Tag: Internet

Online Behavioral Advertising: Industry Guides Require Real Time Notice When Data Are Collected or Used for Personalized Ads

Greenberg Traurig Law firm

WHAT’S COVERED?

Online behavioral advertising (OBA) has become a very common tool for commercial websites. OBA can be defined as follows:

the collection of data online from a particular computer or device regarding web viewing behaviors over time and across Web sites for the purpose of using such data to predict preferences or interests and to deliver advertising to that computer or device presumed to be of interest to the user of the computer/device based on observed Web viewing behaviors.

OBA might be implemented by use of cookies directly on a company’s website by the company itself. Or it might occur through technology embedded in ads from other parties displayed on the company’s site. Either way, the operators of commercial websites need to be aware when OBA is occurring on their sites and should be taking steps to provide greater transparency about OBA occurring on their sites.

WHAT’S THE CONCERN?

While the use of OBA is largely unregulated by law in the U.S. at this time, its spread has generated concern among privacy advocates. Of particular concern is the gathering of data about consumers without their knowledge where such information is supposed to be anonymous but advances in technology make it more and more possible to link that information to individuals (not just devices) through combination with other information. Examples can include information about health conditions and other sensitive information gleaned by watching the sites a user visits, the searches he/she conducts, etc. Key characteristics of OBA include that it is: (a) invisible to the user; (b) hard to detect; and (c) resilient to being blocked or removed.

In an effort to stave off government regulation of OBA in the United States, the Digital Advertising Alliance (DAA), a consortium of the leading advertising trade associations, has instituted a leading set of guidelines. Based on standards proposed by the Federal Trade Commission, the DAA Self-Regulatory Program is designed to give consumers enhanced control over the collection and use of data regarding their Internet viewing for OBA purposes.

WHAT’S REQUIRED?

The key principles of the DAA’s guides are to provide greater transparency to consumers to allow them to know when OBA is occurring and to provide the ability to opt out. For commercial website operators that allow OBA on their sites, the compliance implications are as follows:

  1. First Party OBA. First Parties are website operators/publishers. If a company simply gathers information for its own purposes on its own site, it is generally not covered by the guidelines. However, as soon as the First Party allows others to engage in OBA via the site, it has a duty to monitor and make sure that proper disclosures are being made and even to make the disclosures itself if the others do not do so, including assuring that “enhanced notice” (usually the icon discussed below or a similar statement) appears on every page of the First Party’s site where OBA is occurring.

  2. Third-Party OBA. Third parties are ad networks, data companies/brokers, and sometimes advertisers themselves, who engage in OBA through ads placed on other parties’ sites. These Third Parties should provide consumers with the ability to exercise choice with respect to the collection and use of data for OBA purposes. (See below on how to provide recommended disclosures.)

  3. Service Providers. These are providers of Internet access, search capability, browsers, apps or other tools that collect data about sites a user visits Service Providers generally are expected to provide clear disclosure of OBA practices which may occur via their services, obtain consumer consent for such practices, and provide an easy-to-use opt-out mechanism.

HOW TO COMPLY

Generally, Third Parties and Service Providers should give clear, meaningful, and prominent notice on their own websites that describes their OBA data collection and use practices. Such notice should include clear descriptions that include:

  • The types of data collected online, including any PII for OBA purposes;

  • The uses of such data, including whether the data will be transferred to a nonaffiliate for OBA purposes;

  • An easy to use mechanism for exercising choice with respect to the collection and use of the data for OBA purposes or to the transfer of such data to a nonaffiliate for such purpose; and

  • The fact that the entity adheres to OBA principles.

In addition, “enhanced notice” should appear on each and every ad (or page) where OBA is occurring. The “enhanced notice” means more than just traditional disclosure in a privacy policy. It means placement of a notice on the page/ad where OBA is occurring. The notice typically is given in the form of the following icon (in blue color) which should link to a DAA page describing OBA practices and providing an easy-to-use opt-out mechanism:

online behavioral advertising

The icon/link should appear in or around each ad where data are collected. Alternatively, it can appear on each page of a website on which any OBA ads are being served. It is normally the duty of the advertisers (Third Parties) to deploy the icon. However, if they fail to do so, then the operator of the site where the OBA ads appear has the duty to make appropriate real-time disclosures about OBA on each page where OBA activity is occurring, including links to the DAA page describing OBA practices and providing an easy-to-use opt-out mechanism.

