Protecting Secrets in Tech

Transcript

Alitia (00:06):

Welcome to Jackson Lewis's podcast, We get work™. Focused solely on workplace issues everywhere and under any circumstances, it is our job to help employers develop proactive strategies, strong policies, and business-oriented solutions to cultivate a workforce that is engaged, stable, and diverse.

Our podcast identifies the issues dominating the workplace in its continuing evolution and helps answer the question on every employer's mind, how will my business be impacted? Efforts to bolster regulations aimed at limiting covenants not to compete coupled with the increased and sustained prevalence of remote work, have technology companies scrambling to protect their trade secrets. On this episode of We get work™, we provide an overview of the recent regulatory sea change, describe strategies for resolving the remote work conundrum, and identify practical ways to ensure trade secrets stay secret.

Our hosts today are Erik Winton and Pat Richter, principals in the Boston and Austin offices of Jackson Lewis respectively. Erik serves as the co-leader of the firm's Restrictive Covenants, Trade Secrets and Unfair Competition Practice Group, counseling employers on restrictive covenant drafting, litigation avoidance, and when avoidance is futile, representing clients on both sides of these issues before a judge and jury. Pat's litigation practice includes matters involving intellectual property and trade secrets, covenants not to compete, stock option agreements, employment contracts, and wrongful discharge claims.

Erik and Pat, the question on everyone's mind today is how can technology employers protect valuable company information in the face of regulatory restrictions and tech-savvy employees? And how does that impact my business?

Pat Richter (01:58):

Hi, I'm Pat Richter.

Erik Winton (01:59):

And I'm Erik Winton. And welcome to this episode of We get work™.

Why is the topic of how to protect trade secrets relevant to the tech industry right now? Well, by definition, tech companies are engaged in the process of creating new or innovative tech, in whatever form that may take. And this process involves a creation of valuable intellectual property, IP. That IP, such as trade secrets, copyrights, patents, they're the lifeblood of successful tech companies. And protecting IP from misappropriation is one of the highest priorities for many tech companies.

Recently I, along with my practice group co-leader, Cliff Atlas, co-signed a letter to the White House and the FTC urging caution on restrictive covenant regulation. In that letter, we cited sources indicating that hundreds of billions, that's billions with a B, hundreds of billions of dollars are lost each year as a result of trade secret theft and the vast majority of people who misappropriate trade secrets are either employees or someone else known to the party whose secrets are stolen.

Now, traditionally, one of the primary ways that tech companies protect trade secrets is through restrictive covenants, including covenants not to compete. However, it's becoming more challenging for tech companies to protect trade secrets through restrictive covenants for at least two reasons. First, we are in the midst of a regulatory sea change in the non-compete arena. In the last few years, many states have passed statutes that limit or completely eliminate the circumstances in which non-competes or other restrictive covenants are permitted. And the federal government is also, for the first time, expressing interest in regulating this area of law.

Second, we're also experiencing a sharp rise in remote work thanks in large part to the pandemic. And that is not going away. Hopefully, the pandemic's going away, but not the remote work. Increased prevalence of remote work creates both practical and legal challenges in restrictive covenant enforcement and trade secret protection.

On this podcast, we will, first, provide an overview of the state of non-compete regulation and what might be on the horizon for tech companies. Two, explain how remote work has changed the calculus of non-compete enforcement even in states where they remain permitted. And three, discuss some practical ways tech employers can protect trade secrets in addition to restrictive confidence.

Pat Richter (04:24):

So with that in mind, in this podcast, we're going to talk about a handful of things. First, we're going to talk about an overview of the state of non-compete regulation, kind of where things currently stand and where we think things might be going on the horizon for tech companies. We're also going to talk about how remote work has changed the math of how companies evaluate non-competes and how those non-competes are enforced in the states where they're still permissible. And we're going to talk about some practical ways that tech companies can protect their trade secrets in addition to or above and beyond restrictive covenants.

So I'm going to start by talking about the increased regulatory efforts by talking about a little bit of how did we get here, a little background on the regulation of non-competes. And as you can guess, these kinds of agreements have been around for a long time, hundreds of years. And under common law, the test was really whether it was reasonable, whether there was something that the employer had an interest in protecting, and then whether the restriction was reasonable with respect to what that interest was. So you couldn't go too far in terms of interfering with a party's ability to get work, but you could protect whatever the protectable interest was.

