Cybersecurity and intellectual property flight risk reduction

Cybersecurity has become increasingly important and relevant to businesses. According to the Canadian federal government, about 70% of Canadian businesses have been victims of cyberattacks. According to IBM the average consolidated total cost of a data breach in 2016 was CAD 4 million. This cost is likely to further increase.

A major reason for cybersecurity is the protection of trade secrets. In Canada, trade secrets are, as explained by Justice Biron in the Positron Inc. v. Desroches et al. case “…usually formulas, manufacturing processes unique to its owner and which have been revealed confidentially to an employee”. Justice Biron further explained that “[a trade secret is] knowledge or ‘savoir-faire’ belonging to the employer and revealed by him for the sole purpose of permitting the employee to produce what the trade secret enables him to do.”

In the United States (US), the Defend Trade Secrets Act (DTSA) defines a trade secret as “all forms and types of financial, business, scientific, technical, economic, or engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processes, procedures, programs, or codes, whether tangible or intangible, and whether or how stored, compiled, or memorialized physically, electronically, graphically, photographically, or in writing if (A) the owner thereof has taken reasonable measures to keep such information secret; and (B) the information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable through proper means by, another person who can obtain economic value from the disclosure or use of the information.”

A key characteristic of trade secrets is that ownership is tied to confidentiality. If a trade secret is discovered or revealed to the public, then the organization ceases to own the trade secret. As explained in a previous blog post, IP flight risk is the risk of losing valuable IP from a company. Specifically then, the risk of losing a valuable trade secret is tied to its risk of loss of confidentiality.

Then for trade secrets, IP flight risk reduction practice ties together with cybersecurity policy closely. As explained previously, IP flight risk reduction comprises three steps:

          1) Instituting an “IP aware” mindset within the company via the formulation, implementation and dissemination of an effective IP policy. Such a policy will:

a) prompt the employee to proactively consider whether valuable IP is being created;

b) explain the processes necessary to identify and secure the ownership of the IP; and

c) identify the key people and their responsibilities in carrying out the processes.

        2) Securing the company’s IP ownership by using appropriate IP ownership clauses, and

        3) Running periodic IP mining or discovery sessions to identify IP created within the company.

Applying these steps specifically to trade secrets within the cyber realm:

Step 1: Instituting an “IP aware” mindset within the company via the IP policy.

A well formulated IP policy will:

a.       Prompt the employee to proactively consider whether a valuable trade secret is being created;

b.      Explain the processes necessary to identify and secure the confidentiality of the trade secret, including cybersecurity processes; and

c.       Identify the key people for process implementation, including cybersecurity processes.

Step 2: Securing the company’s trade secret ownership via agreements or clauses in agreements

The following should be used to maintain trade secret confidentiality:

a.      Appropriate agreements such as non-disclosure agreements, including outlines of “best practice” cybersecurity measures.

b.      Appropriate clauses in agreements such as employee, contractor and partnership agreements, including cybersecurity specific clauses.

Step 3: Running periodic mining or discovery sessions

Periodic IP mining or discovery sessions should be utilized to discover and document trade secrets created within the company. By doing this, vital trade secrets can be identified and ownership of the trade secret can also be documented. Finally, the value and importance of the trade secret can also be documented. The cybersecurity team should be informed of the results of these processes.

Good IP flight risk management practice complements cybersecurity in the following ways:

-       Identifying valuable trade secrets as a precursor to being secured: Good identification results in better tracking and securing of relevant trade secrets, resulting in more complete coverage.

-       Prioritizing trade secrets based on the importance to the organization: Once trade secrets have been identified and the value to the organization has been determined, the cybersecurity team can set the required level of protection accordingly.

-       Better regulation of access: As part of the prioritization process, the cybersecurity team can determine who has access and provide temporary access on an “as-needed” basis to trusted employees. This makes management and securing of trade secrets easier.

-      Deterrent to misuse and misappropriation: If an action involves misuse or misappropriation of a trade secret, then the party carrying out the action may be punished. The determination of misuse/misappropriation and corresponding punishment depend heavily on factors such as:

o   measures taken to maintain confidentiality;

o   the degree to which the owner regards and treats the information as confidential;

o   the degree to which the recipient regards and treats the information as confidential; and

o   whether the recipient ought to have known that the information was confidential;

Therefore the combination of a strong IP flight risk reduction strategy and cybersecurity policy makes it likely that misuse or misappropriation is likely to result in harsh punishment. It also signals message that the organization takes trade secret protection seriously. Together these act as deterrents to misuse and misappropriation.