ENFORCEMENT

The DAA is taking its OBA guidelines seriously. It has issued sets of “compliance warnings” to many major U.S. companies. While DAA has no direct authority to impose fines or penalties, its issuance of a ruling finding a violation of its guidelines could create a tempting target for the FTC or plaintiffs’ class action lawyers to bring separate actions against a company not following the DAA guidelines. For all these reasons, operators of websites employing OBA (either first party or third party) should pay heed to the DAA Guidelines.

ARTICLE BY

Ed Chansky
David A. Wheeler
OF
Greenberg Traurig, LLP

5 Serious (& 1 Lighthearted) Legal Web Marketing Predictions for 2015

Consultsweb Logo

Where is legal web marketing headed in 2015? Do we need to prep for any upcoming roadblocks? What about exciting changes to anticipate? Are there any new technologies that will help the industry?

If these are questions you’ve been asking, I’m right there with you. When I have legal marketing questions, I turn to the expertise of my teammates at Consultwebs.com. I asked their predictions as to where legal web marketing is headed in 2015.

Here’s what they said.

Ashley Krohn, Outreach Specialist, @tweetinash

Ashley Krohn
Outreach Specialist
@tweetinash

  • Mobile will continue to grow. Your site MUST be optimized for mobile in 2015.
  • There will be a great focus on the user: understanding who they are, what content they consume, and how they view it.
  • We will see more personalized, targeted content marketing. Content will be optimized towards the purchase funnel, or the journey a visitor will take on your site, in whatever format works best for your audience.
  • Watch Reddit. If your audience is there, then you would be wise to start putting resources there.

Mike Dayton, J.D., Manager of Content Services, @senorpibb

Mike Dayton, J.D.
Manager of Content Services
@senorpibb

The message for content is moving toward: “Go deep!” Google is rewarding longer, substantive articles and website sections. Our Content Team will continue its emphasis on resource sections that signal our clients’ authority and expertise in their practice area niches.

John Damron, Senior Marketing Strategist, @consultwebs

John Damron
Senior Marketing Strategist
@consultwebs

My prediction is that mobile technology will become even more of an important tool that law firms (and all businesses) will use to connect with their clientele. Not just for lead generation and online search, but also case management, client payments, and communication.

Jennifer Frame, Local SEO Specialist, @jmframe

Jennifer Frame
Local SEO Specialist
@jmframe

I think we’ll see even more importance placed on mobile friendly sites. Google launched a mobile friendly checker last month, google.com/webmasters/tools/mobile-friendly, and results that get a passing grade will have a mobile friendly badge next to their name in results. This is yet another hint to site owners that mobile is of critical importance and that Google is rewarding the sites that are mobile friendly.

Derek Seymour, Senior Web Engineer, @derekseymour

Derek Seymour
Senior Web Engineer
@derekseymour

As far as web technological shifts in 2015, I predict we’ll see a trend towards statically-generated websites (as opposed to dynamically-generated, such as WordPress).  Much of the power and functionality given to dynamically-generated sites today is being outweighed by slow performance, security risks, and a barrage of product updates.  Static sites, however, tend to be much cleaner, respond extremely quickly, and help minimize the amount of vulnerabilities available to hackers.  In addition, tools for static sites have come a long way in recent months and many of the common features found in sites can now be implemented using HTML/CSS/JavaScript libraries and frameworks in conjunction with the method of generating static sites known as ‘compiling.’  While some limitations remain, the barriers to building static sites are quickly going away with the plethora of resources available and we’re likely to see an increasing number of businesses and professionals taking advantage of this in the coming year.

Michael Wice, Online Marketing Consultant, @consultwebs

Michael Wice
Online Marketing Consultant
@consultwebs

Matt Cutts will move to Alaska and build a cabin like Dick Proenneke, never to return to Google. He will grow a mountain man beard and catch salmon from streams with his teeth.

Seriously, it’s worth noting that Cutts’ leave from Google was extended into 2015. His future with the search engine is something to track in 2015.

An In-Depth Analysis of the NLRB’s Decision to Permit Employees to Use Employer Email Systems for Union Organizing and Other Non-Work Purposes

Sheppard Mullin Law Firm

The rights of employees under Section 7 of the National Labor Relations Act have been given quite the digital treatment over the last few years.  In its newest decision issued on December 11, 2014, the National Labor Relations Board ruled that “employee use of email for statutorily protected communications on nonworking time must presumptively be permitted by employers who have chosen to give employees access to their email systems.”  The full decision can be found here.

