Unisystems Biotechnologies, Inc. ("UniBio") is a large biotechnology company based in Burlington, Massachusetts, just outside of Boston. It employs 1,250 people in two locations in the United States, and its stock is publicly traded on the NASDAQ. Harold Biden has ben the CEO of UniBio since 1996

Goethetechnologik GmbH ("Goethe") is a large German chemical manufacturer based in Cologne. It employs 10,000 people at three locations in Germany; its newest plant is located in the former East Germany. The firm is privately held.

In 1997, UniBio and Goethe entered into a joint venture to develop drugs to prevent colon cancer. Responding to financial incentives from the German government, they established the research center for the joint venture in Munich, Germany, and built a modern 40,000 square foot biotech research facility at that location. At present, 200 research scientists and production engineers from the United States and Europe are employed by the joint venture at the Munich site. The joint venture's site manager reports each month to a management board of six, consisting of the CEOs, CTOs and CFOs of UniBio and Goethe.

The Joint Venture Agreement provides that operating expenses will be shared equally by UniBio and Goethe, that all inventions, trade secrets and intellectual property will be held in the name of the joint venture, and that, in consideration of its start-up incentives, the government of Germany will receive 10% of any net profits derived from use, licensing or sale of that intellectual property. The Joint Venture Agreement also provides that all technical, confidential and trade secret information will be carefully protected through a variety of procedures, including: screening potential employees, implementing and enforcing confidentiality agreements with employees and third parties, limiting access to information, using lab notebooks, building a library of documents, and maintaining confidentiality legends on all computer screens and documents. It also provides that information on any inventions which are considered to have market value will be delivered to and retained by the CTOs of UniBio and Goethe, cloaked at all times in heavy 128-bit encryption and stored in secure file systems in UniBio's and Goethe's mainframe databases. The site manager of the joint venture facility has been rigorous in implementing these programs to protect trade secrets and confidential information.

Xavier Augustine Franco is a member of one of the joint venture facility's research teams. His specialty is bio-engineering of beta blockers, but he is also a gifted computer hacker. Señor Franco has become disillusioned with his job. He believes that other researchers are getting credit for his inventions as a result of influence by the German government. Señor Franco has decided to steal the formula for the joint venture's only marketable invention to date, a vaccine against colon cancer which is now in human trials, and to sell it to a syndicate in Barcelona, Spain.

On Sunday, February 14, 1999, at 6:00 a.m., Señor Franco lets himself into the joint venture facility in Munich. He proceeds directly to the central bank of networked computer work stations. Entering a user name and password that he has stolen from a senior research scientist, Señor Franco logs onto the joint venture's computer network and, within a few minutes, gains access to the senior research scientist's files containing decryption keys and algorithms that can be used to unlock secure files on the UniBio mainframe in Burlington, Massachusetts. Within five minutes, Señor Franco has broken into UniBio's encrypted computer files and found the formulae and human trial results for the vaccine against colon cancer. He immediately transmits the information over the Internet to the syndicate in Barcelona and copies the information onto three diskettes. The diskettes are then labeled "Open for Public Disclosure" and left in the document library and in the desks of two junior researchers. At 6:20 a.m., Señor Franco leaves the joint venture facility.

Nearly 24 hours later, a routine check at the joint venture facility in Munich detects that a senior research scientist has accessed the encrypted database of UniBio's Burlington facility. Computer security personnel immediately contact the senior research scientist, a native of Bangladesh, who establishes that at 6:00 a.m. on Sunday he was on a plane from Calcutta to Frankfurt. The front security desk personnel at the joint venture facility report that the only non-security employee to enter or leave the facility between 5:00 a.m. and 7:00 a.m. on Sunday was Señor Franco. A check at Señor Franco's bungalow shows it to be deserted. Computer security personnel checking their logs of Internet activity find that a transmission was made from the joint venture facility to a Barcelona website within minutes after UniBio's encrypted database was accessed. At 7:00 a.m., the joint venture facility manager is notified of these facts. He then spends 45 minutes confirming the results of his security office's investigation. At 7:45 a.m. Munich time (1:45 a.m. Boston time), the joint venture facility manager places a conference call to the CEOs of UniBio and Goethe to report that it appears that Señor Franco has made a copy of the joint venture's most valuable invention and delivered it to a person or persons in Barcelona. The two CEOs thank the facility manager for his report and say that they will consider the matter and call back with instructions. They then get on the phone with each other and consider what to do.

