Publicizing Corporate Secrets

Let's begin with two short stories of secrets held by federal regulatory agencies. In each, a regulator obtains and holds secret technical information about a product sold by a company it regulates. The secret information concerns the product's safety and also contains some kernel of proprietary, commercially valuable knowledge. Each regulator thus faces a dilemma. On the one hand, the regulator wants to protect the regulated entity's legitimate interest in keeping commercially valuable secrets secret. On the other hand, the regulator wants to inform the American public of a threat to its safety. To disclose the secret risks angering its source, undermining incentives across the broader industry, and, perhaps, triggering legal liability for violating trade secrecy law. To keep the secret risks depriving the world of important technical information and people possibly being harmed, even killed, by the products in question.

In 1941, inspectors of the Food & Drug Administration (FDA) discovered widespread and deadly contamination in a then-new and best-selling antibiotic drug product: sulfathiazole manufactured by the Winthrop Chemical Company. 1 The contamination arose from a series of ill-conceived features of Winthrop's manufacturing process-a manufacturing process that fast-growing Winthrop had shielded from its competitors. Winthrop had, among other missteps, placed tableting machines for two different drugs in the same room, adjacent to one another, making it dangerously easy for workers to mix the two drugs up. 2 Winthrop downplayed the problem, telling the FDA (falsely) that contamination was limited to a single lot of tablets and telling its customers (falsely) that the issue was a less serious disintegration problem. 3 Winthrop attempted to keep its manufacturing processes and problems secret, but the FDA elected to publicize them. Through a press release widely covered by the news media, the agency informed the public of Winthrop's deadly contamination and disclosed specific details of Winthrop's manufacturing processes that had encouraged the accidental contamination (including the inadvisably placed tableting machines). 4 The resulting scandal prompted Winthrop to reform its manufacturing processes (and to replace many executives). 5 The experience also prompted changes throughout the entire U.S. pharmaceutical industry: the FDA revised its regulations to tighten its oversight of all drug makers' manufacturing processes and to mandate, for the first time, industry-wide manufacturing controls that reduce the risk of accidental contamination. 6 These quality controls, shaped by knowledge of what went wrong at Winthrop, evolved into the so-called "good manufacturing practices" that are the FDA-enforced norm in the pharmaceutical industry today. 7 A second short story: In 2018 and 2019, hundreds of people died, tragically, in two separate crashes of Boeing's 737 MAX passenger jet. 8 After [Vol. 171: 1319 to disclose technical details of the flight control system. 17 Flyers Rights alleges that it is "impossible for independent technical experts to evaluate any FAA decision to unground the 737 MAX unless they can obtain access to the technical submissions made by Boeing." 18 Flyers Rights lost its case in district court 19 and, at the time of writing, was litigating an appeal. 20 Time will tell whether FAA releases this information, and what consequences FAA's choice to resist disclosure will have for the aerospace industry, passenger safety, and public trust in the industry and agency.

The fight over 737 MAX data is just one fight over corporate secrets, but it is likely an important harbinger of more to come. As carmakers follow airplane manufacturers and design their vehicles to be increasingly autonomous, even "self-driving," contests over access to information on their software and hardware control systems seem almost certain to recur. 21 In turn, autonomous vehicles are but one instance of the broader phenomenon of contestation over regulators' stores of knowledge on technology-and information-intensive industries. We live in the age of "informational capitalism" 22 and "infoglut." 23 As a greater proportion of industry value is tied up in information itself, a greater proportion of the work of regulators is governance of that information. Today, the federal administrative state holds more information than ever-vast reservoirs of scientific knowledge, economic and sociological data, manufacturing schematics, safety testing data, data on environmental harms, and on and on. 24 As Rory Van Loo has described, today's federal regulatory state barrier-real or imagined-to federal regulators' publicizing companies' secrets: trade secrecy. 32 Generally speaking, a trade secret is legally protected, "proprietary" information that has economic value from not being known to competitors and is subject to reasonable efforts to maintain its secrecy. 33 As Charles Tait Graves and Sonia Katyal have shown, companies claim that an expanding body of information on their activities meets this definition, 34 and that any sort of public disclosure of that information would constitute a violation of trade secrecy law. 35 Invocation and fear of trade secrecy law now seriously hinder federal regulators from disseminating to the public reliable information about the spheres of activity that they regulate, especially those that are technologyintensive. 36 Meanwhile, claims of trade secrecy now even hinder some regulators from obtaining information from the entities they supposedly regulate in the first place. 37 Against that backdrop, this article makes two main contributions. The first is legal-a claim about the powers federal agencies have under existing law. The second contribution is normative-a claim about what federal agencies should do with those powers. 32 Of course, more than trade secrecy ails the federal regulatory state today. For deeper analysis detailing modern problems in administrative law, see, for example, Julie E. Cohen 33 Uniform Trade Secrets Act § 1(4); 18 U.S.C. § 1839(3); Trade Secret, BLACK'S LAW DICTIONARY (10th ed. 2014). 34 Graves & Katyal, supra note 31, at 1352-68. 35 Id. See also Deepa Varadarajan, Business Secrecy Expansion and FOIA, 68 UCLA L. REV. 462, 464 (2021) ("Legal and technological changes have created an environment in which firms invoke trade secrecy to protect all manner of information . . . ."). 36 See Graves & Katyal, supra note 31, at 1352 ("In an increasing array of contexts, companies or government agencies use trade secrecy and confidentiality agreements to prevent investigations by journalists, employee-whistleblowers, research scientists, and private parties. These incidents arise frequently in environmental disputes, but they can extend into clashes over the use of private technology in public infrastructure . . . and other efforts to suppress investigations into governmental or corporate practices in the public interest."); Sonia K. Katyal, The Paradox of Source Code Secrecy, 104 CORNELL L. REV. 1183, 1240-41 (2019) (coining the term "information insulation" to refer to "an increased willingness [by government agencies] to assert trade secret protection in cases where transparency might be justified due to public interest concerns." ). See also infra Part I. 37

The article's first contribution is to disprove the conventional wisdom that trade secrecy law, or any other existing body of law, creates a general bar against federal agencies publicizing corporate secrets. This insight is simple but important, so it bears repeating: as a general rule, federal regulators generally do have a legal right to disclose (and thereby "break") even bona fide trade secrets. This authority emerges from the regulators' enabling statutes and from the fundamental background principle, formalized in statutes and reaffirmed by the Supreme Court, that federal agencies have legal discretion to disclose information within their possession. 38 Even the Roberts Court has acknowledged this authority, giving regulators meaningful room to maneuver. 39 Various constitutional and statutory sources of federal law, including the federal Trade Secrets Act 40 and the Fifth Amendment's Takings Clause, can complicate disclosure and make it expensive for regulators, but they do not prohibit disclosure.

It is simply untrue, as a matter of law, that trade secrecy law prevents the sovereign U.S. government from communicating urgent information to its citizens. For an agency to choose to "break" a private trade secret and share it with the public is no more shocking and no less legal than agencies' wellestablished powers to exercise eminent domain over real property, or to use privately patented inventions on the public's behalf. 41 Yet the view that trade secrecy law categorically prohibits disclosure of private trade secrets to the public currently reigns, both inside and outside the U.S. government. FAA and other agencies repeatedly echo the premise that federal law prohibits disclosure of private trade secrets. 42 In 2020, the usually authoritative Government Accountability Office (GAO) stated flatly that "federal laws generally prohibit agencies from disclosing information that concerns or relates to trade secrets, processes, operations, statistical information, and related information." 43 Most scholars, too, seem to have accepted the same premise, at least implicitly-even leading scholars who support more disclosure as a normative matter and have advanced important proposals to unearth information protected as trade secrets. 44 David Levine, for example, has written that "FOIA and the Trade Secrets Act (TSA), a criminal statute, act in tandem to prohibit the government from releasing any information that meets a FOIA trade secret definition." 45 Hannah Bloch-We hba has written that agency disclosure of trade secret decision-making algorithms is "legally precluded because these materials are the proper subject of trade secret protections." 46 With some notable exceptions, including Bernard Bell, 47 Matthew Herder, 48 and David Vogel, 49 the view that trade secrecy law hamstrings the government's ability to communicate with the public now dominates.

To be clear, regulators' trade secret-breaking power is far from absolute. Via various enabling statutes, Congress has prohibited some federal regulators from disclosing trade secrets, as I explain below. 50 The most notable regulator so limited is the Federal Trade Commission (FTC); given FTC's unmatched information-gathering ability, 51 FTC's bar on disclosure of 44 See, e.g., Van Loo, supra note 32, at 1605 (concluding that "[a]ny platform-monitoring [regulator] would need to mitigate the spread of trade secrets by limiting information collected only to that necessary and limiting the sharing of any information once it is collected. 46 Hannah Bloch-Wehba, Access to Algorithms, 88 FORDHAM L. REV. 1265, 1270 (2020) (emphasis in original). 47 See Bernard Bell, Food Marketing Institute: A Preliminary Assessment (Part II), YALE J. ON REGUL.: NOTICE & COMMENT (Jul. 8, 2019), https://www.yalejreg.com/nc/food-marketing-institute-a-preliminary-assessment-part-ii [https://perma.cc/Y9P2-5BP2] ("[B]y notice and comment rulemaking, [a federal agency] may grant itself the power to release [trade secret] information." ). 48 See Matthew Herder, Reviving the FDA's Authority to Publicly Explain Why New Drug Applications Are Approved or Rejected, 178 JAMA INTERNAL MED. 1013, 1013 (2018) ("[T]he barrier to greater disclosure is the FDA's interpretation of its governing laws rather than the laws themselves."). 49 See David A. Vogel, Government Agencies Can Misuse Your Trade Secret and You Can't Stop Them, 28 PUB. CONTRACT L. J. 159, 166 (1999) ("The Federal Government can have numerous reasons for releasing a trade secret to a third party or to the general public."). 50 See infra section III.B.1. 51 See, e.g., A Brief Overview of the Federal Trade Commission's Investigative, Law Enforcement, and Rulemaking Authority, FED. TRADE COMM'N, https://www.ftc.gov/about-ftc/what-we-agency-held trade secrets is momentous. Other agencies' enabling statutes prohibit them from disclosing certain types of trade secrets, or permit disclosure only when narrow factual circumstances apply. 52 Nonetheless, a majority of major federal regulators, including the Environmental Protection Agency (EPA), FAA, Federal Communications Commission (FCC), FDA, the Department of Health and Human Services (HHS), the National Highway Traffic Safety Administration (NHTSA), and the National Transportation Safety Board (NTSB), retain broad authority to obtain and disclose at least some of the trade secrets (and other secrets) they obtain from the companies they regulate. 53 The insight that federal regulators can obtain and disclose trade secrets moves the terrain of debate from what is possible as a matter of law to what is desirable as a matter of public policy. It prompts hard normative questions: If an agency can take even bona fide secrets from private companies and publicize them, when and how should it? Which secrets should it share? With whom? On what terms? Real harms surely flow from overbroad disclosure, not just to affected individual companies but to entire industries and to the broader economy.

Accordingly, the article's second main contribution is a new normative theory of how federal regulators should wield their power to disclose corporate secrets. It proposes selective, controlled "information publicity" of corporate secrets for public good. I choose the phrase "information publicity" rather than simple "disclosure" to emphasize the need to tailor information disclosure to serve some interests in information over others. 54 Transparency is not an end unto itself. Its benefits and costs depend entirely on its context-who is using the information, in what ways, to what ends. 55 As Kapczynski wrote in a recent call to arms, "we cannot achieve the insights that we need into data and AI systems through a simple insistence on passive do/enforcement-authority [https://perma.cc/BQ38-7DK6] (explaining investigative authority delegated to the FTC under section 6(b) of the FTCA); WHAT THE FTC COULD BE DOING (BUT ISN'T) TO PROTECT PRIVACY, ELECTRONIC PRIVACY INFORMATION CENTER 14 (2021), https://epic.org/wp-content/uploads/privacy/consumer/EPIC-FTC-Unused-Authorities-Report-June2021.pdf [https://perma.cc/RGT4-NL4P] (same). 52 See infra section III.B.1. 53 See infra section III.B.1. 54 Kapczynski and I chose the corresponding term "data publicity" in our predecessor paper, which proposed controlled disclosure of specific scientific data held by FDA. and unmediated 'transparency.' If access to data is to serve public ends, it will need to be active, sensitive to underlying structures of power, and in many cases, conditional." 56 To that end, the article proposes agency-administered programs of information publicity that do not simply disclose information to all comers, unconditionally, but instead cultivate carefully bounded "gardens" of information. These gardens may exclude some, and they may subject users to substantial legal and technical constraints on information access and use. I argue that agencies can and should discriminate among users and uses, to privilege socially valuable uses and to protect legitimate trade secrets from competitive uses and consequent economic harm. In this way, the competitive value of trade secret information can be protected while socially beneficial noncommercial uses of the information are unlocked. To invoke the garden metaphor: Regulators must be responsible caretakers of the informational "flora" they collect from the companies they regulate. Regulators may permit some representatives of the public to pick informational "fruit," but only if they do so in ways that don't harm the plant. Regulators can block competitors and irresponsible would-be users from entering the garden at all.

