The New Federal Defend Trade Secrets Act

Speaking of trade secrets, there’s a new civil law on the books.

Two weeks ago, with a stroke of the President’s pen, Congress enacted a law that allows you to sue (or be sued) in federal court for the theft of trade secrets. The new law amended a criminal statute that we alluded to in last week’s post.

The amended statute defines a trade secret as any information you own that you’ve taken reasonable steps to keep secret and that derives economic value from not being known to, nor readily ascertainable by, another person who could derive value from it. The law provides federal jurisdiction for civil claims if the trade secret has sufficient nexus to interstate or foreign commerce. It doesn’t preempt any state laws.

If you’ve got a claim, you must bring it within three years of the date you discovered the theft or should’ve discovered it through reasonable diligence.

If you win, you can get injunctions to protect your trade secret as well as recover damages for your actual losses, their unjust gains, or your reasonable royalties. If you prove that the other side acted in bad faith, you can get punitive damages up to double your other damages, along with reasonable attorneys’ fees.

Plus, at the outset, not only can you sue (or be sued), you can apply for an emergency restraining order to freeze or seize property you need to preserve your trade secret, without notice to the other side.

The courts won’t just dole these orders out, though, because the law reserves them for “extraordinary circumstances.” To get one, you must clearly allege specific facts to show, among other things, that the bad guys stole your trade secret and would hide or destroy the property or evidence if they were given notice. And you have to put up security in advance to cover their damages if it turns out you were wrong or went too far.

If you do get a restraining order, the law requires that the seizure be carried out in a way that minimizes harm to any legitimate business operations. The court will schedule a hearing within seven days of the order, and there, you’ll have to prove up the underlying facts or the court will dissolve or modify its order.

If it turns out you were wrong or went too far, anyone harmed by your seizure can sue you for their damages, including lost profits, cost of materials, loss of good will, punitive damages if you acted in bad faith, and reasonable attorneys’ fees in most cases.

Finally, the law protects whistleblowers who disclose trade secrets in the course of reporting a violation of law, as well as parties to litigation who disclose trade secrets in a court filing, as long as they file it under seal and abide by any subsequent court orders.

For the full text of the statute, see here.

What Are Your Intentions?

In most white-collar cases, the main driver at sentencing is the dollar amount of the victim’s loss, and in federal cases, the rule is that you’re responsible for either the actual loss or your intended loss, whichever is greater. We touched on the difference between actual and intended loss in this post from last spring.

But recently, an influential federal court of appeals had to decide a case in which the defendant stole his employers’ trade secrets but didn’t actually cause or intend any loss.

How so?

The defendant was a young financial analyst who, over a two-year period, worked for two securities firms. Both firms had created computer software to engage in high-frequency trading, where a computer trades at lightning-fast speed in response to market events. Each firm had invested time and money to develop the algorithms behind its software.

The defendant pleaded guilty to copying their computer programs for his own use, but he didn’t sell them, publish them, or take them to a competitor.

Instead, he used them to start making computerized trades himself, and he lost $40,000 in the process. There was no evidence he had any bigger plans for them than that. He got caught when the second firm grew suspicious of the activity on his work computer, which led to his being indicted for wire fraud, computer hacking, and theft of trade secrets.

At sentencing, everyone agreed that the two firms had suffered no actual loss, and there was no evidence the guy intended to cause them any loss at all.

The trial court, however, found that he intended to cause a loss of $12 million because that was the total labor cost that the firms incurred in developing their software.

That number made a big difference. Under the federal sentencing guidelines, it jacked up the guy’s suggested sentence from probation, which may have included some time in home detention or a halfway house, to a sentence of seven to nine years in prison. Based on that, the court sentenced him to three years in prison.

And yet, there was no evidence that the guy intended to cause the victims any loss, let alone a loss that equaled their internal cost of development. Although the trial court could consider such costs under the sentencing guidelines, it could not base its loss estimate on those costs alone without any proof of the defendant’s intent.

So the court of appeals sent the case back for resentencing.

California’s Cybercrime Statute

As promised last week, here’s the lowdown on Penal Code section 502, otherwise known as California’s Comprehensive Computer Data Access and Fraud Act.

Nowadays, of course, cybercrime can include any flavor of fraud, identity theft, or other scheme or swindle that is committed by computers or related to their use. Not to mention other crimes like stalking and child pornography.

Section 502, however, is found in the part of the Penal Code that deals with theft, larceny, and other crimes against property, and it lists fourteen separate ways you can land yourself in hot water by harming, hacking into, or misappropriating computer data or systems or by helping others to do so. See Pen. Code § 502(c). The list covers a lot of ground, and you can read it yourself here if you scroll two-thirds of the way down the page. The law also covers a lot of ground geographically, as it authorizes long-arm jurisdiction over your activities in every state to which or from which you direct them. Id. § 502(j).

The more serious offenses are wobblers. If they are charged as felonies, they are punishable by imprisonment in the county jail for 16 months, two years, or three years; a fine of up to $10,000; or both. If they are charged as misdemeanors they are punishable by imprisonment in the county jail for up to one year; a fine of $5,000; or both.

