The prevailing wisdom is that federal agencies cannot generally disclose trade secrets and confidential information given to them in confidence by companies that they regulate or work with. Indeed, the Trade Secrets Act (18 U.S.C. § 1905), passed in 1948, seems on its face to make it a crime for federal government personnel to do so.
However, in a highly provocative, but ultimately compelling article, "Publicizing Corporate Secrets," forthcoming in the University of Pennsylvania Law Review, Christopher Morten of Columbia Law School argues that federal agencies have much more power to publicly disclose trade secrets than is commonly believed. Morten argues that the scope of agencies' power to disclose is defined by their enabling statutes and that, with many important exceptions, several of these enabling statutes do not, at a legislative level, prohibit disclosure of trade secrets or confidential information. Some agencies may have regulations on the books preventing disclosure of trade secrets, but he suggests that they could in some cases change those regulations without additional authorization from Congress, and that there would be far fewer negative consequences for them than we might think if they did so.
On a very hot day in July, I interviewed Morten about the details of his argument. The interview took place in the air-conditioned NYU Engelberg Center. Many thanks to Katrina Southerland and Mike Weinberg for arranging a space for us. This was a fascinating, lengthy discussion, which I have excerpted below.
CAH: I take your basic thesis to be that federal agencies have more power to disclose trade secrets than is commonly believed. How did you come to write this paper?
CM: I was working with the activist organizations on vaccine access in the global South, and we confronted this difficult question: Do we want to leave legal and actual control of COVID vaccine manufacturing entirely in the hands of a small handful of drug companies based in the United States and Europe, or do we want more government institutions and manufacturers around the world to be able to make and distribute vaccines? If we want the latter scenario, then one key question is how do we get the requisite knowledge into their hands? That led me to the realization that, due to Operation Warp Speed, the U.S. government holds significant information about how to make Covid vaccines but that it keeps this information secret. Public Citizen has shown that because of the government’s exceptionally close collaboration with Moderna, it almost certainly has detailed information on Moderna’s commercial-scale-manufacturing process for mRNA-1273, the vaccine that Moderna and the National Institutes of Health co-invented. That in turn led me to the question of whether it would be legal to take such information, collected from private companies or developed in public-partnerships, and share it with the World Health Organization or other organizations? The fact I could not find a straightforward answer to that legal question led me to this paper.
CAH: Can you give an example of where an agency or the public might want the agency to disclose trade secrets?
CM: For the vaccine example, the main agency I was looking at is the Department of Health and Human Services (HHS). Many activist groups and civil society organizations argued that HHS had good reason to share with the World Health Organization all the COVID vaccine manufacturing information it had in its possession, even if that information included trade secrets (or alleged trade secrets). I agreed, and in 2021 I co-wrote a number of pieces advocating that HHS and the White House explore every legal pathway at their disposal.
Another good example is the Federal Aviation Administration (FAA). To my knowledge, as of today, Boeing and the FAA both have details about defects in software used in Boeing's 737 Max airplanes that contributed to the crashes of two 737 Max airplanes that killed hundreds of people. Numerous consumer groups and airline industry workers’ organizations have that tried to get some of this information. One, Flyers Rights, filed Freedom of Information Act (FOIA) requests and battled unsuccessfully with the FAA, arguing it had a legal right to see documentation of Boeing’s software. Journalists have asked the FAA for some of this information directly. And none of these interested stakeholders have been able to get this information. The FAA's position has been that the details of Boeing’s software include trade secrets that the agency cannot legally disclose even if it wanted to.
Yet another example is the Food and Drug Administration (FDA), which holds all kinds of alleged trade secret and confidential commercial information the safety and efficacy of drugs. The agency does disclose important fractions of this information, but not all. Many nonprofits and academics have clamored for them to disclose more, including Amy Kapczynski and me in a paper that came out last year. But the FDA has consistently said for decades now that it does not have authority to disclose this data because it can’t legally disclose any trade secrets or confidential commercial information. One last FDA example—in early 2020, FDA announced, somewhat mysteriously, that a COVID drug was in shortage, but it couldn’t disclose the name of the drug or its manufacturer(s) because it is confidential commercial information, and confidential commercial information is simply undisclosable as a matter of law. This even though the shortage made the New York Times and other major papers and was a topic of intense public interest.
CAH: You argue that sometimes the FDA does not have that authority, but sometimes it does... And this for me was the core insight of your paper: Agencies' authority to disclose trade secrets is not governed by norms, it's not even ultimately the regulations that matter; it's the agencies' enabling statutes passed by Congress that dictate their power to disclose trade secrets they collect.
