L O C K T O N C O M P A N I E S , L L P

Intellectual property is a principal driver of the economy and for many companies an asset of increasing importance. IP-intensive industries support at least 40 million jobs and contribute more than $5 trillion to US Gross Domestic Product (34.8 percent).i

To understand the growing impact of intellectual property, consider that the Bureau of Economic Analysis is revising its criteria for measuring GDP because of a growing recognition that the “product” known as intellectual property has been inadequately measured. Factoring in the work of all the code writers, business process architects and electronic game animators, US economic output is three percent higher than previously thought.

The protection of intellectual property is a growing concern because IP is often the foundation of a company’s commercial advantage. Recently, Coca-Cola was quick to assure the public that its formula for Coke was secure after a Georgia man claimed to have a copy of the secret recipe.

The creation, transmission and commercialization of intellectual property today knows no borders and touches almost every industry. A recent report revealed China had stolen sensitive information from 141 US and Canadian companies through cyber attacks - a charge the Chinese government adamantly denies.ii President Obama recently ordered tougher measures and the US is mobilizing its trading partners in defense against IP theft. These efforts revolve around increased vigilance and include negotiating protections, enforcing agreements and the publication of watch lists.iii However, preventing IP theft is more than a political or trade issue. IP theft hurts business. It can damage a company’s reputation, alarm investors and potentially sink a company. In recent weeks, US federal authorities have turned up the heat. A Louisiana man pleaded guilty to stealing 3,700 copyright protected files from his former employer to hand over to his new employer.iv A San Francisco man was convicted of stealing trade secrets from his old firm to set up his own business.v And in New York, three researchers have been charged with conspiring to forward non-public information about MRI innovations to a Chinese concern.vi

Is intellectual property insurable, and how can companies protect this precious asset?

Ben BeesonPartner

Global Technology & Privacy Practice

+44 (0)20 7933 2857ben.beeson@uk.lockton.com

Intellectual Property Risk - Have you been hacked? Business Insurance Perspectives ArticleIP ProtectionAuthor: Ben Beeson

IP protection is in many ways derivative of cyber liability because digital formats have eclipsed paper as the preferred medium for creation, storage and transmission of sensitive information. Corporate security used to watch closed circuit monitors for suspicious activity on the loading dock. Now, risk managers and CIOs install systems to place data under virtual lock and key. But IP protection isn’t just about data breach as the focus shifts from privacy to security. While leakage of patient or customer data can provoke legal action and trigger consumer animosity, the loss of intellectual property is something else altogether. Leading companies of all sizes are acknowledging that if intellectual property is compromised, revenue projections can be cratered and brands destroyed.

The topic is coming up with greater frequency in the C-suite. Not only is pressure coming from within - as part of enterprise risk management - it’s also coming from the outside as investors demand more information about a company’s data security and the SEC advises publicly traded companies in the US to give more detailed guidance on their data safeguards.

Experts say intellectual property can be compromised or stolen in three ways: from the inside, from the outside or through a combination of both. From the inside: an employee walks out with sensitive information when dismissed from the company. From the outside: a corporate terrorist hacks into a company’s system. Or, an outsider engages an employee to help out. Sandeep Kumar, a director of cyber protection services at Alvarez & Marsal, notes that insiders may be unknowingly helping an insider gain access to intellectual property when their communication device is breached through social media or email.

Says Kumar: “Once the breach has occurred, the hacker can then use it as a launch point to move laterally within the network to find what they want to steal.” vii

As with other emerging risks, the insurance industry is developing ways to protect businesses in the event of intellectual property loss. As always, it starts with placing a value on the asset. It is much more straightforward to compensate a policyholder for the loss of a building or calculate the replacement value of an auto. To determine how much losing control of a trade secret means to the bottom line is a daunting task.

Contrast those unknowns with the relative certainty of third party IP. Over the decades, we’ve seen enough loss experience to underwrite Professional Liability - protecting, for example, a law firm in the event an associate should fail to safeguard a client’s intellectual property. Insurance is designed to cover the

firm’s defense costs. First party IP, however, is largely uncharted territory as underwriters and brokers are now addressing critical questions to help establish a market for intellectual property loss. Questions include:• How does one place a value on IP? Whether based on

share price or loss of revenue or both, sophisticated algorithms must be developed to accommodate a host of key financial variables.

• How can a pharmaceutical formula or a piece of computer code be insured against loss or theft?

• For which losses would a policyholder be compensated? Traditional liability recognizes things such as defense costs, cost of medical care and noneconomic damages. On the other hand, the theft of intellectual property could saddle a company with a much different set of expenses and losses.

Given the magnitude and commercial impact of intellectual property, we at Lockton envision the emergence of a substantive insurance market and ancillary risk management services to combat IP theft. In the meantime, prevention is the best way forward. First and foremost, we recommend setting up a data classification system and identifying your sensitive information. Then establish the data trail within the organization and also outside to third parties. This helps you prioritize the data and segregate the most sensitive data while assigning more stringent security controls to it. Ensure your vendors do the same and match your levels of security as well as assume as much contractual risk as possible in the event that the data is compromised.

Additionally, consider the following measures:• Establish security policies and procedures and educate

employees.• Implement strong password controls and two-factor

authentication mechanisms - either as a software client or keyfob.

• Develop and enforce confidentiality agreements with employees.

• Assess firewalls to confirm that confidential data is contained.

• Encrypt data so that it can’t be read or decoded if it falls into the wrong hands.

• Perform regular data backups.• Monitor networks to see what’s being downloaded from the

outside.

Above all, be open and honest. Communication is a critical element of a successful data protection strategy. It’s imperative to foster a culture of trust and help employees understand that protecting intellectual property is good for the company and ultimately good for them.

June 2013 • Business Insurance Perspectives Article

i. http://www.esa.doc.gov/new-report-intellectual-property-and-us-economy-industries-focusii. White House Adopts New Strategy to Safeguard Intellectual Property, Los Angeles Times, February 20, 2013iii. Ibid.iv. http://www.fbi.gov/neworleans/press-releases/2013/branch-man-pleads-guilty-to-theft-of-intellectual-propertyv. http://www.fbi.gov/sanfrancisco/press-releases/2013/executive-recruiter-david-nosal-convicted-of-computer-intrusion-and-

trade-secret-chargesvi. http://www.fbi.gov/newyork/press-releases/2013/manhattan-u.s.-attorney-and-fbi-assistant-director-in-charge-announce-

criminal-complaint-against-three-new-york-based-university-researchers-for-conspiring-to-receive-bribes-from-a-chinese-company-and-a-chinese-government-supported-research-institute

vii. http://www.risk.net/operational-risk-and-regulation/feature/2267371/defence-against-ip-theft-in-financial-services

June 2013 • Business Insurance Perspectives Article

Lockton Companies LLP. Authorised and regulated by the Financial Conduct Authority. A Lloyd’s broker Registered in England & Wales at The St Botolph Building, 138 Houndsditch, London, EC3A 7AG.

Company No. OC353198. LLP-1140. www.lockton.com

Our MissionTo be the worldwide value and service leader in insurance brokerage and risk management

Our GoalTo be the best place to do business and to work