Three questions immediately occur to the two CEOs:

1. Do they know what happened?

2. If their trade secrets have been disclosed, can they get the information back?

3. Who, if anyone, must they inform about these events and when must they do it?

They realize that all these issues are connected. For example, their obligation to report may be lower if they know less about what happened. Even if they can't do anything to recover possession of the missing trade secrets information, they may still be able to exploit the invention by being first to market, and it may only hurt their companies to disclose that security has been breached. However, their ability to get the information back or to compel its recipients to keep it secret, and thereby to protect the value of their invention, if any value remains at all, depends upon promptly learning all the facts. And their obligation to report these events may depend upon a valuation of the trade secrets. The two CEOs are in a quandary, but must decide quickly how to proceed. What should they do?

I THEY SHOULD FIND OUT WHAT HAPPENED.

A. The CEOs Have No Choice.

The CEOs are faced with the possibility that a substantial asset of their two companies has been stolen or rendered worthless. Their decision to continue investing in human trials and, if those are successful, the government approval process, followed by manufacturing and marketing, depends upon an analysis of the profit potential of these activities. That profit potential will be significantly reduced if the joint venture is not able to maintain exclusive worldwide rights to the vaccine, which, at this point, depends on secrecy. It is not possible for the CEOs to go forward without immediately learning the full extent of their companies' losses and as much as possible about what has happened.

B. The CEOs Should Seek to Investigate In Private.

The two CEOs have three options in seeking to find out what happened: 1) call in public agencies to investigate the theft; 2) continue the investigation through the employees of either the joint venture or the constituent companies; or 3) bring in a third party to conduct an investigation and report to the CEOs.

The first possibility, calling in public agencies, has the advantage of bringing in compulsory process (such as search warrants, detention of suspects, and the threat of prison and fines to encourage cooperation), but the disadvantage of starting a process that cannot be controlled, may involve long delays, and could become public.

The second possibility, continuing the investigation through existing employees, is tempting because it appears to maintain confidentiality within the organization, can be done quickly with trusted employees, and will require little additional expense. However, it assumes that the persons who are assigned to do the job will be able to get cooperation, will know where to look, what to look for and how to look for it and, once they learn the full extent of what has happened, will continue to follow the directions of the CEOs regarding the problem. Their communications within the company in most cases also will not be protected by the attorney client privilege.

The third possibility, hiring an outside firm to conduct an internal investigation, has many of the advantages of the first two options without the disadvantages. An experienced internal investigation firm can quickly be on site to interview personnel, check systems, and document the extent of any loss. It can engage related professionals, private investigators, valuation experts, forensic accountants, and computer professionals, as necessary to assist in establishing the facts quickly and in preserving the results of their investigations for later use in court, and can coordinate the work of those professionals in multiple locations.

Experienced internal investigation firms made up of former prosecutors and government investigators, knowledgeable about the government's methods of investigating criminal offenses and operating with the support of management, can expect to receive at least the same level of cooperation as a present employee attempting to do the job, and frequently the appearance of an outside firm working quickly to investigate a problem will bring out more facts than a similar attempt by an existing employee. Finally, an internal investigation firm's communications with employees and management will be protected by the attorney client privilege and work product doctrine. The firm's future in business depends on being bound by enforceable obligations of confidentiality and following the instructions of the company even after the investigation is concluded. The same level of security and control cannot be expected from employees who perform an investigation, then become disillusioned or unemployed.

The CEOs should therefore promptly engage a firm experienced in internal investigations to conduct a thorough review of what has happened and to report their conclusions orally to the two CEOs by a deadline that the CEOs set.

II. THEY SHOULD ESTABLISH THE EXTENT OF THE BREACH.

A. Try to Get the Information Back.

Trade secrets are lost by disclosure to the public. Under the law of most countries, they are not lost by unauthorized possession by a thief or his accomplices. Thus, if the two CEOs can find out where their information has gone and prevent further disclosure, they may be able to maintain the value of their property. It is critical that they establish immediately where Señor Franco transmitted their information and preserve the joint venture's records of that transmission for use in court. An internal investigation firm will make this a first priority and can assure that a record that could be produced in court or to law enforcement authorities is preserved.

