4 ms·

I don't think that's a straightforward argument. It's certainly not a completely unreasonable argument, but if Amazon can determine these things from using the

I don't think that's a straightforward argument. It's certainly not a completely unreasonable argument, but if Amazon can determine these things from using the publicly-facing services the way they're intended to be used, then it's quite reasonable to argue those competitive advantages are not "non-public". I generally view trade secrets through a very conservative lens, >90% of the time, if it smells like a trade secret violation, I firmly believe that it very much is a violation. Most people think I usually take this too far for their liking. So I'm already biased towards thinking this could be a violation, and I'm still concluding that it probably isn't. (Though trying to ever guess what the verdict of a USA vs. FAAMG case, or whether the USA will even pursue the case, is about as fruitful as reading tea leaves).

lazide 3y ago
It is a big question - if you upload your code + keys to AWS infrastructure, are you really protecting them enough to be able to claim trade secret protection? Especially if you’re knowingly a competitor to Amazon in some other way? I could see it going either way in court.
- reaperman 3y ago
  That's a different bar than the one most relevant to this article. No one in the general public could access your data on AWS the same way Amazon could. But Amazon can use other logistics platforms the same way that the general public would and get all this information about how those platforms operate. The bar you're talking about is more "How much do you have to protect data you give to a third party, such that it still remains a trade secret from that third party?" Currently, all of AWS is covered by the blanket statement here[0]: > As a customer, you own your customer content, and you select which AWS services can process, store, and host your customer content. We do not access or use your customer content for any purpose without your agreement. That should provide a good caliber of ammunition for trade-secrets claims against Amazon if they violate this, because not only can the rest of the public not access your data on AWS, you have every reasonable belief that Amazon is not allowed to either. I can't find any resources that suggest this policy is any different for their AI API's. Microsoft Azure also has strong protections around their branded offerings of OpenAI GPT-3/4 API's. 0: https://aws.amazon.com/compliance/data-privacy-faq/ https://aws.amazon.com/compliance/data-privacy-faq/
  - lazide 3y ago
    Yup, I just thought this was an interesting tangent. I suspect overall you’re right, however… That statement from AWS is a contractual agreement (not even that explicitly, but implicitly it is), not a verifiable ‘physical’ protection. Trade secret protection requires a pretty high bar of actual reasonable protection. For example, Coca-Cola’s secret recipe, and KFC’s ‘secret blend of 11 herbs and spices’ both have to actually be physically locked in a vault (or similar), and the list of people with access to them have to be very limited to get actual trade secret protection. If they made everyone in the company sign a contract saying they’d keep it secret, but then distributed it on index cards to everyone involved in the process, they’d have no actual trade secret protection, since they’d have taken insufficient steps to keep it an actual secret. Same if they left the vault door open and gave tours where people could reach over and see what was on it. So if it turned out that a bunch of folks on the EC2 team had the ability to dump cores on any running EC2 instance, and some did so and got said trade secret, could the customer say they did the equivalent of putting it in a vault and someone broke into it - or they did the equivalent of putting it in index cards, and it leaked? Same with payload information at S3 edge API servers. I’m imagining it would boil down to how reasonable it would be to expect Amazon to actually follow their agreements here in all situations, and how reasonable it would be to expect the technology to actually work as advertised, even if it was a competitor or something? I don’t know of any case law testing this yet. [https://www.wipo.int/tradesecrets/en/tradesecrets_faqs.html https://www.wipo.int/tradesecrets/en/tradesecrets_faqs.html] Said company could of course still sue Amazon for economic damages presumably, but also the ToS of AWS restricts the size of such claims to be well below what the company would likely want to pursue if the trade secret was actually valuable. And there would be none of the criminal penalties involved in trade secret prosecutions, which is really why people want it. There is a big difference between civil court and jail time.
    - singleshot_ 3y ago
      > pursue if the trade secret was actually valuable. If the trade secret is not valuable (more precisely, if economic advantage is not gained or maintained by the continued secrecy of the intellectual property) then I believe that you will find it is not eligible for protection.
AlotOfReading 3y ago
The point is that these services aren't publicly available. You access them by signing an agreement with e.g. Walmart, which are only available if you meet certain criteria like the sales volume mentioned in the article. I agree that I wouldn't want to try a trade secret argument in court though.

