Cyber-Espionage and Trade Agreements: An Ill-Fitting and Dangerous Combination

Print Friendly, PDF & Email

EFF.orgYesterday’s (Oct. 16, 2014) leak of a May 2014 draft of the Trans-Pacif­ic Part­ner­ship (TPP) agree­ment revealed the addi­tion of new text crim­i­nal­iz­ing the mis­use of trade secrets through “com­put­er sys­tems”, as men­tioned in our pre­vi­ous post about the leak. This is a sig­nif­i­cant rev­e­la­tion, because we also know that trade secrets are planned for inclu­sion in the EU-US free trade agree­ment, TTIP (the Trans-Atlantic Trade and Invest­ment Part­ner­ship). The rev­e­la­tion of the pro­posed text in the TPP pro­vides a good indi­ca­tion that the same kind of lan­guage will like­ly also appear in TTIP. Fright­en­ing­ly, this text con­tains no pro­tec­tions to safe­guard the pub­lic inter­est.

Today we delve into this pro­vi­sion and its back­ground in more depth.

Why Trade Secrets, and Why Now?

The US Trade Representative’s sud­den inter­est in trade secret pro­tec­tion aris­es large­ly from reports of wide­spread cyber-espi­onage against US com­pa­nies ema­nat­ing from Chi­na. This has also led to domes­tic pro­pos­als such as this year’s Defend Trade Secrets Act, intro­duced in the Sen­ate in April, and its com­pan­ion House bill, the Trade Secrets Pro­tec­tion Act, which would cre­ate a new fed­er­al pri­vate right of action for trade secret theft.

In August this year, 31 law pro­fes­sors wrote a joint let­ter oppos­ing these bills on a num­ber of grounds, includ­ing that they are unbal­anced, risk­ing that they could be used for anti-com­pet­i­tive pur­pos­es, and that they have poten­tial ancil­lary neg­a­tive impacts on access to infor­ma­tion. The pro­fes­sors write:

Label­ing infor­ma­tion as a trade secret has become a com­mon way to pre­vent pub­lic and even reg­u­la­to­ry access to impor­tant infor­ma­tion rang­ing from the com­po­si­tion of hydraulic frac­tur­ing flu­ids to the code inside of vot­ing machines, all of which have com­pelling (but not uncon­tro­ver­sial) rea­sons for pub­lic access in a democ­ra­cy.

Even if these new US bills pass, their enforce­abil­i­ty against for­eign­ers will be, in prac­ti­cal terms, rather lim­it­ed. The intro­duc­tion of new lan­guage on trade secrets into both TTP and TTIP—which may become the Unit­ed States’ two largest trade agreements—is there­fore a par­al­lel tac­tic to address cyber-espi­onage on the glob­al stage.

(Obser­vant read­ers might have spot­ted an appar­ent flaw in this plan, giv­en that Chi­na will not be a par­ty to either of these agree­ments. But the rea­son­ing is that if enough oth­er coun­tries agree on new glob­al stan­dards, diplo­mat­ic pres­sure can be applied on Chi­na to also com­ply. As the Euro­peans have put it, “The EU and the US also have a com­mon inter­est in pur­su­ing pro­tec­tion of trade secrets against mis­ap­pro­pri­a­tion in third coun­tries”.)

Para­graph 1—Trade Secrets

The lan­guage in the TPP, how­ev­er, doesn’t much resem­ble either of the cur­rent Con­gres­sion­al bills. This is because if the TPP is agreed, it will cre­ate an oblig­a­tion on the US to ensure that it accords with domes­tic law, and the US Trade Rep­re­sen­ta­tive is unable to guar­an­tee that the bills cur­rent­ly in Con­gress will pass. Instead, the first para­graph is drawn from TRIPS, the mul­ti­lat­er­al treaty that sets a glob­al min­i­mum stan­dard for so-called intel­lec­tu­al prop­er­ty pro­tec­tion, and the sec­ond and third para­graphs are brand new, but share lin­eage with both the Eco­nom­ic Espi­onage Act and the Com­put­er Fraud and Abuse Act (CFAA).

This is where things get complicated—because the legal the­o­ries, meth­ods and objec­tives of those two sources are actu­al­ly quite dif­fer­ent.

So begin­ning with para­graph 1: it very close­ly mir­rors the lan­guage that TRIPS mem­bers (includ­ing all the TPP nego­ti­at­ing coun­tries) have already agreed. It requires them to offer the means to pre­vent trade secrets from being dis­closed to, acquired by, or used by oth­ers with­out con­sent in a man­ner con­trary to hon­est com­mer­cial prac­tices. This gen­er­al­ly, as in the US, involves a pri­vate cause of action to be lit­i­gat­ed in a civ­il court.

