mjhjmtu

One of my company's internally developed algorithms was published online. It's a complex algorithm that took years to develop, I have a pretty good idea of which employee leaked it based on the team who worked on it and personal information on the blog, but I want confirmation. The algorithm is covered in detail but without any code from our codebase, so my employee might have thought it was okay to share this information publicly when it is absolutely not.

What steps should I take to confirm this employee's identity, and make sure this issue doesn't happen again with our engineers?

_{Related legal questions have been asked over at Law SE.}

Step 1 - Get an intellectual property law firm hired. Not a lawyer, a LAW FIRM!

Step 2 - Listen to them!

At the very least, you should file for a copyright AND a patent on it ASAP (copyright will probably get turned down, but patent will probably not).

Then have that law firm send a takedown notice to the blog's registered agent(s).

This will cost $, but if your algorithm is valuable, this is what to do.

What steps should I take to confirm this employee's identity, and make sure this issue doesn't happen again with our engineers?

First, since you are reasonably confident which employee it was, I suggest pulling them aside and talking to them. Time is important here, so I wouldn't waste too much time trying to make 100% sure you have the right person.

John, this is your blog, right? I need you to take this post down immediately. This is proprietary company information that and cannot be leaked to the public.

Depending on how you want to handle this, you might discuss consequences for the employee, but the biggest thing is just getting them to take it down as soon as possible.

Once you've taken care of the immediate damage, I'd say it's worth having a company meeting or sending out a company-wide email (depends on your style and size of your company). Don't name names or mention the specific incident, but explain that all company algorithms and information are proprietary and should not be shared or published without prior approval. This shouldn't be new information for them, but it sounds like it needs to be reiterated.

As for damage control for the information that has already leaked, I don't have a good answer, but I recommend talking to a professional who specializes in intellectual property.

It's possible that the employee did nothing wrong.

IANAL, but my understanding is that actual implementation is intellectual property and belongs to the company, but the generic idea of algorithms can't be protected. This is the reason why companies like Google and Facebook are extremely strict about not disclosing anything about their algorithms in public. And this shows also in game rules. Rules can't be protected but all names, artwork, fluff can be. That's why you see similar copied games right after somebody publishes a successful one.

What you do to protect yourself in future is contact lawyer and start obtaining patents and make all your employees to sign NDA where you explicitly prohibit disclosing any information related to your work.

And because it's possible the employee did nothing wrong, I'd approach the issue very carefully. Contact a lawyer and verify what you can and cannot do to mitigate damage on this incident.

The other answers highlighting your need for legal advice right now are correct, but for reasons other than they give.

As the employee disclosed no code, copyright is not a concern here - in pretty much all jurisdictions, you cannot copyright an algorithm.

Patents are an approach, but again have different issues in different jurisdictions - some jurisdictions are "first to file" and some are "first to discover", so you may not have any retroactive cover from any patent applied for today, even assuming the algorithm is patentable.

What you can attempt to pursue is protection for your algorithm under trade secrets laws if they exist in your jurisdiction, which can apply protection and civil and (often) criminal penalties for unauthorised disclosure, even when no copyright or patent is violated.

Also check your employment contract for any non-disclosure agreement, which would certainly apply in this case. Seek legal advice as to how enforceable it is in your jurisdiction and in this specific case.

Once its been established what right of control you have over the algorithms disclosure, I would suggest you have a full team meeting with everyone who has access to the code base in which you discuss what happened, why it is inappropriate to disclose such things as they can be extremely detrimental to the companies operation and their continued employment, and also highlight the potential civil or criminal liabilities such actions can result in.

If the specific employee in question does not come forward after the team meeting, there is little you can do without proof of identity - you can of course hire an investigator to see if they can uncover proof, but then all of this really comes down to what course of action are you intending to take if you do discover their identity.

A slap on the wrist and a "that was really damaging to the company, please dont do it again"? - well, the team meeting will have covered that.

Firing the employee? Intent on taking legal action against the employee? - depends on how badly you want retribution.