A $200M corporate espionage lawsuit against Westjet reveals the possibility that Operations Research firms may share data between clients. A mechanism is needed to ensure that two competitors do not share the same Operations Research consultants.

November 25, 2004

Many of the policies and procedures of airlines are ripe for optimization, and airlines are some of the most eager clients of firms professing to understand Optimization Theory. In other words, they are likely to require help with Operations Research (OR), Management Science (MS), and/or Management Consulting. For example, airlines possess large databases of information about passengers, which could be used to predict calling patterns, resource requirements (such as meal plans or staffing), or to simulate strategies to understand better whether they could be effective. The value propositions are clear: Any improvement in the efficiency of operations will make the airline more profitable and more competitive. Any strategic insight could turn into an operational advantage. To stop improving operations and developing strategic insights is to allow the competition to advance faster than you do.

Yet the number of professionals, and professional firms, who are qualified to perform operations research is still small compared to the number of opportunities for improving corporate operations. Thus, it is likely that both Westjet and Air Canada were entrusting the same group of people with their highly sensitive information. Similarly, across Canada and the United States, it is likely that many competing firms have enlisted the services of local practitioners of Operations Research.

Of course, a reputable management consulting firm will outline its policies on its web pages and other marketing materials, and adhere to codes of strict secrecy about all clients. There are pragmatic reasons for this, including the potential in legal disputes or other battles that the firm's access to sensitive information might cause it to be vulnerable to legal actions or corporate espionage itself. Another reason might be to prevent clients from knowing that competing firms are enlisting the services of the same consultants, as clients would be either wary of the connection, or eager to take advantage of it.

If a firm accepts a client, having already accepted a competing client, the firm must at a minimum be able to enforce separation of data between the two clients, and it must also be able to avoid all conflicts of interest. In many cases it is not possible to guarantee this, yet the lure of a large contract or lucrative opportunity will cause the consulting firm to claim that there is no problem. Thus, to truly protect clients, a mechanism is required that will protect their anonymity, while also preventing the more grave situation of information sharing or conflicts of interest. The recommendations below may form the first steps towards creating such a mechanism.

Recommendations for Potential Clients

In light of the above, clients seeking to engage in a contract with an Operations Research or Management Consulting firm should:

• Establish a clear Non-Disclosure Agreement (NDA) with the consultants, before engaging in any further commitments.
• In written contracts and communications, define in broad terms what conflict of interest would mean in relation to your company.
• Ask consultants if they work for competing firms. If there are specific firms that you are worred about, then after the NDA, ask about them specifically.
• Ask about what policies and practices are in place to ensure that information is not shared between projects.

Recommendations for Consultants

• Establish procedures that make it possible to guarantee that information will not be shared between competitors
• Bow out of contracts where there is a potential conflict of interest.
• Avoid storing information about two competitors in the same office or building, except where the two projects can be effectively isolated from one another.
• Avoid sharing staff between projects of two competitors

Recommendations for Regulators

The following two suggestions should be taken together, to be effective.

• Require consulting firms to publicise the corporate names and public trademarks of client firms, including past client firms.
• Provide legal protection to consulting firms, to ensure that confidentiality can be maintained, even against court orders.