is a matter for the U.S. Attorney's Office in that closest federal
courthouse. The office may be too busy to prosecute your case, but
the staff is great. Whether you get more assistance will depend on
your persuasiveness, your presentation and your persistence.
If you're serious about pursuing this, personally visit the local U.S. Attorney.
Make a friend. You have no idea how few a tough prosecutor has. Don't waste his
time. Do your homework like a most-placeable-candidate preparing for an interview.
Document all of the facts, circumstances and evidence. Your lawyer shouldn't
get involved (unless he has connections there), since the deputy is more likely
to tell you it's a civil matter.
Your goal should be to get a letter -- any letter -- written to your ex on the
U.S. Attorney's letterhead. Just mentioning your business name and the words "Have
a nice day." would be fine. With that letterhead, no injunction will be
Now let's pay attention to prevention.
9. Having an Employment Agreement
There are a few things you must know:
The most important thing to know is that you absolutely need an
It's like having an insurance policy. Actually, it is an insurance policy --
a business interruption one.
The next most important thing to know is that consistently 80% of the ones we
review are either unenforceable or -- even worse -- illegal. Some are the product
of a store-bought software package, a one-size-fits-all Internet download, a
form from a do-it-yourself book, a seminar that blew into town, a network/franchise/association
package, or just some well-intentioned lawyer's idea of what will work. Others
cost a fortune and read like your office lease. 20% are fine.
Even our agreements -- as effective, state compliant and industry specific as
you might expect after three decades -- are automatically updated for our clients.
Like all of the agreements in this area, they're only as good as:
The latest federal or state law on the subject. (Each state has
The latest federal or state reported court decision on the subject.
(New ones are published regularly.)
The latest federal or state regulation. (From the many governmental
agencies involved with employment matters.)
The latest federal or state administrative ruling. (From those
many governmental agencies.)
If you have employees in several states, multiply the complexity by that number.
Employment agreements are an art form. They must be enforceable to the extent
that the limits of the law will allow. They must also be marketable to new and
current employees, so they sign without changing the terms. (Major equal employment
issues with different agreements for different employees. Major morale problems
If (and only if) you're convinced that your current agreement is valid, insert
the following language where appropriate:
Name of employee understands and agrees that the unauthorized
use or disclosure of any information contained in the name of
your business computers will be subject
to the provisions of the federal Computer Fraud
and Abuse Act (18 USC 1030, et seq.) that provides injunctive relief,
civil damages and criminal penalties for violations.
Don't write a law review article here. Less is more. More will cause your employees
to go running to a lawyer, and will impede signing the agreement.
A simple statement like this enhances your agreement by placing the employee
on notice that the CFAA will apply. The honest warning can only mean:
You know your rights, and
You intend to enforce them.
Please have someone knowledgeable review your employment agreement now.
80% is the statistic. Believe it.
10. Establishing Immediate
Evidence of Unauthorized Use
Think about the damage someone with a $50 flash drive and a few minutes
can do. Your database could be twirling on some whistler's keychain
before you finish
this article. Telecommuter recruiters don't even need that.
You need to move f-a-s-t if you expect an injunction to "issue". It's
a cold day in the courtroom when the judge looks down at your lawyer from on
high and bellows "Where were you a month ago, counsel? You want me to stop
the conduct now? Why can't this wait until trial?"
If you're going to nudge a judge, you'd better be prepared to budge a judge. Or you'll know what it means to grudge a judge. Again " 'Tis
better to have not tried at all . . ."
Third-party forensic computer analysis takes weeks and sometimes months. If your
ex has possession of the computers, just getting access may require a court order.
Time is on their side, since they make placements, make money, make calls to
your current employees, make client and candidate friends, and generally make
your life miserable.
Yet you don't need to deal with your ex if you set up your system properly. It
costs less than one small placement fee. You can be in court at the first opportunity
with sufficient proof to convince the court to issue an instant injunction.
The consensus from our experts is that you need a separate server, locked up,
that gives you central backup and security throughout your network. This is to
automatically and reliably control access to files, track use (who, what, where,
when and how), block the use of data storage devices, and prevent deletions.
It will stop current employees from making plans as well as "placements
in the basement". It will also deny access to ex-employee competitors.
The current gold standard for this is the Microsoft Small Business Server (SBS),
and is cyber-years ahead of the pack. If you have five employees or more, it's
a minor buying decision that's essential. You might also check out web-based
systems, but our clients give them mixed reviews.
Aside from your peace of mind and protecting your livelihood, the server can
give you an instant printout of the "unauthorized use" the CFAA requires.
Written information about computer security is usually outdated faster
than an employment agreement. The mass-market books don't have the
detail you need, but
we found two excellent textbooks: Security Plus:
A Guide to Networking Security Fundamentals by Mark
Ciampa, and Principles of Information Security by Michael
Whitman and Herbert Mattord. Both of these are available
for $80.95 each from Thomson Learning, Inc. at (800)648-7450.
What? Can it be? I've stopped muttering! And you've got the moves.