Intellectual Property

Intellectual property (IP) can take many forms, as we have discussed throughout the book. Determining where your IP ends up and how it got there requires a diverse toolset for monitoring and reporting. You have to monitor sites that can host your information, such as LinkedIn, but you also have to monitor news articles, video stories, and offline press items, in addition to the typical social media monitoring. For all the mentions from news articles, you can utilize paid services such as CyberAlert.com, Meltwater.com, Newsnow.co.uk, and Cision.com. To make it useful, you need daily alerts and specific searches on topics of interest to your company.

Laws in the United States that could arguably apply to social media searches and monitoring include:

The Federal Electronic Communications Privacy Act Concerned with the sharing of personal data without permission

The National Labor Relations Act Employers are prohibited from interfering with an employee’s rights to organize for collective bargaining purposes or to engage in protected concerted activities.

Anti-Cyber Squatting Protection Act A trademark owner may bring a cause of action against a domain name registrant who (1) has a bad faith intent to profit from the mark and (2) registers, traffics in, or uses a domain name that is (a) identical or confusingly similar to a distinctive mark, (b) identical or confusingly similar to or dilutive of a famous mark.

The Digital Millennium Copyright Act Deals with copyright infringement.

ICANN’s Uniform Domain Dispute Resolution Policy International dispute resolution procedure that enables trademark holders to challenge trademark infringement.

State statutes Many states outlaw adverse employment action for engaging in off-work activities.

IP theft usually falls into three categories: first, when it is used to form a new competing business; second, when an employee takes the IP to a new company to get a better position and give the new company a competitive advantage; and third, when a competitor or third party looking to sell the information engages in corporate espionage. Once you have your tools in place, you will need to implement an incident response program in case you find information that is damaging. If you come across a third-party hosted site that you have no control over, removing a post that contains your IP may prove to be difficult. If the incident is one where your employee is disclosing confidential information, saying inappropriate things about your product or service or company, or engaging in similarly unacceptable behavior, you have a better shot of managing the incident and reducing your exposure. If the attack is someone trying to break into a secured database, you can rely on your perimeter security devices such as firewalls, intrusion detection, and intrusion prevention systems. Your last recourse could be legal action.

Employees should know they are being monitored, and you should set the boundaries that require monitoring. Specific policy violations that may trigger your incidence response process include:

Transmitting or posting any material in violation of any federal or state copyright law without the permission of the copyright owner

Transmitting or posting information that may cause reputation harm to the company or partners or customers

Attempting to “hack” or break into any systems

Conducting unapproved business activities from company premises

Transmitting or posting confidential information that has not been authorized

Intentionally introducing any computer virus, worm, Trojan, or malware that adversely impacts company resources

Representing your company as a third party or misrepresenting a company representative

Prior to taking legal action, you have to follow your incident response program to monitor any further activity, block activity, and report on all actions taken by those stealing your IP. See the “Incident Management” section for details.