The bounded garden model of information publicity I propose here builds on recent proposals for "controlled-access" or "bounded" disclosure of trade secrets from Mary Fan, 57 as well as Amy Kapczynski and me. 58 The article proceeds in four parts. Part I describes the troubling status quo: despite unparalleled access to valuable corporate information, federal regulators share little with the public, and the public has no effective recourse. Part II provides a normative case for reviving "information publicity"controlled, conditioned disclosure of corporate secrets-and prescribes how it should be done. Part III presents a legal roadmap to this sort of information publicity. Part III "shows my work"; it identifies the sources and limits of regulatory agencies' disclosure authority under existing law. It also presents two simple steps that interested federal regulatory agencies can take to protect information publicity programs from legal challenge, even under scrutiny by a Supreme Court with a pronounced deregulatory bent. I conclude with brief thoughts on how federal agencies' legal authority to publicize corporate secrets might be exercised more broadly in the data economy and informational age.

A quick note on terminology: Throughout this paper, I use the somewhat unorthodox phrase "corporate secrets." I intend "corporate secrets" as a convenient umbrella term that encompasses all secret information generated by private commercial entities-not just true corporations but also noncorporate companies, partnerships, and so on. Corporate secrets include all "trade secrets." But I also use the term corporate secrets to refer to a wider swath of information. This wider swath includes secret information that does not qualify, for one reason or another, for protection as a trade secret but 62 See Sandeen, Relative Privacy, supra note 60, at 675-76 (explaining American trade secrecy law's traditional rejection of a "property basis" and focus instead on the relationship between plaintiff and defendant in trade secret misappropriation cases); see also Sharon K. nonetheless has some commercial or financial value and is accordingly protected by FOIA's exemption for "commercial or financial information . . . [that is] privileged or confidential" (also known as "confidential commercial information," or "CCI"). 64 More broadly still, corporate secrets also encompass information that corporations and other businesses manage to keep secret despite the information lacking any genuine commercial or financial character, such as embarrassing evidence of "illegal or unethical payments to government officials or violations of civil rights, environmental or safety laws." 65 I choose "corporate secrets" not just because it is a concise and convenient shorthand for all this information but also because it helpfully disregards distinctions between trade secrets, CCI, and other secret information. As I argue below, the precise formal legal category of a piece of information is often irrelevant as a legal matter; under existing federal law, a federal agency can often legally disclose a corporate secret no matter whether it is a trade secret or CCI, assuming the agency takes certain preparatory steps. 66 Moreover, agonizing over the formal legal category of a piece of information is often unhelpful from a policy perspective, as it obscures more pressing, fact-specific questions of the specific harms and benefits likely to flow from publicizing the information in question. 67

This Part tells a story of how information flows through the federal regulatory state. A torrent of information on regulated entities flows into federal regulatory agencies, yet only a fraction currently trickles out to the public. This Part is primarily descriptive; it maps those information flows. It proceeds in three subparts. Subpart I.A shows that federal regulators have sweeping and durable power to demand and collect information generated and held by the private companies they regulate. Subpart I.B summarizes what federal regulators today do with secrets they collect. It surveys a handful of effective programs of proactive disclosure of corporate secrets to the public. These programs underscore the value of such disclosure, but such programs are scattered, and their numbers may be declining. Subpart I.C then briefly describes the public's existing set of tools to "self-help"-to get access to corporate secrets of public interest when the relevant regulator does not share them proactively. Subpart I.C shows that this set of tools is small and inadequate. The problem of obsessive corporate secrecy has become deadly serious, as journalists, public interest groups, academic researchers, and other representatives of the public find themselves without access to vital information in federal regulators' hands, even when the information is of intense public interest.

In sum, this descriptive Part will paint a rather dismal picture: the federal regulatory state's proactive disclosure programs are scattered and limited. FOIA is painful for agencies and public the alike, and yet it is the dominant means by which the public obtains information from federal regulators. This picture forms the backdrop for a better solution: proactive information publicity, as proposed in Part II.

U.S. federal regulators hold oceans of information, much of it gathered from the companies they regulate. 68 A few examples: FDA houses the largest known repository of clinical data" on prescription drugs and medical devices in the world-almost all of which is generated by industry and then submitted to FDA. 69 EPA maintains numerous databases on (inter alia) air and water pollution, environmental radiation, and the chemical and toxicological properties of pesticides. 70 The National Transportation Safety Board (NTSB) and FAA each hold vaults of information on commercial aircraft and airline accidents. 71 These examples are just the tip of the informational iceberg frozen inside the federal regulatory state. Van Zeckhauser & Edward Parson 73 have analyzed in more detail the enormous information flows into the federal regulatory state as a whole. Rather than retrace those authors' steps, I focus here on how federal regulators come to hold information on the businesses they regulate. I do so for two reasons.

First, the federal administrative state has changed significantly in recent decades and continues to change. Several interrelated trends have converged to sap many regulators' efficacy, ambition, and independence-among them declining appropriations from Congress, high turnover of agency staff, corporate capture of agency leadership, and executive orders that hamstring agencies' independence. 74 Rebuilding the federal regulatory state will require, inter alia, restoring agencies' information-gathering authority. Thus, the question of what precise information the federal regulatory state holds now is arguably less important than the question of what information it could collect, hold, and use in the future.

The second reason I focus on federal regulatory agencies' informationgathering capacity is to address a concern that reviving regulators' practice of publicizing corporate secrets will jeopardize other vital elements of the regulators' work. That concern has been elaborated most thoroughly by Elizabeth Rowe, 75 but it has been echoed by courts 76 and by agencies 73 See Cary Coglianese et al., Seeking Truth for Power: Informational Strategy and Regulatory Policymaking, 89 MINN. L. REV. 277, 305 (2004) (discussing the tactics that regulatory agencies use to elicit information). 74 See, e.g., Metzger, supra note 32, at 2 (noting antiregulatory actions, such as decreased funding and repealed regulations, during the Trump administration); Pozen, Transparency's Ideological Drift, supra note 55, at 123 ("[T]ransparency has become increasingly associated with institutional incapacity and with agendas that seek to maximize market freedom and shrink the state."); Cohen, The Regulatory State in the Information Age, supra note 32, at 375 ("[I]nstitutional disruption has provided new points of entry for power. Emerging, nontraditional regulatory models have tended to be both opaque to external observation and highly prone to capture."); Lisa Heinzerling, Quality Control: A Reply to Professor Sunstein, 102 CAL. L. REV. 1457, 1458, 1461-62 (2014) (noting the downfalls of both cost-benefit analysis and breakeven analysis in justifying regulations); Frank Pasquale, Cost-Benefit Analysis at a Crossroads: A Symposium on the Future of Quantitative Policy Evaluation, THE LAW AND POLITICAL ECONOMY PROJECT (Sep. 27, 2021), https://lpeproject.org/blog/cost-benefit-analysis-at-a-crossroads-the-future-of-quantitative-policy-evaluation/ [htps://perma.cc/3P9K-4BSG] (noting that during the Reagan administration costbenefit analysis "was almost always presented as a check on regulation, rather than a way to promote more effective regulation") 75 themselves. 77 The concern is that disclosure's short-term public benefits can easily be outweighed by harmful long-term ripple effects. If a regulator discloses secret information from even a single company, its "collegial" relationships with entire industries may be permanently altered. Thus, regulated entities may refuse to submit sensitive information to the regulator, or hide it from inspectors, or condition submission of information on the agency's assurance of secrecy. 78 That concern is important but manageable, in my view, for two main reasons. First, as this subpart shows, federal regulators have power to get information even if their relationships with industry become less "collegial." (Of course, one might argue, as Julie Cohen 79 and others have, that less collegiality between regulators and those they regulate might actually be good for regulation, on balance.) By and large, federal regulators simply do not have to rely on regulated entities' voluntary submissions to obtain good information. The myriad enabling statutes that create and empower federal regulatory agencies almost always empower those agencies to collect secret information from regulated entities, with or without regulated entities' consent. In this article, I summarize two varieties of that power-premarket approval and investigative. 80 Second, regulators can cultivate carefully bounded "gardens" of corporate secrets that constrain users' access and use to reduce financial harm to the sources of such secrets and protect regulators' relationships. These bounded gardens are the focus of Part II. 77 (Feb. 28, 2020), https://www.raps.org/news-and-articles/news-articles/2020/2/why-fda-cant-disclose-the-first-coronavirus-relat (quoting an FDA spokesperson who said that FDA relies on "the cooperation of the drug companies in order to obtain accurate information . . . and companies will be less willing to provide this voluntary information if they cannot trust FDA not to disclose commercial confidential information such as drug names, company names or exact location of facilities."). 78 See Rowe, Striking A Balance, supra note 68, at 794 ("ometimes [companies] are either unwilling to provide trade-secret information at all, or may be willing to provide the information if and only if the integrity and safety of the information will be fully protected against direct or indirect disclosure to competitors."). 79 See Cohen, The Regulatory State in the Information Age, supra note 32, at 413 ("In the informational era, thinking about the proper relationship between government and management requires a more measured and constructively critical approach.").

80 Any harms to the company whose secrets are disclosed, and any chilling effects felt industrywide, can be minimized through use of bounded information publicity, discussed in detail in Part II.

A minority of federal regulators possess a particularly potent tool to collect information from regulated entities: "premarket approval" power. When an agency possesses this power, a private entity seeking to sell a new good or service on the U.S. market must first apply for and receive the regulator's approval before it can legally do so. 81 Among the federal regulators that wield premarket approval power are FDA (with respect to essentially all prescription drugs 82 and vaccines 83 and some medical devices 84 ), EPA (pesticides 85 ), Department of Defense (military equipment and other defense contracting 86 ), and FAA (design and manufacture of commercial airplanes, operation of commercial airlines 87 ).