In Purple Communications, Inc. and Communications Workers of America, AFL–CIO. Cases 21–CA–0951 51, 21–RC–091531, and 21–RC–091584, the Board overturned its previous decision in Register Guard, 351 NLRB 1110 (2007), which held that employees do not have a right to use their employers’ email systems for Section 7 purposes.  But, as seen in recent years, the Board has embraced the digital age and has concluded that employee Section 7 rights include everything from social media to, in this case, company email.

Like most companies, Purple Communications, Inc., has an “Internet, Intranet, Voicemail and Electronic Communication Policy” in its employee handbook.  Among other things, this policy prohibits employees from using the “computer, internet, voicemail and email systems, and other Company equipment” to engage in “activities on behalf of organizations or persons with no professional or business affiliation with [the] Company” or “sending uninvited email of a personal nature.”  The Communications Workers of America filed an unfair labor charge regarding this policy, and the Administrative Law Judge found the policy lawful under Register Guard, dismissing the allegations.  This new decision by the NLRB then followed.

In overturning Register Guard, the Board stated that email has “effectively become a natural gathering place pervasively used for employee-to-employee conversations” and the fact that this “gathering place” is virtual does not undermine the role that email plays in Section 7 protected workplace discussions.  In fact, the Board concluded that “email’s effectiveness as a mechanism for quickly sharing information and views increases its importance to employee communication,” especially in the seven years since Register Guardwas issued.  Interestingly, the Board relied on empirical evidence regarding the rise in “teleworking” and email usage for all work functions, at the physical workplace and remotely, to demonstrate that email has become a significant platform for employee communication.  Accordingly, it was held that email’s use for Section 7 activity must be protected under the NLRA.  The Board will no longer “perpetuate” an “outmoded assessment of workplace realities.”

The Board attempted to preemptively address employers’ concerns about the ruling, by stating that this decision is a “limited one,” in that it addresses only email and not any other types of electronic communication systems.  Moreover, businesses are not prevented from monitoring their computers and email systems for legitimate management purposes.  Finally, the Board stated that an employer may justify a ban on non-work use of its email system if it can point to “special circumstances” that necessitate the ban, including system overload, the nature of the business, and excessive costs.  Regardless, the Board’s dissenting members apparently are not convinced, arguing that this decision will lead to significant problems down the road.

Interestingly, the Board fails to directly address the decision’s effect on other types of policies that could be affected, such as non-solicitation and non‑distribution policies.  The Board distanced itself from the issue, stating that “we do not find it appropriate to treat email communication as either solicitation or distribution per se.”  The dissent took issue with this stance and predicts that this decision will make it very difficult to determine what communications violate lawful restrictions against solicitation in the future.

Although the Board did not outright declare Purple Communication’s electronic communications policy unlawful, employers should be wary of overly broad or restrictive electronic communications policies.  As with the onslaught of social media decisions and subsequent policy revisions, employers should take a hard look at their electronic communications policies in light of this decision and consider whether their policies put them at risk in this evolving digital age.

ARTICLE BY

Kevin M. Cloutier
Mikela T. Sutrina
OF
Sheppard, Mullin, Richter & Hampton LLP

Online Presence Management: You Down with OP…M? Yeah, You Should Be!

Morgan Lewis logo

The stakes are higher than ever when it comes to your company’s online presence management (OPM), and you should be proactive in ensuring that your company is best positioned for success.

We are talking about total OPM. Yes, it is a real thing. The soaring growth of online media revenues (over 17%, recently), thesophistication of bad actors responsible for “mega-hacks,” and the ever-expanding social media market are but a few of the headlines that top the news on a daily basis.

Public interest is extremely high. As such, the risks and liabilities to your company are self-evident.

As a responsible lawyer (or, at least, someone interested enough in the law to read this blog), you should take a proactive approach to ensuring your organization is aligned with measures to both capitalize on the enormous opportunities presented by, as well as mitigate the risks associated with, managing your company’s total online presence.

So, where do you begin? What are the first steps? We recommend scheduling an internal discussion with your relevant stakeholders to take inventory of where you are with respect to your company’s OPM. You don’t need to involve outside counsel or be an expert in every nuance of the OPM space. Instead, the goal is to get a discussion between your business team and legal team about the structure and needs of your company. That is, the goal is to get the dialogue started internally so you have the information that you need to provide or to seek artful advice.