It is technically possible to establish that Señor Franco transmitted information to the Barcelona website. Within 24 hours, the joint venture could engage a law firm in Barcelona to seek the help of Spanish courts for an order preventing further transmissions and requiring inspection of the Barcelona firm's records of transmissions. Quick detection and the threat of criminal prosecution in Spain for receipt of stolen property might encourage the Barcelona syndicate to return the stolen trade secret information. If the Barcelona syndicate has already passed the information along to someone else, it may be possible to establish the identity and location of the new recipient and to repeat the process in a second location. In addition, to the extent that any recipient has assets or does business in the United States, it may be possible to obtain relief by suing the recipients for damages and injunctive relief in federal courts in the United States. An experienced internal investigation firm will also inventory the trade secret information on hand at the joint venture plant and should discover the three diskettes that Señor Franco has left on the premises for later disclosure.

A prompt and thorough investigation by a firm experienced in handling trade secret theft should be able to establish within a few days the extent of the loss and whether anything can be done to recover the stolen information.

B. If the Information Cannot Be Completely Recovered, Preserve Evidence For A Damages Action And Consider Alternative Methods Of Preserving The Asset Values.

If the internal investigation firm establishes that some information has been placed outside the joint venture's control, the two CEOs should direct that evidence of the theft, the joint venture's efforts to recover the information, and the later losses to the joint venture be documented and preserved in a form that can later be used in court.

The two CEOs should also consider whether any steps can be taken to preserve the value of these inventions for the joint venture despite a breach of confidentiality and possible future public disclosure. It may be possible for the joint venture to seek patent protection in the United States for some parts of the inventions. This would prevent the thieves from applying for their own patent and could eliminate some of the threats of loss due to general public disclosure. Or it may be that the time has come to report the theft to public agencies and encourage them to pursue the thieves with the threat of criminal sanctions, which will in turn discourage public disclosure of the trade secrets.

Several options are open, once the two CEOs have complete information on the breach of security and the extent of their loss. More options are open if they learn the full story from a reliable source within days rather than weeks. Once the complete facts are known, the two CEOs must consider whether they have an obligation to report, and, if so, what they must report and to whom.

III. MUST THE TWO CEOS REPORT THESE EVENTS TO ANYONE AND, IF SO, TO WHOM MUST THEY REPORT?

A. The Two CEOs Must Report To Their Boards.

The two CEOs are required under the corporate laws of the United States and Germany to report the loss, their proposed corrective actions and the anticipated effect on their companies to their respective boards of directors. They may not be required to disclose the full details of their internal investigation firm's report, but they would probably be well-advised to disclose the details at least to the Chairmen or to the Executive Committees. The two CEOs should instruct their internal investigation firm to report to them orally as the investigation progresses, then to prepare a comprehensive written report which can be shown to key members of the Board. The two CEOs will want to take care that the process of reporting on the theft does not have the effect of making a further disclosure of trade secret material to people associated with the company who would not otherwise see it. While some members of the internal investigation firm will naturally have to be briefed on the information, every member of the two boards and upper management teams may not, and the two CEOs will want to be as careful with disclosure of the results of the investigation as they would be with the trade secret itself. The two CEOs will also need to conduct an assessment of their internal security to determine whether changes can be made that would prevent a similar theft in the future. A report on this analysis should be made to the same select members of the Boards and perhaps to the Boards' audit committees.

B. The CEO Of UniBio Must Disclose To The SEC and Investing Public.

If the internal investigation establishes that the trade secret information cannot be recovered and that there is a threat that the value of the joint venture's invention will be lost, the CEO of UniBio will have to disclose that fact in UniBio's next Form 10-Q (or, if the date for its annual report occurs first, its Form 10-K) informing the investing public of certain basic information about the potential loss. If information on the new formula and its potential value to the company has recently been provided to the securities markets, it may even be necessary to issue a press release advising of the potential loss without waiting until the next Form 10-Q or 10-K is due. While the Forms 10-Q or 10-K and any press release must be sufficiently explicit to let investors evaluate the potential effect on value of the company's stock, they should be no more detailed than necessary, in order not to prejudice future litigation or prosecution of the thieves. The Forms 10-Q or 10-K and the press release should be prepared in consultation with the internal investigation firm hired to look into the matter and with UniBio's securities counsel.