Under premarket approval review regimes, regulators require applicants to make certified submissions of large quantities of information on their products and services, which are then reviewed by the regulator to decide whether to approve or deny the application. FDA, for example, has for decades demanded that drug companies generate and submit reams of data as a condition of letting those companies' new drugs onto the U.S. market. 88 Regulated entities that decline to submit the required information are barred from the market. 89 Regulated entities have argued in the past 90 and may argue again that a regulator's decision to make submission of trade secret information a precondition of approval constitutes an unconstitutional condition, under a takings 91 or other constitutional theory. But the Supreme Court has foreclosed this argument: in Ruckelshaus v. Monsanto, it held that a regulator (EPA) may legally require a regulated company (a pesticide manufacturer) to submit information on a product (a pesticide) that the regulator and regulated company agreed was a trade secret (the pesticide's health and safety properties) as a condition of permission to sell the product to the U.S. market. 92 Ruckelshaus declared (quoting Justice Brandeis) that such restrictions on manufacturers "are the burdens we all must bear in exchange for the advantage of living and doing business in a civilized community." 93 Ruckelshaus's holding that regulators may condition regulatory approval on mandatory submission and disclosure of information remains the law. To be sure, it has been criticized. 94 A 2002 en banc decision of the First Circuit attempted to cabin Ruckelshaus into near-oblivion, suggesting that it had effectively been overruled sub silentio by subsequent Supreme Court decisions. 95 In that case, the tobacco giant Philip Morris managed to defeat a Massachusetts state law that would have required it to disclose to regulators and the public a complete list of the ingredients in its cigarettes. 96 But, unlike the First Circuit, the Supreme Court has consistently reaffirmed Ruckelshaus-and this specific holding-as good law, as recently as 2019. 97 If the Court has cabined this aspect of Ruckelshaus at all, it is only in the modest respect that, to avoid imposing an unconstitutional condition, the regulator must confirm that the goods and services properly subjected to mandatory information submission and disclosure schemes pose some legitimate risk to the public-e.g., to environmental health or workers' safety. 98

Most federal regulators-even those that lack premarket approval authority-possess a second, similarly potent tool to collect data from regulated entities: investigation. 99 Agencies with investigative power can, through subpoenas and the like, demand that regulated entities submit confidential information, or can send auditors and inspectors to gather that information, with penalties for noncompliance. 100 As Van Loo has written, 96 Id. 97 Ruckelshaus was cited as good law in the Court's conservative-led 2015 and 2019 takings decisions in Horne and Knick. See Horne v. Dep't of Agric., 576 U.S. 351, 365-66 (2015) (characterizing the regulations in the case as creating a voluntary exchange of benefits); Knick v. Township of Scott, PA , 139 S. Ct. 2162, 2173 (2019) (upholding language in Ruckelshaus, which states that no takings occur unless administrative remedies have been exhausted). 98 See Horne, 576 U.S. at 366 (characterizing Ruckelshaus as "[a] case about conditioning the sale of hazardous substances on disclosure of health, safety, and environmental information related to those hazards" and describing government-granted permission to engage in commerce as a "valuable Government benefit"). This portion of Horne is entirely consistent with Ruckelshaus itself, which held that conditioning permission to sell a product on public disclosure about the product is particularly appropriate "in an area, such as pesticide sale and use, that has long been the source of public concern and the subject of government regulation." Ruckelshaus, 467 U.S. at 1007. Cf. Cedar Point Nursery v. Hassid, 141 S. Ct. 2063, 2079 (2021) ("[T]he government may require property owners to cede a right of access as a condition of receiving certain benefits, without causing a taking. . . . When the government conditions the grant of a benefit such as a permit, license, or registration on allowing access for reasonable health and safety inspections, both the nexus and rough proportionality requirements of the constitutional conditions framework should not be difficult to satisfy."). 99 In this paper, I use the term "investigation" broadly, to refer to all information-gathering activities that do not involve premarket approval or rely on voluntary submissions of information by regulated entities. As such, the term "investigation" covers not just formal investigations-e.g., those made pursuant to a specific consumer complaint-but also less formal information-gathering. "Investigation" includes what Van Loo terms "visitation" and "reporting" and encompasses regulators' on-site inspections, subpoenas of records, interviews with employees, etc. See Van "[i]n many agencies, regulatory monitors combine prosecutors' enforcement and adjudication authority with the patrol function of police officers and investigatory function of detectives." 101 The only real limit is that the information gathering must serve the regulator's statutorily-defined regulatory function. 102 Among the many federal regulators with strong investigative authority resources are the U.S. Department of Agriculture (USDA) (which, inter alia, sends investigators into slaughterhouses and meat processing plants 103 ), Centers for Medicare & Medicaid Services (CMS) (which investigates, inter alia, medical testing laboratories 104 ), EPA (which investigates, inter alia, water pollution, 105 oil tankers, 106 and makers and distributors of pesticides 107 ), FAA (which investigates, inter alia, aircraft manufacturers and commercial airlines 108 ), FDA (which investigates, inter alia, drug manufacturing facilities 109 and clinical trials 110 ), FTC (which has wide-ranging authority to investigate most any corporate activity that affects competition and consumer welfare 111 ), the Department of Health and Human Services' (HHS) Office [Vol. 171: 1319 for Civil Rights (OCR) (which investigates healthcare providers' compliance with medical data privacy rules and federal civil rights laws 112 ), and NTSB (which investigates the causes of aviation and other transportation accidents 113 ). In each case, agency inspectors have legal authority to collect confidential information from regulated entities and authority to retain and use what they collect.

The previous subpart described how federal regulators gather secret information from industries they regulate. This subpart turns to how regulators share those secrets with the public-and whether they share at all.

Today, federal regulators tend to keep corporate secrets secret. True, some federal regulators maintain programs of broad proactive disclosure of corporate secrets of public interest, and these programs underscore the social value of such disclosure. However, these proactive programs are scattered, and anecdotal evidence suggests they have dwindled in recent years.

A few federal regulators maintain effective programs of proactive disclosure of corporate secrets. Like FDA's disclosure of manufacturing problems at Winthrop Chemical, 114 these programs inform the public of corporate malfeasance and keep regulators themselves publicly accountable.

Here are three examples: 1. For years, FDA has consistently publicized reports prepared by FDA inspectors that document deviations from Current Good Manufacturing Practices in pharmaceutical manufacturing facilities around the world. 115 For example, between 2016 and 2020 FDA published a series of these reports documenting ongoing mold contamination at an ostensibly sterile drug https://www.bloomberglaw.com/document/X4QGLMRK000000 [https://perma.cc/96P3-H5LC] (discussing calls for the FTC to use its inquiry authority to regulate tech companies' use of data and protect consumer privacy).

112 Infra § III.B. 113 See The Investigative Process, NTSB, https://www.ntsb.gov/investigations/process/Pages/default.aspx [https://perma.cc/6VMG-K5TU] (describing the NTSB's investigative process). 114 See Swann, supra notes 1-7 and accompanying text. 115 See Inspection Observations, FDA (Nov. 24, 2020), https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/inspection-references/inspectionobservations [https://perma.cc/QG95-FHVE] (describing "Form 483" reports); ORA FOIA Electronic Reading Room, FDA, https://www.fda.gov/about-fda/office-regulatory-affairs/ora-foia-electronic-reading-room [https://perma.cc/FJ7B-YPXG] (providing links to Form 483 reports).

Publicizing Corporate Secrets 1341 manufacturing plant in Kansas operated by Pfizer. 116 Although the Pfizer plant still suffered from problems in early 2020, media coverage (plus FDA's chastisement) led Pfizer to make "significant management changes" between their 2018 and 2020 inspections, which helped lead to an improved rating at the 2020 inspection at the Kansas plant-just in time to begin packaging and shipping the Pfizer-BioNTech COVID-19 vaccine. 117 Moreover, after the January 2020 report, a Pfizer spokesperson announced that "'significant investments have been made' in resources, equipment and the facility." 118 2. The Centers of Medicare & Medicaid Services (CMS), which regulates most medical laboratory testing in the U.S., similarly publicizes its laboratory inspection reports as a matter of standard practice. 119 In CMS's words, the agency makes such reports-so-called "CMS Form 2567"-"publicly available through a variety of settings as part of the Department's commitment to transparency, and to providing all health care consumers and the general public with access to quality and safety information." 120 In 2016, CMS disclosed an inspection report cataloguing rampant problems in the central lab of the then-high-flying, now-infamous Silicon Valley biotech startup Theranos, which created "immediate jeopardy to patient health and safety." 121 The report disclosed technical flaws in the Edison, a proprietary, secret, and supposedly highly innovative blood testing device developed by Theranos. 122 116 See Sarah Jane Tribble, Pfizer's Newest Vaccine Plant Has Persistent Mold Issues, History of Recalls, KAISER HEALTH NEWS (Mar. 10, 2021), https://khn.org/news/article/pfizer-new-vaccine-plant-persistent-mold-issues-history-of-recalls/ [https://perma.cc/5D72-RWGC] ("Pfizer's management knew last year there was 'a mold issue' at the Kansas facility now slated to produce the drugmaker's urgently needed covid-19 vaccine, according to a Food and Drug Administration inspection report."). 117 See Suzanne Elvidge, Troubled Pfizer plant faces more criticism in Form 483, BIOPHARMA DIVE (Dec. 13, 2018), https://www.biopharmadive.com/news/pfizer-mcpherson-form-483-fda-warning-manufacturing/544242/ [https://perma.cc/WNT3-BL2P] (describing the FDA's Form 483 report and related issues at the Pfizer plant in McPherson, Kansas); Tribble, supra note 116 (reporting that the Pfizer plant received a better rating from the FDA in 2020 than in 2018, and describing facility changes after the 2020 report).

118 Tribble, supra note 116. 119 See JOHN CARREYROU, BAD BLOOD 284 (2018) ("CMS usually made such documents public a few weeks after sending them to the offending laboratory, but Theranos was invoking trade secrets to demand that it be kept confidential."). [https://perma.cc/8DVJ-DHDW] ("Portions of the inspection report that CMS had initially redacted included references to the Edisons, Theranos's family of proprietary blood-testing devices. Those passages, which are no longer [Vol. 171: 1319 Once released, CMS's report was dissected by independent experts, who declared the Edison "not reliable enough to form the backbone of a lab service." 123 Shortly thereafter, Theranos publicly voided or revised tens of thousands of test results obtained on the Edison in 2014 and 2015 124unreliable results that had shaped doctors' care and harmed patients' health. 125 CMS's disclosure thus helped to drive a dangerous device out of use, and Theranos itself went out of business two years later. 126 3. In June 2021, the National Highway Traffic Safety Administration (NHTSA) issued a new order requiring automakers, tech companies, and other entities that design and operate vehicles equipped with advanced driver-assistance and fully automated driving systems-so-called "selfdriving cars"-to submit crash data promptly after any crash. 127 NHTSA's order was explicit that the goal of this effort is not just to gather information but to disseminate it: except for a few categories of information defined by the agency (not industry) as protected "confidential business information," NHTSA has vowed it "will not keep this information confidential" and "intends to make it publicly available." 128 NHTSA's acting administrator stated that "gathering data will help instill public confidence that the federal government is closely overseeing the safety of automated vehicles" and that "[a]ccess to [driverless vehicle] data may show whether there are common patterns in driverless vehicle crashes or systematic problems in operation."foot_1 As of November 2022, the NHTSA has disclosed data from 18 fatal accidents it said involved advanced driver-assistance. 130 (Almost all of these accidents involved a Tesla.foot_3 )

The above examples of proactive information publicity programs at federal regulatory agencies are isolated. In recent years, many federal regulators-even some of the same regulators that once promoted proactive information publicity programs-have resisted calls to share secret information on the businesses they regulate. The story of FAA's ongoing refusal to disclose data on Boeing's 737 MAX is no outlier. 132 Take fracking. Consumer groups, environmentalists, and scientists have fought, for years, to get information on the potentially toxic chemicals used in fracking fluid, which can poison soil and water. Despite these efforts, the federal regulators that hold this information-EPA and Bureau of Land Management (BLM)-have refused to disclose it. 133 A representative of the environmental group Environmental Integrity Project (EIP) said it had "long pressed the EPA to have the oil and gas industry report fracking fluid ingredients under an EPA program called the Toxic Release Inventory, a public database of hazardous chemicals and wastes the regulator compiles."foot_6 "The regulator, not the company, determines if chemicals can be kept from public view as a trade secret"-and the EPA chose secrecy. 135 BLM too: In 2015, BLM promulgated a rule that promised to begin public disclosures of the chemicals in fracking fluids, but the rule was challenged by fossil fuel industry groups and then rescinded under President Trump before the agency disclosed any secret formulas. 136 President Biden has not reinstated the rule.

Relatedly, under the Trump administration, multiple federal regulators that had historically cultivated important proactive disclosure programs ended them. As of writing, most of these disclosure programs have not been revived under President Biden.