Here are the top three agenda items for your initial meeting:

1. Online Contracting Discussion—What agreements do you use, or should you use, on your website? Terms of service? Terms of use? Privacy policies? Codes of conduct? Foreign Corrupt Practices Act policies? Open-source policies? Once the inventory is completed, have a candid discussion with your business/marketing/OPM teams about (1) how each agreement is executed and used within the organization, (2) how updates are communicated, and (3) any pain points experienced by the business team. Special attention should be given to agreements that control services or products that produce revenue or that deal with the handling of important data or information. Understanding the total picture of your company’s online contracting structure allows you to identify risks and install protections to mitigate them.

2. Security Protocol Discussion—What are the processes in place to monitor and respond to potential security threats? What would your company do if it suspected a breach? How long would it react? What reporting systems are in place to alert responsible OPM team members of suspicious activities? Lawyers, like CEOs, can no longer assume that their company’s IT personnel handles these issues. By understanding the lay of the land, in-house lawyers and well-integrated outside counsel can better respond to emergency situations.

3. Data Leverage Discussion—What data is collected by your company’s internal tools? What data is collected by third-party tools and services? How is the data collected from the website (both personally identifiable and commercial) used by the company? Are there any synergies that can be gained by various business teams by gaining access to either of the above? Understanding what data is collected, especially commercial data such as user tendencies and product information, can assist lawyers in understanding the rights to negotiate when dealing with outside vendors and in drafting privacy policies.

As you can probably tell, the “discussions” approach will likely lead to many tangent discussions and identification of issues that you didn’t even realize existed in your organization. This is intentional.

In today’s online environment, you need to be proactive and agile to ensure that your company’s OPM is handled in a responsible, predictable, and measured manner. Having the discussions above will at least give you a starting point to demonstrate a more active approach and likely result in you being able to provide better and more business-focused counsel.

ARTICLE BY

Glen W. Rectenwald
Doneld G. Shelkey
OF
Morgan, Lewis & Bockius LLP

QVC Sues Shopping App for Web Scraping That Allegedly Triggered Site Outage

Proskauer Law firm

Operators of public-facing websites are typically concerned about the unauthorized, technology-based extraction of large volumes of information from their sites, often by competitors or others in related businesses. The practice, usually referred to as screen scraping, web harvesting, crawling or spidering, has been the subject of many questions and a fair amount of litigation over the last decade.

However, despite the litigation in this area, the state of the law on this issue remains somewhat unsettled: neither scrapers looking to access data on public-facing websites nor website operators seeking remedies against scrapers that violate their posted terms of use have very concrete answers as to what is permissible and what is not.

In the latest scraping dispute, the e-commerce site QVC objected to the Pinterest-like shopping aggregator Resultly’s scraping of QVC’s site for real-time pricing data.  In its complaint, QVC claimed that Resultly “excessively crawled” QVC’s retail site (purpotedly sending search requests to QVC’s website at rates ranging from 200-300 requests per minute to up to 36,000 requests per minute) causing a crash that wasn’t resolved for two days, resulting in lost sales.  (See QVC Inc. v. Resultly LLC, No. 14-06714 (E.D. Pa. filed Nov. 24, 2014)). The complaint alleges that the defendant disguised its web crawler to mask its source IP address and thus prevented QVC technicians from identifying the source of the requests and quickly repairing the problem.  QVC brought some of the causes of action often alleged in this type of case, including violations of the Computer Fraud and Abuse Act (CFAA), breach of contract (QVC’s website terms of use), unjust enrichment, tortious interference with prospective economic advantage, conversion and negligence and breach of contract.  Of these and other causes of action typically alleged in these situations, the breach of contract claim is often the clearest source of a remedy.

This case is a particularly interesting scraping case because QVC is seeking damages for the unavailability of their website, which QVC alleges to have been caused by Resultly.  This is an unusal theory of recovery in these types of cases.   For example,  this past summer, LinkedIn settled a scraping dispute with Robocog, the operator of HiringSolved, a “people aggregator” employee recruting service, over claims that the service employed bots to register false accounts in order to scrape LinkedIn member profile data and thereafter post it to  its service without authorization from Linkedin or its members.  LinkedIn brought various claims under the DMCA and the CFAA, as well as state law claims of trespass and breach of contract, but did not allege that their service was unavailable due to the defendant’s activities.  The parties settled the matter, with Robocog agreeing to pay $40,000, cease crawling LinkedIn’s site and destroy all LinkedIn member data it had collected.  (LinkedIn Corp. v. Robocog Inc., No. 14-00068 (N.D. Cal.  Proposed Final Judgment filed July 11, 2014).

