Security expert Keith Alexander aims to file patents on behavioral modeling techniques that are raising issues because they could have their roots in insights he gained working in top US government posts.
Keith Alexander, a four-star Army General, recently retired as Director of the National Security Agency, the first Commander of US Cyber Command, and Chief of Central Security Service. In these roles he had complete oversight of the nation's cyber offense and defense strategies and technology, including all signal intelligence operations of the NSA, the protection of the Department of Defense's networks, responsibility for the military's cyberspace warfare operations, and all military cryptology issues.
After retiring, Alexander set up shop as a consultant at IronNet Cybersecurity. He offered his consulting expertise on preventing attacks on financial networks to the Securities Industry and Financial Markets Association for a million dollars a month, later reduced to $600,000 a month. He subsequently justified that valuation based on a "unique approach" that he invented after he left the NSA "to detect so-called advanced persistent threats, or hackers who clandestinely burrow into a computer network in order to steal secrets or damage the network itself" on which he intends to file nine or more patents.
According to Alexander, the inventions are based on a behavioral modeling approach to threat detection that was not used by the government during his tenure. Behavioral modeling uses machine learning to identify patterns of events that are predictive of a particular outcome, such as an attack before it occurs.
Under federal law, the government owns any inventions made by employees during working hours; or with the use of government facilities or information; or which "bear a direct relation" to the employee's official duties. Indeed, the law presumes that an invention is owned by the government when the employee's job includes inventing and conducting research; supervising, directing or coordinating government financed R&D; or acting as a liaison with other governmental or non-governmental agencies in R&D work.
The first question is whether these provisions of law apply to Alexander's situation. If Alexander invented this new approach after he retired, then they do not apply. This may be the basis of Alexander's position that he's cleared his inventions with NSA lawyers.
However, behavioral modeling of network threats is a known approach. Perhaps what makes Alexander's system so valuable is his knowledge about the behaviors and attacks the most sophisticated hackers use. His position gave him unique access to this information, insights competitors would not have.
With an advanced degree in physics, Alexander was known as one of the few NSA heads who deeply understood the details of the technology. According to Foreign Policy, colleagues used "mad scientist" and "evil genius" to describe both Alexander's technical chops and his outlook. Inventing solutions was part of his job, as demonstrated by his patents for the NSA on using wavelets for data compression. Thus, even if Alexander invented his approach after leaving office, both the kinds of inventions and their content were squarely within the zone of his official responsibilities and could be based on special knowledge that came from that position.
Another question is whether Alexander should file these patent applications, or instead keep his inventions as trade secrets. If the inventions are really as good as Alexander states, the NSA or other government agencies can have the US Patent and Trademark Office issue a secrecy order, which would effectively put Alexander's patent applications in a state of suspended animation for years, preventing them from issuing and thus considerably reducing their commercial value.
If the patents are not locked down under a security order and do issue, they may disclose the very details of hacking behavior he intends to use in his behavioral models. This would allow hackers to understand the details of the model, and thereby modify their behavior to avoid detection, again diminishing the value of the patents. Further, if the government does own these patents, then others may be able to license them without Alexander's involvement at all.
Alexander may indeed own the inventions on which his post-retirement consulting fees depend. But the circumstances here raise questions about whether the federal law needs to address this type of situation more clearly to provide better oversight of how far a high-level employee of the federal government can go in using the knowledge and information developed at taxpayer expense.
— Robert Sachs is a partner in the intellectual property practice at Fenwick & West LLP, concentrating on software technologies. He is the founder of the firm's Bilski Blog, focusing on legal developments around patentable subject matter.