For example, for decades, the USDA disclosed inspection reports compiled by the Animal and Plant Health Inspection Service (APHIS). These reports documented mistreatment and death of animals in research laboratories, zoos, equestrian centers, and other businesses that rely on animals. 137 In 2017, the USDA removed all such reports from its website, reportedly under pressure from businesses that had been criticized and lost business after disclosures of abuse. 138 In 2020, after animal welfare groups "filed several lawsuits aimed at forcing the agency to restore the records" and successfully lobbied Congress to bring back a public database of the reports, USDA restored these reports to its website and added updated records. 139 Similarly, for decades the FDA maintained a program in which, upon approval of a new drug or vaccine, it disclosed detailed "reviews" prepared by its expert scientists that summarized the product's therapeutic, chemical, and other properties for the public. 140 In July 2019, the FDA announced that it will cease posting complete reviews and instead make public only a single condensed "integrated review." 141 The FDA's shift to less information-rich, more "integrated" reviews was welcomed by many in the industry 142 but criticized by dozens of academics (including me), who observed that it would "deprive researchers . . . of valuable information and data" otherwise inaccessible to the public. 143 Around the same time, the FDA retreated from other nascent agency efforts at proactive disclosure of information of public interest. It abandoned one initiative to share agency-generated analyses, so-called Complete Response Letters, that illuminate the safety and efficacy data on not-yetapproved drugs 144 and abandoned a second initiative to publicize nearcomplete Clinical Study Reports (CSR) that would have provided a detailed look at important clinical trials on FDA-approved drugs. 145 Medical researchers and consumer watchdog groups such as Public Citizen had advocated these disclosure programs for years and lamented the FDA's retreats. 146 But the pharmaceutical industry cheered. One of the two leading 140 See Matthew Herder, Christopher J. Morten & Peter Doshi, Integrated Drug Reviews at the US Food and Drug Administration-Legal Concerns and Knowledge Lost, 180 JAMA INTERNAL MED. 629, 629 (2020) (describing the benefits of the antecedent review process). 141 See id. ("The disciplines will collectively generate an integrated review-a 'collaborative document with input from clinical, clinical pharmacology, biostatistics, toxicology reviewers, and other disciplines based upon the issues raised by the application.'" (internal citations omitted)). 142 144 See Nick Paul Taylor, FDA Chief Gottlieb Backs Away from Plan to Publish CRLs, FIERCEPHARMA (Jan. 17, 2018), https://www.fiercebiotech.com/biotech/fda-chief-gottlieb-backs-away-from-plan-to-publish-crls [https://perma.cc/DG4X-GMAT] ("[R]esearchers, investors and other interested parties rely on the honesty and transparency of the companies that receive CRLs [to learn why a drug was rejected by the FDA]"). 145 See Zachary Brennan, FDA Ends CSR Pilot, Plots New Approach for Disclosing Study Reports, RAPS REGUL. FOCUS (Mar. 26, 2020), https://www.raps.org/news-and-articles/news-articles/2020/3/fda-ends-csr-pilot-plots-new-approach-for-disclosi [https://perma.cc/T2EK-QM5M] ("The [FDA] . . . ended a fledgling pilot program that was part of an effort to provide more transparency on the drug approval process"). 146 pharma industry trade organizations had expressed "serious concerns" with the FDA's rescinded plan to publicize CSRs, alleging (unsubstantiated) incompatibility "with global disclosure and data protection policies." 147 The other leading trade organization similarly contended that the same rescinded plan had threatened "commercially confidential information" necessary "to protect a Sponsors' intellectual property rights and further commercial development." 148 Graves and Katyal document additional vivid examples of federal regulators withholding information despite public outcry, such as the EPA's refusal to share data on Teflon. 149 In short, regulators' current programs for proactive disclosure of corporate secrets of public interest within their possession are important but scattered.

The apparent trend away from proactive public disclosure of corporate secrets has occurred even as the U.S. government has committed itself to increasing levels of "open government" and "open data." 150 Over the past two decades, major federal initiatives along these lines, such as the Obama Administration's Open Government Initiative 151 and 2019's OPEN Government Data Act, 152 have expanded public access to some forms of data held by the U.S. government. Much of this data is not just generated by the government but is about its very operation, providing information on the U.S. government's own spending and performance in areas such as health, education, and climate policy. Through such various open government initiatives, the U.S. government has arguably made itself more open to public scrutiny than ever, even as it shields the industries it regulates from the same. 153

The preceding subpart showed that today's federal regulators do not maintain consistent or effective proactive disclosure programs to share secret information on corporate activity, even when it is of major public interest. As a result, the public often turns to "self-help." That is, journalists, consumer organizations, activists, academics, and other interested citizens try to obtain pertinent information on corporate conduct with other tools.

But those tools are inadequate. The most prominent such tool-FOIAsuffers from deep structural problems and is today very difficult to use to obtain information on corporate conduct. Other tools, including disclosure by state-level regulators, disclosures in litigation, and reliance on individual whistleblowers "on the inside," are likewise inadequate. These inadequacies underscore the need for substantially expanded proactive disclosure by federal regulators-the "information publicity" that this paper proposes in detail in Part II.

On its face, FOIA seems the perfect tool for members of the public to obtain information from federal regulators. FOIA ostensibly requires any federal agency subject to FOIA to make information-"records"-within its possession "promptly available" to "any person" who requests it. 154 FOIA makes disclosure the default rule, thought it carves out nine seemingly narrow categories of information as exempt from the presumption of disclosure.

Yet, in reality, FOIA has four key flaws. 155 First, FOIA requests are reactive and require the requester to know precisely what information she needs before she asks. 156 Second, FOIA requests are slow, sometimes taking years to produce the documents the requester seeks. 157 Third, FOIA requests are resource-intensive for requesters, often requiring sophisticated and expensive legal help. 158 Fourth, FOIA requests are highly deferential to 153 See generally Pozen, supra note 55; see also Kapczynski, supra note 27. As Pozen, Kapczynski, and others have argued, it's no surprise to see these two trends occur together; transparency has been weaponized as a tool against the state.

154 5 U.S.C. § 552 (2018). 155 Kapczynski and I described these at greater length in a recent paper. Morten & Kapczynski, supra note 54, at 520. 156 Id. 157 Id. at 521. 158 Id. [Vol. 171: 1319 industry; agencies can and do legally withhold information that regulated entities ask the agencies to keep secret. 159 Today, FOIA offices throughout the federal administrative state are overwhelmed with requests. Kwoka has calculated that in just 2013 and 2014, federal agencies received over 700,000 FOIA requests. 160 The average FOIA request takes months to fulfill, and complex requests often linger for years. 161 One vivid example: in response to a 2021 FOIA request for copious data on Pfizer's COVID-19 vaccine, FDA's lawyers asked a court to allow fifty-five years to fulfill it. 162 The never-ending flood of requests to federal regulators comes mostly from commercial users-often public corporations-using FOIA to gather "[c]ompetitive [i]ntelligence" on the regulator's plans as well as their direct competitors. 163 Each FOIA request requires a bespoke response, even if numerous requesters seek the same types of information repeatedly. The result is enormous burden on federal agencies. As Kwoka has described, "agencies spend millions-and sometimes tens of millions-of dollars processing FOIA requests, and recoup very little of the costs through fees paid by requesters, even commercial requesters." 164 The FDA alone spent over $300 million responding to FOIA requests between 2008 and 2017. 165 Given the backlog and burden of responding to FOIA requests, agencies have understandable incentives to offload some of the work. When a FOIA request seeks information submitted by a third party, agencies have a perfect excuse to offload-in fact, a legal obligation to do so. Pursuant to a Reaganera executive order, No. 12,600, 166 that has since been encoded into ubiquitous regulations, 167 federal regulators must notify a regulated entity before disclosing, to a FOIA requester, information designated confidential by that entity. The effect is that regulated entities typically get a first cut at proposing what to disclose and what to withhold.

Regulated entities have exploited this procedure to claim massive swaths of information as withholdable under FOIA. One of FOIA's statutory exemptions, Exemption 4, permits an agency to withhold not just trade secrets but the broader category of confidential commercial information (CCI) from FOIA requesters. 168 The category of CCI has always been broad, and thus problematic for FOIA requesters. 169 But in 2019, the Supreme Court made a bad situation even worse. As Deepa Varadarajan has described, the Court's Food Marketing Institute v. Argus Leader Media decision dramatically "expand[ed] the private sector's ability to shield information provided to the government from disclosure." 170 "Upending four decades of circuit court precedent, the Court held that information can be withheld from FOIA disclosure as 'confidential' so long as the submitter . . . treats it as private" 171without requiring anything more. The early evidence we have on the effects of Food Marketing Institute indicate that federal agencies are using the decision to defer more than ever to industry-and thus keeping more corporate secrets than ever from FOIA requesters. 172

If FOIA is broken, does the public have other tools to obtain corporate secrets of vital public interest? In short, no. Here I will briefly describe three alternatives to FOIA and explain why they too are inadequate.

State governments regulate the same industries that the U.S. government does. That begs the question of whether requests made under state public records laws could fill the gap left by FOIA. That is undoubtedly true in some cases. But Christina Koningisor has shown that state public records requests 167 See, e.g., 21 C.F.R. § 20.61(e)(1) (2021) (requiring the FDA to make reasonable efforts to notify the submitter of any FOIA requests for secret information that may contain trade secrets or CCI and giving the submitter an opportunity to submit objections to disclosure).

168 5 U.S.C. § 552(b)(4). 169 See Deepa Varadarajan, Business Secrecy Expansion and FOIA, 68 UCLA L. REV. 462, 466 (2021) (discussing how the broad right of access provided by FOIA is subject to certain constraints to balance the public's right to know with other governmental and private interests). 170 Id. at 500. 171 Id. at 516. 172 See id. at 499-500 (describing cases in which district courts have described plaintiffs' burden as harder to meet and noted changes in agency withholding behavior after Food Marketing Institute).

tend to be even more difficult than federal FOIA requests, and state agencies even more secretive. 173 As another alternative, civil and criminal litigation can provide invaluable, otherwise secret information on corporate activity that threatens public health and other interests. 174 For example, tort litigation has for decades unearthed otherwise secret information on the safety and efficacy of medical products. 175 However, information via litigation is no systemic solution. Litigation is rare and slow. Information on troubling corporate conduct may not emerge for years or even decades. 176 And overprotection of trade secrets is a problem for courts just as it is for agencies. For example, Rebecca We xler has documented how overbroad exercise of the trade secret privilege in criminal cases has stymied disclosure of information on technologies used by law enforcement, including DNA-matching and facial recognition software. 177 A team of investigative journalists at Reuters has shown that judges' negligent sealing of information alleged to be trade secrets (but often not actually trade secrets) hid, for decades, everything from the extent of opioid abuse knowingly fueled by prescription drug manufacturers 178 to the deadly rollover risk of General Motors' SUVs. 179 Like litigation, individual whistleblowers also provide a vital stream of information on illegal corporate activity. Think, for example, of the Theranos employees, Erika Cheung and Tyler Shultz, who bravely informed CMS and the media of improprieties in Theranos's blood testing laboratories. 180 However, reliance on individual employees to blow the whistle on dangerous corporate activity is no structural solution. In addition, existing whistleblower laws in the United States provide employees with insufficient incentives and protections. 181 Those same Theranos employees, Cheung and Shultz, faced intense legal threat from Theranos's lawyers and incurred substantial financial losses and stress as a result of their decision to divulge Theranos's secrets in this way. 182 As Katyal and Graves have explained, "[d]espite recent legal protections for whistleblowers, secrecy can still remain paramount, harming the public interest in exposing wrongdoing." 183 That leaves federal regulators' information publicity abilities as our best hope. Part I described the unsatisfactory, even dangerous, status quo we live under. Despite holding some of the world's largest reservoirs of information concerning public health and safety, environmental safety, and other matters of vital public interest, U.S. federal regulatory agencies disclose little. Regulators disclose little even though sharing some of these secrets may be more vital than ever to protect public health and safety, the environment, consumer welfare, labor rights, and democracy itself. Where do we, as a country, go from here?

In this Part, I propose a solution, or at least a step toward one. That step is "information publicity," to inform, enrich, and protect the public. This proposal is this article's main normative contribution: a new theory of how administrative agencies should govern information and disseminate it to the public. I argue in this Part that the federal regulatory state can and should undertake a comprehensive, intentional program of information publicitycontrolled, bounded disclosure of corporate secrets to the public, including secrets that merit the legal protections of trade secrecy.

I build this theory in three subparts. First, in subpart II.A, I show that when agencies elect to disclose information proactively, they are free to control who gets access to the information and on what terms. This feature of proactive information disclosure distinguishes it from reactive disclosures to FOIA requesters, which, by statute, must be made unconditionally, to all requesters.