However, in one of the early, yet still leading cases on scraping, eBay, Inc. v. Bidder’s Edge, Inc., 100 F. Supp. 2d 1058 (N.D. Cal. 2000), the district court touched on the foreseeable harm that could result from screen scraping activities, at least when taken in the aggregate.  In the case, the defendant Bidder’s Edge operated an auction aggregation site and accessed eBay’s site about 100,000 times per day, accounting for between 1 and 2 percent of the information requests received by eBay and a slightly smaller percentage of the data transferred by eBay. The court rejected eBay’s claim that it was entitled to injunctive relief because of the defendant’s unauthorized presence alone, or because of the incremental cost the defendant had imposed on operation of the eBay site, but found sufficient proof of threatened harm in the potential for others to imitate the defendant’s activity.

It remains to be seen if the parties will reach a resolution or whether the court will have a chance to interpret QVC’s claims, and whether QVC can provide sufficient evidence of the causation between Resultly’s activities and the website outage.

Companies concerned about scraping should make sure that their website terms of use are clear about what is and isn’t permitted, and that the terms are positioned on the site to support their enforceability. In addition, website owners should ensure they are using “robots.txt,” crawl delays and other technical means to communicate their intentions regarding scraping.  Companies that are interested in scraping should evaluate the terms at issue and other circumstances to understand the limitations in this area.

ARTICLE BY

Jeffrey D Neuburger
OF
Proskauer Rose LLP

3 Things You Need To Know About Penguin 3.0

Consultsweb Logo

Penguin is an algorithm from Google that judges the quality of links that you have pointing to your site. Inbound links, sometimes called “backlinks,” to your website are one of the factors that Google’s algorithms use to rank websites in its search results. Google uses the Penguin algorithm (or filter) to punish link profiles that it sees as low-quality (coming from untrustworthy sites) or unnatural.  This is a response to linking practices used in the early days of search marketing, and still employed by some vendors, to show clients’ quick success.

3 Things You Need to Know about Penguin 3.0

In the early days of the Web and SEO, the sheer volume of links (and linking domains) to a website helped its rankings in Google Search results.  Many early SEO companies prospered by buying and selling links, creating directories and setting up other sites for the sheer purpose of creating content and supplying links. This was an exploit used for years by almost every search marketing vendor to gain rankings for their clients.  Since April of 2012, Google has used Penguin to dissuade webmasters from this practice for fear of losing all rankings for their websites.

As Google crawls the Web and finds a link to your site, it places them in a particular database of known links.  If you are bored, you can read through the original paper by Sergei Brin and Larry Page.  Penguin is a separate algorithm that is run periodically to parse through this database of links pointing to your site to check against known spam sites and known manipulative techniques.

In an explanation of Penguin 3.0 for Forbes magazine, Jayson DeMyers says Penguin “rewards sites that have natural, valuable, authoritative, relevant links.” It penalizes sites that have built manipulative links solely for the purpose of increasing rankings, or links that do not appear natural.

Penguin was introduced in April 2012 and updated twice that year with versions 1.1 and 1.2. Penguin 2.0 came out in May 2013 and an October update (2.1) had a fairly wide affect, causing Google ranking changes in about 1 percent of sites.

Penguin 3.0 was released in mid-October in what Google said could be a slow rollout. For some websites, Google said, it could be a few weeks until Penguin 3.0 had an effect, which would be about the time of publishing this article.

Here are the top 3 takeaways from the first days of Penguin 3.0:

1.  Penguin 3.0 may have little impact on quality websites.

Upon its introduction of Penguin 3.0, Google said: “(W)e started rolling out a Penguin refresh affecting fewer than 1 percent of queries in U.S. English search results. This refresh helps sites that have already cleaned up the Web spam signals discovered in the previous Penguin iteration, and demotes sites with newly discovered spam.”

This indicates that Penguin 3.0 will adjust rankings for sites that were adversely affected by earlier versions of the Penguin algorithm, but have since cleaned up offensive links.

