The conveniences of cloud computing are many, but so are the dangers of doing business in the cloud. For businesses whose intellectual property is accessible in the cloud, there is the constant threat that that intellectual property will be stolen. There is an increasing belief that the threat of theft is not a nebulous eventuality, but a virtual certainty. And the numbers seem to reflect that: businesses worldwide annually lose hundreds of billions of dollars of revenue, and businesses in the U.S., tens of billions of dollars, through cybercrime and industrial espionage carried out in the cloud. Those estimates do not even attempt to quantify other deleterious effects of intellectual property theft, such as the erosion of the incentive for innovation—a bedrock principle of U.S. intellectual property law.
Some of those losses are attributable to espionage funded by sophisticated foreign interests, but many, like those alleged in Advanced Instructional Systems, Inc., d/b/a WebAssign v. Competentum USA, Ltd., 1:15-cv-858 (M.D. N.C.), are, despite their high-tech instrumentalities, more mundane business torts—attempted usurpations of corporate opportunity by former insiders.
The court’s recent opinion in Advanced Instructional Systems, granting a temporary restraining order enjoining Competentum from deploying a product rivaling its former principal WebAssign’s cornerstone product, highlights some of the risks incurred by any business that puts its intellectual property into the cloud. The case involves claims of computer trespass, copyright infringement, and misappropriation of intellectual property. WebAssign developed and owns a proprietary software platform by that name, consisting of two components—“Parser” and “Grading Statements”—that educational institutions use to remotely assign and grade math and science problems. It took WebAssign many years to develop its Parser and Grading Statements applications. The applications were not capable of easily being reverse engineered. Parser, as the Middle District of North Carolina found in connection with the TRO application, is a trade secret. Grading Statements is copyrighted. And WebAssign tightly guarded the code for the applications, making it accessible to no one outside of a small group of employees and contractors.
Competentum (and its predecessor) was one of those contractors. WebAssign hired Competentum’s predecessor in 2006; work under the contract was completed in 2009. It hired Competentum in early 2012; work was completed by mid-2012. In both projects, Competentum employees had access to WebAssign’s server, but when their work ended, so did their authority to access the server. But that did not stop them from accessing the server.
In 2014, WebAssign noticed that two former Competentum user IDs had been systematically used to access the server. WebAssign deactivated the IDs. Someone continued to access the server: within minutes of their deactivation, five IDs attempted to access the server.
WebAssign confronted Competentum’s CEO, who admitted that Competentum employees had accessed the server, claimed that it was commissioned to do so by Cengage—one of WebAssign’s biggest clients—and promised to explain further later. No explanation came. WebAssign investigated further: online, it found Competentum’s plans to create a rival to WebAssign’s software and launch it in concert with Cengage, and materials linking the suspect user IDs to Competentum’s efforts to create the rival software.
The United States District Court for the Middle District of North Carolina found that these circumstances warranted granting WebAssign’s application for a temporary restraining order, as they showed the immediate irreparable harm WebAssign would suffer, the potential loss of its customer relationships, and the loss of its proprietary information.
While litigation in this matter is ongoing, businesses must heed the warnings that have already emerged from it: redouble your efforts to control access to your computer server and assiduously protect your intellectual property from theft or misappropriation.