Given this feature, I then argue in subpart II.B that federal regulators should cultivate bounded "gardens" of secret corporate information, accessible to only to trustworthy users and then only on the regulators' terms. That is, federal regulators can and should provide moderated access to corporate secrets subject to both legal and technical limits, which dictate which users get access and constrict the uses those users make of that information. This is "information publicity," distinct from blunt, unfettered information disclosure. By bounding information gardens carefully, federal regulators can foster uses that maximize public benefit and prevent, or at least discourage, those uses of commercially valuable secret information that would most harm the sources of this information. In fact, successful proof-ofconcept models for these agency-moderated bounded gardens of information already exist. A handful of federal agencies in the U.S. and Canada have quietly pioneered programs of what are-in substance if not in nameinformation publicity: they constrain access and use of valuable agency-held information through contract law, technical limits on information access, and other bounds.

Subpart II.C proposes a procedural framework for agencies to set those boundaries. Balancing the potential benefits of (controlled) disclosure against its harms can be difficult, but there are procedures an agency can employ to gather relevant information and make wise choices.

Part II focuses on what I believe agencies should do with corporate secrets of public interest. The next part, Part III, "shows my work." That is, Part III explains why the proposals of Part II are legal under existing law-even when the corporate secrets to be publicized are bona fide trade secrets.

A simple but important legal insight forms the basis of this article's information publicity proposal: when federal agencies disclose information proactively, they set the rules of that disclosure-when, to whom, and on what terms.

This insight may seem trivial or self-evident to some readers. The insight is stated plainly in some basic treatises on administrative and information law. As James O'Reilly's Federal Information Disclosure puts it,

[E]xcept where Congress actually mandated withholding . . . , [an] agency has very broad discretionary choices [about disclosure] . . . . Agencies can publish, place on their websites or otherwise disseminate any document that is not required to be withheld under another statutory requirement. 184 But others will be surprised to learn that federal agencies make their own rules when they disclose information proactively. The same O'Reilly treatise characterizes this key insight as "a crucial fact, often overlooked." 185 How did it come to be overlooked? Perhaps because of the dismal history told in Part I. Part I showed that the federal regulatory state's proactive disclosure programs are scattered and limited, and that FOIA, flawed as it is, is today the dominant means by which the public obtains information from federal regulators. FOIA's dominance may have fueled a mistaken perception among scholars, information users, and even agencies themselves that all information disclosure by federal agencies must proceed via FOIA request, or must follow the procedures of FOIA. 186 184 1 James T. O'Reilly, Fed. Info. Disclosure § 9:1 (2022). 185 Id. 186 See, e.g., FOOD DRUG COSM. L. REP. ¶ 2147 (2009) (stating, overbroadly, that "[t]he Freedom of Information Act (FOIA) governs the public's access to information held by federal agencies in the conduct of their business"); Matthew B. Tropper, Patentability of Genetically Engineered Life-Forms: Legal Issues and Solutions, 25 J. MARSHALL L. REV. 119, 140 (1991) (stating, overbroadly, that "[t]he FOIA controls dissemination of government-held information"). Part III shows that FOIA alone does not actually control federal agencies' information disclosure.

Under FOIA, disclosure is reactive, unfettered, decontextualized, and blunt. Under FOIA's standard process for disclosure, an agency waits for a FOIA request to come in and then conducts a responsive search, gathers relevant records, and determines whether it has a legal basis to redact or withhold them. By FOIA's express statutory text, any information for which the agency lacks a legal basis to redact or withhold must be disclosed without restriction or condition. That is, if no exemption or exclusion applies to a piece of information, the agency must disclose it to any and all who request it, regardless of who the requester is or how they plan to use it. 187 FOIA treats all requesters equally, with minor exceptions. 188 That means FOIA treats public interest groups that intend no commercial use of information they obtain as if they were direct competitors of the source of a corporate secret. 189 As the DOJ put it in 2009, "Neither the willingness of the requester to restrict circulation of the information nor a claim by the requester that it is not a competitor of the submitter should logically" bear on the question of whether to disclose or withhold. 190 "The question is whether 'public disclosure' would cause harm; there is no 'middle ground between disclosure and nondisclosure.'" 191 Faced with FOIA's all-or-nothing, dichotomistic choice between total secrecy and total disclosure, courts and agencies alike have Act, 165 U. PA. L. REV. 1097, 1100-04 (2017) (discussing FOIA's decontextualized quality); Kwoka, FOIA, Inc., supra note 160, at 1372-78 (summarizing the FOIA request process and challenges journalists face with FOIA requests); Morten & Kapczynski, supra note 54, at 520 ("FOIA generally requires a federal agency to make information-'records'-within its possession 'promptly available' to 'any person' who requests that information."); cf. Schiffer v. FBI, 78 F.3d 1405, 1411 (9th Cir. 1996) (holding that a federal agency cannot use a protective order to constrain a FOIA requester's use of information received pursuant to a FOIA request).

188 By statute, agencies subject to FOIA must offer fee waivers and expedited processing to some requesters. See 5 U.S.C. § 552(a)(4)(A), (a)(6)(E). In practice, noncommercial, public-spirited FOIA requesters regularly get fee waivers, but expedited processing is granted in fewer cases. See, e.g., Mark. H. Grunewald, E-FOIA and the "Mother of All Complaints:" Information Delivery and Delay Reduction, 50 ADMIN. L. REV. 345, 364 (1997) (noting that the "vast majority" of FOIA cases "do not meet the standard" for expedited processing). Neither fee waivers nor expedited processing affect the ultimate level of access the FOIA requester receives. 189 See, e.g., Pub. Citizen Health Rsch. Grp. v. FDA, 185 F.3d 898, 904 (D.C. Cir. 1999) (explaining the Supreme Court has been clear that the identity of the requester does not bear on whether disclosure of a document is warranted). But see id. at 908-10 (Garland, J., concurring) (reasoning that FOIA does authorize agencies and courts to weigh whether a FOIA requester's use of information will benefit the public in their determination of whether the FOIA exemption protecting trade secrets and CCI applies); GC Micro Corp. v reason to err on the side of caution and keep secret any secret information that has even an iota of potential commercial value to competitors.

Proactive disclosure of information by federal agencies is appealing in significant part because it offers a way to escape FOIA's blunt choice between total disclosure and total secrecy. When disclosing information proactively, agencies have "very broad discretionary choices" about when, how, and to whom to disclose. 192 Unlike with FOIA requests, when making proactive disclosures, agencies are free to ask who will use the information, and how, and to limit disclosure accordingly. Agencies can, for example, selectively publicize information-permitting and encouraging certain uses of information by certain members of the public, in ways that simultaneously protect the information's integrity and serve the public interest-rather than bluntly disclosing the information unconditionally.

Privacy scholars have mounted similar descriptions and critiques of oncedominant, blunt and dichotomistic views of personal privacy and the purposes of privacy law. Solove, 193 Nissenbaum, 194 and Wo odrow Hartzog 195 are among the prominent scholars here. They have shown that, in privacy law, absolutist thinking about information as either entirely "public" or entirely "private" occluded, for decades, deeper questions about just how broadly individuals' personal information is and should be shared, with whom, in what contexts, and with what restrictions. For example, two decades ago, Solove convincingly critiqued the blunt and "outmoded" way that privacy "law often treats information in this black-and-white manner; either it is 192 O'Reilly, supra note 184, at § 9:1. See Part III for more. 193 See, e.g., Solove, Access and Aggregation, supra note 55, at 1140-41 (summarizing Solove's critiques of some facets of privacy law); DANIEL J. of what is public is often just the threshold line that is drawn somewhere on the spectrum of things that range from completely obscure to totally obvious or known . . . . [Yet] [p]rivacy law, it seems, is often content to treat disclosures to anyone outside of narrowly prescribed, formalized confidential relationships as 'public.'").

wholly private or wholly public." 196 The way forward for privacy law, argued Solove, was to "abandon the secrecy paradigm" and create gradated, contextspecific "control over and limitations on certain uses of information, even if the information is not concealed" entirely. 197 In parallel, Nissenbaum developed the concept of "contextual integrity" and a related framework for understanding and protecting the privacy of personal information. 198 Under Nissenbaum's framework, "private" information need not be kept purely secret; it remains private-its integrity remains intact-so long as contextrelative informational norms are respected. 199 To quote Nissenbaum, "[u]sually, when we mind that information about us is shared, we mind not simply that it is being shared but that it is shared in the wrong ways and with inappropriate others." 200 My critique of FOIA's dominant model of disclosure and its grip on our imaginations is inspired by these critiques of privacy law. In my view, the administrative law of corporate secrets is overdue for precisely the sort of shake-up that privacy scholars accomplished. 201 The next Subpart details my proposal for "information publicity" for corporate secrets-proactive, controlled sharing of corporate secrets by federal agencies with the public in a way that escapes the secrecy/disclosure dichotomy.

How should federal regulators exercise their power to disclose corporate secrets? In my view, they should take advantage of the flexibility of discretionary proactive information disclosure to cultivate protected, bounded "gardens" of corporate secrets. Within these gardens, information becomes accessible to select members of the public only on the regulators' terms. That is, federal regulators can and should provide moderated access to corporate secrets subject to both legal and technical limits that constrict what information users get access to and what uses those users make of that 196 Solove, Access and Aggregation, supra note 55, at 1177. 197 Id. at 1178. 198 See Nissenbaum, Privacy as Contextual Integrity, supra note 194, at 124-25 (introducing the "contextual integrity" analysis). 199 See Nissenbaum, PRIVACY IN CONTEXT, supra note 194, at 140 (explaining informational norms, context-relative informational norms, and contextual integrity). 200 Id. at 142. 201 Again, this paper is not the first to observe conceptual links between trade secrecy and privacy law. See, e.g., Samuelson, Privacy as Intellectual Property?, supra note 60, at 1151-52 (explaining three commonalities between trade secrecy and information privacy laws); Sandeen, Relative Privacy: What Privacy Advocates Can Learn from Trade Secret Law, supra note 60, at 673-692 (showing that the two fields share common doctrinal roots). Sandeen has also analyzed the distinct concepts of "disclosure" in trade secret, patent, and copyright law. Sharon K. Sandeen, A Typology of Disclosure, 54 AKRON L. REV. 657, 667 (2021).

information. This is "information publicity," distinct from blunt, unfettered information disclosure. This Section argues that by bounding these public gardens carefully, federal regulators can foster uses that maximize public benefit and simultaneously prevent, or at least discourage, uses of commercially valuable secret information that would most harm the sources of this information.

Later in this Section, I show that we already have working proof-ofconcept models for agency-cultivated bounded gardens of information. Under the radar of most scholars, numerous federal agencies have quietly pioneered programs of what are, in effect, information publicity, with access and use of valuable agency-held information effectively constrained through contract and technical controls.

Why information publicity through "bounded gardens" of information? In short, the goal of bounded gardens is to minimize harm inflicted on the source of the relevant corporate secret while simultaneously maximizing socially beneficial uses. Agencies can achieve both goals at once because there is a beneficial mismatch between the uses of corporate secrets most harmful to their sources and uses that most public interest groups, researchers, and other members of the public wish to make of the information. In other words, there are many socially valuable ways the public can use a corporate secret that do not destroy the economic value of the secret. The economic value of the trade secret endures even though the secret is no longer entirely secret.

What are the socially beneficial, noncommercial uses I propose be made of corporate secrets? Blowing the whistle on unsafe products and services to protect public health and safety or the environment? Exposing discriminatory or exploitative treatment of workers? Conducting novel secondary scientific research on industry-generated data sets? Informing the public about new developments in science and technology? Simply expanding public knowledge of (and thus democratic oversight of) regulated industries? Rebalancing, even in a limited way, some of the growing imbalance of information between private companies and the broader American public? Opening regulators themselves to greater public scrutiny, perhaps as a gesture to rebuild public trust?

The answer to all these questions is "yes." My goal in this paper is not to advance a single vision of the "public good" or an omniscient theory of when private secrets should be publicized. (I have neither.) Instead, my goal is to reopen a political debate over when and how federal agencies should wield their largely dormant but powerful authority over information. In my view, federal regulators themselves have not just power but unique competence to determine how information should be publicized.

