IP, ENCRYPTION, AND THE THREAT TO PUBLIC SAFETY
Updated: Oct 8
Author: Matt Malone
Introduction
Law enforcement agencies in liberal democracies increasingly assert that the proliferation of end-to-end encryption is a major threat to public safety.[1] While such assertions are hardly new,[2] end-to-end encryption is increasingly a mainstay of the infrastructure of digital communications.[3] Although government and law enforcement have long utilized end-to-end encryption for their own purposes, this technology, which renders communications “unreadable except to a person who has the key to decrypt it into readable form … all the way from sender to receiver,”[4] is now being disseminated pervasively, such that it has become a fact of life for average users and an important default in many communication systems,[5] from iMessage[6] to FaceTime[7] to WhatsApp.[8] In response to this state of affairs, law enforcement bodies have identified challenges to criminal investigation and prosecution and have called for access to such communications “in limited circumstances where necessary and proportionate” by embedding vulnerabilities that allow for circumvention of the technology.[9] Some legislative actors have even proposed statutory interventions aimed at dismantling and forestalling the spread of end-to-end encryption in such technologies.[10]
These calls from law enforcement have been the subject of vociferous critique, largely centered on evocations of data insecurity; privacy; and threats to human rights, due process, and fundamental principles of law.[11] They rarely invoke explicitly the protection of intellectual property (IP). This comment supplements these critiques by offering a perspective centered on the connection between the proliferation of end-to-end encryption and its importance in protecting IP (in particular trade secrets and confidential information, which are highly reliant on encryption). This comment argues that embedded vulnerabilities pose a fatal threat to IP and, by extension, to public safety. It takes as a starting point the growing understanding by law enforcement that protection of IP is a national security issue. It then points to a confusion in law enforcement’s recognition of encryption as vital to protecting these assets while simultaneously propounding calls for its circumvention, and argues that such calls undermine the maintenance of public safety by endangering these assets.
The argument is grounded in a reading of the joint statement “End-To-End Encryption and Public Safety” (the “International Statement”) released on October 11, 2020, which exhorted private actors in the technology industry to provide law enforcement with access to such communications “in limited circumstances where necessary and proportionate.”[12] The International Statement was signed by top-ranking law enforcement officials in seven countries, including Canadian Public Safety Minister Bill Blair. [13] At the outset, it is important to note this comment does not tackle the merits of any technical proposition that it is (or is not) possible to create embedded vulnerabilities. The essay effectively treats encryption as a “static”concept in the same manner as the International Statement, delving into neither scenarios where it is invoked for marketing or advertisement purposes nor those where it is presented as an evolving litmus in the evolution of decryption. It also does not cast doubt on the sincerity of law enforcement bodies to effectuate their responsibilities to protect public safety and does not explore the efforts that have been conducted to examine how advertising-reliant business models, which are common throughout social media, might serve as natural guardrails on the use of default end-to-end encryption.[14] Instead this comment focuses solely on the arguments propounded in the International Statement to support law enforcement bodies’ call for access, drawing out the assumptions about IP, secrecy, and public safety upon which they stand, and the connections between them. In doing so, it is does not confront objections based on an indiscriminate entitlement from the state through its law enforcement bodies to “access any information at any time.”[15] Under such a view, whether the justifications proffered to support the calls for access are accurate, persuasive, or grounded in any real connection with public safety is irrelevant.[16] Yet this comment presumes that the justifications propounded by law enforcement are sincere, affecting and shaping citizen behaviour; public, legislative, and lawful discourse; and the decision-making processes of affected stakeholders.