Obviously statutory interpretation isn't always clear-cut. People can reach different conclusions. With that in mind, can you cite examples of enabling statutes that you think would allow agencies to disclose trade secrets, and then examples of enabling statute that you think would not allow disclosures of trade secrets? I would like to post the full text of some of these in the post so readers can see the statutes and make their own interpretations.
CM: Yes. I will send you a few examples. [In a follow-up blog post, I provide Chris' citations of statutory provisions with links, along with our rather lengthy post-interview exchange about the text of some of these enabling statutes.]
CAH: I was primed to dismiss your argument because of the Trade Secrets Act in Title 18, Section 1905. It is commonly said that this law makes it illegal for federal employees to disclose companies' trade secrets that the government has in its possession. It says:
"Whoever, being an officer or employee of the United States or of any department or agency ...publishes, divulges, discloses, or makes known in any manner or to any extent not authorized by law any information coming to him in the course of his employment or official duties ... which information concerns or relates to the trade secrets [etc...] confidential statistical data...[etc...] of any person, firm, partnership, corporation, or association....except as provided by law; shall be fined under this title, or imprisoned not more than one year, or both; and shall be removed from office or employment."
18 U.S.C. § 1905 (passed in 1948).
Can you talk about why, in your interpretation, that language does not necessarily imprison any government official who discloses trade secrets?
CM: So, to be clear, my interpretation of Section 1905 is not revolutionary. Others before me have also said that the Trade Secrets Act is not the blanket prohibition on trade secret disclosure that many, or most, people seem to think it is. Two of the important scholars before me are Bernard Bell and Matt Herder.
How I personally came to the conclusion that the Trade Secrets Act permits some disclosure of trade secrets by federal agencies is through my clinical work. Since 2018, I’ve been working with clinic students to litigate and advocate on behalf of clients for broader access to clinical trial data. In the course of this work I encountered Section 1905 in the following way.
There was, and still is, a federal law on the books enacted in 2007 called the Food and Drug Administration Amendments Act that mandates that important information from the majority of significant clinical trials run in the United States be published on the National Institute of Health (NIH) website. When NIH got around to promulgating a rule implementing the statute, it basically said "we are going to demand that drug and device manufacturers submit certain information to us about their products and how they test them, including the assays and other methods they use in their clinical research, and we are going to publish it on our website." The companies then responded, "but that will break our trade secrets and must be illegal." NIH replied, "we hear you, but we don't think this information is truly a trade secret, and in the alternative we are legally authorized to collect and disseminate this information under the law. We don't think the law is a barrier."
So here was NIH telling the drug and medical device industries "we think we have authority to break your trade secrets because Congress authorized it in the 2007 Act." This cast me back to the agency and admin law literature, where I found that a handful of other agencies that read Section 1905 the way NIH does, and I do. Which is this: Section 1905 clearly prohibits and criminalizes careless or malicious disclosure of trade secret information by government employees, but if the disclosure is authorized under law—e.g., pursuant to an agency rule which is turn within the agency's authority under its enabling statute—then Section1905 does not create a bar to disclosure.
CAH: Fascinating. It seems obvious in hindsight, when one reads the text. It does seem to limit an illegal disclosure to those "not authorized by law..." and it does say explicitly "except as provided by law..." But I had not personally put those pieces together. I see this interpretation in theory. But of course, in practice, there are a lot of regulations already on the books that would make any disclosure unauthorized, right? So if agencies have regulations already preventing disclosure of trade secrets, regardless of what their enabling statutes allow, what happens? If one of those agencies discloses trade secrets without authority under their own regs, what is the consequence?
CM: Under that scenario, my view of the law is that disclosure of the trade secret would indeed be unauthorized and thus illegal. Along with Section 1905, which we just talked about, a disclosure without authority would also be a classic Administrative Procedure Act (APA) violation. Agency action in violation of law can be enjoined, and that includes the agency's own regs.
CAH: What's the remedy for an APA violation? Wrist slap?
CM: I believe it's injunctive, not monetary.
CAH: So more, "oops, sorry, take it down" than a real penalty? But often the secret would be out of the bag. So the company would want to stop the disclosure before it occurs, ideally...