Para­graphs 2 and 3—Computer Espi­onage
Next, let’s turn to para­graphs 2 and 3, which are worth set­ting out in full:

2. Each Par­ty shall pro­vide for crim­i­nal [VN pro­pose: or admin­is­tra­tive] pro­ce­dures and penal­ties for one or more of the fol­low­ing:
    A. the unau­tho­rized, will­ful access to a trade secret held in a com­put­er sys­tem;
    B. the unau­tho­rized, will­ful mis­ap­pro­pri­a­tion of a trade secret, includ­ing by means of a com­put­er sys­tem; or
    C. the fraud­u­lent {or unau­tho­rized} dis­clo­sure of a trade secret, includ­ing by means of a com­put­er sys­tem.

3. A Par­ty may, where appro­pri­ate, lim­it the avail­abil­i­ty of such crim­i­nal pro­ce­dures or lim­it the lev­el of penal­ties avail­able in respect of the afore­men­tioned activ­i­ty to one or more of the fol­low­ing con­di­tions:
    A. for pur­pos­es of com­mer­cial advan­tage or finan­cial gain;
    B. relat­ed to a prod­uct or ser­vice in nation­al or inter­na­tion­al com­merce;
    C. intend­ed to injure the own­er of such trade secret;
    D. direct­ed by or for the ben­e­fit of or in asso­ci­a­tion with a for­eign eco­nom­ic enti­ty; or
    E. detri­men­tal to a Party’s eco­nom­ic inter­ests, inter­na­tion­al rela­tions, or nation­al defense or nation­al secu­ri­ty.

These pro­vi­sions are quite dif­fer­ent from the first, because they make trade secret mis­ap­pro­pri­a­tion a crim­i­nal offence. As not­ed above, these pro­vi­sions part­ly draw on the US Eco­nom­ic Espi­onage Act. But they go con­sid­er­ably fur­ther, in that the offense is not required to be lim­it­ed to cas­es where the own­er is harmed and where some­one else ben­e­fits from the trade secret mis­ap­pro­pri­a­tion, both of which are con­di­tions of the offense under cur­rent US law.

They also add a new offense of unau­tho­rized, will­ful access to a trade secret held in a com­put­er sys­tem, regard­less of whether the trade secret is copied or dis­closed. This pro­vi­sion has more in com­mon with the CFAA which crim­i­nal­izes any­one who “inten­tion­al­ly access­es a com­put­er with­out authorization…and there­by obtains…information from any pro­tect­ed computer”—one of the pro­vi­sions under which Aaron Swartz was charged.

So in sum, these pro­vi­sions go fur­ther than cur­rent US law, poten­tial­ly crim­i­nal­iz­ing any­one who gains access to secret infor­ma­tion of com­mer­cial val­ue. There are no safe­guards to pro­tect inves­tiga­tive jour­nal­ists, secu­ri­ty researchers or whistle­blow­ers, who may obtain access to infor­ma­tion with­out crim­i­nal or com­mer­cial intent. The inevitable result will be to chill the speech of those who might oth­er­wise have a valid pub­lic inter­est jus­ti­fi­ca­tion for releas­ing infor­ma­tion that had been kept secret.

The TPP and TTIP are, sup­pos­ed­ly, free trade agree­ments; they are not the Cyber­crime Con­ven­tion. If this text were accept­ed, it would be the first time that a trade agree­ment would be used to crim­i­nal­ize those who obtain access to secret infor­ma­tion held online, regard­less of their moti­va­tion and with­out any pub­lic inter­est defens­es. Like the rest of the IP chapter—but if any­thing, even more so—this goes far beyond the appro­pri­ate scope for an agree­ment that is being nego­ti­at­ed behind closed doors and away from pub­lic over­sight.

We don’t know for sure that these para­graphs are includ­ed in the cur­rent TPP text, as the leaked text is sev­er­al months old. It also con­tains the dis­claimer, “Par­ties are still reflect­ing on the new for­mu­la­tion for para­graphs 2 and 3.” As such a spokesper­son for the US Trade Rep­re­sen­ta­tive has had the gall yes­ter­day to “strong­ly cau­tion any­one from draw­ing pre­ma­ture con­clu­sions of any kind based on sup­posed leaked text from unsub­stan­ti­at­ed, unnamed sources”, as if we had any more offi­cial source of infor­ma­tion on which to draw.

All we can say is that we had all bet­ter hope that these pro­vi­sions don’t make it into the final agree­ment, because they are amongst the most atro­cious, over­reach­ing and human-rights infring­ing pro­vi­sions in the entire text of the TPP.