Trade Secret Theft on the Cloud: Concerns For Both Employers and Employees

Max Taves authored an article posted by Law Technology News  entitled "Trade Secret Spats Center on Cloud."  The article highlights the increasing difficulty employers face when trying to avoid theft of confidential information when employees have access to third party storage providers such as DropBox, Googe Docs, SugarSync, and SkyDrive.  Third party data storage providers enable users to either locally sync or upload documents at work which can be accessed from another computer.  I have posted on tips for employers to reduce the risk of this kind of theft. Essentially, to mitigate risks and have evidence of theft, businesses need a robust and frequently updated fraud management plan.  

What I also found blogworthy in this article was how use of cloud based document storage posses a risk for employees as well.  One attorney in a high profile case pointed out that an employee’s use of DropBox, or similar provider, could generate the appearance that the employee may have stolen data even if they did not intend to do so.  I have seen this happen several times and it can be a big problem.

An employee may use DropBox to store personal information (family photos, resume, etc) but also mix in company documents to work from home.  The employee may leave for another job and forget that he or she still has documents from the former employer.  The employee could end up in a lawsuit because the employer may believe documents were stolen by use of DropBox.  Having already used DropBox at work, it may be even more problematic to show evidence of returning such documents or deleting them.  

The take away here is that use of cloud storage creates a risk for both employers and employees when it comes to confidential information.  While employers should develop a fraud management plan, employees would be well advised to have clear permission to use cloud storage providers. To avoid or reduce the risk of a lawsuit, employees should also seek to address cloud storage as part of an exit strategy.  Even if an employee has no desire to use confidential information after leaving, ignoring the issue is a big risk that may create the wrong impression. 

Understanding Risks and Avoiding Lawsuits – Negotiation of the Master Services Agreement

Recently, I received a call from an attorney trying to figure a way out of a Master Services Agreement for his client.  His client, the purchaser, was stuck owing a lot of money to a technology vendor under a Master Services Agreement that was not working for the client.  The problem – – there was no protection under the contract for the purchaser and no clear way out without owing money to the vendor. 

The problem is not unique to technology purchasers.  Bad contracts also can hurt technology providers.   Take for example a recent case involving a technology company in a lawsuit over installation of new software for a small business.  The business claimed loss of profits due to extended down time as a result of a claimed breach of warranty.  The problem for the technology vendor – –  no protection in the contract with a limitation of remedy provision or disclaimer of warranty.  This opened up a claim for consequential damages that neither party contemplated.

In these cases, whether you are the attorney for the customer or the vendor, many times you are left saying "I wish you called me when you negotiated this contract."   In most instances, when a large or significant service and technology purchase is involved, the relationship between customer and vendor is set forth in a Master Services Agreement.  Master Services Agreements are typically contracts in information technology or professional services that govern a long term vendor-client relationship.  The contract includes general provisions on price, payment terms, and project scope.  The contracts usually include a Statement of Work. The Statement of Work will define the project specifics, services, or deliverables.

While the negotiation of a Master Services Agreement can be quite complex depending on the scope of the project, there are some general terms and clauses that should be considered or included in each agreement to avoid mutual misunderstandings, bad financial decisions, and unnecessary business litigation.  This applies to both sides of the negotiation whether you represent the customer or the vendor.  

There are some standard clauses and considerations in Master Services Agreements that can help the parties reach a true meeting of the minds as to the scope, risks, and obligations. Here is a checklist of some topics and questions that should be discussed as part of the negotiation of a Master Services Agreement:

  • Price.  Very important to remember that the sticker price or price on the contract is many times not as important as the soft costs and expenses.  It benefits both sides of the deal to make sure the price and payment terms (including add on fees like renewals, maintenance and service) are clear and understood.
  • Payment.  Is the agreement going to call for payment by time and materials?  A fixed fee?  A hybrid of both?  Will the payments be tied to meeting milestones on deliverables?  Penalty or late fees? Any retained amounts until completion?  For both sides of any deal, it is better to work out the details on payment ahead of time and avoid problems before they arise.
  • Intellectual Property.  Who is going to own the intellectual property rights to the new software or work performed?  If this is not addressed in the contract, unintended results may occur where the vendor has future property rights for a project paid for by the customer. 
  • Warranty.  What is the scope of the warranty of the work? Will the warranty be limited to the vendor’s performance in a workmanlike manner or is greater warranty protection needed for a new product installation?  Does the vendor warrant the software or other products? The warranty many times provides the basis of the claim for damages against the vendor.  By limiting or expanding the warranty, the scope of liability is understood by both parties at the outset. 
  •  Statement of Work.  This is the document that will provide the specifics on the deliverables under the agreement.  Will it be a separate document?  How much detail will be included?  What assumptions are made?  How can the scope of the project increase?  What are the due dates and deadlines?  An overly broad Statement of Work can be a problem for both a vendor and customer. 
  • Confidentiality Agreement.  Typically, the parties to a Master Services Agreement will want a mutual confidentiality agreement or non-disclosure agreement to prevent disclosure of proprietary information and company trade secrets.  How will you define proprietary information and trade secrets?  How long will the agreement last?  What are the penalties for violation?
  • Indemnification.  These clauses typically shift the risk associated with a loss or a claim from one party to another.  For example, what happens if the customer gets sued for patent infringement for work product of the vendor?  Should the vendor have to defend and indemnify the customer for the lawsuit?
  • Attorneys fees and Alternative Dispute Resolution (ADR).  How will disputes under the contract be resolved?  ADR clauses in the contract can provide for the award of attorney’s fees to the prevailing party and force all disputes to be resolved in a binding arbitration as opposed to a typical lawsuit in court.   More and more, both customer and vendor are seeking to avoid costly litigation by electing for a streamlined dispute resolution process.
  • Insurance.  Does the vendor have errors and omissions insurance?  Should it be required in the contract?
  • Termination.  What terms will govern when one party is unhappy or if a party is in breach?  How do you get out of the contract?  30 days notice?  10 days notice?  Is there any payment for at will termination?  Does work stop upon notice?

These are just a few of the major considerations at play for both a purchaser and vendor under a Masters Services Agreement.  For any significant transaction,  it is advisable for a technology lawyer to negotiate the contract.  Early involvement of a technology attorney can save time and expense later and help each party understand the risks of any particular project.