C. The Two CEOs Need to Consider Whether To Report The Theft To Public Agencies And, If So, Where To Do So.

Once the two CEOs know the extent of their loss, whether they can do anything to limit their damages, and what can be done to assure that the same thing doesn't happen again, they should consider whether to report the theft to law enforcement agencies.

Reporting the theft of trade secrets to law enforcement agencies may be necessary if the company wants to claim reimbursement from an insurance company. It may also provide a means of assuring outside Board members, regulators and investors that everything possible is being done to recover the stolen property and that no facts are being covered up. And it may provide the most satisfactory means of deterring others from committing similar acts and seeing that Mr. Franco and his accomplices are punished.

The principal difficulty with reporting the theft to law enforcement agencies is that the process of public investigation and prosecution cannot be controlled once it has begun (please see endnote 2), may last for a period of years during which management's attention and resources are diverted from profitable activities, and, worst of all, may result in further disclosure of trade secrets. When the two CEOs are evaluating this issue, they will need to compare the criminal justice systems of the countries in which they could make the report and remember that they are not obligated by the law of the United States, Germany or Spain to report that they are the victims of a crime. In most situations, a victim of a crime always has the option not to report the event(please see endnote 3).

If the CEOs decide that they do want to report this event to a law enforcement agency, they will need to consider where that should be done. As a general matter, although the crime was initiated in Germany, it occurred, in part, in the United States and, in part, in Spain. Any one of the three countries could therefore assert jurisdiction over the crime, and the joint venture has the option of deciding where to start the process. Since a company can generally expect more sympathetic and protective treatment from its home country's law enforcement agencies than from the law enforcement agencies of other countries in which it merely operates, the two CEOs should concentrate on reporting the offense in the first instance to either United States or German authorities or both (please see endnote 4).

1. U.S. and German Laws Against Theft of Trade Secrets

Both the United States and Germany have national laws making it a crime to steal trade secrets. The United States statute is known as the Economic Espionage Act, 18 U.S.C. ' 1831 et seq. It prohibits any person from stealing, attempting to steal or conspiring to steal any form of business, scientific or technical information which the owner has taken reasonable measures to keep secret and which has value from not being generally known to or readily ascertainable by the public (please see endnote 5). A violation of the Economic Espionage Act is investigated by the United States Federal Bureau of Investigation and prosecuted by the United States Department of Justice, through one of the 93 United States Attorneys operating across the country.

In Germany, criminal sanctions for theft of trade secrets are set forth in Sections 17 through 20a of the German Act against Unfair Competition. Section 17 (1) prohibits unauthorized disclosure of a trade secret by an employee, worker or apprentice either with the intent to cause damage to the owner of the trade secret or with the intent to benefit someone other than the owner of the trade secret. Section 17 (2) no. 1 prohibits a person from obtaining a trade secret "by technical means" (e.g., computer-assisted theft) or from taking a physical object that embodies the trade secret.

The U.S. Economic Espionage Act has certain strengths. It defines trade secrets very broadly to include any kind of information which is valuable because it is not known to "the public," and which the owner has taken reasonable measures to keep secret. It prohibits any knowing attempt to convert a trade secret to the benefit of someone other than the owner, regardless of how it is done or of whether it is effective. It extends United States criminal jurisdiction to acts which are committed outside the United States by any United States citizen, permanent resident alien or organization formed in the United States. Only one act in furtherance of the offense needs to occur within the United States for U.S. courts to take jurisdiction of the crime. It allows the United States Attorney General to seek an injunction, as well as an order forfeiting the proceeds of any theft or any property used to commit the theft. And it provides for a sentence of 10 years in prison and a $250,000 fine for theft by an individual and a $5,000,000 fine for theft by an organization (please see endnote 6).