Though overlooked today, dissemination of information has been a central part of federal regulators' mission and expertise since the dawn of the federal regulatory state in the Progressive Era. Regulators then emphasized the very same concept of "publicity" that this paper proposes-context-sensitive information disclosure by public agencies, intended to privilege noncommercial uses over commercial ones. As David Pozen has described, "[f]or American progressives at the turn of the twentieth century, the call for new laws mandating [regulatory] 'publicity' was tied to a reform agenda that aimed to limit the influence of big business and to produce more efficient, scientific, and democratically accountable regulation." 202 From that origin, regulatory "publicity" has always been distinct from mere disclosure. Publicity has always emphasized selective, contextual disclosure to particular audiences to serve particular goals and values within the agency's ambit. 203 In the 20th Century, regulators collected secret information from industry and then disseminated and contextualized it, at turns warning, outraging, teaching, and "improving" the public, and helping, over time, to form democratic competence and will. 204 Empowering the public to use information effectively was an essential function of the federal regulatory state, especially in fields of industry and activity where information is complex, new, or fast-changing, as was (and is) the case with technology industries. 205 (Recall the Winthrop Chemical example told in the Introduction, wherein the FDA not only warned the public away from a 202 Pozen, Transparency's Ideological Drift, supra note 53, at 108. 203 See id. at 113-14 ("Exposing the inner workings of institutions was not an end in itself, but rather a precondition for new modes of responsive regulation and democratic action. As attested by the introduction of the secret ballot and by Brandeis's own efforts to establish a right to privacy, progressives were willing to trade certain forms of openness for opacity where the risks to principled decision making or other values seemed too severe."). 204 Id.; see also Matthew Herder, Denaturalizing Transparency in Drug Regulation, 8 MCGILL J. L. & HEALTH S57, S61 (2015) (explaining the progressive tradition of "publicity" in Canadian consumer protection law in the late 19th and early 20th Centuries). 205 See Pozen, Transparency's Ideological Drift, supra note 55, at 102, 113-14 (describing how Progressives used publicity to promote economic fairness during the advances of the Gilded Age); Herder, Denaturalizing Transparency, supra note 205, at S61 (explaining the importance of publicity for Canadian federal regulation of food and drug technologies). For more examples of effective "publicity" in action, see generally Kapczynski, Dangerous Times, supra note 27, at 2359; Bradley C. Karkkainen, Bottlenecks and Baselines: Tackling Information Deficits in Environmental Regulation, 86 TEX. L. REV. 1409, 1411 (2008) (explaining that environmental regulation typically "place[s] the burden of acquiring or producing information, and then managing, analyzing, and evaluating that information, on the government-more particularly, on the responsible regulatory or resourcemanagement agencies"); Mary L. Lyndon, Information Economics and Chemical Toxicity: Designing Laws to Produce and Use Data, 87 MICH. L. REV. 1795, 1810 (1989) (explaining the challenges of publicity for chemical toxicity data). specific unsafe product but educated a then-nascent industry about safe manufacturing.) Effective information publicity spurred and ensured effective legislation, substantive regulation, and democratic oversight of industry and government alike. 206 As Brandeis wrote, a century ago, regulators' "publicity" can be "a remedy for social and industrial diseases." 207 ] The question of how, exactly, today's agencies should revive their authority to publicize corporate secrets is a complex factual and legal question, and certainly not an easy one. But in innumerable other contexts, these same regulators routinely generate, gather, and analyze factually complex evidence, solicit feedback from fractious stakeholders, and then make difficult choices. Such questions are exactly the sort that our political and legal system traditionally delegates to administrative agencies because of their unique expertise and structure 208 -and, indeed, a close look at many regulators' enabling statutes shows that Congress expressly empowered these agencies to ask and answer questions about whether and how to disseminate secret information. 209 The question of how agencies should wield their information publicity power is also a quintessential political question, suitable for contestation by our country's democratic process, messy and fragile as it is. Regulators are at least somewhat democratically accountable; presidents whose regulators err too far on the side of secrecy or disclosure may lose 206 that FDA has "special expertise and administrative experience" in interpreting its own enabling statutes and determining the proper contours of its own disclosure authority). 209 See, e.g., 7 U.S.C. § 136h(d)(2) (provision of FIFRA specifying that EPA may collect information on pesticides, including information "entitled to confidential treatment," and then, at its discretion, disclose it publicly "in connection with a public proceeding to determine whether a pesticide, or any ingredient of a pesticide, causes unreasonable adverse effects on health or the environment, if the [EPA] Administrator determines that such disclosure is necessary in the public interest."); 12 U.S.C. § 5512 (authorizing the Consumer Financial Protection Bureau to obtain secret information from the consumer finance industry and then "make public such information obtained by the Bureau under this section as is in the public interest," pursuant to the agency's own rules on confidentiality); 42 U.S.C. § 282(j)(3)(D) (provision of the Food and Drug Administration Amendments Act (FDAAA) of 2007 granting broad authority to the National Institutes of Health (NIH) to define an "expanded" set of information on clinical trials, mandate its submission to NIH by companies, universities, and other entities that run clinical trials, and then disseminate that information to the public, "[t]o provide more complete results information and to enhance patient access to and understanding of the results of clinical trials"); 49 U.S.C. § 40123 (provision of the Federal Aviation Reauthorization Act of 1996 specifying that FAA should withhold "safety or security related information" only if "withholding such information from disclosure would be consistent with the Administrator's safety and security responsibilities"). For more examples, see infra subsection III.B.1. popular support. (Consider that in the wake of the George W. Bush administration-widely perceived as secretivefoot_16 -Obama won the presidency on a platform that promised, among much else, "increasing public access to information," including a specific proposal to "conduct regulatory agency business in public." 211 ) In short, the question of what precise goals publicity of corporate secrets should serve is a question I think best left to the agencies.

Having said something about the intended benefits of publicity of corporate secrets, what about its harms? Compared to publicity's benefits, publicity's potential harms are simpler to define: in short, the legally and normatively relevant harm is use by competitors. The dominant theoretical justifications for legal protection of trade secrets 212 are that protection incentivizes the creation of socially valuable inventions, discourage overprotection of these inventions through actual secrecy, and promote "ethical competition." 213 All these justifications for trade secrecy law focus on mediation of relationships among existing and potential commercial competitors, and more specifically on protecting the rightful holder of commercially valuable information from misappropriation. 214 Thus, the core harm that trade secrecy law seeks to avert is competitive use of the information by a competitor of the holder of the trade secret. When publicizing corporate secrets, regulators can and should seek to avert this core harm.

Happily, the primary uses of corporate secrets that members and representatives of the public-consumer watchdogs, environmental and labor groups, academic researchers, patient activists, and so on-make are usually noncommercial and almost always noncompetitive. These people and groups typically have no interest in competing with the company that is the source of a given corporate secret. Instead, they typically seek to investigate and inform the public about features of the company's products and services, and often focus on harms-poisoned water, toxic drugs, erratic autonomous vehicles, racial discrimination against employees or customers, and so on.

Of course, if researchers use a corporate secret to establish and publicize a product's harm, the product's maker may lose business. Ye t any diminution in profits that follows the revelation that a company's products or services are unsafe, or that its business practices are unsavory, is not the "competitive" harm that trade secrecy law intends to prevent, nor is it the sort of harm that any part of our law seeks to prevent. As the Supreme Court announced in Ruckelshaus

[T]he value of a trade secret lies in the competitive advantage it gives its owner over competitors . . . . If . . . a public disclosure of [trade secret] data reveals, for example, the harmful side effects of the [trade secret] submitter's product and causes the submitter to suffer a decline in the potential profits from sales of the product, that decline in profits stems from a decrease in the value of the pesticide to consumers, rather than from the destruction of an edge the submitter had over its competitors, and cannot constitute the taking of a trade secret. 215 The D.C. Circuit has similarly stated that "[c]ompetitive harm [to the holder of proprietary information] should not be taken to mean simply any injury to competitive position, as might flow from customer or employee disgruntlement or from the embarrassing publicity attendant upon public revelations concerning, for example, illegal or unethical payments to government officials or violations of civil rights, environmental or safety laws." 216 [Vol. 171: 1319 Indeed, as Sandeen and Kapczynski have shown, trade secrecy law writ large was never intended to restrict noncompetitors' use of trade secrets in the same way it restricts competitors'. 217 To quote Sandeen,218 The rhetoric of "theft" that pervades trade secret law and accusations of cyberhacking suggests that many assume that all acts leading to the unauthorised acquisition of information should be deemed "wrongful'' but . . . a commitment to free enterprise and a competitive market environment requires a more nuanced view-one that recognises the value of information flows, particularly for information that is not protected by an existing body of law. This is particularly true if the subject information was acquired for a salutary purpose, such as to reveal criminal behaviour, share unprotected information or enhance competition.

The obvious solution, then, is information publicity-selective disclosure of corporate secrets to members of the public in ways that prohibit competitive uses. By cultivating bounded gardens of information publicity, agencies can unlock the benefits of disclosure without inflicting the harms to regulated entities that unfettered disclosure would. 219 As Fan put it, 217 See Sandeen, Relative Privacy, supra note 60, at 697 (in private-litigant trade secret misappropriation cases, "the analysis is contextual and depends on a number of factors, not the least of which is the relationship that exists between the trade secret owner and the person(s) to whom the information is disclosed"); Sandeen, Out of Thin Air, supra note 62, at 373-74 (describing the elements of a wrongful acquisition claim when trade secret misappropriation is viewed as a form of unfair competition); Kapczynski, The Public History of Trade Secrets, supra note 89, at 1381 ("Historically, and now, the primary ways to violate a trade secret are relational: they involve a breach of confidence or the violation of a promise."); see also Graves & Katyal, supra note 31, at 1345-47 (tracing trade secrecy's historical origins as mediating relationships among competitors); Du Pont v. Masland, 244 U.S. 100, 102 (1917) ("[T]he starting point for the present [trade secrecy dispute] matter is not property or due process of law, but that the defendant stood in confidential relations with the plaintiffs"). 218 Sandeen, Out of Thin Air, supra note 62, at 374. 219 Among other things, bounded disclosure is likely to preserve the legal status of trade secrets as trade secrets for purposes of private misappropriation litigation. That is, any corporate secrets that meet the relevant legal definition of a trade secret and are publicized by administrative agencies to a limited number of information users, subject to prohibitions on commercial use, will likely remain a trade secret in the eyes of the law. As Sandeen and Rowe have explained, "pursuant to the relative secrecy doctrine, the owner of information that would otherwise qualify for trade secret protection does not lose protection if the information is shared with others in a manner that is reasonable under the circumstances to maintain its secrecy." SHARON K. SANDEEN & ELIZABETH A. ROWE, TRADE SECRET LAW IN A NUTSHELL 76 (2nd ed. 2018); see also Sandeen, Relative Privacy, supra note 60, at 696-97 (explaining the relative secrecy doctrine). Trade secret owners routinely share trade secrets with licensees, pursuant to contracts that require confidentiality from the licensee; such sharing does not typically destroy the information's status as a trade secret. See SANDEEN & ROWE, supra note 220, at 76-77 (arguing trade secret law was meant to facilitate efficient sharing of information). In effect, the law of private trade secret misappropriation acknowledges, and has long acknowledged, that legal "secrecy" is contextual; it is really the administrative law of trade secrecy that has foundered on the secrecy/disclosure binary. And yet even "[b]ounded disclosure thus optimizes the utility of disclosure so that the benefits are enhanced while the costs are reduced." 220 To elaborate on the garden metaphor: Imagine (entirely hypothetically) that the NHTSA wanted to expand its nascent data-sharing program on selfdriving cars 221 to include not just crash data but also certain data collected from everyday driving. Researchers might reasonably argue that sharing this data would permit them to better understand the software and critique the claims made by car companies. Those companies might reasonably argue that sharing this data would make it dangerously easy for competitors to reverseengineer their proprietary and innovative software. To accommodate both arguments, NHTSA could create and maintain a "bounded garden" of information. In this garden, regulated companies' data sets, collected by NHTSA, become the precious "plants." NHTSA bounds the garden carefully and blocks competitors and frivolous users from even seeing the plants. NHTSA permits established safety researchers and other credible, noncommercial users into the garden, to scrutinize, query, and even download some data, but subject to strict conditions-no commercial use, no retransmission of data, and so on. (I say more on such conditions in the next section.) In effect, a few representatives of the public are allowed into the garden, to study and sample the informational plants' flowers and fruit under the watchful eye of the regulator, so long as these visitors are careful not to harm the plants in the process.

