RATs, TRAPs, and Trade Secrets

INTRODUCTIONTrade secrets are arguably more important to companies now than ever before in our history. In fact, since the most recent revisions to our patent laws, many believe that trade secrets might be even more important than patents.1 Accordingly, the theftof trade secrets or trade secret misappropriation from company employees and from outsiders, such as competitors and foreign gov-ernments, is on the rise. Facilitating that ascent is technology. We live in a world where the most sensitive proprietary information can be carried on a mobile device in one's pocket or stored without a device "in the cloud." 2 Alt-hough technology has made it easy to store vast amounts of data constituting trade secret information electronically, the Internet and the rise of cyber intru-sions into computer systems and networks have created a stormperfectly ripe for corporate espionage and trade secret misappropriation.3 ThisArticle refers to that type of activity as cyber misappropriation.Corporate espionage, particularly from foreign countries, is a significant problem for U.S. companies, with some even characterizing it as a war. But the true extent of the problem is unclear. Although some believe it is on the scale of warfare, others are more skeptical.4 Because the figures are difficult to veri-fy, they might be exaggerated.5 The rhetoric may also be hyperbolic. Neverthe-less, we know that corporate espionage and the theftof trade secrets from American companies is a problem and will continue to be one. The list of companies that have been affected by trade secret misappropriation, either in-ternally from employees or externally from hackers, is striking.6 Given the in-tangible nature in which trade secrets exist today, it comes as no surprise that these digital threats are so pervasive.7What makes the problem so urgent, elusive, and significant is that we do not appear to have any effective judicial or legislative tools with which to ad-dress it.8 Rather, it presents peculiar challenges for which our existing legal and regulatory framework is not well suited. Although trade secret misappro-priation occurring within the United States and involving known offenders, such as employees, can be redressed in civil litigation, the same is not true for cyber misappropriation that originates abroad. 9 Of particular concern, and the focus of this Article, are the types of cases that involve unknown or anony-mous offenders, who may or may not be in the United States, and who steal trade secrets through hacking or other breaches of cybersecurity that involve remote access tools ("RATs"). A RAT can remotely control a victim's comput-er and access their files.10 Accessing targets remotely without needing to be on the same premises has opened up the world of potential perpetrators and sets up an unwieldy cat and mouse game.The challenges in this area demonstrate how advances in technology have far outpaced the law. Indeed, it may always be that the law will never be suffi-ciently nimble to adapt to and keep pace with the cyber world. Effectively ad-dressing cyber misappropriation requires a holistic approach that must involve self-help on the part of trade secret holders. Reliance on the government, law enforcement, criminal laws, and other legal and judicial remedies have not been successful, and it is unlikely that, standing alone, they ever will be.The Article begins in Part I by briefly framing the foreign economic espi-onage problem.11 Part II reviews the current legislative remedies available un-der both the Economic Espionage Act and the Computer Fraud and Abuse Act for addressing cyber misappropriation, and explains why the technological landscape makes them ineffective.12 Part III then discusses the war rhetoric that often surrounds cyberattacks and the forces that threaten to make this nar-rative counterproductive.13 In Part IV, the Article critically explores an ap-proach focused more on self-help and self-defense, integrating both technolog-ical and human considerations. …