Don’t Set Your Hair on Fire Yet over Data Rights Challenges Under the FY 2019 NDAA

DefenseCongress recently authorized the Department of Defense’s spending for Fiscal Year 2019 and, unsurprisingly, attached some strings in the guise of acquisition reform.  One of these is a modest change to the burden of proof in a rarely used exception to a data rights challenge.  This exception now allows the DOD to override the challenge process and to release a contractor’s data when there are “compelling mission readiness requirements” rather than “urgent and compelling circumstances,” which was the existing standard.  Although this has caused consternation in some quarters, we think that, as a practical matter, the effects of this change are not likely to be significant.  Contractors should not be alarmed.  Here is how this change came about and why not to worry too much.

This year, we watched with considerable concern the progress of a draft Senate provision in the FY 2019 National Defense Authorization Act (“NDAA”) that would have allowed the Government to treat contractor proprietary and trade secret materials however DOD pleased if the Government so much as challenged the validity of a contractor’s restrictive markings.  That is one heck of a damper on industry innovation and participation, as well as on due process.  Fortunately, this remarkably bad provision did not make its way out of Conference.  The final FY 2019 NDAA, insofar as it addresses rights in technical data and software, is light on substantive effects.  The change to the override’s burden of proof is one of them – a remnant from the Senate’s ill-conceived draft.

By way of background, when a DOD contractor delivers proprietary technical data or computer software under a contract, it must apply very specific restrictive markings contained in the Department of Defense Federal Acquisition Regulation Supplement (“DFARS”) and its “data rights” clauses.  Failing to mark, or marking incorrectly, jeopardizes a contractor’s ability to enforce any limitations on the Government’s use of those data or software and may provoke a data rights challenge by the contracting activity.  See DFARS 252.227-7013(f); DFARS 252.227-7014(f).  There is, however, a healthy measure of due process in this “validation” process.

For example, if the Government thinks any restrictive markings are unjustified – say the Government contends it paid for the development of something the contractor is claiming to have developed at private expense – then the Government may challenge the contractor’s markings.  The DFARS sets out a comprehensive and iterative procedure for these challenges; they allow the contractor to submit various written justifications (often consisting of extensive development and timekeeping records) on which the contracting officer must issue a final decision.  See DFARS 252.227-7019; DFARS 252.227-7037.  As with a contracting officer’s final decision on a monetary claim, the contractor may appeal an adverse data rights final decision to either the Armed Services Board of Contract Appeals (“ASBCA”) or to the U.S. Court of Federal Claims.  All the while, the Government is bound by the contractor’s restrictive markings until the dispute is finally resolved – that is, at least in most cases.  Under the current regulations, if the head of an agency makes a written determination that the agency cannot wait due to “urgent or compelling circumstances,” the agency may release or disclose the data, with the understanding that the contractor retains its right to seek damages or any other lawful relief if the restrictions are upheld.  This type of preemptive action by an agency head is very, very rare.

DOD personnel occasionally complain that contractors abuse this appeals process to drag out invalid restrictions, overlooking (or not appreciating) the fact that contractors think long and hard before pursuing an appeal, especially in light of the significant resources and legal fees involved, and typically do not do so unless there is good reason and the stakes high.  Regardless, someone within DOD wanted to limit this longstanding disputes process.  And someone on the Senate staff listened, giving us the draft Senate provision that would have allowed DOD to treat challenged technical data or software as if they were not marked at all while the challenge litigation plays out.  Of course, allowing DOD to release these data or software like this, and even temporarily, could utterly destroy the value of the contractor’s trade secrets.  Worse yet, under this proposed scheme, if restrictive markings ultimately were found to be justified, DOD would be liable to the contractor only if the agency had acted unlawfully or in bad faith.  It is unsurprising this ill-conceived provision did not last.

In Conference, the House receded with a provision, now in law at Section 866 (and codified in 10 U.S.C. § 2321(i)), that more or less mirrors the current framework in the DFARS, with one small exception:  instead of “urgent and compelling circumstances,” the head of the agency must find “compelling mission readiness requirements.”  Alarm notwithstanding, it is difficult to imagine a situation where an agency faced with “compelling mission readiness requirements” could not equally classify its predicament as “urgent and compelling circumstances.”  It should, however, be about equally difficult for the agency to succeed in proving the “circumstances” under either definition.  No doubt, one can debate perceived differences between the new standard and the old – much like attorneys can debate the perceived differences between “negligence” and “gross negligence,” but the question is whether they make much of a difference.  Probably not.

Given the edit deleting “urgent,” it might be that Congress wanted to move away from the “urgent and compelling” standard to avoid case law in the Court of Federal Claims interpreting the phrase, as it pertains to sole-source awards or overrides of statutory stays of performance during a protest, to require a threat of “immediate harm to health, welfare, or safety.”  This is language originally found in a Senate Report when the authority to award sole‑source contracts was promulgated.  See PMTech, Inc. v. United States, 95 Fed. Cl. 330, 345‑46 (2010) (quoting S.Rep. No. 98-50, at 21 (1983)).  There is, however, no similar case law related to restrictive markings – indeed, no case law at all to suggest the requirement to show “immediate harm” would be adopted.  And under either standard, the facts confronting the agency must compel it to misappropriate what is, at least for the time being, considered to be a valid trade secret.  When should mission readiness requirements compel an agency to act immediately if those requirements were not also urgent?

In all events, DOD historically is patient during data rights litigation; and, although often aggressive, it almost always respects contractor markings pending the court’s or board’s decision.  This respect for the disputes process reflects the facts that compelling circumstances are infrequent and often difficult to prove.  Moreover, it is as likely attributable to reputational and monetary risks as it is to the regulatory standard.  The potential damages for misappropriating trade secrets can be astronomical, and doing so cavalierly could jeopardize important industry relationships.  With these circumstances still present, and the burden of proof so similar, there is no reason to think the slightly relaxed standard of the NDAA will result in a wave of restrictive marking overrides.  We can probably silence the alarms for now.