From Softjourn's CEO

Description: If, due to circumstances beyond your control, your outsourcing vendor goes out of business, your team members need to have a job and will be looking for the next company to work for, taking their knowledge with them, perhaps to your competitors.

Solution:  These situations happen for one reason or another, so why not prepare for it. Add language in to your contract with your outsourcing vendor that gives you the option to take over the team if something does happen to your vendor. Make sure key persons on the project know about this option so no one is in the dark if something does happen. Define what taking over the team means, will you, as part of the contingency plan, set up your own facilities in the offshore country, or will you have the option to move the team to another vendor, with the help of your current vendor.

You will notice that through these 9 IP issues, I have not mentioned technical protection. This is because it is a given that, since we are all in the technology field, that technology will be used, to the extent possible, to protect your IP.  This may include firewall protection, encryption protection, blocking of the use of external drives, etc.  It is also a given that you have the appropriate processes in place to assure that the technology is being used and monitored correctly.  For example with the use of encryption, you may want to put in place a secure process for transferring your code between your offshore vendor and your onshore location, or transferring any type of documents in a secure manner. It may be a long shot that any of your code or any of your documents will ever fall in to the wrong hands, but why take the chance that it is sitting on a server some place for your would be competitors to get their hands on.

Description: Unauthorized access to your IP either intentional or unintentional.

Solution: This IP risk can be mitigated by both physical solutions and legal solutions. Physically require that your service provider arrange for a separate room for your team to work in, perhaps even a separate server room, isolate your network from the other network used by other clients of your outsourcing vendor.

While not the only way to stop unauthorized access, it does set the right environment for the team members, i.e. only one location where everything about this solution is talked about, it is not discussed outside this room. It is a constant reminder that what they are working on needs to be protected.

Legally include in your contract with your outsourcing vendor restrictions on who can have access to your IP, as well as include any physical restrictions that you require.

Description: Members of your team in the offshore location may be persons who frequently change their jobs taking your IP with them, IP which they may be planning to use in their own products which will compete in your space.

Solution: Have your outsourcing partner conduct background checks on your team members enabling you to get to know your team members. The background checks should include contacting all references, previous employers, former professors, as well as a criminal background check. Make sure the team member can explain frequent job changes, i.e. multiple changes after less than a year on the job, and make sure you feel comfortable with their reasons. While a motivation for frequent job changes can be an increase in salary, find out the real reason why your potential team members have changed positions so often. Have they been working on your competitor’s products?  Sometimes this may be an ideal situation for you because you want to take advantage of their knowledge of the business segment that your product competes in. Just be aware that they worked on your competitor’s system, their reason for leaving, etc. , especially if they have not been with your current outsourcing provider for long. You may be happy taking advantage of the knowledge they have gained by working on your competitor’s products, but you may not be so happy if they use knowledge they gain with you to go on to yet a 3^rd competitor in your segment or on to build their own products competing in your segment. Conducting more thorough background checks does not prevent your team members from leaving and going to your competitor’s team or leaving and starting their own business, but it does give you an awareness of who you are working with and may raise some signals of the potential for that type of behavior.

Definition: Someone working for your outsourcing partner takes your code, localizes it if necessary and begins selling your product or a close version of it in the offshore market.

Solution: Previous IP issues addressed mitigating the risk of having your code walk out the door, in the case that it does go out the door, one of the risks is that it ends up in a product sold in the offshore country. Help mitigate this risk before it occurs by getting your outsourcing partner involved. Discuss upfront the potential for your product in the offshore market. Your outsourcing partner knows the local market well, get their input, then decide if you want or could even support future sales in that market. For some offshore locations such as Eastern Europe and any of the Former Soviet countries, this may stretch beyond the offshore country itself to neighboring countries as well. Does your outsourcing partner have an interest in localizing and representing your product in the local market? Would they make a good representative of your product in that region? Assess them as you would any representative of your product. If they would be a good fit, outline some of the representative details in the initial SLA.

In all cases your outsourcing partner should be tied in to your success and to protecting our IP, for you, for their image and reputation and their very existence. While having your outsourcing partner represent your product in the local market will not prevent one of your team members from leaving your outsourcing partner, walking out with your code and starting their own company; it does get your outsourcing partner tied in even tighter to not allowing this to happen, to finding it before it goes to far and if it does occur to stamping it out quickly.

Definition: This involves any of the developers that work on your code via any of your outsourcing partners coming back in the future and claiming ownership of code and wanting to be compensated for what they have worked on.

Solutions: How to solve this issue can depend on the country that you are working in. Make sure you understand the rights your developer gets for working on your code, based on the country where he is working. For example in Former Soviet countries, Ukraine included, there is such a thing as author’s rights, i.e. the person who writes the code, irregardless of whose idea it was, or who is paying for it, gets what is termed author’s rights, i.e. the right to say they wrote the code. It does not give them right to use the code or do anything else with it, but you should understand how your outsourcing partner assigns IP rights from the employee back to you. Appropriate language needs to be included in the employee contract to assign all rights of the work that the employee is doing directly to the company where they are working. From there it should travel back to you in the contract you sign with your outsourcing partner so that you receive all rights to the work that you are paying for. Alternatively you can approach your outsourcing partner about having the employee contracts for your team members assign IP rights directly to your company. Whether or not this is a good idea depends on the country where you are working.

Definition: While the idea, concept or your actual solution leaking out to your competitors can take many forms, this one refers to it occurring in a more casual context, in a non-deliberate manner.

Solutions: Raise awareness on social engineering. Social engineering is probably the most overlooked form of industrial espionage because most often times it is inadvertent. You may be in a pub or restaurant talking with your colleagues about work, about how you are solving a client’s problem, and are overheard by some others in the pub. Or you may be at a professional meeting, project management institute or other, talking with your colleagues, former colleagues, etc., and you begin discussing what you are working on, just from a purely intellectual software engineering standpoint, you want to share what you are doing which is only natural. As part of the discussion you bring up the latest problem you are working on which reveals details of how the client company you are working with, is solving a problem, which is overheard by others and incorporated in to a competing product or service sold in the US or in the offshore location or elsewhere around the world. Social engineering also naturally occurs in the office as employees are talking amongst themselves. Employees should be made aware that all of these types of situations, while intellectually stimulating set the stage for the employee to inadvertently give out sensitive information that needs to be protected, and even amongst their colleagues within the company they should avoid these types of conversations. Having separation locations for teams for clients which may be competitors will also help avoid some of the natural flowing conversations between different team members, it also puts emphasis on the fact that what is done in that room is sensitive work and must stay in that room.