That was that way for a long time. In the late 1800s, a handful of states passed laws that banned non-competes. California, which is sort of notorious for banning non-competes across the board, but also North Dakota and Oklahoma had laws that outright banned non-competes under any circumstances.

You know, I think those are three examples. I think that things kind of stayed that way for quite a while. You know, the next real wave of state regulation happens in the middle 2000s. There's a handful of states that pass statutes to tinker with how non-competes are enforced and under what circumstances. Oregon, for example, had a statute that required minimum compensation. If an employee was below a certain amount, you couldn't tie them to a non-compete. Massachusetts passed a law that became law in 2018. Georgia has a law that restricts who can sign restrictive covenants. Interesting, perhaps, Hawaii in 2015 was the first and only state to ban non-compete and non-solicitation clauses for employers of what it defined as a tech business. And I think that's interesting because in my experience technology companies are arguably more interested in and maybe have a greater interest in having a non-compete given the trade secret intellectual property issues that are at stake.

But these examples of these states passing these different laws, this isn't the first time that states will take different views leading to kind of a patchwork across the board for employers that have employees everywhere.

Erik Winton (07:11):

And with those different states, Pat, starting legislation, I saw it as sort of those states were actually doing it from an activist point of view, like they wanted to change the law. The common law had been there for 100 years or so or maybe even more and some of them wanted to change that for whatever reason, there was some lobbying group behind that. Some of them also instead were just seeking to codify what was already the common law and just to put it in the statute so that it allowed for a little bit more predictability for practitioners and parties. So there's sort of a combination of that depending on where they were.

Pat Richter (07:47):

Yeah. And I find it interesting sitting here in Texas, the push and pull of trying to make non-competes either more or less enforceable. You know, you have businesses that say, look, we want to be able to go out and hire people; we don't need the labor market artificially tamped down. But at the same time, they're like, I don't want my best sales guy going across the street with the Rolodex and going to a competitor. So it feels like, especially on the business end of things, there's always a push and pull there about pushing the state to either do more or less to make the covenants more or less enforceable.

Erik Winton (08:15):

Having their cake and eating it too.

Pat Richter (08:17):

Of course.

Erik Winton (08:18):

Yeah. Well, maybe be in Texas having their ribs and eating it too.

So moving on to sort of the timing here. Pat, so that takes us to October 2016 after some of these states had issued regulations. And that was when the Obama administration issued a call to action to the states. And we say it's the Obama administration, vice president at the time, Biden, current President Biden was heavily involved in that call to action. We know that because he's spoken about his feelings against non-competition agreements. And that call to action to the states made several suggestions, one of which was to ban non-competes for certain categories of workers, like low-wage workers or workers in occupations that promote public health and safety or workers unlikely to possess trade secrets or workers perhaps laid off or terminated without cause.

And what I find interesting about that, and I found that interesting at the time, was that as a practitioner and having advised clients on drafting these agreements and having certain people sign them and then trying to enforce them, that's not rocket science, that's not news to most people that you shouldn't have low-wage employees signing true non-competes and you shouldn't have people who aren't likely to possess trade secrets signing true non-competes. Maybe they'll sign a nondisclosure. Maybe they'll sign a non-solicitation of employees or non-solicitation of customers provision. But a true noncompete should be used with someone who's at a higher level, someone who's more higher paid, and someone who's, has access to more trade secrets or other confidential information. So I don't think that was groundbreaking advice from the call to action. But apparently, there were some companies, as the news was picking up at the time, that were using non-competes across the board for sandwich shop workers or camp counselors or warehouse workers. So that's what the call to action recommended.

It also recommended improving transparency, meaning requiring advanced notice if an employee needed to sign a non-compete, that they know about it before they accept the offer. And that's something that links to some of the reports or studies we've seen from economists in this area that indicate that if someone doesn't know they need to sign a non-compete when they're starting their job and they've already left their other job, that's statistically they make less money than someone who knew they had to sign a non-compete.

Now, I'm not sure that the two things are necessarily directly correlated, that, for example that companies are purposely holding back non-competes pre-offer in order to stifle wages. As I've spoken to some of the economists who've actually done these studies, their mindset is, well, if a company can do that, that's why they're doing that. And I'm not sure that's the way it works. Clients of mine who aren't, for some reason, giving the non-compete with the offer letter, it's usually just a function of poor HR hygiene as opposed to trying to find a way to stifle wages.