But, if your site is still plagued by low-quality links, Penguin 3.0 will have an effect on you, and the impact – “demotes sites with newly discovered spam” – should be in line with earlier iterations of Penguin.  The word to note here (bolded) is that Google’s Pierre Far, called this a refresh, intimating that no new signals were added to this release.

2. Penguin 3.0 means you need to evaluate your links.

To avoid a penalty via Penguin 3.0 or to recover from it if Google has already penalized your site, you need to make sure you are not adding bad links that will hurt your site. You also need to rid your site of bad links pointing to it.

To avoid Penguin penalties, you want to review the type of links pointing to your site.  This can easily be done in Web Master Tools by using their tool to download a list of Sample and Latest links to your site.  Some of the items to look for are:

  • Links from foreign domains (ie. walre.co.pl)
  • Links sites that contain many hyphens (ie. best-personal-injury-lawyers-us.com)
  • Sites that are obviously off-topic (ie. a site about fishing would not normally link to an attorney’s site)
  • Large quantities of links from a particular domain.
  • Large percentages of commercial anchor text in the links pointing to your site.  (If you see anchor text that you would love to rank for in Google, then it is commercial.  Commercial should not make up more than about 10% of your anchor text.)

Removing bad links can be tedious and tricky. First you have to identify them and then you have to figure out how to get them taken down. You can simply contact the site that hosts them (if you can find a contact) and ask for it to be removed. Google also provides a “disavow tool,” by which you can ask Google not to take into account certain links when assessing your site.

But Google’s disavow tool come with two warnings: 1) “You should still make every effort to clean up unnatural links pointing to your site. Simply disavowing them isn’t enough.” And deeper on Google’s Webmaster tools site, 2) “This is an advanced feature and should only be used with caution. If used incorrectly, this feature can potentially harm your site’s performance in Google’s search results.”

3. If you’ve invested in a search marketing campaign, you need to know how your provider is obtaining links to your site.

Building links to your site cannot just be something you expect your marketing provider to do. How it is done can ultimately affect your business, and could adversely impact your overall revenue if your website is penalized by the latest Penguin update or by future Penguin updates.

The biggest takeaway from all Penguin updates is that you need to know how your vendor, your provider, is getting links for you. If they are not working directly with you, then it is likely a scaled process, meaning that their tactics are low quality and potentially harmful.

Instead, your vendor should be working to obtain links from sites that represent highly regarded authorities in your field. In addition to direct outreach to request backlinks, which may have limited cost effectiveness, firms may build links by community outreach, such as sponsoring organizations or public events in the community, which would publicize the firm. Or establishing a scholarship for local students and promoting it to area schools and school systems, which would link to scholarship information on your site. If a member of a law firm teaches at a local college or sits on a corporate or non-profit organization’s board, those organization’s sites may link back to that individual’s profile on your site.

Obtaining high quality backlinks is not always the easiest road, but it is the road well worth traveling, especially in the post-Penguin era.

.bit: Why Brands Need to Pay Attention [VIDEO]

Sterne Kessler Goldstein Fox

Monica Riva Talley, director at the intellectual property law firm Sterne, Kessler, Goldstein & Fox, P.L.L.C., discusses the unregulated domain .bit and why brands need to pay attention to this “Wild West of the Internet.” As Ms. Talley explains, ‘.bit’ is unlike any customary domain and presents several areas of concern for intellectual property owners including cybersquatting, the use of pirated content, and the absence of oversight or control by any regulatory entity.

© 2014 Sterne Kessler
ARTICLE BY

Monica Riva Talley
OF
Sterne, Kessler, Goldstein & Fox P.L.L.C.

Protecting Trade Secrets in the Cloud

FINAL SW logo wLLP2

The business community’s growing use of cloud-based computing services provides great benefits due to cost-savings and mobile information access.  However, business leaders should understand the risks of storing valuable trade secrets in the cloud.  This article provides the business community tips on how to safeguard valuable trade secrets stored in the cloud from being freely disclosed to the public, thus putting the business at risk of losing protections that courts grant trade secrets.

