But what does “reasonable steps” mean in the context of cybersecurity? How can companies ensure that they are taking the specific, concrete “reasonable steps” necessary to attain the protection of state and federal trade secret protection laws and treaties?
While existing caselaw suggests some basic, common measures that constitute “reasonable steps”, (e.g., passwords, firewalls and encryption), firms will be under constant, increasing pressure to anticipate new waves of cyber-attacks on their trade secrets, and to deploy countermeasures that will subsequently hold up in court as “reasonable steps.” In addition, courts and lawmakers will be called upon to provide additional guidance to firms, as cyber-threats proliferate, and trade secrets come under closer scrutiny.
Remember, by the time a trade secret case reaches an overworked federal judge (often in the rushed context of a preliminary request for temporary restraining order), that judge will be learning in the first instance (1) what the asserted trade secret is; (2) how defendants were able to obtain it; and (3) what steps plaintiffs took to prevent disclosure. The judge’s initial reaction will likely determine the fate of the plaintiff’s trade secret claim. In such circumstances, the plaintiff—and its lawyer—must have good answers ready for judicial scrutiny.
Perhaps the single best source of concrete measures companies should take to ensure their trade secrets will hold up in court is a helpful guide from the Department of Justice’s Computer Crime & Intellectual Property Section. “[These] guidelines… seek information that, in the experience of Department of Justice prosecutors and investigators, is useful or even critical to the successful prosecution of the most common intellectual property crimes.” Although many companies will pursue their own claims in a civil action, it stands to reason that they would benefit by following the same guidelines DOJ uses in a criminal case, since “trade secret” is defined in exactly the same way whether the case proceeds pursuant to the EEA’s criminal provisions or the DTSA’s civil provision. And, while the guidelines are not law, surely any federal judge would look approvingly on a trade secret plaintiff who can credibly cite to DOJ guidance in support of its trade secret protection practices.
Regulate access to any electronic files that contain the trade secret.
Give employees that have access to the trade secret files unique user names, passwords and electronic storage space.
Store the trade secret files on a network protected by a firewall.
Limit remote access into the network.
Where remote access is allowed, utilize a virtual private network.
Maintain the trade secret files on a separate server from other company files.
Prohibit employees from using unauthorized programs or unapproved peripherals, such as high capacity portable storage devices (thumb drives).
Maintain electronic access records such as computer logs.
While additional practices may come to light from a review of other sources, or based on the specific attributes of a company’s operations, the DOJ guidelines are an excellent source for reasonably adequate trade secret protection in the cybersecurity context.
The Van de Verg Law Offices offers legal services in the areas of cybersecurity and data privacy. Contact us today to set up a free initial consultation.
 Columbus Bookkeeping & Bus. Servs. v. Ohio State Bookkeeping, LLC, 2011 Ohio App. LEXIS 5655, *10, 33 I.E.R. Cas. (BNA) 434, 2011 WL 6938340 (2011).
 18 U.S.C. § 1839 (“the term "trade secret" means all forms and types of financial, business, scientific, technical, economic, or engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processes, procedures, programs, or codes, whether tangible or intangible, and whether or how stored, compiled, or memorialized physically, electronically, graphically, photographically, or in writing if--(A) the owner thereof has taken reasonable measures to keep such information secret; and (B) the information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable through proper means by, another person who can obtain economic value from the disclosure or use of the information;”).
 18 U.S.C. §§ 1831, 1832.
 Trade secret protection is just one facet of a company’s overall cybersecurity risk management program and risk assessment. Resources permitting, the DOJ guidelines should be evaluated against the backdrop of the company’s cybersecurity current risk profile and target state.