What to do after an employee leaked our algorithm? [closed]

Question

One of my company's internally developed algorithms was published online. It's a complex algorithm that took years to develop, I have a pretty good idea of which employee leaked it based on the team who worked on it and personal information on the blog, but I want confirmation. The algorithm is covered in detail but without any code from our codebase, so my employee might have thought it was okay to share this information publicly when it is absolutely not.

What steps should I take to confirm this employee's identity, and make sure this issue doesn't happen again with our engineers?

_{Related legal questions have been asked over at Law SE.}

Answer 1

The other answers highlighting your need for legal advice right now are correct, but for reasons other than they give.

As the employee disclosed no code, copyright is not a concern here - in pretty much all jurisdictions, you cannot copyright an algorithm.

Patents are an approach, but again have different issues in different jurisdictions - some jurisdictions are "first to file" and some are "first to discover", so you may not have any retroactive cover from any patent applied for today, even assuming the algorithm is patentable.

What you can attempt to pursue is protection for your algorithm under trade secrets laws if they exist in your jurisdiction, which can apply protection and civil and (often) criminal penalties for unauthorised disclosure, even when no copyright or patent is violated.

Also check your employment contract for any non-disclosure agreement, which would certainly apply in this case. Seek legal advice as to how enforceable it is in your jurisdiction and in this specific case.

Once it's been established what right of control you have over the algorithms disclosure, I would suggest you have a full team meeting with everyone who has access to the code base in which you discuss what happened, why it is inappropriate to disclose such things as they can be extremely detrimental to the companies operation and their continued employment, and also highlight the potential civil or criminal liabilities such actions can result in.

If the specific employee in question does not come forward after the team meeting, there is little you can do without proof of identity - you can of course hire an investigator to see if they can uncover proof, but then all of this really comes down to what course of action are you intending to take if you do discover their identity.

A slap on the wrist and a "that was really damaging to the company, please don't do it again"? - well, the team meeting will have covered that.

Firing the employee? Intent on taking legal action against the employee? - depends on how badly you want retribution.

Answer 2

What steps should I take to confirm this employee's identity, and make sure this issue doesn't happen again with our engineers?

First, since you are reasonably confident which employee it was, I suggest pulling them aside and talking to them. Time is important here, so I wouldn't waste too much time trying to make 100% sure you have the right person.

John, this is your blog, right? I need you to take this post down immediately. This is proprietary company information that and cannot be leaked to the public.

Depending on how you want to handle this, you might discuss consequences for the employee, but the biggest thing is just getting them to take it down as soon as possible.

Once you've taken care of the immediate damage, I'd say it's worth having a company meeting or sending out a company-wide email (depends on your style and size of your company). Don't name names or mention the specific incident, but explain that all company algorithms and information are proprietary and should not be shared or published without prior approval. This shouldn't be new information for them, but it sounds like it needs to be reiterated.

As for damage control for the information that has already leaked, I don't have a good answer, but I recommend talking to a professional who specializes in intellectual property.

Answer 3

Step 1 - Get an intellectual property law firm hired. Not a lawyer, a LAW FIRM!

Step 2 - Listen to them!

At the very least, you should file for a copyright AND a patent on it ASAP (copyright will probably get turned down, but patent will probably not).

Then have that law firm send a takedown notice to the blog's registered agent(s).

This will cost $, but if your algorithm is valuable, this is what to do.

Answer 4

It's possible that the employee did nothing wrong.

IANAL, but my understanding is that actual implementation is intellectual property and belongs to the company, but the generic idea of algorithms can't be protected. This is the reason why companies like Google and Facebook are extremely strict about not disclosing anything about their algorithms in public. And this shows also in game rules. Rules can't be protected but all names, artwork, fluff can be. That's why you see similar copied games right after somebody publishes a successful one.

What you do to protect yourself in future is contact lawyer and start obtaining patents and make all your employees to sign NDA where you explicitly prohibit disclosing any information related to your work.

And because it's possible the employee did nothing wrong, I'd approach the issue very carefully. Contact a lawyer and verify what you can and cannot do to mitigate damage on this incident.

Answer 5

Addendum:

This might sound like a piece of blatant open-source advocacy. I am not in any way condoning what your employee did.

Consider how you can take advantage of what happened. You're taking the disadvantage anyway. Irrespective of what you will do about it, the toothpaste is out of the tube now. Trying to completely get something like that out of circulation tends to leave copies in the hands of those that you least want to have them.

You can still say that you have the best, most tested, professionally best supported implementation on the market NOW. Someone leaking data like that always generates interest in the technology - and people interested in your technology are potential customers. Also, nothing creates an industry standard like a mix of "free" and "competent for-cost" implementations available...

Answer 6

A perspective from information security: do not do anything without having all your actions reviewed with legal. This includes suggestions from answers such as talking to to employee, checking whether he could be the culprit, etc.

If you start your own investigation you may erase or alter evidence and possibly jeopardize chances to have legally receivable ones.

Answer 7

Let's start with the fact that a similar situation was admitted, which means your employee had access to the algorithm, after which he gave it publicity.

In this problem there is a fault and a manager who made a similar outcome of events. As a result of an incident that has already happened, except for drawing conclusions, nothing remains for you.

In the future, you should take care of reliable security and security of software products. To do this, try to use the program to prevent attempts to seize someone else's intellectual property. At best, begin to restrict employee access to company materials. There are various options, such as using software to monitor the actions of employees, heard about SoftActivity. These are preventive measures to avoid further problems.

If the problem has already been resolved, as in your case, you should take care as soon as possible about legal proceedings on this matter. Legal advice with a specialist will help you to find out all the advantages in this matter.