Here, again, are instructive parallels with privacy law. To talk, as Fan and I do, about enhancing the utility of disclosure of certain information while reducing or eliminating the costs of disclosure is, in effect, to talk about protecting the integrity of that information when sharing and using it in a new context, very much as Nissenbaum has theorized vis-à-vis governance of "private" personal information. 222 Privacy law and trade secrecy law alike are within the world of administrative law, under EPA's FIFRA-based regime for sharing trade secret pesticide data, controlled sharing of a source company's data with a competitor does not destroy the data's status as a trade secret vis-à-vis future competitors. Future competitors must continue to compensate the source company for access to the data. See Pesticide Registration Manual: Chapter 10 -Data Compensation Requirements, ENV'T PROT. AGENCY, https://www.epa.gov/pesticide-registration/pesticide-registration-manual-chapter-10-data-compensation-requirements [https://perma.cc/BV6Z-EZ7Q ] (describing the pesticide registration information an applicant must submit to comply with FIFRA). 220 Fan, Private Data, Public Safety, supra note 57, at 169; see also id. at 198-203 (arguing for bounded access to privately held data of public concern and the merits of this model over regimes of unconditioned disclosure).

221 Supra subsection I.B.1. 222 See Nissenbaum, Privacy as Contextual Integrity, supra note 194, at 138-40 (discussing contextual integrity when norms of appropriateness and distribution are upheld); Nissenbaum, A Contextual Approach to Privacy Online, supra note 194, at 33 ("Generally, when the flow of information adheres to entrenched norms, all is well; violations of these norms, however, often result in protest [Vol. 171: 1319 designed not to thwart all flows of information but to govern them toward normatively desirable ends. In a recent piece, Madelyn Sanfilippo, Brett Frischmann, and Katherine Strandburg made explicit the many lessons that the fields of privacy law, on one hand, and innovation and intellectual property law, on the other, hold for one another. They observed that "private" personal information is just "one type of knowledge resource, which can produce value when it is shared and managed appropriately," and that many of "[the] communities within which privacy is a hotly contested issue are also dealing with corresponding questions about" creation and governance of valuable knowledge-traditionally the core concern of intellectual property law and related fields. 223 Sanfilippo, Frischmann, and Strandburg map intriguing similarities between Nissenbaum's theory of contextual integrity for governance of private information and Ostrom's theory of knowledge commons for governance of innovative information, and they encourage further "exploration of intersections of privacy with commons arrangements focused on knowledge production and sharing." 224 The next subsection explores some of those intersections and proposes that, through "bounded garden" information publicity, the integrity of corporate secrets can be protected even as their secrecy is "violated" to create new knowledge.

Let's get practical. How, exactly, can agencies publicize corporate secrets for public good while prohibiting competitive uses and protecting their integrity as trade secrets?

Both legal and technical constraints on these gardens of information are possible and effective. I sketch three exemplary constraints below: (1) information use applications, (2) information use agreements, and (3) technical limits on access to information. These legal and technical constraints find meaningful real-world precedents in important but littlenoticed data-sharing programs already undertaken by federal agencies in contexts where similar pro-secrecy and pro-disclosure interests clash. For example, a combination of legal and technical constraints successfully

Publicizing Corporate Secrets 1365 mediates clashing interests in the context of medical data, where scientists clamor for broad access to data but patients and privacy advocates urge privacy-preserving restrictions on access and use of individuals' sensitive medical data. In sketching here the legal and technical constraints on information access and use that agencies may impose in their information publicity programs, I draw less from the trade secrecy context 225 than from the better-developed literatures around privacy law 226 and the open science movement. 227 To be clear, I do not propose that all the constraints enumerated below be imposed in every instance of information publicity. Instead, agencies can and should pick and choose among these constraints-and devise others. My main goal here is simply to illustrate that it is indeed possible, even practical, to publicize corporate secrets without destroying their commercial value. 225 To my knowledge, the only prior proposals in the legal literature for controlled disclosure by federal agencies of privately held trade secrets are Fan's bounded access model, see Fan, Private Data, supra note 55, at 198-99, and the "data publicity" for clinical trial data held by FDA, proposed by Kapczynski and me, see Morten & Kapczynski, supra note 52, at 540-49. 226 See Solove, Access and Aggregation, supra note 55, at 1195 ("When government discloses information, it can limit how it discloses that information by preventing it from being amassed by companies for commercial purposes, to be sold to others, or to be combined with other information and sold back to the government."); see also Nissenbaum, Privacy as Contextual Integrity, supra note 194, at 119-20 ("This Article seeks to shed light on the problem of public surveillance first by explaining why it is fundamentally irreconcilable within the predominant framework that shapes contemporary privacy policy, and second by positing a new concept-contextual integrity-to explain the normative roots of uneasiness over public surveillance."; Nissenbaum, A Contextual Approach to Privacy Online, supra note 194, at 32-33 ("This article explores present-day concerns about online privacy . . . . Finally, the essay lays out an alternative approach to addressing the problem of privacy online based on the theory of privacy as contextual integrity."); Nissenbaum, PRIVACY IN CONTEXT, supra note 194, at 91-98 (discussing the various ways in which the "private/public dichotomy" has guided the normative scope of privacy); Sanfilippo, Frischmann & Strandburg, supra note 222, at 6-8 (discussing and supplementing Nissenbaum's theories of information governance). 227

When sharing corporate secrets proactively, federal agencies can discriminate. That is, they can elect to publicize secret information to certain users, while sharing less information, or nothing at all, with others.

Information use applications that detail a prospective user's credentials, intended uses, and security practices can help agencies decide with whom to share corporate secrets, and on what terms. 228 In her proposal for agencyadministered bounded public access to private secrets, Fan puts it this way: Only those applicants that document their "ability to design and adhere to a data protection plan to ensure use . . . for the purpose of addressing important public health and safety issues would be allowed to access the database." 229 Agencies could also demand that prospective users submit detailed information use plans, spelling out exactly how they intend to use the secret information in socially beneficial ways. As I describe below, three existing information publicity programs administered by the National Institutes of Health (NIH), CMS, and Canada's national drug regulator require exactly this. 230 Agencies may refuse access to their informational gardens for any number of reasons-e.g., to prospective users who appear unable to make effective use of the publicized information (especially if technically complex), unable to disseminate their findings to the broader public, or likely to use the information in a way that competes with its source.

An information use agreement (or data use agreement) is simply a contract that governs transfer, maintenance, and use of protected information. These agreements are legal devices to constrain information users, and the constraints imposed can be positive as well as negative-they can discourage or prohibit information users from doing certain things and can equally well encourage or require information users to do other things. 231 228 Information use applications-often called data use applications-are widespread in voluntary data-sharing programs. For an example from the pharmaceutical and biotech context, see INST. OF MED. OF THE NAT'L ACADS., SHARING CLINICAL TRIAL DATA, supra note 226, at 149-53.

229 Fan, Private Data, supra note 57, at 199. Fan proposes that bounded access is the right model for disclosure "where public disclosure is otherwise barred by protections for trade secrets, property law, or contractual confidentiality terms." Id. As I explain elsewhere in this paper, trade secrecy law, constitutional law, and other sources of law do not actually prohibit outright disclosure even of bona fide trade secrets, as a general matter, though some federal agencies' enabling statutes do. However, I believe that Fan's bounded access proposal is normatively correct. 230 See infra subsection II.B.2.d. 231 See Discussion Framework for Clinical Trial Data Sharing, supra note 226, at 32-35 (describing qualifications for access and conditions for use of data in various initiatives for sharing clinical trial data).

These agreements can be paired with the information use applications described above; a prospective information user that clears the application is typically required to sign an information use agreement before it receives access to the agency's information.

Contract law is highly flexible, and the regulatory agencies that administer information publicity programs can devise and impose any number of different provisions on information users. For example, information use agreements can prohibit the user from making commercial uses of the information; prohibit the user from sharing the protected information with others; require the user to report, promptly, to the regulator any findings that implicate public health and safety; give the regulator a right to review any publications before publication; require the user to disseminate new knowledge to the public at large-e.g., through the medical or scientific literature, or through the news media; and require the user to destroy the information once analysis is complete.

Agencies can levy penalties for breach of any of these provisions, including a ban on future participation in the information publicity program and financial penalties. (Think here of literal gardens: Visitors who ignore instructions to stay on paths and end up trampling a flower will be banned from future visits.)

The two prior bounds on information access and use, information use applications and information use agreements, are administrative and legal in nature. They regulate information flows and protect information's integrity.

But, as Lawrence Lessigfoot_19 and othersfoot_20 have observed, technical architecture, too, can regulate flows of information. Agencies that undertake information publicity can contrive the architecture of information sharing in ways that shape access and use.

These technical limits may prove even more effective than legal ones. For example, regulators can build information publicity portals that permit information users to view and/or query proprietary information but not to download or copy in full. 234 Such constraints may successfully permit [Vol. 171: 1319 noncommercial uses of secret information while discouraging or preventing the directly competitive uses most harmful to the secret's source. (More garden analogy: These technical limits would work something like a fence ringing the trunk of a beloved fruit tree in a public park. The fence prevents people from climbing the tree and damaging its branches but allows people to enjoy its blossoms and pick its lowest-hanging fruit.)

For example, an academic or environmental advocacy group seeking to determine whether the fluid used in a particular location for hydrocarbon fracking contains a particularly hazardous chemical could query the EPA for the answer; the EPA could then publicize the presence or absence of the chemical, and its concentration, without revealing the entire chemical makeup of the fluid. Similarly, the FAA could conceivably provide groups seeking to scrutinize Boeing's 737 MAX MCAS software with access to portions of Boeing's code and other secret information (but not all)-enough to scrutinize and validate Boeing's claims but not enough build a competing product.

Why focus on these three constraints on information access and useinformation use applications, information use agreements, and technical limits? In part because each is already working in proactive information disclosure programs run by administrative agencies. That is, these three constraints already govern access to bounded gardens of otherwise-secret information currently cultivated by parts of the U.S. government (and, in one example, the Canadian government). These constraints determine which users access information; they dictate the range of uses users make of information; and they shape the flow of information from users back to the agency and to the public at large. These existing proactive information disclosure programs are-as best I can tell-little noticed and little theorized in the legal academic literature. But they are, in effect, proofs-of-concept for the information publicity I propose in this paper.

to download the data to their own computers. . . . This approach helps protect sponsors from secondary users' carrying out analyses beyond those proposed in the data request . . . ."); Discussion Framework for Clinical Trial Data Sharing, supra note 226, at 30 ("In some [data sharing models], the actual data are not provided to the requestor. Instead, data holders might run specific data analyses for approved requestors . . . . In another model, recipients . . . access and run queries on the data, but are not able to download or obtain copies of the data.").