CM: Yes, one context where that comes up is the "reverse FOIA" case, where a company brings a court action to prevent an agency from disclosing trade secrets or confidential information in response to a Freedom of information Act request. Although, if you’ll take a bit of detour with me, in my view all of what are called "reverse FOIA" cases are in fact brought under the Administrative Procedure Act (APA) and should be thought of as a simple subset of APA litigations, where the challenged agency action involves potential disclosure of allegedly protected information to a FOIA requester. In all “reverse FOIA” cases, the plaintiffs are really just seeking to stop a disclosure that would be a violation of the APA. Courts sometimes confuse this and apply FOIA case law rather than APA, but really these are APA cases at heart.
CAH: You predicted my next question: FOIA. We have been talking mostly about situations where agencies themselves are making these disclosures. But the pressure to disclose seems more likely to come from outside activists, media, or basically anyone. The Freedom of Information Act allows individuals and organizations to access information collected by federal government agencies. The statute says that each agency "shall make available to the public information as follows..." But then Exemption 4 provides that the agency does not have to allow public access to "trade secrets and commercial or financial information obtained from a person [that is] privileged or confidential." 5 U.S.C. § 552(b)(4). The Supreme Court held recently in Food Marketing Institute v. Argus Leader Media (2019) that this "commercial or financial information" exemption is quite broad with respect to information given to the government in confidence. So wouldn't Exemption 4 mean an agency can always decline to disclose in a FOIA request so long as information was given to the agency in confidence?
CM: FOIA exemption 4 authorizes the agency to withhold in some circumstances. But it creates discretion to withhold, not a mandate. FOIA itself never says the agency must withhold. Also, even assuming an agency wants to withhold under Exemption 4, this exemption applies narrowly to information that truly qualifies as a trade secret or that was among other things disclosed to the agency in confidence.
CAH: Ok, so let's talk about the Takings Clause. If any federal agency discloses trade secrets, would this be a "taking" of "property" under the Fifth Amendment requiring just compensation? Isn't that what the Supreme Court implied in Ruckelhaus v. Monsanto (1984), where the issue was whether an agency could, pursuant to explicit statutory authority from Congress, disclose trade secrets belonging to Monsanto? That can still be a taking, even though Congress may have authorized it...? If so, how would "just compensation" be calculated and awarded for trade secrets?
CM: I’ll start by saying that I think, from first principles of constitutional law, trade secrets have a suspect claim to protection under the Takings Clause. I just don’t think they should qualify as “property” for purposes of the Takings Clause. Other protections, such as the Due Process Clause, may apply, but not the Takings Clause. I don’t think this should be a radical view. For example, the Federal Circuit just reaffirmed in 2020 that there’s no taking when the government uses a patent without the patent holder’s permission, and the origins of patents are arguably more “property-like” than trade secrets. Of course, in 1984, the Supreme Court decided Monsanto v. Ruckelshaus and concluded that trade secrets are property for purposes of the Takings Clause. But, in my view, the Court sort of skimmed over that part of the analysis, and the Environmental Protection Agency (EPA) had just conceded that Monsanto's trade secrets were property under the Takings Clause and attempted to fend off liability on other grounds. So I think the Court’s analysis was incomplete, and the fundamental question still begs deeper analysis. If I were a bolder theorist of con law I might argue that trade secrets are not eligible property under the Takings Clause.
But anyway, I accept Monsanto good law, and so I begin from the premise that trade secrets are indeed “property” eligible for protection under the Takings Clause. But I read Monsanto carefully, and, I think, faithfully. To echo Pam Samuelson, Monsanto is simply not the victory for strong trade secret law that some people think it is—especially trade secret holders’ lawyers. In the actual decision, the Court held the EPA committed a taking only insofar as it disclosed trade secret information that it had told the source that it would keep secret. For a taking to occur, there has to have been an assurance of secrecy from the government. As to certain trade secrets at issue in Monsanto, EPA had not made that promise, and the Court concluded that EPA committed no taking by disclosing those secrets. The takeaway from Monsanto is this: If there's assurance of secrecy when an agency collects the information, then that assurance forms the foundation of a taking if the agency breaks the promise. But if an agency collects information without making such a promise, then there is no taking. So I argue that certain trade secret collection and disclosure is simply not a taking if the agency makes sure not to promise secrecy when it obtains and holds the information in question.
What if the agency has assured secrecy? Then the agency can still disclose the information so long as the disclosure is for “public use”; it’s bedrock con law that a taking for public use cannot be enjoined. But the “takee” whose secret has been disclosed can bring a takings claim for compensation. There are indeed some tricky remedies questions in cases where there is a taking. Scholars including Katrina Wyman here at NYU have some ideas on how to measure "just compensation" that are relevant to this. The very condensed version of what I say in the paper is that compensation in takings cases is designed only to make the take whole, not to punish the government or discourage future takings. And as I talk about in the normative part of my paper, there are all sorts of things agencies can do to limit the harms, and economic damages, caused by disclosures of confidential information. This is a good thing, I think, as it aligns the agency’s incentives—avoid harmful competitive use of the protected information!—with the trade secret holder’s. It means the agency has to think about that economic harm before it acts.