The International Statement
Raising concern about challenges to public safety posed by the proliferation of end-to-end encryption as a default in communication technologies, the International Statement called for the creation of “mutually agreeable solutions” with companies in the technology industry to facilitate “[t]he ability of law-enforcement agencies to protect victims in the public at large.”[17] Released during the U.S. government’s Cybersecurity & Infrastructure Security Agency’s “National Cybersecurity Awareness Month,”[18] the International Statement was seen as a call to Big Tech to adopt more cooperative approaches with national security entities in the interception of communications.[19] In the International Statement, the signatories noted that they “challenge the assertion that public safety cannot be protected without compromising privacy or cyber security”— albeit without providing any blueprint for the sought-after compromise.[20] The International Statement highlighted the investigatory and prosecutorial challenges associated with certain types of crimes, such as the sexual exploitation of children, organized crime, and terrorism.[21] However, few agree on the scope of the problem posed by encryption to law enforcement in the execution of its duties.[22] As indicated at the outset, this comment is focused on the International Statement’s import for IP. In
particular, this comment focuses on trade secrets and confidential information, which are information-based assets that are not widely known, and which have value from not being widely known, and which have been the subject of reasonable steps to maintain and continue their secrecy. Law enforcement understand the importance of these forms of IP, and in particular their relationship with encryption, as is made clear in the International Statement’s opening salvo: “We, the undersigned, support strong encryption, which plays a crucial role in protecting personal data, privacy, intellectual property, trade secrets and cyber security.”[23] (Emphasis added.) Despite this preamble, a true belief of the importance of these assets has been wanting in Canada for some time. This is partly because the country’s economy has historically hinged on commodity security based on physical assets.[24] Originally a staples economy based on fish, fur, timber, and wheat, today only 7% of Canada’s GDP remains linked to natural resources, with most value now existing in goods that are intangible. Canada is still developing a defense and security mindset that takes seriously the protection of intangible assets. For example, the Canadian Centre for Cyber Security’s reporting system for reporting cybercrime advises “[i]f you believe a cyber incident is of a criminal nature, please contact your local law enforcement agency or the RCMP.”[25] However, the RCMP's National Cybercrime Coordination Unit maze-like reporting system (still in pilot-testing) does not enable such reporting and will only “reach full operating capability in 2023.”[26] The Ontario Provincial Police online crime reporting tool, which is limited to reporting certain crimes, does not mention cybercrime or criminal theft of IP.[27] (Canada’s counterparts in the United States,[28] the United Kingdom,[29] and Australia[30] all have robust reporting mechanisms for theft that include theft of intangibles). Although a seemingly discrete point, these mechanisms for protecting IP matter greatly, since IP is the key form of protection of many intangible assets.
Trade Secrets and Encryption
As noted above, one of the constituent elements of trade secrecy and confident information protections is that the party seeking to invoke those protections undertakes reasonable steps to maintain secrecy. In Canada, trade secrets and confidential information are principally covered through the civil instrument of the breach of confidence, which describes this requirement as establishing “the necessary quality of confidence.”[31] As well, a recent amendment to the Criminal Code of Canada now criminalizes misappropriation of trade secrets, incorporating the same requirement that the subject matter be the focus of “efforts that are reasonable under the circumstances to maintain its secrecy.”[32] The Security of Information Act, which penalizes theft of trade secrets by foreign actors, likewise stipulates that a trade secret is only a trade secret where it “is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.”[33] But what is reasonable under the circumstances? Although there is no particular action that accrues to given subject matter such status, the Canadian Intellectual Property Office, in its guidance for the public on how to acquire such status, advises several best practices: use of non-disclosure agreements, confidentiality clauses, password protection, lock and key, and, significantly, encryption.[34] The office of United States Patent and Trademark Office has issued guidance along the same lines, similarly emphasizing the importance of encryption for trade secrets.[35] The U.S. Department of Justice manual for district attorneys providing instruction on prosecuting IP crimes specifically includes encryption on a checklist for determining whether subject matter are trade secrets,[36] as does the Department’s victim-focused Reporting Intellectual Property Crime.[37] Also, the U.S. Cybersecurity & Infrastructure Security Agency advocates, in its public-facing “tips” series, “to add an additional layer of security to sensitive information” through encryption, so as to ensure “that the data can only be read by the person who is authorized to have access to it.”[38] Further, countless bar organizations, in their requirements on attorneys to exercise reasonable care in the handling of client information, explicitly mention encryption.39 In Canada, the Canadian Centre for Cyber Security recommends it as a basic measure of conducting business in the country.[40] In short, encryption is a vital method of garnering trade secret protection for a most digital subject matter and a common tool to ascribe digital subject matter such status.[41] Sonia Katyal has written compellingly that “code is largely dominated by trade secrecy,”[42] to such a degree that it has become the “default avenue for protection.”[43] In an economic environment where so much wealth is concentrated in algorithms, data, and software, the importance of has risen encryption accordingly.[44] Importantly, without encryption a party may not be able to argue that they undertook the necessary “reasonable steps” to treat the subject matter like a trade secret—obviating the possibility of such legal protection in the event of misappropriation. This point is all the more significant as the preferred modalities of IP protection pivot from traditional forms of “hard” IP like patents towards “soft” ones like trade secrets.