The U.S. Economic Espionage Act has significant weaknesses, however. First, there is every likelihood that prosecution of the thief will require disclosure of a company's trade secrets in open court. Once a company has reported the theft to United States criminal investigation authorities, it will not be possible for the company to prevent disclosure. Although the Economic Espionage Act provides that the court shall enter orders to protect the confidentiality of trade secrets, United States constitutional law may require that a person charged with theft of trade secrets be shown what he is accused of taking and to be able to fully explore whether the information was the subject of reasonable efforts to keep it secret or had value from being unavailable to the public. This inquiry may even allow criminal defendants to explore what the company has done to protect its other commercial information and thereby to discover information on trade secrets that they are not accused of stealing. All this information may then be subject to disclosure in a public trial. Although the decision of one United States federal court to disclose a company's trade secret information has been reversed on appeal (please see endnote 7), it is not at all clear how other courts will balance the rights of companies and of the persons accused of stealing trade secrets from them. The risk that a company will be forced to disclose its trade secrets in order to have a thief convicted is a significant factor to consider when deciding whether to report trade secret theft to United States authorities.

In 1996, when the Economic Espionage Act was passed, the United States Congress was concerned that it would become a business weapon for competing companies. It therefore elicited a promise from the United States Attorney General that she would supervise prosecutions for 5 years. As a practical matter, this pledge has meant that several cases are investigated but few are prosecuted; as of April, 1999, only 11 cases had resulted in public criminal charges, while the FBI reported having 800 cases under investigation. Since United States "white collar" criminal cases customarily take 3 or more years to investigate, it can reasonably be assumed that many of these 800 cases are close to indictment, but what types of cases the federal government will eventually choose to bring, and how many of the reported offenses will result in charges under the Economic Espionage Act are still open questions. As a result, a company which is considering reporting a theft of trade secrets to United States authorities must ask itself whether it will spend years assisting the government to investigate, only to discover that the type of theft it has reported does not fall within the range of cases that the United States Department of Justice eventually wants to prosecute. Reporting trade secret theft to United States authorities remains, at best, an uncertain course of action.

Similar considerations arise under the German system. Section 17 of the German Act Against Unfair Competition is remarkably similar to the EEA. The term "trade secret" is defined broadly to include any information that has an economic or competitive value for a business, if: (1) the owner has made reasonable efforts to keep it secret, and (2) access to the information is limited to a select group of employees within the business. Under Section 17, a German court can order the forfeiture of any proceeds of the theft of trade secrets and of any property used to commit the crime. However, the General Act Against Unfair Competition provides for less severe penalties than the United States Economic Espionage Act. Section 17 provides for a sentence of only three years in prison and/or fines (please see endnote 8).

German authorities also have a more limited ability to prosecute thefts of trade secrets than do United States authorities. Under Section 5 no. 7 of the German Criminal Code, Germany asserts criminal jurisdiction to prosecute a theft of trade secrets only if the theft occurred within Germany and the trade secret belongs to a company: (1) that is actively doing business within Germany, (2) that is incorporated within Germany, or (3) that is a subsidiary of a German company located in a foreign country. German Criminal Code Section 3. Señor Franco's theft of trade secrets in the Munich joint venture facility, a business entity actively doing business within Germany, would fall within the jurisdiction of German prosecution.

Under the German System, once a public prosecutor "affirms a specific public interest" in prosecuting a case of theft of trade secrets (please see endnote 9), and thereby launches a full public investigation and prosecution, the victim company will not be able to prevent disclosure of the trade secrets and the company's efforts to keep them secret to the accused. In Germany as in the United States, the accused is entitled to obtain any information which will support his defense. A German defendant will therefore be able to request that UniBio and the joint venture -- as well as perhaps Goethe -- turn over the details of the trade secrets that are alleged to have been stolen and of all their efforts to keep their secret. However, in Germany disclosure to the accused and defense counsel does not mean automatic disclosure to the public at-large. Under Section 172 no. 2 of the German Constitution of Courts Act, the presiding judge may exclude the public from the trial in order to limit disclosure of trade secrets and under Section 174 (3) of the German Constitution of Courts Act, the presiding judge may also require the parties and counsel to keep secret any trade secret information which is disclosed during the case. Similar protections could not be expected from a United States court.