Some of the fourteen provisions are broad in scope, and one punishes you simply for knowingly using computer services without permission. See Pen. Code § 502(c)(3). If it’s your first violation, and you didn’t cause any injury to any computer data or systems, and you didn’t use more than $950 worth of computer services, then it’s a misdemeanor punishable by up to one year in the county jail, a fine of up to $5,000, or both. The term injury, however, means any alteration, deletion, damage, or denial of access you may have caused. Id. § 502(b)(10). If it’s not your first time, or you did cause injury to data, or you used more than $950 worth of computer services, or it costs the victim more than $5,000 to investigate the breach, then it’s a wobbler punishable as a felony or misdemeanor.

The least serious offenses—where you accessed stuff without permission but didn’t cause any injury—may be infractions if it’s your first time, and you may get off with a fine of $1,000 or less. If it’s not your first time, or if it costs the victim $5,000 or less to investigate the breach, then it’s a misdemeanor punishable by up to one year in the county jail, a fine of up to $5,000, or both. If it costs more than $5,000 to investigate the breach, it’s a wobbler.

Beyond criminal prosecution, section 502 gives the victim a private right of action to sue you civilly for money damages and other relief. The court may even order you to pay the victim’s legal fees, and it may hold you liable for punitive damages if your conduct was bad enough. And parents, take note: you can be held liable for your kid’s conduct. Or, if you’re a college student, you may face automatic disciplinary proceedings at your school on top of everything else. See generally id. § 502(e).

But not all is lost for those who can’t help goofing around at work. First off, there’s an exception to prosecution for acts that were within the scope of your employment, meaning they were reasonably necessary to the performance of your assignment. Id. § 502(h)(1). But even if you acted outside the scope of your employment, you can’t be punished if you didn’t cause any injury to your employer or anyone else, or if the total value of the goods or services you used didn’t exceed $250. Id. § 502(h)(2), (i). See also Chrisman v. City of L.A. (2007) 155 Cal. App. 4th 29, 34-37 (applying these exceptions to a police officer who misused a law-enforcement database to look up celebrities and others). Finally, the statute directs a court to consider alternate sentencing, including community service, if you’ve demonstrated remorse and an inclination not to repeat the offense. Pen. Code § 502(k).

California Courts Dismiss Robbery Case Based on Government’s Bad Faith

If the police or prosecution destroys evidence that is potentially favorable to the defense, or if they fail to preserve that evidence such that it degrades or disappears, they can lose the case on a motion to dismiss. See California v. Trombetta (1984) 467 U.S. 479; Arizona v. Youngblood (1988) 488 U.S. 51.

Two weeks ago, for example, the California Court of Appeal upheld the dismissal of robbery charges in a case out of Orange County.

Here’s the backdrop. Late one Saturday night, two men left a bar in Fullerton just before last call. As they walked through the parking lot, they encountered another group of five men, and one of those men snatched a $3,200 gold chain from the victim’s neck. Three of the five men were soon arrested and charged with robbery, and the victim readily identified the culprit who snatched his chain, but it wasn’t clear how culpable the other two were, if at all. Upon arrest, one of the two had earnestly protested his innocence to a detective, and the exchange was captured by the detective’s personal recording device as follows:

  • Defendant:  “You guys know we didn’t do anything, man.”
  • Detective:    “No, we don’t know. You know why we don’t know? ‘Cause none of us were there.”
  • Defendant:  “Check the cameras, dude! There’s gotta be cameras around here, man.”
  • Detective:    “I’m telling you right now. If I had video cameras of what took place, that’s part of my job. My job is not to arrest people that aren’t guilty of something.”

The defendant then continued protesting that he hadn’t done anything.

At an early hearing in the case, defense counsel requested an order that any surveillance video be preserved. The prosecutor responded that “in regards to the videos, we had already requested those be held … and the People are already in the process of obtaining the videos. I think that’s the appropriate way to go about getting the evidence. At this point in time, there’s no possibility that they are going to be destroyed. We’re within 30 days.”

Oh, but there was a possibility of the videos being destroyed, and before long, they were.

The defendants then moved to dismiss the case, and at the hearing on their motion, the police department’s watch commander acknowledged that the department had two cameras focused on the parking lot where the robbery occurred, and they generally retained their footage for two or two-and-a-half weeks.

Another department witness, who maintained and controlled these cameras, testified that he received no request for footage from any of the arresting or investigating officers in the case, even though they typically knew the footage was available only for a short time. He did receive such a request from defense counsel, but by then the footage had been overwritten—just days beforehand.

On these facts, the trial court granted the defendants’ motion and dismissed the case, and its ruling was mostly affirmed on appeal.

In its opinion, the court of appeal agreed that the evidence was potentially useful to the defense, and it held that the prosecution acted in bad faith by failing to preserve it when they knew it was potentially useful. That wasn’t just negligence, according to the court; that was bad faith on the government’s part, and it required that the charges be dismissed:

“The importance of holding the police and prosecutors to their obligations under BradyTrombetta, and Youngblood cannot be overstated. Police and prosecutors are more than willing to avail themselves of technology when it is to their advantage; there must be a level playing field that gives defendants equal access to the same evidence.”

Ratings and Reviews

The National Trial Lawyers
Mani Dabiri American Bar Foundation Emblem