Maximizing portfolio value through smart claim drafting - targeting potential infringers in method claims

Patent claims are the most important part of a patent, as the claims define the invention for which the patent holder holds an exclusive monopoly. Patent portfolio value is dependent on a variety of factors. Three very important factors are:

• Likelihood of use of the claimed invention by attractive target companies,
• Ease of enforcement of infringement of the patent claims, and
• Difficulty of invalidation of the patent claims.

Typically the main driver of value of a patent portfolio is the value of the United States (US) patents. Therefore US law is pertinent. Since a US patent is valid for 20 years from the date of filing, the state of US law at the time of discovery of an alleged infringement is pertinent.

Two well-known types of patent claims are system and method claims. A system claim covers the structural features of an apparatus which has been invented. A method claim is usually a series of steps describing how an invention is to be applied. Each of these types of claims have advantages and disadvantages.

For a method claim to be infringed in the US, it is necessary for every step in the method claim to be performed. A major issue with method claims in the US is “divided” infringement, that is, where different parties perform the steps described. For ease of enforcement of infringement, it is best to avoid divided infringement by asking the following questions:

1. Who is/are the potential infringer(s) to be targeted by the claim? 
2. What steps are they likely or not likely to perform?
3. How should the claim be written to cover the steps in (2)?

Here are some example implementations of this process.

Example 1: Patent revolving around a software application or “app”

To answer question 1, there is a need to determine the intended target of the claim. It would be in the best interest of the patent holder to target either

• The producer of the app, or
• The vendor who makes the app available for the end-user

and not the end-user.

For question 2 which concerns steps likely or unlikely to be performed, it is important to remember that the producer or vendor is unlikely to be using the app themselves. Rather the producer or vendor is likely to perform the steps of providing tools to the end-user to use the app, or enabling the end-user to perform a function via the app.  

Then to address question 3, the method claim can be written as a series of “providing” or “enabling” steps or similar. If in doubt, it may be useful to write more than one method claim. Furthermore, the drafter should revisit the specification and drawings to ensure that there is sufficient support for such method claims.

Example 2: Patent for a physical product

For question 1, it is likely that the patent holder would want to target either:

• The manufacturer of the physical product, or
• The vendor who makes the physical product available for the end-user,

For question 2, the manufacturer is likely to be assembling the physical product. The vendor is likely to be selling the physical product to the end-user.

  

Question 3 can then be addressed by drafting the method claim as a series of “assembling” or “providing” steps or similar. Again, if in doubt, it may be useful to draft two or more different method claims. As with example 1, the drafter should revisit the specification and drawings to ensure sufficient support.

 

Finally, it is important to remember that the fact pattern of each case may be unique. Furthermore, the future state of US patent law is uncertain and unpredictable. One mitigating strategy in the US to address both these issues is by filing continuation applications. This helps keep the family alive, and therefore adapt the claims to ever-changing patent law and to address different fact patterns and potential targets.

Re-examination as a tool for US patent litigation: Waymo vs Uber

Re-examination can be a useful tool to address United States (US) patent litigation. The utility of re-examinations in US patent litigation was demonstrated recently in the Waymo vs Uber case. Waymo sued Uber for patent infringement and trade secret misappropriation on its Light Detection and Ranging (LIDAR) technology. Uber agreed to settle the lawsuit by redesigning its LIDAR technology so as to avoid the Waymo patent, and giving Waymo USD 245 million of equity and a commitment not to copy Waymo technology.

       

The main patent in question in this infringement case was US Patent 9,368,936 to Lenius et al (the “’936 patent”). Eric Swildens, an engineer working for a cloud computing startup, then decided to challenge the ‘936 patent by requesting the United States Patent and Trademark Office (USPTO) to undertake an ex parte re-examination .

Briefly, in an ex parte re-examination request, the challenger can submit prior art patent and other printed publications to the USPTO to show that a patent’s claims were either anticipated or obvious in light of the prior art. The USPTO then decides if a substantial new question (SNQ) of patentability has been raised. If an SNQ has been raised, and the USPTO agrees with the challenger’s assertions, then the patent claims are rejected. The patent owner can make arguments, add new claims or amend existing claims to address these rejections.

Mr. Swildens submitted the prior art against the ‘936 patent in August 2017. In December 2017, the USPTO issued an office action rejecting all the claims of the ‘936 patent. After a response by Waymo, followed by another USPTO rejection and a further Waymo response, in September 2018 a final office action was issued by the USPTO rejecting all but 3 claims of the ‘936 patent. Waymo can still act to defend the ‘936 patent but has not done so as yet.

While the final outcome is unclear at this moment, it points to the utility of re-examinations as a tool against litigation. Based on USPTO statistics from December 2017, ex parte re-examinations have resulted either in all claims cancelled or claims having to be amended around 79% of the time. This makes them a potentially useful and low-cost weapon in litigation, as long as the claims can either be cancelled completely or are amended sufficiently to allow noninfringement arguments to be made. This will depend on factors such as the quality and scope of the prior art.