Moreover, as disputes over IP internationalize, adequate patent protection is seen as challenged by requiring sophisticated strategy, execution, and maintenance across multiple jurisdictions.[45] The costs and timelines associated with acquiring patent protection in this paradigm prevents smaller actors “from executing an IP information that … has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret.”
However, even the strength of this nation- and regional-based approach is called into question by the mobility of intangible assets. protection plan with the same sophistication as their larger commercial counterparts.”[46] With trade secrets offering a more flexible alternative, and a wider and longer array of protection, the focus turns towards identifying the administrative, legal, and technological measures sufficient to gain such protections. Among those, encryption is a key technological measure.
Rethinking IP and Public Safety
As stated above, IP is increasingly perceived as a national security question. In the United States, theft of trade secrets by private actors has been punishable as commercial espionage since 1996, separate and apart from economic espionage conducted by, or at the direction of or the benefit for, a foreign entity.[47] Unlike in Canada, the federal Department of Justice in the United States has taken a very aggressive position on prosecuting criminal theft of IP—one that overtly and directly links such instances of theft with harms to the state. Prosecutorial guidelines advise attorneys general that “[t]he criminal enforcement of IP rights plays a critical role in safeguarding U.S. economic and national security interests … our national security interests can be undermined by foreign and domestic competitors who deliberately target leading U.S. industries and technologies to obtain sensitive trade secrets that have applications in defense, security, or critical infrastructure.”[48] When Republican Utah Senator Orrin Hatch introduced the Defend Trade Secrets Act, a federal overhaul of the existing trade secrets law that created a federal private right of action that removed many of the procedural hurdles created by the existing state-only rights of action, national security was invoked as the basis for the law.[49] During its debate in Congress, the bill was extolled for its power to “help U.S. competitiveness, job creation, and our nation's future economic security.”[50] Much of this discourse was tailored towards the threat to American jobs presented by IP theft and addressing the fact that trade secrets were the only type of IP not covered by any civil federal law.[51] As well, the Computer Crime and Intellectual Property Section of the federal Department of Justice, a 40-attorney strong unit, is given the mandate to “advise federal prosecutors and law enforcement agents; comment upon and propose legislation; coordinate international efforts to combat computer crime; litigate cases; and train all law enforcement groups. Other areas of expertise possessed by CCIPR attorneys include encryption, electronic privacy laws, search and seizure of computers, e-commerce, hacker investigations and intellectual property.”[52] In this paradigm, where IP is viewed as the object of a potential attack, IP is construed as nothing less than the assets of the nation—albeit possessed by private actors.[53] Although such an understanding is explicit in the language of the International Statement—and in the widely-remarked comments to the Canadian business community by Canadian Security and Intelligence Service Director David Vigneault when he noted that “the greatest threat to our prosperity and national interest” [54] is economic espionage, in particular of IP—Canada has few prosecutions to demonstrate that it takes this concern seriously.