And the other thing that the call to action said was that they wanted to incentivize employers to write enforceable agreements so that they promote the ability of judges to reform contracts made in good faith and that they didn't have companies overreaching with the language of the agreements. And after the call to action, there was another, not surprisingly, a recent wave of state changes banning non-competes for low-wage or low-skill workers in about 10 states. That happened between 2016 and 2021. There were other states that had notice requirements, again between 2018 and 2021. And then more recently, the District of Columbia, what looks like a full ban on non-competes that may become applicable in April of 2022.

So again, as Pat mentioned, we have this patchwork of regulations with wildly inconsistent requirements across the country. And there are also many pending bills around the country that would continue to amend state laws on these issues. I think most recent count is that this year, as of last week, there have been 68 non-compete bills that were pending in 26 states. And also, as of last week, 39 of those bills in 17 states have died. And three other bills in Oregon, Illinois, and Nevada have passed, leaving the current tally at something like 26 non-compete bills still pending in nine states. And that's not even counting two bills or two proposed legislation that just happened in the last week in New York and New Hampshire. The New York one was almost like a copy of the Massachusetts statute, and the New Hampshire one tried to tie vaccine requirements to non-compete enforcement by telling employers if you're requiring or you fire people for not having the vaccine, then you can't enforce a non-compete. Nothing like combining two completely unrelated issues.

Pat Richter (13:06):

Especially for either a headline or a little publicity on it, right?

Erik Winton (13:09):

Yeah. And isn't New Hampshire Live Free or Die. I just ...

Pat Richter (13:12):

Something like that.

So what happens then, it seems like anytime you get these patchwork of issues across the country and inconsistent rules and employers now, especially with remote work being a little more nationwide, you get the federal government jumping in and trying to make some sort of uniform effort towards regulation. And so that's what's happened in the last five or six years. There have been a couple of different attempts at the federal level to pass legislation to regulate non-competes. There was something called the Workforce Mobility Act, which was essentially a complete federal ban on non-competes. It got introduced in think 2018, but it never got any real traction. I think there are current versions of that bill pending in the Senate and the House. But the never-passed, no-traction current version pending is basically the state of any real federal effort to pass a law to address these non-compete issues.

So the most recent thing that happened with respect to these federal efforts is in July of 2021, President Biden directed the Federal Trade Commission to look into what it could do to curtail non-competes. So his executive order didn't directly address non-competes, but it told the FTC what to do. There's no actual change in the law yet. And the language of Biden's order leaves the door open for the Trade Commission to regulate non-competes going forward.

On that front, I believe there's a meeting coming up in December between the Federal Trade Commission and the Department of Justice to look at kind of a broad range of issues, including non-competes and other restrictive covenants, even non-solicitation obligations. It's interesting, in some places those aren't considered restrictive covenants. I know they are in Texas, even an employee non-solicit, but particularly a customer non-solicit's treated the same as a non-compete. So it'll be interesting to see.

You know, Erik, based on what's happened previously with state and federal regulations, do we think it's likely that the federal government's going to regulate this area either through legislation or Federal Trade Commission regulation?

Erik Winton (15:29):

I actually, I think we're a long ways away from that, Pat. I mean, I attended the FTC workshop in January of 2020. It was a full-day workshop. And I would say it started off pretty strong, saying here's why, a lot of economists up there, professors, and others who wanted to be activists and say here's why the FTC should be taking action in this area. But the afternoon was concentrated on a bunch of administrative law experts who were essentially saying first of all we're not even sure if the FTC has the authority to do this, and if they do how they would do it, and then if they decided to do it how long it would take to have a rule-making and the like.

So we're likely not months but years away from something happening, if it does happen, at the FTC level. And the federal legislation just hasn't had enough traction no matter how many times, last few times that they've tried to get things passed. So I'm thinking, I'm not sure we didn't mention this, but in September of 2021 there was an FTC commissioner, Christine Wilson, who gave written testimony to a House subcommittee discussing labor issues. And she sort of, even though in July President Biden had put this on the FTC's doorstep, she came back and said that elected officials in each state are best situated to weigh these issues relating to non-competition agreement, which by the way makes sense, right? There's hundreds of years of common law in each one of these states, and they're not all the same. And different states have different industries and different interests. So I really don't see, if I was a betting man, I wouldn't see that federal legislation or FTC action is likely at least in the short term.

Pat Richter (17:09):

Yeah. If I was betting, I'd say it's probably more likely you get some sort of regulation by the FTC with Biden appointees but that it gets tied up in litigation and it probably never, it either dies or it just gets hung up forever.