As businesses’ profit margins have continued to shrink since the Great Recession, more companies have looked to reduce costs by reducing growing expenses related to their information technology departments.[1] The first line item to draw attention in the IT budget is frequently the rising costs associated with maintaining and upgrading system hardware.  Businesses often find that housing and operating multiple servers stretches IT budgets thin by increasing maintenance, labor, and operational costs.  The solution so many businesses have turned to is to move their valuable data to virtual servers, or the “cloud.”[2]  A recent survey of IT executives provides that companies will triple their IT spending on cloud-based services in 2014 over 2011.[3]  Cloud service providers have also seen demand increase as they increase their cloud capabilities.[4]

Although cloud-based servers provide businesses with substantial financial and operational benefits, businesses must recognize that there are perils to shifting data to the cloud.  One of the key concerns businesses should consider before moving data to the cloud is the risk that its valuable trade secrets will lose protection as a result of insufficient safeguards to protect against disclosure.  This article addresses that concern and provides businesses keys for seeking to protect valuable secrets in the cloud.

What is a Protectable Trade Secret

The initial step for a business to determine how to protect its trade secrets is to understand how the law characterizes a trade secret.  Information qualifies as a trade secret only if it derives independent economic value as a result of not being generally known or readily ascertainable, and be subject to reasonable efforts to maintain its secrecy.  Trade secrets are broadly defined as information, including technical or non-technical data, a formula, pattern, compilation, program, device, method, technique, drawing, process, financial data, strategies, pricing information, and lists of customers, prospective customers, and suppliers.

Businesses Need to Take Reasonable Efforts to Protect Trade Secrets in the Cloud

Trade secrets are only protectable when the owner takes reasonable efforts to prevent them from being freely disclosed to the public so that the information does not become generally known.

Information does not have to be cloaked in absolute secrecy to be a trade secret, as long as a business’s efforts to maintain secrecy or confidentiality are reasonable.  It is easy for one to imagine how a business may protect confidential documents that are stored locally.  Computer files may be password-protected with several layers of encryption software, with access limited to specified personnel.  Similarly, paper files may be stored in locked cabinets, in secured rooms, where only specified personnel are granted access.

However, those seemingly straight-forward security protocols become murky when information is stored in the cloud.  Unlike storing data on local servers, storing data in the cloud requires the owner to disclose confidential information to a third-party vendor.  In most situations, disclosing data to a third-party eliminates trade secret protections.   Therefore, businesses must take additional steps to ensure that its data remains secure.

Three Keys to Protecting Trade Secrets Stored in the Cloud

There are no fail-safe measures to protect data stored in the cloud.  The best way for a business to protect its trade secrets is to locally store and protect its most valuable data with the proper data security protocols.  A business, however, should not fear the cloud as long as it takes certain steps to ensure that it exercises reasonable efforts to protect its cloud-based data.

First, business leaders must conduct appropriate due diligence before selecting a cloud-provider.  The business should conduct necessary research to select a reputable, well-established company that has the physical and technological capabilities to store and protect data.

Conducting due diligence on a provider includes ensuring that the provider has taken necessary steps to establish appropriate physical and virtual security protocols to protect the confidentiality of your information.  Inquire how the provider establishes physical security measures, and monitoring capabilities to prevent unauthorized access to its data centers and infrastructure.  Also, learn how the provider limits its employees’ access to customer data and determine the internal controls that the provider has in place to prevent unauthorized viewing, copying, or emailing of customer information.

A business should also inquire about the provider’s virtual security protocols.  A business must generally understand how its cloud-provider’s encryption software and security management systems work to protect data.  If your business is not capable of independently evaluating whether the provider has proper security protocols, a good indicator is to ask the provider for its client list.  If the provider has clients that are typically security-conscious companies, such as financial institutions or healthcare facilities, that is a good indication that the provider has been vetted and it has proper security measures in place.  Finally, the provider should maintain sufficient data-protection insurance coverage to protect against potential data breaches or system failures.

Second, a business must have contractual safeguards in place with its cloud-provider to adequately protect its intellectual property and trade secrets.  The contract should establish that the business owns the data, that it will be segregated from other data groups, and that the business may enjoy unfettered access to the data.  The contract should specify that the business can demand that the data be deleted or returned request, and detail how the provider will purge the data to ensure that it is properly deleted upon termination of the relationship.  The contract should require regular data backup and recovery tests, while restricting the provider from accessing, using or copying data for its own purpose.  Finally, the contract should establish the provider’s obligations to notify the business of a data breach or system failure.

Third, a business should also consider adding multiple layers of authentication and encryption to data containing trade secrets before transmitting it to the cloud-provider.  However, a business should consider if the additional encryption efforts could adversely affect the business’s ability to access, utilize, and port data for its normal business use.