CAH: Your interpretation of the takings claim here aligns with the Supreme Court's reading of Exemption 4, I think, in Argus Leader because it's limited to situations where the government makes that promise of confidentiality. It also aligns with the civil trade secret law view. Trade secrets unlike patents are relational right. There is only a trade secret if there were "reasonable measures" in place to protect the information, including obtaining promises of secrecy where appropriate, and there is only "misappropriation" if there was a duty of confidentiality. Whatever you think about the Monsanto opinion, I think most would agree that a trade secret "taking" is just not the same as a taking for a piece of land.
CM: Yes, and let me just add that Elizabeth Rowe has a really interesting paper in which she argues that agencies can gather and then use or disseminate certain information gathered from certain regulated industries, and that the Takings Clause and other sources of law may not always apply, they may not prohibit all of that disclosure. She then considers the important point that some companies will therefore withhold and not share information with agencies, if they think it's not fully protected from later disclosure. Her paper thinks through this, in a realpolitik way, "Ok, well what sorts of assurances should agencies give to protect their relations with regulated industries? How can they place caveats on what they tell companies about secrecy in order to protect their relationships?" So that is a really interesting paper, and while I don’t agree with all of her policy recommendations or the precise balance between secrecy and disclosure she proposes to strike, I think she gets the law exactly right. So all this is to say that my reading of Monsanto is not one I invented—I’m standing on the shoulders of giants.
CAH: Ok, so we have done Section 1905, takings, FOIA... What about civil private actions under state or, more likely, federal trade secret law? Can't a government agency or official be sued for damages or at least an injunction if they disclose trade secrets? Say there's a duty of confidentiality, there's a trade secret, why couldn't the company sue the agency under trade secret law? I know you'll talk about sovereign immunity for damages, but what about injunctions under say the Ex Parte Young doctrine?
CM: I do not believe so, no, there's no other injunctive claim available to the aggrieved trade secret holder. That is, I don’t think there’s any legal way to seek an injunction against disclosure of a trade secret or other protected information except through the APA and the Takings Clause, which we’ve already discussed.
By the way, there’s a terrific recent student note from a Columbia Law student, Alexandra Nickerson, that considers the limited, ex-Parte-Young-esque contexts in which plaintiffs can seek injunctions against government action outside the APA, and I think it’s clear that none of those apply to disclosure of trade secrets. And I’ve never seen such a claim, in my survey of the case law.
As to damages, we’ve talked about how trade secret holders might be able to claim damages under the Takings Clause, if (only if) the agency has made a promise of secrecy. What about under trade secret law itself? In my view, there’s no simple trade secret misappropriation case that can be brought against the U.S. government; takings is really where the action is. You might think the Defend Trade Secrets Act exposes the government to liability, but there is simply no waiver of sovereign immunity in the DTSA. That statute does not give private actors the ability to bring a trade secret misappropriation claim against the U.S. government. There are a couple interesting separate instances in which trade secret holders have brought cases against the U.S. government under the Federal Tort Claims Act (FTCA), on the theory that the government has, under the FTCA, waived its sovereign immunity to a range of tort claims cognizable at state law. Two courts have permitted FTCA claims to proceed on the theory that the federal government has violated state trade secrets law, though I haven’t found an instance where the trade secret holder actually won on the merits and got paid any damages. This is, I hope, the last bit of doctrinal research I need to complete to finish this work-in-progress paper. But, in any event, the FTCA is only ever going to permit a trade secret holder to claim damages after disclosure occurs, not prevent disclosure, and I think the damages analysis will dovetail what we discussed in the takings context—compensation should simply make the company whole, not punish the government for deciding to disclose the secret.
One more thought—There are interesting differences between, on one hand, copyrights and patents and, on the other, trade secrets, in the extent of the U.S. government’s waiver of sovereign immunity. For copyrights and patents, Congress enacted Section 1498, a blanket waiver of sovereign immunity that guarantees rights holders an opportunity to seek "reasonable and entire" compensation in the Federal Court of Claims any time the government chooses to use a patented inventions or copyrighted subject matter. We don't have that for trade secrets; for trade secrets, there is no general waiver of sovereign immunity and no specific, Congressionally-created right of action of the trade secret holder to seek damages from the government. Instead, the holder has to do the best it can with the Takings Clause, the APA, and perhaps the FTCA, as we’ve discussed. And as I conclude in the paper, I think the trade secret holder will lose any and all of these challenges if the agency is disclosing a trade secret pursuant to legal authorization under its enabling statute and its own rules, and has made no assurance of secrecy. In other words, I think there are lots of circumstances where agencies can disclose or use private trade secrets and pay no compensation at all. Again, that’s different from patents and copyrights, where the statutory default rule is that the government has to pay for its use.