lazide 3y ago

It is a big question - if you upload your code + keys to AWS infrastructure, are you really protecting them enough to be able to claim trade secret protection? Especially if you’re knowingly a competitor to Amazon in some other way? I could see it going either way in court.

reaperman 3y ago
That's a different bar than the one most relevant to this article. No one in the general public could access your data on AWS the same way Amazon could. But Amazon can use other logistics platforms the same way that the general public would and get all this information about how those platforms operate. The bar you're talking about is more "How much do you have to protect data you give to a third party, such that it still remains a trade secret from that third party?" Currently, all of AWS is covered by the blanket statement here[0]: > As a customer, you own your customer content, and you select which AWS services can process, store, and host your customer content. We do not access or use your customer content for any purpose without your agreement. That should provide a good caliber of ammunition for trade-secrets claims against Amazon if they violate this, because not only can the rest of the public not access your data on AWS, you have every reasonable belief that Amazon is not allowed to either. I can't find any resources that suggest this policy is any different for their AI API's. Microsoft Azure also has strong protections around their branded offerings of OpenAI GPT-3/4 API's. 0: https://aws.amazon.com/compliance/data-privacy-faq/ https://aws.amazon.com/compliance/data-privacy-faq/
- lazide 3y ago
  Yup, I just thought this was an interesting tangent. I suspect overall you’re right, however… That statement from AWS is a contractual agreement (not even that explicitly, but implicitly it is), not a verifiable ‘physical’ protection. Trade secret protection requires a pretty high bar of actual reasonable protection. For example, Coca-Cola’s secret recipe, and KFC’s ‘secret blend of 11 herbs and spices’ both have to actually be physically locked in a vault (or similar), and the list of people with access to them have to be very limited to get actual trade secret protection. If they made everyone in the company sign a contract saying they’d keep it secret, but then distributed it on index cards to everyone involved in the process, they’d have no actual trade secret protection, since they’d have taken insufficient steps to keep it an actual secret. Same if they left the vault door open and gave tours where people could reach over and see what was on it. So if it turned out that a bunch of folks on the EC2 team had the ability to dump cores on any running EC2 instance, and some did so and got said trade secret, could the customer say they did the equivalent of putting it in a vault and someone broke into it - or they did the equivalent of putting it in index cards, and it leaked? Same with payload information at S3 edge API servers. I’m imagining it would boil down to how reasonable it would be to expect Amazon to actually follow their agreements here in all situations, and how reasonable it would be to expect the technology to actually work as advertised, even if it was a competitor or something? I don’t know of any case law testing this yet. [https://www.wipo.int/tradesecrets/en/tradesecrets_faqs.html https://www.wipo.int/tradesecrets/en/tradesecrets_faqs.html] Said company could of course still sue Amazon for economic damages presumably, but also the ToS of AWS restricts the size of such claims to be well below what the company would likely want to pursue if the trade secret was actually valuable. And there would be none of the criminal penalties involved in trade secret prosecutions, which is really why people want it. There is a big difference between civil court and jail time.
  - singleshot_ 3y ago
    > pursue if the trade secret was actually valuable. If the trade secret is not valuable (more precisely, if economic advantage is not gained or maintained by the continued secrecy of the intellectual property) then I believe that you will find it is not eligible for protection.

AlotOfReading 3y ago

The point is that these services aren't publicly available. You access them by signing an agreement with e.g. Walmart, which are only available if you meet certain criteria like the sales volume mentioned in the article. I agree that I wouldn't want to try a trade secret argument in court though.