A competently filed ex parte re-examination costs around USD 50,000 including both USPTO and legal fees. Mr. Swildens did a prior art search, drafted and filed the re-examination request himself, keeping the cost down to USD 6,000.

There is a good chance that Uber may 

- not have had to undertake a costly redesign of its LIDAR technology, or 

- have had to pay Waymo less than USD 245 million in equity. 

It is interesting that Uber did not challenge the ‘936 patent. Mr. Swildens expressed surprise that Uber had not filed a re-examination.

In short, re-examination can be a useful and potentially low-cost tool to address US patent litigation. Even the threat of re-examination using relevant prior art can act as a deterrent or be used as a negotiating tool to obtain a more favourable settlement. To mount an effective re-examination, the defendant should make sure that a high quality prior art search is performed, and that a strong written submission is made to the USPTO.

Disclaimer: The above is not meant as legal advice. The author is not a lawyer. In the event of litigation, the author recommends seeking out legal advice from a lawyer.

Best Practices for Software Applications post-Alice

Strategies which give software patent applicants time and flexibility to counteract the effects of the US Supreme Court’s Alice decision become more valuable with each passing day. As I pointed out in a previous blog post, this is because:

• The United States Patent and Trademark Office (USPTO) continues to issue clarifying guidelines for applicants to deal with the impact of the Alice decision; and
• The courts, namely the United States Court of Appeals for the Federal Circuit (USCAFC), continue to bring down judgments which further clarify Alice. 

The recent McRO vs Bandai and BASCOM vs AT&T USCAFC decisions and accompanying USPTO November 2016 memorandum; and USPTO December 2016 Subject Matter Eligibility Examples demonstrate this continuing clarification. In a previous blog post, I also discussed lessons which could be drawn from the USCAFC Enfish vs Microsoft decision. Putting together those lessons and the recent clarifications, a set of best practices for software patent applications is emerging, as I will explain below.

In its November 2016 memorandum, the USPTO stated the following notable points with regard to McRO vs Bandai:

• Examiners should consider the claim as a whole and not try to overgeneralize or simplify it into gist or core principles
• An improvement in computer-related technology may also be claimed as a set of “rules” that allow computer performance of a function not previously performable by a computer. Indications of improvement include
• Teaching in the specification about how the claimed invention improves a computer or other technology; and
• Claiming a particular solution to a problem or a particular way to achieve a desired outcome defined by the claimed invention as opposed to claiming the idea of a solution or an outcome.

With regard to BASCOM vs AT&T, the USPTO stated the following in both its November 2016 memorandum and December 2016 Subject Matter Eligibility Examples:

• Examiners should consider additional elements both in combination and individually when determining whether a claim as a whole is patent eligible. This is because the claim as a whole may pertain to a non-conventional and non-generic arrangement of known conventional elements.
• The limitations in the claims confine the invention to a specific practical application of the abstract idea.

In the December 2016 Subject Matter Eligibility Examples, the USPTO provided two further examples relating to automated teller machine (ATM) technology, and technology to track inventory. In both cases, the USPTO gave examples of claims directed to each of the technologies which were patent eligible, because these claims relate to specific implementations; and the combination of elements in the claims relate to the performance of functions in a non-conventional and non-generic way.

Based on the continuing clarifications and Enfish vs Microsoft, a set of best practices for software applications post-Alice can be drawn up:

1.  Describe the underlying hardware where the software resides using non-generic terms. Software does not exist in a vacuum. Also using non-generic terms makes it more difficult for the examiner to state that the additional elements either individually or in combination are generic components. Furthermore, the examiner is less likely to find that the claims are directed to an abstract idea, if the claims are tied to the underlying hardware.
2. State clearly within the specification how the invention at hand improves the operation of the underlying hardware over the prior art. For example, in McRO vs Bandai, the USCAFC relied on the specification’s explanation of how the claimed rules enabled automation of specific tasks that previously could not be automated.
3. Direct the claim towards a particular solution to a problem or a particular way to achieve a desired outcome defined by the claimed invention.
4. Use claim language that allows the applicant to make prosecution arguments to tie in with the language of the USPTO guidelines relating to the above decisions.
5. Tie the claim language to the hardware using more “technical” language rather than generic terms.

Additionally, it may also be worthwhile to propose a narrower independent claim where the words “enhance” or “improve” are used. While these may seem unnecessarily narrowing to some, sometimes trading off breadth for an issued patent is useful. As I pointed out in my last blog post “Take It or Keep Going”, advantages include:

• Easier to convince investors for fundraising,
• Easier to market products connected to the application, and
• Less resources needed to continue prosecution of the application.