Erik Winton (17:23):

Yeah. I mean, what? Does that happen, Pat? Does legislation get tied up in litigation over people disagreeing with the rights of federal authorities to regulate things? I think I've heard that in the news recently.

Pat Richter (17:35):

I'm in the Fifth Circuit. The Fifth Circuit suspends everything down here.

Erik Winton (17:39):

Yeah. So look, I mean in terms of the challenges facing the, pivoting to the remote work, and that's what we've experienced more now now that we've been through approaching two years of the pandemic, we've seen that restrictive covenant law is a state-driven area and changes can be drastic from state to state, whether it be common law or through the legislation. And that makes it very difficult for employers and multi-state employers to administer contracts when they have this remote workforce in a lot of different states.

So when we prepare agreements for multi-state employers for their employees to sign, we try to balance essentially three considerations, ease of HR administration, we have to respect that HR has to get these things signed, legal enforceability, and business protection. And if you could look at sort of the spectrum of how we would address these contractually, if you wanted to make it as easy as possible from an HR perspective, just have one document, one size fits all. But there, if you had to do that, then you'd have to cater to the lowest common denominator, a state like California where you can't have much to these protections. So you'd be giving up protections, like legal enforceability and business protections, the other issues we want to address, giving up those things in some of the other states where you wouldn't need to be as narrow as you would be in California. So that's not great.

On the other side, you can have an agreement or multiple agreements for multiple states so that you're addressing the legal enforceability and business protection as best you can. And maybe there are 30 different versions with the 50 states that would cover everything. But that would be a nightmare from an HR administrative standpoint.

So what we recommend is you find your agreement and you have a choice of law provision for a law that hopefully is employer-friendly, a state that's employer-friendly in these areas, and also something that has a nexus to the company, whether it's their place of incorporation or a principal place of business, and you try that choice of law as your first line of defense.

And then to the extent there are states out there where you have employees which may not respect that choice of law provision, then you have an addendum to address, hey, if X state's law doesn't apply, then you need to change paragraph B to whatever it may be. And that's something that we've been recommending to clients and something that's been held up in courts to the extent that we need to enforce in states where it's not the choice of law.

So Pat, for you, what are practical ways employers with remote workforces can solve the choice of law question for restrictive covenants where the differences in state laws are so stark?

Pat Richter (20:19):

I mean, I think what you said is generally what I try to do with my clients, which is try to find the most reasonable sort of middle ground that provides the most protection and maybe applies to the greatest number of employees. And then, like you said, build in kind of a fallback addendum in case you end up with a court somewhere, especially with remote employees now sometimes. I've had a situation where a client had an employee who was based in Austin and worked for an Austin company. And then in the pandemic, when she was working remotely, that employee picked up and moved to California. Started to be an argument California law would apply.

But I think the best you can do, on paper anyway, in terms of formulating the agreement is try to make it as protective as possible given the states that you're in and then hope for the best. Also, we're going to talk about this in a second, the sort of practical methods of protecting trade secrets without a restrictive covenant. I think the other thing you want to do is make sure that that agreement has sort of all the other bells and whistles that you want, a customer non-solicit, an employee non-solicit, nondisclosure agreement with respect to anything that's confidential or a trade secret. Because that really is kind of the next topic that we're going to get to is how can you as a tech company in this environment protect your intellectual property, your trade secrets when you've got a remote workforce that now maybe you even planned them to be in four or five or 10 states, now they're in states you don't even know about?

So even without a non-compete, there's ways that you can protect your trade secrets from misappropriation. First and foremost, get your arms around what it is that are the trade secrets that you're trying to protect. Conduct a trade secret audit, look at what you are protecting, make sure it fits the definition. I also, in that circumstance, do recommend looking at things that you make public or that you even give to customers or prospects or vendors, make sure that you're doing that with an NDA because anything that you've disclosed publicly or without strings you're likely to never get enforced as a non-compete. And then look at what you do as a company to protect it. You know, is it marked in some way? Is it segregated in either files or databases? Do people have to sign NDAs to get it? Just walk through are you basically as leak-free as you possibly can be?

Another thing you can do is implement an exit protocol. You know, inevitably these fights come up. The enforcement of these non-competes and restrictive covenants comes up obviously when an employee's leaving and we find out they've gone to a competitor. And all too often, in my experience, the call from the client comes in and it starts with this guy left last Friday, we went through his laptop on Monday, and we found out he emailed a bunch of stuff to himself on his way out the door and we didn't know it. So implement an exit protocol and try to account for or catch as much of that as you possibly can when the employee leaves. I would also include in that restricting the employee's access to certain electronic information once you know they're leaving.

