One of my company's internally developed algorithms was published online. It's a complex algorithm that took years to develop, I have a pretty good idea of which employee leaked it based on the team who worked on it and personal information on the blog, but I want confirmation. The algorithm is covered in detail but without any code from our codebase, so my employee might have thought it was okay to share this information publicly when it is absolutely not.

What steps should I take to confirm this employee's identity, and make sure this issue doesn't happen again with our engineers?

Related legal questions have been asked over at Law SE.

closed as off-topic by Dukeling, solarflare, gnat, Dmitry Grigoryev, Anketam Nov 12 at 14:04

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address only a specific company or position are of limited use to future visitors. Questions seeking legal advice should be directed to legal professionals. For more information, click here." – Dukeling, solarflare, gnat, Dmitry Grigoryev, Anketam
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 13
    @tgreg9 You are right that your management question is on topic. I would just cut the questions asking for how to handle the IP from a legal perspective and maybe ask those specific parts at Law. – David K Nov 8 at 21:51
  • 2
    "so my employee might have thought it was okay to share this information publicly when it is absolutely not." Sounds like I already know the answer to this, but does your company have any policies on the topic, or have they made any broadly targeted communications about what you guys consider "trade secrets"? Sounds like you're not all on the same page regarding the topic. (And of course, the answer to that would impact what you should do about this, so I'd suggest adding those details to the question.) – HopelessN00b Nov 9 at 16:48
  • 1
    Given that the legal-related parts have been edited out, almost all of the current answers seem to need serious editing to address the question in its current form... – V2Blast Nov 10 at 7:21
  • 1
    What is your role in regards to this employee? Are you his direct manager? Are you in HR / in legal department / CTO / CEO / etc. ? – Radu Murzea Nov 10 at 10:08
  • 3
    It's not this one by any chance, is it? :)) - security.stackexchange.com/questions/25585/… – Andrejs Nov 11 at 19:17

The other answers highlighting your need for legal advice right now are correct, but for reasons other than they give.

As the employee disclosed no code, copyright is not a concern here - in pretty much all jurisdictions, you cannot copyright an algorithm.

Patents are an approach, but again have different issues in different jurisdictions - some jurisdictions are "first to file" and some are "first to discover", so you may not have any retroactive cover from any patent applied for today, even assuming the algorithm is patentable.

What you can attempt to pursue is protection for your algorithm under trade secrets laws if they exist in your jurisdiction, which can apply protection and civil and (often) criminal penalties for unauthorised disclosure, even when no copyright or patent is violated.

Also check your employment contract for any non-disclosure agreement, which would certainly apply in this case. Seek legal advice as to how enforceable it is in your jurisdiction and in this specific case.

Once it's been established what right of control you have over the algorithms disclosure, I would suggest you have a full team meeting with everyone who has access to the code base in which you discuss what happened, why it is inappropriate to disclose such things as they can be extremely detrimental to the companies operation and their continued employment, and also highlight the potential civil or criminal liabilities such actions can result in.

If the specific employee in question does not come forward after the team meeting, there is little you can do without proof of identity - you can of course hire an investigator to see if they can uncover proof, but then all of this really comes down to what course of action are you intending to take if you do discover their identity.

A slap on the wrist and a "that was really damaging to the company, please don't do it again"? - well, the team meeting will have covered that.

Firing the employee? Intent on taking legal action against the employee? - depends on how badly you want retribution.

  • Comments are not for extended discussion; this conversation has been moved to chat. – Jane S Nov 10 at 22:11

What steps should I take to confirm this employee's identity, and make sure this issue doesn't happen again with our engineers?

First, since you are reasonably confident which employee it was, I suggest pulling them aside and talking to them. Time is important here, so I wouldn't waste too much time trying to make 100% sure you have the right person.

John, this is your blog, right? I need you to take this post down immediately. This is proprietary company information that and cannot be leaked to the public.

Depending on how you want to handle this, you might discuss consequences for the employee, but the biggest thing is just getting them to take it down as soon as possible.

Once you've taken care of the immediate damage, I'd say it's worth having a company meeting or sending out a company-wide email (depends on your style and size of your company). Don't name names or mention the specific incident, but explain that all company algorithms and information are proprietary and should not be shared or published without prior approval. This shouldn't be new information for them, but it sounds like it needs to be reiterated.

As for damage control for the information that has already leaked, I don't have a good answer, but I recommend talking to a professional who specializes in intellectual property.