This state of affairs carries important consequences for national security. Many in the national security community witnessing these costs have seized on this concern to advocate for an acceleration in cyber security online—even as they argue out of the other side of their mouth for technologies that circumvent end-to-end encryption. In effect, this is what the International Statement itself does. Yet others such as Bruce Schneier have concluded that, in terms of the traditional national security apparatuses in most liberal democracies, the security of communications online should trump signals intelligence conducted by law enforcement—effectively privileging the diffusion of end-to-end encrypted technology. “Instead of working to deliberately weaken security for everyone,” he writes, “the NSA should work to improve security for everyone.”[55] In other words, the efforts of law enforcement to gain access to communications via their calls for legislative and technical reform in the realm of end-to-end encryption has downplayed the degree to which encryption serves as the principal bulwark for protecting IP, having deleterious effects on national security for this same reason. Thwarting end-to-end encryption with the use of embedded vulnerabilities would do no less than pose a significant and critical threat to this bulwark. Returning to Bruce Schneier’s famed observation that actions taken to ensure security often have the opposite effect, in term of making
people feel secure even when the opposite is true,[56] this is precisely what embedded vulnerabilities promise to achieve. As the former general counsel of the FBI during the time of its dispute with Apple over access to the San Bernardino shooter’s phone has now conceded five years later: “[I]n order to execute fully their responsibility to protect the nation from catastrophic attack and ensure the continuing operation of basic societal institutions, public safety officials should embrace encryption.”[57] His change of mind was instigated, he noted, by observing that networks in today’s world operate in an environment that can be characterized as zero-trust. Cybersecurity in liberal democracies has not acknowledged the degree to which a poor cyber health posture in this zero-trust environment has allowed China in particular to engage in “wanton looting” of IP in liberal democracies.[58]
In an ideal environment, governments would lead by display and demonstration in establishing norms for cybersecurity. Yet governments in liberal democracies have shown repeated incompetence in safeguarding data, whether it is protecting the judiciary from cyber-attacks (undermining private actors’ willingness to share confidential information necessary to the dispute of resolutions)[59] or to safeguard critical infrastructure itself.[60] In Canada, such cyberattacks against government, post-secondary institutions, and hospitals, as well as core infrastructure occur with increasing regularity.[61] A failure to lead by example has rendered a situation where many do not trust the government with their data, which partly motivates public resistance to law enforcement bodies’ calls for embedded vulnerabilities in the first place. To be sure, there are other areas of research and reform that call out for invitation. For example, one of the primordial considerations for law enforcement in the encryption debate is access to data, and yet such bodies rarely intervene in the discussion around trade treaties to express concern over the impact of data portability provisions. Similarly, thinking through where and how liability is assigned for data breaches may also balance some of the concerns of law enforcers’ desire to access with citizens’ desire for privacy, as it may encourage private sector actors to offer better protections. But as the end-to-end encryption debate rages in its current form as epitomized in the International Statement, seeking to create embedded vulnerabilities does nothing less than endanger national prosperity while advocating for weakened cyber-infrastructure, creating threats in the short- and long-term alike.
Conclusion
This comment on the International Statement has argued that the encryption debate overlooks the necessity of encryption for the protection of IP, a crucial component of national security. Its purpose was to highlight the role of trade secrets in this discussion, and to emphasize the importance of its protection as a matter of public safety. Encryption has served a vital role in the shifting strategies of corporate entities seeking to protect their IP in a way that is adaptable to the speed of contemporary innovation; in particular, the doctrine of trade secrets has served a critical role in the protection of IP based on code. However, while public safety authorities recognize in their rhetoric the need to safeguard IP assets to guarantee national security, they do not connect the dots in accepting the degree to which the threat to IP posed by weakening encryption is itself a threat to national security. When IP is viewed through a national prosperity discourse, the profusion of end-to-end encryption can be seen as vital to protecting national prosperity.
Endnotes:
[1]For example, following the Charlie Hebdo attacks in Paris in January 2015, the UK Prime Minister David Cameron called for a ban on end-to-end encryption. See "Don't Panic: Making Progress on the 'Going Dark' Debate," Berkamn Center for Internet & Society at Harvard University at 8.
[2] See Solomon Friedman, PGP & Encrypted Communication, 2017 29th Annual Criminal Law Conference Conference 2, 2017 CanLIIDocs 3824, <http://canlii.ca/t/srhp>.
[3] For example, following the bombing of the Alfred P. Murrah Federal Building in 1995, the Clinton Administration called for the creation of backdoors to encrypted telecommunications. See Froomkin, A. Michael (1996) "It Came from Planet Clipper: The Battle Over Cryptographic Key "Escrow"," University of Chicago Legal Forum: Vol. 1996, Article 3; and for an overview of historical efforts see Solomon Friedman, PGP & Encrypted Communication, 2017 29th Annual Criminal Law Conference Conference 2, 2017 CanLIIDocs 3824, <http://canlii.ca/t/srhp>.
