I have been tasked with inventorying my company’s intellectual property. Some things are obvious, such as source code, business plans, and customer lists. What else would fall into this category, in your opinion? How often should my company inventory its IP?
I have been tasked with inventorying my company’s intellectual property. Some things are obvious, such as source code, business plans, and customer lists. What else would fall into this category, in your opinion? How often should my company inventory its IP?
Conducting an inventory of intellectual property can be an exercise of maddening proportions. Not only must you find your intellectual property (IP), it must be valued (versus the 428, 392 other documents on that server). Then of course there are the 3,218 other servers to review. So why am you doing this again? In short, because the courts tell us you must.
To achieve trade-secret protection you must prove to the courts that you have valued different types of information differently. If you make no differentiation among data types, then neither will the courts. You must prove that one data point is more important than another and that you have taken precautions to protect it. This is known as the “reasonable man” rule. What would a reasonable man do to protect this particular data, and did your company meet that level of reasonableness.
There is a more practical purpose for the inventory and valuation process, however. This process allows you to prioritize both the money and time you spend on various data-protection mechanisms. There is also one more reason to consider: eDiscovery. The new Federal Rule for Civil Procedure (#26) stipulates that you must have the ability to identify (discover) relevant documents during a legal discovery process. The new rules are direct about electronic data, including residual data and document metadata. Essentially the new rules require that a reasonable corporation must have knowledge and be able to produce this information within 120 days. The bar for “reasonable access and knowledge” has just been raised.
Where do I find my IP?
So where do you start looking? How do you begin such a mammoth undertaking? You begin by looking at your information from a business perspective. I’ve always started by asking what my competitor would love to know about my company. This opens the doors to many repositories within the company.
Following are a few examples of IP:
* Executive management
* Strategic positioning
* Mergers and takeovers
* Insourcing and outsourcing plans
* Research and development
* Strategic discovery direction
* New discoveries
* Discovery processes
* Sales and marketing
* Strategic marketing and sales plans
* Tactical (regional) marketing and sales plans
* Manufacturing
* Schedules
* Production capacities
* Expansion plans
* Information technology
* Technology strategy and architecture
* Information protection strategy and architecture
* Personally identifiable information
* Employees
* Customers
* Business Partners
Once you’ve identified these various types of information, the other challenge is finding it. While large databases are an obvious place to find information, do not neglect the lab equipment in your R&D facilities. Servers local to that equipment are also hidden IP repositories. Last, I recommend a review of your executive management team’s desktops, as they are likely to have large caches of information.
How often must this be done?
In a global enterprise this process is nonstop and continuing. There are, however, enabling technologies available today to make this process easier. For example, content monitoring appliances can search out the data wherever it lives. Classification technologies can automatically classify the information for you. While neither of these solutions is perfect, they have made the job far easier than ever before. In short, the process never stops, but technology can ease the pain.
Tom Bowers is managing director, Security Constructs, LLC. Have an insider-threat question? Ask our experts.