  • 3
    "I wouldn't waste too much time trying to make 100% sure you have the right person" - I wonder that, if you get the wrong person, you will have not only a blabbermouth or loose-minded employee on one side, but now also a very angry one on the other. – Captain Emacs Nov 9 at 1:06
  • 19
    @CaptainEmacs I'm not saying that you continue to accuse someone if they say you have the wrong person, but I see no reason to wait to approach someone when you are 90% sure who it is. That's why you start by asking, "This is your blog, right?" If they say no, then you ask if they know whose it is and can even explain why you need to know. – David K Nov 9 at 2:21
  • 10
    @CaptainEmacs It depends on your approach, but unless you go down the "we know it was you, confess now!" route then the employee should be equally pissed off with the person who leaked it, and understand why you're upset. – Graham Nov 9 at 8:52
  • @DavidK and Graham, point made. – Captain Emacs Nov 9 at 11:36
  • 1
    One possible reason this is a risky approach. If you can't prove it was this employee, and the employee knows you can't prove it. Then at any point in the future, if you let this employee go, then he/she may choose to pursue a wrongful dismissal case against you. As it would be quite easy for the employee to argue that he/she was dismissed because of the alleged algorithm leak. – user1751825 Nov 10 at 13:45

Step 1 - Get an intellectual property law firm hired. Not a lawyer, a LAW FIRM!

Step 2 - Listen to them!

At the very least, you should file for a copyright AND a patent on it ASAP (copyright will probably get turned down, but patent will probably not).

Then have that law firm send a takedown notice to the blog's registered agent(s).

This will cost $, but if your algorithm is valuable, this is what to do.

  • 2
    Comments are not for extended discussion; this conversation has been moved to chat. – Snow Nov 9 at 6:51
  • 1
    “patent will probably not“ - as a gonna-be patent attorney, that statement is borderline. I feel the need to at least add, act fast, whatever chances there still are for getting a patent (depends), there are time limits! – DonQuiKong Nov 9 at 9:28
  • 28
    “File for copyright”. Copyright is automatically granted on any created work? Who do you “file” a copyright with…? – Martin Bean Nov 9 at 10:12
  • 3
    @MartinBean the united states copyright office, obviously ;) en.wikipedia.org/wiki/Copyright_registration – DonQuiKong Nov 9 at 11:16
  • 17
    It is not legally possible to copyright an algorithm. That recommendation does not make any sense. – Dietrich Epp Nov 9 at 17:57

It's possible that the employee did nothing wrong.

IANAL, but my understanding is that actual implementation is intellectual property and belongs to the company, but the generic idea of algorithms can't be protected. This is the reason why companies like Google and Facebook are extremely strict about not disclosing anything about their algorithms in public. And this shows also in game rules. Rules can't be protected but all names, artwork, fluff can be. That's why you see similar copied games right after somebody publishes a successful one.

What you do to protect yourself in future is contact lawyer and start obtaining patents and make all your employees to sign NDA where you explicitly prohibit disclosing any information related to your work.

And because it's possible the employee did nothing wrong, I'd approach the issue very carefully. Contact a lawyer and verify what you can and cannot do to mitigate damage on this incident.

  • 2
    Comments are not for extended discussion; this conversation has been moved to chat. – Jane S Nov 10 at 3:36

Addendum:

This might sound like a piece of blatant open-source advocacy. I am not in any way condoning what your employee did.

Consider how you can take advantage of what happened. You're taking the disadvantage anyway. Irrespective of what you will do about it, the toothpaste is out of the tube now. Trying to completely get something like that out of circulation tends to leave copies in the hands of those that you least want to have them.

You can still say that you have the best, most tested, professionally best supported implementation on the market NOW. Someone leaking data like that always generates interest in the technology - and people interested in your technology are potential customers. Also, nothing creates an industry standard like a mix of "free" and "competent for-cost" implementations available...

  • 3
    I am going to upvote this answer, due to the fact, the employee does not have enough money to recover any potential damage this might have caused. Additionally, if a patent has not already been issued, the blog containing the information required to implement the algorithm will muddy the waters. Since no code, owned by the company was published, there isn't a copyright claim. So basically "being the best", and leveraging that fact, is the best solution in this case. – Ramhound Nov 10 at 14:04

A perspective from information security: do not do anything without having all your actions reviewed with legal. This includes suggestions from answers such as talking to to employee, checking whether he could be the culprit, etc.

If you start your own investigation you may erase or alter evidence and possibly jeopardize chances to have legally receivable ones.

Let's start with the fact that a similar situation was admitted, which means your employee had access to the algorithm, after which he gave it publicity.

In this problem there is a fault and a manager who made a similar outcome of events. As a result of an incident that has already happened, except for drawing conclusions, nothing remains for you.

In the future, you should take care of reliable security and security of software products. To do this, try to use the program to prevent attempts to seize someone else's intellectual property. At best, begin to restrict employee access to company materials. There are various options, such as using software to monitor the actions of employees, heard about SoftActivity. These are preventive measures to avoid further problems.

If the problem has already been resolved, as in your case, you should take care as soon as possible about legal proceedings on this matter. Legal advice with a specialist will help you to find out all the advantages in this matter.

New contributor
Max Morros is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 2
    this post is rather hard to read (wall of text). Would you mind editing it into a better shape? – gnat Nov 11 at 18:20
  • Okey, i ll do it – Max Morros Nov 12 at 15:57

protected by rath Nov 12 at 15:58

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.