[4] Electronic Frontier Foundation, "What Should I Know About Encryption?”
[5] Pell, Stephanie K. and Soghoian, Christopher, Your Secret Stingray's No Secret Anymore: The Vanishing Government Monopoly over Cell Phone Surveillance and Its Impact on National Security and Consumer Privacy (December 29, 2014). Harvard Journal of Law and Technology, Volume 28, Number 1 Fall 2014.
[6] Apple, “iMessage and FaceTime & Privacy,” 27 Dec. 2019. https://support.apple.com/en-us/HT209110
[7] Id.
[8] WhatsApp, “About end-to-end encryption,” https://faq.whatsapp.com/general/security-and-privacy/end-to-end-encryption/?lang=en.
[9] U.S. Department of Justice, Office of Public Affairs, “International Statement: End-to-End Encryption and Public Safety,” October 11, 2020. The nomenclature of embedded vulnerabilities is complex, with the notion variously being referred to as “backdoors.” For consistency, this paper simply refers to embedded vulnerabilities.
[10] See S.4051 (“Lawful Access to Encrypted Data Act”), 116th Congress (2019-2020).
[11] For example, in the Canadian context Steven M. Penney and Dylan Gibbs have argued that calls for “exceptional access” create too greater a risk of data insecurity to justify the benefits. As well, Christopher Parsons and Tamir Israel support a similar argument in "Government’s encryption proposal will undermine public safety," Toronto Star, Aug., 28, 2019. See also Parsons, Christopher, (2019), “Canada’s New and Irresponsible Encryption Policy: How the Government of Canada’s New Policy Threatens Charter Rights, Cybersecurity, Economic Growth, and Foreign Policy,” Citizen Lab; Gill, Lex; Israel, Tamir; and Parsons, Christopher. (2018). “Shining a Light on the Encryption Debate: A Canadian Field Guide,” Citizen Lab.
[12] U.S. Department of Justice, Office of Public Affairs, “International Statement: End-to-End Encryption and Public Safety,” October 11, 2020. The
nomenclature of embedded vulnerabilities is complex, with the notion variously being referred to as “backdoors.” For consistency, this paper simply refers to embedded vulnerabilities.
[13] Signatories included top-ranking law enforcement officials from the “Five Eyes” (i.e., the United States, the United Kingdom, Australia, Canada, and New Zealand) as well as India and Japan. The change in Canadian policy was initially announced by then-Public Safety Minister Ralph Goodale, who previously supported the widespread use of end-to-end encryption. See Tamir Israel and Chris Parsons, "Government’s encryption proposal will undermine public safety," Toronto Star, Aug., 28, 2019 and U.S. Department of Justice, Office of Public Affairs, “International Statement: End-to-End Encryption and Public Safety,” October 11, 2020 [signed by Public Safety Minister Bill Blair].
[14] By this argument, the business model of many companies necessitates that a lot of data remain unencrypted, since targeted advertising—the lynchpin of the model for many social network companies—requires certain data to facilitate reaching narrow audiences. For more on this point, see "Don't Panic: Making Progress on the 'Going Dark' Debate," Berkamn Center for Internet & Society at Harvard University at 3 and 10.
[15] U.S. Department of Justice, Office of Public Affairs, “International Statement: End-to-End Encryption and Public Safety,” October 11, 2020.
[16]Comey, James (FBI Director), “Going Dark: Are Technology, Privacy, and Public Safety on a Collision Course?” Oct. 16, 2014.
[17] U.S. Department of Justice. Office of Public Affairs. “International Statement: End-to-End Encryption and Public Safety.” October 11, 2020.
[18] See Cybersecurity & Infrastructure Security Agency, “National Cybersecurity Awareness Month, https://www.cisa.gov/national-cyber-security-awareness-month.
[19] Chritkara, Hirsh. “A transnational coalition of intelligence agencies seeks to abolish end-to-end encryption.” Business Insider. Oct. 13, 2020.
[20] U.S. Department of Justice, Office of Public Affairs, “International Statement: End-to-End Encryption and Public Safety,” October 11, 2020.