Conclusion

There are several financial and operational benefits for a business to store data in the cloud.  However, businesses must understand that there are also risks to storing its valuable trade secrets on virtual servers.  Businesses need to take reasonable efforts to protect the confidentiality and secrecy of its most valuable data and information.

[1] Dave Rosenberg.  Reducing IT Infrastructure Costs via Outsourcing.  May 7, 2009.  news.cnet.com/8301-13846_3-10235742-62.html

[2] Thor Olavsrud.  How Cloud Computing Helps Cut Costs, Boost Profits.  March 12, 2013. www.cio.com/article/730036/How_Cloud_Computing_Helps_Cut_Costs_Boost_Profits

[3] Andrew Horne. Transformational Change in IT Will Drive 2014 Spending.  November 5, 2013.  http://blogs.wsj.com/cio/2013/11/05/transformational-change-in-it-will-drive-2014-spending/

[4] IBM Commits $1.2bn to Cloud Data Centre Expansion.  January 17, 2014. www.bbc.co.uk/news/business-25773266

Common Social Media Profile Picture Mistakes

Consultsweb Logo

How you present yourself on social media can either draw clients to you, or send them packing.

What’s the first thing you notice about someone’s social media account? Their profile picture. There are over 645 million active Twitter users, 829 active daily users on Facebook, and over 200 million users on Instagram. Profile pictures are the first thing any of these users will see when your account is searched or suggested on social platforms, so it is vital that your picture send the right message.

Do’s and Don’ts of social media profile pictures:

DON’T make yourself so far away that the person has to play a strategic game of “Where’s Waldo” just to identify you.

Where's Waldo

DON’T filter your picture so heavily so that the viewer can’t even imagine what the original looked like.

Filter 2

DON’T pose like you’re on the cover of a magazine. There is a time and a place for glamour shots, but your professional profile is not it.

Model

DON’T set your profile image as a picture of you and your spouse. Marriage is a beautiful thing, but this is your profile, not yours and your significant other’s.

Spouse

DON’T make your profile picture your firm’s logo. While it is important to gain exposure for your firm, your profile picture isn’t the ideal place to do so. A profile picture should personalize you as an attorney. You can, however, put something like a logo as your cover photo so that it is the background to your profile image.

Logo

DON’T leave your image as the default, such as the signature Twitter egg. Doing this will not only look impersonal, but also come off like you didn’t care enough to put in the effort to change the photo.

Twitter egg

DO follow these guidelines for profile pictures:

Profile Picture

  • Crop the picture so it is an up-close, professional shot of your face.

  • Make sure it is well-lit and that you’re looking directly at the camera.
  • Smile! This can showcase how personable you are and also be inviting to the people who see it.
  • Don’t have anything directly behind you; it is ideal to have professional head shots in front of a green screen.

  • Your profile picture needs to be large enough that it can be recognized without actually having to click on the image. Be mindful of general size requirements across social media networks.

ARTICLE BY

Samantha Hicks
OF
Consultwebs.com, Inc.

How to Build Trust Online by Being Human

The Rainmaker Institute

All you have to do is troll your own Facebook or LinkedIn account to know that there is LOTS of content online.

In fact, a recent post at Buffer.com noted that more content is published every day on Facebook than is found in every book published in human history!

Building Blocks with Trust

So how do you stand out from that enormous crowd and earn the trust you need to succeed with your social media marketing program?  Buffer provides these tips:

Use personal pronouns.  Using personal pronouns in your posts — I, we, you, me, etc. — and being more conversational elicits empathy from an audience, getting  you a better response.

Use simple words.  By using simple words, you can convey your idea in a way that people don’t have to think about before understanding it.  Big words and legalese will tend to alienate people, not draw them in.

Use stories.  Since the beginning of time, humans have communicated by telling stories and the propensity to listen to a story is ingrained in our DNA.  A Buffer study showed that adding a story to your blog post can increase readership by 300%.

Use contemporary culture references.  Weaving a pop culture reference or two into your post, especially if you’re able to add a celebrity name or two like Beyoncéor George Clooney (see how I did that?), helps boost readership and interest.

Use the Shaq Rule.  Shaquille O’Neal is a social media powerhouse, with a Twitter following of 8.5 million and 4.7 million Facebook fans.  His rule for posting is that 80% of his posts must be entertaining, 15% must be informative and only 5% should sell something.  People can sniff out a sales pitch online immediately, and just as quickly they are on to the next thing.

ARTICLE BY

Morgan Kennedy
OF
Covington & Burling LLP