CAH [added Sep 2, 2022]: I'll also note that the DTSA has provisions indicating there's generally no suing the federal government for "otherwise lawful" activities...
The beginning of Section 1833, the whistleblower provision, says that "This chapter does not prohibit or create a private right of action for— (1) any otherwise lawful activity conducted by a governmental entity of the United States, a State, or a political subdivision of a State..." 18 U.S.C. § 1833 (a)(1).
Section 1838 states that the DTSA states it cannot be used to prevent the "otherwise lawful disclosure of information" by government employees under FOIA. So this may imply that the DTSA cannot be used in this context at all, assuming the disclosure is "lawful" for all the reasons we talked about. TBD, of course... The DTSA § 1838 provides that—except with respect to a new provision creating immunity for whistleblowers— “this chapter shall not be construed to preempt or displace any other remedies, whether civil or criminal, provided by United States Federal, State, commonwealth, possession, or territory law for the misappropriation of a trade secret, or to affect the otherwise lawful disclosure of information by any Government employee under section 552 of title 5 (commonly known as the Freedom of Information Act." 18 U.S.C. § 1838 (2016) (emphasis added).
CAH: So, we've gone through all of the hurdles: Section 1905, the APA, Exemption 4, the Takings Clause, and DTSA. This world is still hypothetical. But I think you have convinced me there could be more disclosure of government-held trade secrets than we have now if government wanted to do so. In summary, federal agencies can disclose trade secrets and confidential information if they want to, so long as it is in their statutory authority to do so, so long as they write their regulations appropriately, and so as long as they deal with companies on a transparent basis in which they are upfront about their policies and don't make assurances of secrecy.
Anything else you want to say?
CM: Two things. First is another example of an agency that I think has interesting, little-used authority to "break" trade secrets is the HHS Office for Civil Rights (OCR). OCR is an investigative agency that, among other things, is the country’s primary federal enforcer of HIPAA. Based on my reading of the enabling statute and regs on the books, I think there is a strong argument that OCR and HHS more broadly has authority to re-write regs and policies in ways that allow OCR to gather and disclose information on how health systems and their tech company “business associates” are processing and exploiting sensitive medical data, even if those health systems and (especially) tech companies assert trade secrets in the information. HHS OCR may be just one of the federal agencies and offices that have broader information-gathering and information-disseminating powers than we typically talk about. Second, I want to be clear that I think agencies’ trade secret “breaking” authority should be used carefully! For most agencies, it should be used in only a small handful of cases. I am not trying to throw a big bombshell into how agencies do things.
CAH: This is not a .gov Wikileaks.
CM: Right. Right now, I think it's a small set of situations where the public needs to know and where the agency and people requesting the information can handle the information responsibility. This will not mean widespread disclosure of every trade secret under the sun. I dedicate a whole Part of the paper—Part II—to thinking through how agencies could share trade secret information responsibly, with journalists, noncommercial researchers, and so on, in ways that protect the information from commercial use by competitors. In short, I propose agencies undertake carefully controlled sharing of trade secrets to select information users—what I deem “information publicity”—rather than blunt, unconditional disclosure to the world. “Information publicity” gives the paper its title. This Part of the paper builds on privacy law scholarship, especially the work of folks like Helen Nissenbaum and Daniel Solove, and my bridge to the privacy literature in turn depended on the work of Sharon Sandeen, Pamela Samuelson, and others who’ve noted the deep theoretical and doctrinal links between privacy law and trade secret law. To adapt Nissenbaum, Part II basically proposes “contextual integrity for trade secrets.” More standing on the shoulders of giants.
CAH: I forgot to mention expiration. A lot of information only has value for a certain amount of time. This makes me more amenable to your proposal. As a practical matter, a lot of trade secrets and confidential information "sunsets." Some of it seems more like it belongs in a museum than in a vault.
CM: Agreed, as you and Mark Lemley have shown. There is a period of time for this information. Not all of it needs to be secret forever.
CAH: Thank you, I will be in touch about the enabling statutes.
No comments:
Post a Comment