[21] These threats are essentially tantamount to the Four Horsemen of the Infocalypse that were enumerated by Timothy May, quoting Sandy Sanfort, in his Cyberphunk FAQ in 1994 when he described the “[s]cenario for a ban on encryption” as likely to be motivated by law enforcement’s concern about the use of the technology by terrorists, drug dealers, pedophiles, and organized crime. See May, Timothy C. (1994-09-10). "§ 10.4.5. Scenario for a Ban on Encryption". Cypherpunk FAQ. Also, in 2019, then-Public Safety Minister Ralph Goodale highlighted both of these issues in calling for the need to embed vulnerabilities in encrypted communications systems. Tamir Israel and Chris Parsons, "Government’s encryption proposal will undermine public safety," Toronto Star, Aug., 28, 2019.
[22] "Don't Panic: Making Progress on the 'Going Dark' Debate," Berkamn Center for Internet & Society at Harvard University at 2.
[23] U.S. Department of Justice. Office of Public Affairs. “International Statement: End-to-End Encryption and Public Safety.” October 11, 2020.
[24] The seminal trade secrets case in Canada—Lac Minerals Ltd. v. International Corona Resources Ltd. (1989)—involved the mining industry.
[25] Canadian Centre for Cyber Security, “Cyber Incidents,” https://cyber.gc.ca/en/cyber-incidents.
[26] Royal Canadian Mounted Police, “The National Cybercrime Coordination Unit (NC3),” https://www.rcmp-grc.gc.ca/en/the-national-cybercrime-coordination-unit-nc3.
[27] Ontario Provincial Police, “Report a Crime,” http://www.opp.ca/index.php?id=132.
[28] US Department of Justice, “Report a Crime,” https://www.justice.gov/actioncenter/report-crime.
[29] National Fraud and CyebrCrime Reporting Centre, “Reporting Fraud and Cyber Crime,” https://www.actionfraud.police.uk/reporting-fraud-and-cyber-crime.
[30] Australian Signals Directorate, “ReportCyber,” https://www.cyber.gov.au/acsc/report.
[31] See Lac Minerals Ltd v International Corona Resources Ltd, [1989] 2 SCR 574, 1989 SCJ No 83. This case imported the test for the breach of confidence from Coco v. A. N. Clark (Engineers) Ltd., [1969] R.P.C. 41 (Ch.), where Megarry J. (as he then was) put it as follows at p. 47: “In my judgment, three elements are normally required if, apart from contract, a case of breach of confidence is to succeed. First, the information itself, in the words of Lord Greene, M.R. in the Saltman case on page 215, must "have the necessary quality of confidence about it." Secondly, that information must have been
imparted in circumstances importing an obligation of confidence. Thirdly, there must be an unauthorized use of that information to the detriment of the party communicating it.” See also TRIPS, art. 39, 2(c) [“so long as such information … has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret”]; USMCA, art. 20.72(b) states that “trade secret” “means.
[32] Criminal Code, RSC 1985, c C-46, s. 391(5)(c).
[33] Security of Information Act, RSC 1985, c O-5, s. 19(4)(d). The act was amended through Anti-terrorism Act, SC 2001, c 41.
[34] Canadian Intellectual Property Office, “How do you keep trade secrets secret?” Dec. 1, 2015.
[35] United States Patent and Trademark Office, “Trade Secrets Protection in the U.S.”
[36] Appendix H. U.S. Department of Justice, "Prosecuting Intellectual Property Crimes," 4th Ed. 461.
[37] U.S. Department of Justice. Reporting Intellectual Property Crime: A Guide for Victims of Copyright, Infringement, Trademark Counterfeiting, and Trade Secret Theft. 3rd Ed. 22.
[38] See Cybersecurity & Infrastructure Security Agency, “Security Tip (ST04-019): Understanding Encryption,” https://us-
[39] For example, see New Hampshire State Bar Association, Ethics Committee Advisory Opinion #2012-13/4; Arizona State Bar Association, Ethics Opinions 09-04; California State Bar Association, Formal Opinion No 2010-179; Florida State Bar Association, Opinion 1203; Iowa State Bar Association, Ethics Opinion 11-01.
