4 ms·

That's a different bar than the one most relevant to this article. No one in the general public could access your data on AWS the same way Amazon could. But Ama

That's a different bar than the one most relevant to this article. No one in the general public could access your data on AWS the same way Amazon could. But Amazon can use other logistics platforms the same way that the general public would and get all this information about how those platforms operate. The bar you're talking about is more "How much do you have to protect data you give to a third party, such that it still remains a trade secret from that third party?" Currently, all of AWS is covered by the blanket statement here[0]: > As a customer, you own your customer content, and you select which AWS services can process, store, and host your customer content. We do not access or use your customer content for any purpose without your agreement. That should provide a good caliber of ammunition for trade-secrets claims against Amazon if they violate this, because not only can the rest of the public not access your data on AWS, you have every reasonable belief that Amazon is not allowed to either. I can't find any resources that suggest this policy is any different for their AI API's. Microsoft Azure also has strong protections around their branded offerings of OpenAI GPT-3/4 API's. 0: https://aws.amazon.com/compliance/data-privacy-faq/ https://aws.amazon.com/compliance/data-privacy-faq/

lazide 3y ago
Yup, I just thought this was an interesting tangent. I suspect overall you’re right, however… That statement from AWS is a contractual agreement (not even that explicitly, but implicitly it is), not a verifiable ‘physical’ protection. Trade secret protection requires a pretty high bar of actual reasonable protection. For example, Coca-Cola’s secret recipe, and KFC’s ‘secret blend of 11 herbs and spices’ both have to actually be physically locked in a vault (or similar), and the list of people with access to them have to be very limited to get actual trade secret protection. If they made everyone in the company sign a contract saying they’d keep it secret, but then distributed it on index cards to everyone involved in the process, they’d have no actual trade secret protection, since they’d have taken insufficient steps to keep it an actual secret. Same if they left the vault door open and gave tours where people could reach over and see what was on it. So if it turned out that a bunch of folks on the EC2 team had the ability to dump cores on any running EC2 instance, and some did so and got said trade secret, could the customer say they did the equivalent of putting it in a vault and someone broke into it - or they did the equivalent of putting it in index cards, and it leaked? Same with payload information at S3 edge API servers. I’m imagining it would boil down to how reasonable it would be to expect Amazon to actually follow their agreements here in all situations, and how reasonable it would be to expect the technology to actually work as advertised, even if it was a competitor or something? I don’t know of any case law testing this yet. [https://www.wipo.int/tradesecrets/en/tradesecrets_faqs.html https://www.wipo.int/tradesecrets/en/tradesecrets_faqs.html] Said company could of course still sue Amazon for economic damages presumably, but also the ToS of AWS restricts the size of such claims to be well below what the company would likely want to pursue if the trade secret was actually valuable. And there would be none of the criminal penalties involved in trade secret prosecutions, which is really why people want it. There is a big difference between civil court and jail time.
- singleshot_ 3y ago
  > pursue if the trade secret was actually valuable. If the trade secret is not valuable (more precisely, if economic advantage is not gained or maintained by the continued secrecy of the intellectual property) then I believe that you will find it is not eligible for protection.
  - lazide 3y ago
    Yup, in this case I think the question would be ‘more valuable than the amount the company has paid AWS or not’. I’m vaguely recalling that is what damages are capped to in the TOS, but I might be off my rocker.
    - singleshot_ 3y ago
      That could be their way to try and create a contractual provision that works the function of the economic loss doctrine; not a bizarre provision. It is a very interesting question to someone who is a student of both cryptography and extremely slimy corporate entities. Edit: checked your history and I doubt there’s much need to explain this to anyone in this part of the thread, really. :)
- wkat4242 3y ago
  Coca cola make millions of liters of the stuff every day, there must be so many people involved in actually making it that safeguarding the recipe doesn't really matter? With all the people involved in that process.
  - lazide 3y ago
    It’s a difficult question to answer. My understanding is the concentrate syrup is what everyone interacts with except a small set of people at the plants that make the syrup - and that is where the ‘magic’ happens. The actual product the public consumes is bottled at local/regional bottling facilities from the concentrate to save on unnecessary transport costs, which are significant for something which is 99% water and corn syrup, 1% ‘everything else’. However, there is also the reality of mass spectrometry and HPLC. That plus a large enough group of chemists, and I’m not sure ANYTHING except perhaps a more economic means of production can actually be a real secret. But that last part is… complicated, case law wise. clean room reverse engineering has a interesting history. And in the end, after spending all those millions, how will you get your ROI? Selling it as Monzanto-Cola afterwards isn’t exactly going to give you a higher margin, and frankly most of the value of Coca Cola comes from the brand, not the recipe directly anyway. And claiming it tastes exactly the same as Coca Cola would get a giant lawsuit target on you, which you’d almost certainly lose. So you only have half the puzzle at best, and a giant lawsuit aimed at your head. As long as they do what they need to do to reasonably protect their trade secret, even if it’s something like 15% basil, 25% phosphoric acid, and the balance corn syrup.

