Federal Court Rules that a Search Engine Company Can Maintain Negligence Claims Against a Domain Registrar

A judge for the United States District Court in the Southern District of New York has ruled that Baidu, a company which operates a search engine service in China, could maintain gross negligence claims against domain registrar Register.com for failed security practices which Baidu alleges helped facilitate a cyber-attack against Baidu’s website.

After Baidu registered its domain name with Register.com, an intruder launched a cyber-attack against Baidu’s website by redirecting Baidu’s webpage to one stating that “it had been hacked by the Iranian Cyber Army” and showed “an Iranian flag and a broken Star of David.”

The intruder gained access to Baidu’s website after having an online chat with a Register.com customer service representative. The representative asked the intruder for Baidu’s security verification information, which the intruder could not provide, “but the [representative] nonetheless emailed a security code to the email address that Baidu had on file.” However, the intruder did not have the security code, so at the intruder’s request, the Register.com representative changed the e-mail address on file. The hacker was then able to access the account by using the “forgot password” feature.

Baidu brought claims for breach of contract, gross negligence, recklessness, and contributory trademark infringement. In it’s defense, Register relied on the limitation of liability clause in its Master Services Agreement which states that, “termination … or modification of [the Services,] … inability to use the Service[s], … loss incurred in connection with [the customer's] services,” or “any other matter relating to [customer's] use of the Service[s].” The Master Services Agreement also includes a limitation of liability clause limiting Register’s liability to $500, and states that it is the customer’s “responsibility to safeguard the User name, password and any secret question/secret answer . . . from any unauthorized use.”

The New York court stated that, while limitation of liability clauses are generally enforceable, they are not enforceable if they limit liability for willful or grossly negligent acts. Therefore, the court held that Baidu’s complaint satisfied that standard because Register failed to follow even minimal security procedures, much less its own security standards.

In its defense Register also argued that under the contract, it was the customer’s responsibility to maintain security of any password or security information and, therefore, it had no obligation to maintain any security procedures with respect to Baidu’s account. The court rejected this argument, stating that because Register undertook a duty to Baidu, it was required to live up to that duty in a non-negligent manner. In fact, the court said that these security measures were put in place by Register precisely because a cyber attack on its customers was foreseeable.

Finally, Register argued that it should be granted immunity as a registrar because Baidu failed to adequately allege the elements for contributory trademark infringement. The court rejected this argument. Yet, the court agreed with Register that Baidu did not “plausibly allege that Register engaged in contributory trademark infringement.” Therefore, the court dismissed this count.

This case should serve as a warning to domain registrars to maintain their security standards and protocols. It should also serve as a warning website owners to be vigilant in guarding the security of their site. However, based on this case it seems unlikely that a domain registrar would be held liable for website hacks that were unforeseeable.

Do you think that a domain registrar should be held responsible for the security breach that occurred in this situation? Please share your thoughts!

To read this opinion please go to: Baidu, Inc. v. Register.com, Inc.

If you have questions about this issue, or if we may be of assistance to you, please feel free to contact us.

Keep Competitors Off Your Intellectual Property

Telecommunications companies, like other technology-related ventures, often base their businesses on the unique and proprietary nature of their business ideas, processes, products and services. Indeed, it is these proprietary products and services that allow many telecommunications businesses to stake out a niche in the marketplace and to distinguish themselves from the multitude of competing service providers. Yet, despite the importance of these ideas, processes, products and services to the success of their businesses, many telecommunications companies do not take the steps necessary to protect themselves against copycats lying in wait to steal such “intellectual property” from them, thus gaining access to the market niche they have so carefully developed.

In most cases, they need not let this happen. Service providers can protect their company’s intellectual property by obtaining appropriate patent, trademark and copyright protection. This article briefly explains each type of protection, the matters to which they apply, how to determine if protection is needed and, if it is, the steps necessary to obtain such protection.

Patents

A patent may be obtained for “any new and useful process, machine, manufacture or composition of matter, or any new and useful improvement thereof.” To be patentable, the process, machine, manufacture or composition of matter must meet the requirements of patentability, including novelty and non-obviousness. Thus, for example, software may be patentable to the extent that it is not merely a mathematical algorithm and is associated with a practical application. The same is true of a business process: it may be patentable if it is sufficiently unique, useful, concrete and tangible.

Patent law confers what is called a “negative monopoly.” That is, a patent owner may prevent others from making, using or selling the invention for a period of 20 years from the date the application is filed. The patent owner also can elect to license the patent to others and to derive often substantial royalties from such licenses. In determining whether your business has a patentable process or product, it is important to keep in mind that the United States is the last remaining country in the world in which the initial patent applicant must be the “first to invent” and not the “first to file.” Thus, even if a competitor has stolen your invention and has filed first, you still may have the opportunity to secure your rights.