[40] Canadian Centre for Cyber Security. Baseline Cyber Security Controls for Small and Medium Organizations, s. 3.7.
[41] See ConFold Pac., Inc. v. Polaris Indus., 433 F.3d 952, 959 (7th Cir. 2006) (Posner, J.) (citations omitted). [“A trade secret is really just a piece of information (such as a customer list, or a method of production, or a secret formula for a soft drink) that the holder tries to keep secret by executing confidentiality agreements with employees and others and by hiding the information from outsiders by means of fences, safes, encryption, and other means of concealment, so that the only way the secret can be unmasked is by a breach of contract or a tort.”]
[42] Katyal, Sonia, The Paradox of Source Code Secrecy (June 25, 2019), 104 Cornell Law Review at 1189.
[43] Id. at 1191.
[44] This is especially true as entities from start-ups to Fortune 500 companies to governments make use of the communications technologies such as Zoom and iMessage and Slack and Signal to facilitate their communications. The author of this comment observed during two years as an employment attorney in Silicon Valley executive members of several Fortune 500 companies, make recourse to such communications technologies as they conducted, shared, and disseminated and discussed trade secrets.
[45] The golden standard of protection has long been seen as involving filing and registering in the United States, Europe, and Japan.
[46] Malone, Matt (2020), Criminal Enforcement of Trade Secret Theft: Strategic Considerations for Canadian SMEs. Technology Innovation Management Review, 10(11): 40-46.
[47] See 18 U.S. Code § 1831.
[48] See also “Prosecuting Intellectual Property Crimes.” Office of Legal Education for United States Attorneys. Department of Justice. Retrieved online on October 27, 2020 at <https://www.justice.gov/sites/default/files/criminalccips/legacy/2015/03/26/prosecuting_ip_crimes_manual_2013.pdf> at 2.
[49] Lauren Rayner Davis, "Secrecy for the Sake of It: The Defend Trade Secrets Act" (2017) 83:1 Brook L Rev 359.
[50] U.S. Congress, Defend Trade Secrets Act of 2016; Congressional Record Vol. 162, No. 65 (House of Representatives - April 27, 2016)
[51] For example, see Rep. Collins noting that “[t]rade secrets theft jeopardizes our economic security and threatens jobs.” U.S. Congress, Defend Trade
Secrets Act of 2016; Congressional Record Vol. 162, No. 65 (House of Representatives - April 27, 2016).
[52] U.S. Department of Justice, Computer Crime and Intellectual Property Section, https://www.justice.gov/criminal-ccips.
[53] Schneier, Bruce, "Beyond Fear: Thinking Sensibly about Security in an Uncertain World," Springer at 13.
[54] David Vigneault, “Remarks by Director David Vigneault at the Economic Club of Canada,” Dec. 4, 2018.
[55] Schneier, Bruce, “It’s Time to Break Up the NSA,” CNN, Feb. 20, 2014.
[56] Schneier, Bruce, "Beyond Fear: Thinking Sensibly about Security in an Uncertain World," Springer at 5.
[57] Baker, Jim, “Rethinking Encryption,” Lawfare, Oct. 22, 2019.
[58] Id. In his view, without cyber-security, there simply is no security—words that have been noted by Chinese President Xi Jinping himself. “[W]ithout cybersecurity, there is no national security.” See Creemers, Roger, Paul Triolo, and Graham Webster, “Translation: Xi Jinping’s April 20 Speech at the National Cybersecurity and Informatization Work Conference,” Bloomberg News, April 30, 2018.
[59] Krebs on Security, “Sealed U.S. Court Records Exposed in SolarWinds Breach,” Krebs on Security.
[60] Bomey, Nathan and Kevin Johnson, “What you need to know about the FireEye hack: Cybersecurity attack against US government,” USA Today, Dec. 18, 2020.
[61] See Aiello, Rachel, “'Vulnerability' led to Canadians' data being accessed in series of cyberattacks,” CTV News, Aug. 17, 2020 and Bureau, Brigitte,Catherine Cullen, and Kristen Everson, “Hackers only needed a phone number to track this MP's cellphone,” CBC News, Nov. 24, 2017.