lazide 3y ago

Yup, I just thought this was an interesting tangent. I suspect overall you’re right, however… That statement from AWS is a contractual agreement (not even that explicitly, but implicitly it is), not a verifiable ‘physical’ protection. Trade secret protection requires a pretty high bar of actual reasonable protection. For example, Coca-Cola’s secret recipe, and KFC’s ‘secret blend of 11 herbs and spices’ both have to actually be physically locked in a vault (or similar), and the list of people with access to them have to be very limited to get actual trade secret protection. If they made everyone in the company sign a contract saying they’d keep it secret, but then distributed it on index cards to everyone involved in the process, they’d have no actual trade secret protection, since they’d have taken insufficient steps to keep it an actual secret. Same if they left the vault door open and gave tours where people could reach over and see what was on it. So if it turned out that a bunch of folks on the EC2 team had the ability to dump cores on any running EC2 instance, and some did so and got said trade secret, could the customer say they did the equivalent of putting it in a vault and someone broke into it - or they did the equivalent of putting it in index cards, and it leaked? Same with payload information at S3 edge API servers. I’m imagining it would boil down to how reasonable it would be to expect Amazon to actually follow their agreements here in all situations, and how reasonable it would be to expect the technology to actually work as advertised, even if it was a competitor or something? I don’t know of any case law testing this yet. [https://www.wipo.int/tradesecrets/en/tradesecrets_faqs.html https://www.wipo.int/tradesecrets/en/tradesecrets_faqs.html] Said company could of course still sue Amazon for economic damages presumably, but also the ToS of AWS restricts the size of such claims to be well below what the company would likely want to pursue if the trade secret was actually valuable. And there would be none of the criminal penalties involved in trade secret prosecutions, which is really why people want it. There is a big difference between civil court and jail time.

singleshot_ 3y ago
> pursue if the trade secret was actually valuable. If the trade secret is not valuable (more precisely, if economic advantage is not gained or maintained by the continued secrecy of the intellectual property) then I believe that you will find it is not eligible for protection.
- lazide 3y ago
  Yup, in this case I think the question would be ‘more valuable than the amount the company has paid AWS or not’. I’m vaguely recalling that is what damages are capped to in the TOS, but I might be off my rocker.
  - singleshot_ 3y ago
    That could be their way to try and create a contractual provision that works the function of the economic loss doctrine; not a bizarre provision. It is a very interesting question to someone who is a student of both cryptography and extremely slimy corporate entities. Edit: checked your history and I doubt there’s much need to explain this to anyone in this part of the thread, really. :)
wkat4242 3y ago
Coca cola make millions of liters of the stuff every day, there must be so many people involved in actually making it that safeguarding the recipe doesn't really matter? With all the people involved in that process.
- lazide 3y ago
  It’s a difficult question to answer. My understanding is the concentrate syrup is what everyone interacts with except a small set of people at the plants that make the syrup - and that is where the ‘magic’ happens. The actual product the public consumes is bottled at local/regional bottling facilities from the concentrate to save on unnecessary transport costs, which are significant for something which is 99% water and corn syrup, 1% ‘everything else’. However, there is also the reality of mass spectrometry and HPLC. That plus a large enough group of chemists, and I’m not sure ANYTHING except perhaps a more economic means of production can actually be a real secret. But that last part is… complicated, case law wise. clean room reverse engineering has a interesting history. And in the end, after spending all those millions, how will you get your ROI? Selling it as Monzanto-Cola afterwards isn’t exactly going to give you a higher margin, and frankly most of the value of Coca Cola comes from the brand, not the recipe directly anyway. And claiming it tastes exactly the same as Coca Cola would get a giant lawsuit target on you, which you’d almost certainly lose. So you only have half the puzzle at best, and a giant lawsuit aimed at your head. As long as they do what they need to do to reasonably protect their trade secret, even if it’s something like 15% basil, 25% phosphoric acid, and the balance corn syrup.