2. An Alternative Course of Action: Prosecution Under the United States Computer Fraud and Abuse Act

In this case, U.S. prosecutors might be able to avoid the risk of disclosing trade secrets by prosecuting Señor Franco under the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. ' 1030. The CFAA makes it a crime in the United States to access and obtain information without authorization from any computer used in interstate commerce. The computers that UniBio used to store trade secrets generated by the joint venture would qualify for the Act's jurisdiction. 18 U.S.C. ' 1030(a)(2) (please see endnote 10). Because it is not a required element of proof in a CFAA prosecution that the information obtained be a trade secret, the act of intentionally accessing any information without authorization from a computer violates CFAA. The substance of the information unlawfully accessed is irrelevant and hence not subject to disclosure.

Señor Franco might also be charged under 18 U.S.C. ' 1030(a)(4) if the prosecutor can show that Señor Franco acted with the specific intent to defraud UniBio for financial gain. That section makes it a United States crime for a person to "knowingly and with intent to defraud, access a protected computer without authorization, or exceed authorized access, and by means of such conduct further the intended fraud and obtain anything of value. . ." It could be argued that Señor Franco's immediate sale and transmission of the decrypted formulae to the Barcelona syndicate strongly suggests that he carried out a premeditated plan to defraud UniBio for his own financial gain.

3. Choosing Where to Report the Crime

If the two CEOs think that a report should be made to law enforcement agencies, they will need to weigh the advantages and disadvantages of the United States and German systems and to decide whether to make a report to the government of one or both countries (please see endnote 11). They should be guided by the principal purpose they have in making the report. If they are reporting for insurance purposes, it is probably enough to report to one country (but they may want to seek their insurer's views before taking action.) If they are seeking to show that no one is being protected and nothing is being hidden, they may need to report to both countries.

4. Making the Report

If the two CEOs decide to report the theft to authorities in either country, they should have their internal investigations firm organize the evidence that they know the government investigators and prosecutors will want and make a presentation of that evidence to the government in a personal meeting. Most experienced internal investigation firms are staffed with former agents and prosecutors who know the best way to present a case to encourage government interest and sympathy for the corporate victims. They will probably also be able to assist the government in conducting its investigation within the company so that distraction of employees is kept to minimum and the government fully understands the company's business and needs. They will also be able to keep informed about how the investigation is going and to increase the joint venture's chances for restitution if the thieves are caught with the trade secrets or the proceeds of their theft.

In the United States, the case presentation will be made either to the FBI agent or to the United States Attorney or his assistant in the district where the crime will be prosecuted. In the present case, that will likely be the District of Massachusetts. However, Señor Franco's use of the Internet to commit his crime opens up the possibility of prosecution in any jurisdiction in the United States through which his Internet transmission passed. In this situation, the two CEOs would want to look for another district only if the FBI or United States Attorney's Office in Massachusetts indicated that they were not interested in the case.

In Germany, the case presentation will be made to the public prosecutor's office in Munich.

IV. CONCLUSION.

The two CEOs' most critical obligation, upon learning of the theft, is to discover all the facts as quickly as possible and to attempt to recover or prevent further disclosure of the joint venture's trade secrets. They can best accomplish this purpose by hiring an experienced internal investigation firm, with legal, investigative and expert support and contacts in the United States and Europe.

Their next problem is to decide whether they are required to report the theft to anyone and, if so, what they should say. At a minimum, they will need to tell key members of their Boards and public investors that they have suffered a material loss. They will need to be careful that disclosure does not compromise efforts to pursue the thieves or make a broader disclosure of the trade secrets. Finally, they will need to decide whether to report the theft to law enforcement agencies and, if so, where. In this situation, if they decide that their insurer, their Boards, the public or the need for deterrence and punishment require an attempt at criminal prosecution, they will want to compare the United States and German systems and decide which offers a better chance of achieving their purpose while protecting the companies. When they decide where to report, they should have their internal investigation firm make the presentation, in order to assure a maximum opportunity for the authorities to bring the case with the greatest attention to the company's needs.

Richard Wiebusch
[email protected]
Hale and Dorr

Vincent Parrett
Mondaq

Marion Eichert
Mondaq