A very much more intrusive approach that some clients have implemented is sort of Big Brother software. And I don't know a better way to call that. But there's software that'll literally track every keystroke on a computer and tell you what an employee's been doing. It's helpful, but a lot of employees don't like it. And so you have to balance that and see whether it's worth it to you. But you definitely, we've had some success getting employees to turn over information on the way out, forensically examine laptops, computers, USB drives, things of that sort. So anyway, it's most important there just to keep a handle on what the information is and what you can do when you know an employee's leaving to make sure that they don't walk out with stuff in their pockets.

So Erik, on that regard, what are some small things a company can do to kind of make the biggest impact protecting trade secrets? What are the things that are unforced errors that we can avoid?

Erik Winton (24:26):

Yeah. And I think that invest a little bit in the tech, right? I mean, I've got clients who have taken away the ability for employees to put in thumb drives. They just can't do it on their computers, or if it does it, it doesn't recognize it. So there's no easy way to take information out in that regard. You have to invest a little bit in tech in that respect. But what it does is it allows you to better monitor information outgoing and how it gets taken out, or how it potentially could get taken out. Because when there are all these different ways for employees to take information, back in the old days they used to actually print it. Right?

Pat Richter (25:05):

Right.

Erik Winton (25:05):

And I have a case right now where someone printed two reams of paper in the last two days they were employed. And I'm like, okay, somebody from 1986 is calling and they want their printer back. Right?

Pat Richter (25:16):

Right. But in 2021, that might be the sneakiest way to walk out the door with the stuff because nobody's going to look for that and it doesn't leave a paper trail, no pun intended, doesn't leave an electronic trail.

Erik Winton (25:25):

So you would think. But actually, this company did have a way to electronically monitor that. So we had our forensic expert put in an affidavit that they did an investigation and they found that, they knew which documents were printed at what time and on which printer...

Pat Richter (25:42):

Huh.

Erik Winton (25:43):

... which is great. So there is still a way to do it. But again, so invest in the tech so that you can narrow the potential paths for employees to be able to take information away. And then when you do find out, do research forensically to find out what they've done, you're not going to have to look in a million different places. You can look, oh, they did it this way, they accessed it through Citrix, or they went on the computer during this time period, they went on the network during that time period. I think that's sort of one of the smaller, more efficient ways for companies to make the greatest impact on protecting trade secrets.

Pat Richter (26:16):

What about employees using their own devices and having access to company information on their own iPhone? I have some friends who work for a large tech company here in Austin, and I tease them because they carry around two phones. You know, they have to use their company phone for company business, and they've got their personal phone for everything else. And I accuse them of carrying around a burner. But...

Erik Winton (26:37):

Yeah.

Pat Richter (26:38):

... what do you think about companies limiting or restricting employees from using their own devices?

Erik Winton (26:43):

Yeah. I mean, look, I think that it may be difficult culturally for some companies to do that and to roll that back if you've already been doing it, but if you're starting up a new process, the more you can sort of limit, again, those pathways to misappropriation, the better. So if you have a rule that says can't use your personal phone for work and then not just have the rule but enforce it, that's key. So I think it'd be better if employers are not letting their employees use their personal phone for work purposes. That's certainly the preference if you can get away with that.

I think that's, we're coming up on our time limit here, Pat, because this is how long people like to stay on the treadmill. So I think this has been a great talk, and I hope that the people listening take away some good points from this as we move on to the new economy of the majority of the workforce working from home.

Pat Richter (27:35):

It's been nice talking with you. I hope this pod, it's informative to people who listen to it for sure.

Erik Winton (27:40):

Take care. Have a good day.

Pat Richter (27:41):

Yeah, you too.

Alitia (27:44):

Thank you for joining us on We get work™. Please tune in to our next program where we will continue to tell you not only what's legal but what is effective. We get work is available to stream and subscribe on Apple Podcasts, Google Podcasts, Libsyn, Pandora, SoundCloud, Spotify, Stitcher, and YouTube.

For more information on today's topic, our presenters, and other Jackson Lewis resources, visit jacksonlewis.com. As a reminder, this material is provided for informational purposes only. It is not intended to constitute legal advice, nor does it create a client-lawyer relationship between Jackson Lewis and any recipient.

Transcript provided by Rev.com