What to do after an employee leaked our algorithm? One of my company's internally developed algorithms was published online. It's a complex algorithm that took years to develop, I have a pretty good idea of which employee leaked it based on the team who worked on it and personal information on the blog, but I want confirmation. The algorithm is covered in detail but without any code from our codebase, so my employee might have thought it was okay to share this information publicly when it is absolutely not. It looks like the algorithm has been online for at least a month. What can we do to mitigate damage from competition? Should we go ahead and license it? Should we even talk about this on our company blog? (Related management question asked here.)
Whether this is considered a trade secret (at least in the US) depends partly on whether you've taken reasonable action to keep it secret. If an employee thought it was OK to publish the algorithm, that's evidence that you didn't try very hard to keep it from getting out. Even if nobody's noticed it yet, getting the blog post taken down in't going to get it off the internet. You may as well try to do it anyway. If nobody has noticed the algorithm by now, you want to make it harder for them to find. You need an IP lawyer pronto. Depending on where you are, you might be able to get a patent on the algorithm still, but patents are hard to enforce, and it appears to be getting harder in the US to patent algorithms. (There's a Stack Exchange site so people can look at patent applications and see if they can invalidate the application with prior art.) You can't license out the algorithm without having some legal way of stopping other places from just using it. If you have more proprietary algorithms or things that aren't generally known that give you a competitive advantage, it would be a good idea to inform employees that they aren't supposed to reveal them. Check with your IP lawyer to see what you should do.
If it's patented then it doesn't matter that you independently came up with it. Most software is not patented, though. Most developers do not even think about patents when writing code. In theory you could spend your time keeping up to date on software patents so that you avoid infringing. But this probably only makes sense for specialists who would want to read the latest patents in their field anyway. All software is protected by literary copyright, though. In this case they will try to prove that you did not independently created it, and did copy it. Whelan v. Jaslow in 1986 ruled that structure, sequence and organization of a computer program were protected by copyright. So you could be liable even if you did not just copy and paste sections of code. But even if you're worried the court would get things wrong and think you copied a program when you never even saw it in the first place, there is really nothing you can do about it.
Can Hacker Corp. claim that they acted in good faith, believing that the Permission to Attack was granted by someone from within the company who was allowed to grant such a permission? Unless ACME proves that Hacker knew or should have known that ACME's low-level employee had no authority to make the decision on behalf of ACME, Hacker ought to prevail on the basis that it performed the contract. There is no indication in your description that Hacker targeted other system(s) than the one(s) specified or that it departed from the agreed conditions. Therefore, there is no sign of Hacker breaching the implied covenant of good faith. ACME's evidently poor management (i.e., the turmoil, the delay for signing or denying permission, its low-level employee's opportunity to make sensitive decisions, the company's failure to withdraw the authorization or to take precautions) is not Hacker's fault.
GDPR forces companies and employees to keep personal data confidential and to use it only for its allowed uses. That obligation continues after the work contract ends. If the employee breaches confidentiality, it does not matter if he provides the data as a file in an USB-drive or if he provides it from memory; it is a breach of confidentiality. Access logs will help to determine which employees have had access to your data, in case a leak is suspected. The part of the question about human memory seems to come from a deep misunderstanding of how human memory works1. I can remember tomorrow something that I have totally forgotten now. Even worse, there is no telling of what can make me remember you; your name might not ring a bell but I may remember you by seeing someone walking a dog. And nobody will ever be able to tell if I have complied with any of your requests or if I am just lying. And of course, there is only one proven way to erase memories, and I am pretty sure the GDPR does not allow for the execution of employees (Disclaimer: IANAL and IANYL, check with a lawyer before murdering anyone if you have doubts). 1 The classical example: You can certainly delete a file from a disk. But just try to stop thinking about white bears
If it’s relevant, yes However, Twitter’s position is that they have disclosed all the data that the contract requires them to disclose. It is likely that case will turn on whether they have or not. Data they haven’t disclosed is not relevant to answering that question.
Firstly: that depends on the jurisdiction. It might not even be possible at all for employers to attempt to sue their own employees for damages caused by negligence. Even terminating an employment contract for reasons of negligence is quite difficult in many jurisdictions. Second, if it is possible, the question is wether such legal proceedings could be expected to be successful. Employees making mistakes is part of the risk of doing business, and distinguishing a "mistake" from "negligence", "gross negligence" , or "intentional wrongdoing" by the employee ought to place quite a burden of proof on the employer. To be held negligent in the first place, the employer will have to to prove that the employee was aware of the fact that the password they used was common, well-known and extremely insecure. Knowledge of which passwords are common and well-known is, unless you are considered a skilled IT security professional, not something that a typical employee can reasonably be expected to know. Before there can be a case for negligence by the employee, the employer needs to make a strong case that: either the employee is that skilled IT security professional that really should have know better or the company can demonstrate that they provide all employees with adequate instruction and security training that includes how to select good passwords and which bad ones to avoid and that they seriously ensure both awareness of their password and security policies and compliance. even then, not enforcing a good password policy in your IT systems and assigning or allowing users to select weak passwords is in itself already negligent...
IANAL, and as @GeorgeBailey suggests, you should ask one. That said, some aspects of your question are directly addressable with what we know. Does US law states anything about this? Yes. Federally this falls under the Wiretap Act, 18 U.S.C. §2511. Workplace monitoring generally falls under either the "System Administrator Exception" or under Consent. In general, continuing past a banner constitutes consent. Does company policy enforcement with such a warning over ride the right to not be subject to surveillance? In general, yes. You don't need to use the companies network if you don't want to consent - and they don't need to hire you if you don't want to use their network. But it's their network, and their rules apply. There are some nuances, and courts have found that the wording of the notice has made a difference in some cases, but overall, if the systems are properly posted with banners, then the employer may capture communications. See the "Bannering and Consent" section of this article from cybertelecom.org, e.g.: Even if no clicking is required, a user who sees the banner before logging on to the network has received notice of the monitoring. By using the network in light of the notice, the user impliedly consents to monitoring pursuant to 18 U.S.C. § 2511(2)(c)-(d). Note that stored data is covered by different laws than communications. It's a nuance. Is it ethical to sniff all the data without giving any other warning than the logon banner? "Ethical" is a very different question than "Legal", and largely more subjective. Most employers require signed consent for monitoring as a condition of employment, and use banners thereafter. That is ethical by my definition, in that it meets or exceeds the requirements of the law, and does not mislead or use subterfuge. The tone of your question suggests you find it distasteful, and therefore probably it violates your personal code of ethics.
I'm wondering whos responsible for this code if people start using it? The user. Can the people using it that think its under GPL in any way get in trouble for it or be made to remove it from their projects? Yes, they can be sued (successfully) for copyright violation. It’s not enough that you think you have permission from the copyright holder - you actually have to have permission. The law places the onus on the copier to seek out and get permission from the copyright holder. In theory, someone deceived in this way could sue the repo poster(s) for misrepresentation, however, there are practical issues about finding them, having them in an accessible jurisdiction and if they are judgement proof. Copyright law was created to protect physical books and paintings - it doesn’t really fit with digital methods of reproduction but it is the law. It doesn’t matter that complying with it can be hard bordering on impossible - comply with it you must.