Trademarks

The function of a trademark is to evoke a connection in the minds of the purchasing public between a product or service offered under the mark with the source of the product or service or the company that produces it. By using a trademark and making it known in the marketplace, a company creates a valuable asset: goodwill. Goodwill is a byproduct of the consumers’ loyalty to a product, as well as their ability to recognize the product, thereby being able to distinguish just that product from others that are similar.

The best marks to consider are those that are arbitrary and fanciful. For example, “Kodak” and “Polaroid” for cameras are excellent marks. These trademarks do not describe the products in any way and are very strong. Trademarks should not describe products or services. In fact, the U.S. Patent and Trademark Office will not register marks that are descriptive or that it determines to be generic. Examples of marks that have become generic are cellophane and escalator.

Unlike patents, trademark registrations do not expire as long as certain statutory requirements are met. For example, between the fifth and sixth year after the date of registration, an affidavit of continued use and incontestability must be filed at the Trademark Office. Also, every 10 years from the date of registration a renewal must be filed. Thus, with a little thought and planning, you can protect your company’s name and business identity through the trademark process.

Copyrights

Unlike a patent, a copyright does not protect ideas; it protects the expression of ideas in original works of authorship in a tangible medium of expression. Thus, businesses may be able to copyright software (including source code and object code), promotional materials, databases and related materials.

The beauty of a copyright is that you don’t have to do much to obtain protection, and you can get the protection immediately. A business automatically obtains copyright protection by fixing the work in a tangible medium of expression. In fact, a work expressed in RAM on a computer will be protected by copyright. Notice of copyright is provided by the placing the copyright symbol “©” on the relevant work, along with a date of copyright and an indication of the party to whom the copyright belongs. For an individual, a copyright lasts for the life of the author plus 50 years.  For a work created as a “work made for hire,” which is typical in a company setting, the copyright lasts for 75 years after the first publication of the work or for 100 years from the year of creation, whichever expires first.

A copyright owner, in most circumstances, has the right to exclude others from reproducing, distributing, displaying or importing infringing copies of the work, or from making derivative works. Derivative works are works based on the underlying copyrighted work. For example, certain enhancements to software can be viewed as derivative works.

So if you already have copyright protection in the instant you create the work, why register it in the Copyright Office? First, it allows you immediate access to the federal courts in case someone infringes your copyright. Second, it automatically gives you statutory damages in case of infringement. Third, if you prevail in a copyright litigation, you automatically will get attorneys’ fees. Litigation is extremely expensive in this country, and litigation over intellectual property is no exception.

Trade Secrets

A trade secret “… may consist of any formula, pattern, device or compilation of information which is used in one’s business, and which gives one an opportunity to obtain an advantage over competitors who do not know or use it.” Examples include technical and nontechnical data, plans, drawings, recipes, financial data, lists of customers and suppliers and software, which have economic value. Trade secrets can be used in conjunction with both patents and copyrights.

Trade secrets give you very powerful protection. At the same time, trade secrets are extremely vulnerable. If you own any trade secrets they must be kept secret or the protection will be lost.  Once this cat is out of the bag, it is out forever. License agreements involving any trade secret material need not disclose the secret itself, but must identify that trade secrets exist in the subject matter of the license. Furthermore, the license must direct the licensee to take sufficient measures and safeguards to keep the trade secret actually secret.

Unless prohibited under contract or license, reverse engineering is a legitimate means to let the trade secret cat out of the bag, so contracts and licenses must be drafted with care. Nevertheless, legal action can be brought for misappropriation of trade secrets. In such a case, you would have to prove three elements: (i) relative secrecy (e.g., that you have taken reasonable steps to protect your proprietary rights in the trade secret); (ii) the trade secret’s value to you; and (iii) novelty of the trade secret (although a unique combination of generally known information, or even data in the public domain, still can constitute a trade secret).

The duration of a trade secret is as long as it is kept secret. Companies would do well to set up internal safeguards in addition to the external safeguards set forth in their licensing agreements. The only cost is that associated with maintaining the secrecy.

The best way to determine whether you have assets–e.g., intellectual property–that need to be protected is to have a qualified attorney perform an intellectual property audit. We know–when you hear the word “audit” you automatically assume the fetal position, begin to whimper and to envision long visits with nasty, boring accountants. In this case, however, the audit will help you protect your business and save you money.

The intellectual property audit also will help you identify whether your company name, product names, logos or slogans have trademark or service mark significance. The intellectual property audit also will investigate and examine whether your company has documents, software and the like that should be registered with the U.S. Copyright Office. Finally, the intellectual property audit also will help you consider whether you have developed anything that could be considered a trade secret, and how you should protect it.

Once the intellectual property audit is completed, you will be in a position to make an informed judgment as to which of your assets need to be protected and the most efficient and effective means of obtaining protection. Like many other things in life, a little care and attention now inevitably will pay substantial dividends later.