Since the 2000s, NIH has maintained the Biologic Specimen and Data Repositories Information Coordinating Center (BioLINCC), a center that shares sensitive and scientifically valuable biomedical data with select requesters. 235 NIH created and administers the center, but much of the information contained in BioLINCC's databases is contributed not by NIH itself, but by nongovernmental entities. (Many of these entities are required to submit information to BioLINCC as a condition of taking grant money from NIH's National Heart, Lung, and Blood Institute (NHLBI). 236 ) BioLINCC's information-sharing program has proven popular and influential, as hundreds of requesters have sought and received access to thousands of data sets, leading to dozens of high-profile scientific and medical publications in cardiology, infectious disease, and other fields of research. 237 [Vol. 171: 1319 BioLINCC data does not typically implicate trade secrecy, but it does implicate individual patients' privacy. As such NIH avoids unconditioned disclosure of BioLINCC data and instead constrains access to and use of the data-making BioLINCC a bounded "garden" of information. BioLINCC requires information use applications, which must disclose would-be users' intended uses (their "Research Plan") and their data security practices and commitments. NIH discriminates among users: Commercial users can access only a subset of BioLINCC's data, and would-be data users that cannot muster a credible Research Plan are provided no access at all. 238 Before getting access to any BioLINCC data, information users must execute, with NIH, an information use agreement termed a "Research Materials Distribution Agreement" (RMDA). 239 The RMDA imposes various prohibitions and obligations on users. For example, the RMDA prohibits the transfer of BioLINCC data, or the use of data to identify specific medical study subjects. It also obligates users to destroy all downloaded data after research is complete, and to provide NIH with yearly updates on use of the data. 240 NIH warns that any information users who breach the RMDA may be denied further access to BioLINCC data. 241 No misuse of BioLINCC data has been reported in the many years of the center's existence.

ii. CMS's Medicare Data for Performance Measurement: Information Use Applications, Information Use Agreements & Technical Limits on Access to Information CMS is the single largest payer for healthcare in the United States and important federal regulator. 242 In 2011, under the Affordable Care Act, CMS began publicizing certain information on the quality and costs of healthcare services and supplies that it pays for through Medicare-data for so-called "performance measurement." 243 CMS also shares other Medicare claims data with researchers on a more ad hoc basis, fielding requests through a dedicated Research Data Assistance Center (ResDAC). 244 Public sharing of Medicare claims data has since served a wide variety of useful ends: "[T]o describe patterns of morbidity and mortality and burden of disease, compare the effectiveness of pharmacologic therapies, examine the cost of care, evaluate the effects of provider practices on the delivery of care, and explore the effects of important policy changes on physician practices and patient outcomes." 245 For example, the nonprofit Health Care Cost Institute uses CMS's performance measurement data and other data to generate annual reports on regional, state, and national trends in healthcare spending for the general public; 246 it recently used this data to show that Medicare generally pays less for healthcare services than commercial health insurers. 247 Like BioLINCC data, CMS's Medicare data for performance measurement does not typically implicate trade secrecy, but it does implicate individual patients' privacy. As such, CMS, like NIH, avoids unconstrained disclosure of this data and instead constrains access and use-making this another bounded "garden" of information. To access any of this data, prospective information users must complete an elaborate, multi-phase application process administered by CMS.foot_22 Among other things, CMS demands that applicants prove "expertise and sustained [multi-year] experience" in health data analysis as well as "[e]xpertise in establishing, documenting and implementing rigorous data privacy and security policies including enforcement mechanisms." 249 As of September 2022, about 40 institutions-a mix of commercial, nonprofit, and academic-had met CMS's criteria and become so-called "qualified entities." 250 Once qualified, entities that seek CMS data must first execute data use agreements with CMS that require them to, inter alia, maintain privacy and security protocols and destroy all downloaded data once research is complete. 251 Qualified entities that use CMS data must provide annual updates to the agency, 252 and if a qualified entity breaches its data use agreement, CMS can impose penalties, including fines for any instances of individuals' private medical information kept insecurely. 253 CMS now gives qualified entities the option of visiting and querying data through a "virtual research environment" called the Virtual Research Data Center (VRDC); within the VRDC, users are prohibited (by the data architecture itself) from accessing personally identifiable information on individual patients. 254 This technical limit both protects the data's integrity and reduces access and infrastructure costs for data users (who no longer need to pay to store and secure local copies of the data).

iii. Health Canada's Public Release of Clinical Information and Paragraph 21.1(3)(c): Information Use Applications & Information Use Agreements Since 2019, Canada's central regulator of drugs, vaccines, and medical devices-Health Canada-has shared rich datasets from clinical trials of products it has approved, under the "Public Release of Clinical Information" (PRCI) program. 255 The data shared through PRCI is generated and compiled not by Health Canada, but by the drug and device companies who submit it when seeking product approval. 256 As of February 2023, data on over 340 distinct products, gathered from dozens of companies, have been posted to PRCI. 257 Academic researchers have used data shared via PRCI to analyze and communicate the safety and efficacy of important medical products, constituting an important check on and complement to the work of Health Canada, FDA, and other national regulators. For example, one academic group recently used PRCI data to show that extended-release oxycodone hydrochloride (better known under its brand name Oxycontin) was approved by Health Canada, the FDA, and other national regulators without evaluation of the risks of misuse and addiction, even though opioids were widely known at the time to be addictive. 258 The clinical trial data shared by Health Canada through the PRCI program implicates both patient privacy and trade secrecy. To protect these interests, Health Canada asks regulated entities to redact what it deems "confidential business information" (CBI)-essentially, trade secrets 259 -as well as information identifying individual trial participants before making the data accessible to routine users of PRCI. 260 Users who wish to access and use these redacted data sets may do so with few restrictions.

Yet Health Canada shares even more information-including unredacted trade secrets. According to Paragraph 21.1(3)(c) of the Canadian Food and Drugs Act, 261 Health Canada will share trade secrets (CBI) with certain users, on certain conditions. First, users must submit a data use application that proves their use is noncommercial and relates to "protection or promotion of human health or the safety of the public." 262 The application must also explain "[h]ow the results of the proposed project will be disseminated to the Canadian public." 263 Any users granted access must then sign data use agreements insisting "the specified CBI can be used only for the purposes of the proposed project and must be kept confidential using appropriate safeguards." 264 In the event that a data user detects a safety, efficacy, or quality problem, Health Canada requests that the user notify Health Canada as well as the public at large. 265 In 2018 a medical researcher, Peter Doshi, successfully used Paragraph 21.1(3)(c) to obtain detailed and previously secret data on the safety and efficacy of several medical products, including oseltamivir (Tamiflu) and 259 Health Canada's definition of CBI is nearly identical to the UTSA's definition of a trade secret. Health Canada defines CBI as "business information[] that is not publicly available . . . in respect of which the person has taken measures that are reasonable in the circumstances to ensure that it remains not publicly available, and . . . that has actual or potential economic value to the person or their competitors because it is not publicly available and its disclosure would result in a material financial loss to the person or a material financial gain to their competitors." Gov't Can., Guidance Document -Disclosure of Confidential Business Information Under Paragraph 21.1(3)(c) of the Food and Drugs Act, CANADA.CA (Mar. 12, 2019), https://www.canada.ca/en/health-canada/services/drug-health-product-review-approval/request-disclosure-confidential-businessinformation/disclosure-confidential-business-information/guidance.html#a1.2 [https://perma.cc/26X2-X785].

260 Gov't Can., Public Release of Clinic Information: Guidance Document, CANADA.CA (Mar. 12, 2019), https://www.canada.ca/en/health-canada/services/drug-health-product-review-approval/profile-public-release-clinical-information-guidance/document.html [https://perma.cc/UK2B-SLYZ] (detailing the types of clinical information that should be redacted as CBI).

261 See Gov't Can., supra note 258 (noting that the government has discretion to share nonredacted data under certain conditions). 262 Id. 263 Id. 264 Id. 265 See id. ("Recipients of disclosed information are expected to make the findings of their project with the disclosed information publicly available when the findings provide additional knowledge about the therapeutic product under study. If the recipient of disclosed information has made a determination that the safety, efficacy or quality of a product(s) may change as a result of the evaluation of the CBI then the results should be submitted to Health Canada.").

vaccines for human papillomavirus (HPV), without signing a confidentiality agreement. 266 The researcher's access to this CBI-and his legal authority to disseminate analysis of it-was upheld by the Canadian Federal Court.foot_25

How should an agency decide whether to publicize a particular corporate secret? And if the agency does elect to publicize it, which bounds should it impose on access and use? The answers to these questions rely on a deeper set of factual concerns. For example, will a particular prospective user's use of the information cause competitive harm to the source? If so, how, and how bad? Will that user's proposed use meaningfully benefit the public? What information can reasonably be disclosed without condition to all comers? What information should never be publicized at all? In short, how should the overall balance of secrecy and disclosure be struck to unlock information's socially valuable uses while protecting its integrity?

In my view, the process of publicizing corporate secrets should start with the regulator gathering information from both the secret's prospective users and its source (or sources). To gather information from a secret's prospective users, the regulator can require information use applications, as described above. 268 To gather information from the secret's source(s), the regulator can adapt the process that already exists for FOIA requests. As noted above,foot_27 regulators already routinely ask regulated entities to designate information those entities believe should be kept confidential-whether because it contains trade secrets or some other protected category of information-and notify those entities before contemplating disclosure.

But to build effective information publicity programs, regulators should do more than simply ask regulated entities to identify secret information. Regulators should also ask those entities to articulate the competitive value of the information and the corresponding harm that would flow from disclosure to competitors. This, too, is entirely consistent with longstanding FOIA practice; until 2019 (when the Supreme Court upended the legal standard for withholding CCI under FOIA exemption 4),foot_28 federal agencies in FOIA disputes routinely asked the submitters of purported CCI to describe and document whether unconstrained disclosure would "cause substantial harm to [their] competitive position."foot_29 There are good efficiency reasons to ask regulated entities to submit this analysis to regulators, rather than forcing agencies to speculate; regulators face huge information asymmetries, and regulated entities are better positioned to identify and quantify the harms that would flow from unconstrained disclosure. 272 Of course, regulators contemplating beginning information publicity programs can and should solicit and gather input from a broader group of stakeholders whenever time and resources permit. Particularly if contemplating an ongoing, long-term information publicity program rather than an urgent, one-time release of information, regulators may choose to use notice-and-comment rulemaking to gather detailed feedback. (As I explain below,foot_31 notice-and-comment rulemaking may be not just desirable but legally necessary, both to undo existing rules that constrain agencies' disclosure of information and to supply the necessary legal "authorization" to make sharing of any bona fide trade secrets permissible under the federal TSA). NHTSA's newly announced program of sharing data on accidents involving self-driving cars and CMS's long-running program of publicizing inspection reports from diagnostic blood-testing laboratories are two examples of long-term information publicity programs for which rulemaking would be beneficial, to formalize the scope and process of publicity. 274 All this comes with some costs for the agency. Each step-gathering information, organizing and analyzing information, deciding whether to publicize information, implementing an information publicity program, and maintaining the program-imposes burdens. Rulemaking is itself difficult and takes years. Yet burdens are already borne by the same agencies, as they respond to FOIA requests. Indeed, the burdens of responding to FOIA requests may be uniquely high, as current practice involves painstaking page-by-page, line-by-line redaction of each document to excise information exempted from disclosure. 275 Proactive information publicity can, in general, be cheaper and quicker than fulfilling FOIA requests, as technical and legal limits on information access and use can obviate the need for line-by-line redaction. Agencies can quickly and cheaply publicize information to certain users in toto, subject to appropriate constraints. 276 In addition, effective information publicity will moot at least a subset of FOIA requests, permitting agencies to divert resources currently consumed by these requests. For example, as Kapczynski and I described in an earlier paper, 277 the FDA could publicize complete or near-complete data sets from the clinical trials of prescription drugs and medical devices without undertaking the difficult redaction that regularly demands months, and sometimes years, of FOIA officers' time to fulfill even a single significant FOIA request. 278 One final recommendation: A corporate secret's formal legal category should not dictate either the process for publicizing a corporate secret or the substantive limits imposed on users' access and use. In other words, agencies' analysis should not begin or end with preoccupation over whether the information constitutes a trade secret (under the Uniform Trade Secrets Act (UTSA) definition). As I show below, 279 as a legal matter, agencies generally have legal authority to disclose even bona fide trade secrets (though they may need to take preparatory steps to do so, including rule changes). Equally important, from a normative perspective, agencies should be thinking less about formal legal categories and more about the actual, material consequences that could flow from use of the secret-both the benefits that would flow from sharing with independent analysts and the broader public and the harms that would flow from sharing with competitors. 280 In weighing whether to undertake information publicity, agencies should consider not just the formal boundaries of trade secrecy but other values and interests that militate toward close control of information, including individual privacy and the agency's own deliberative processes.

The preceding Part II was largely normative. It argued that agencies should proactively publicize corporate secrets. Part II endorsed bounded "gardens" of information that unlock socially useful uses of corporate secrets while protecting their integrity vis-à-vis competitors, and it sketched a procedural framework for agencies to determine how and how much to publicize.

This Part is largely doctrinal. It shifts focus to the important question of how federal regulators can undertake proactive information publicity programs within the confines of existing law-and survive the scrutiny of a Supreme Court skeptical of administrative action. This Part provides detailed support for the article's central claim that federal regulators generally do have a legal right to disclose trade secrets. (Or, better yet, to publicize them carefully, subject to the legal and technical limits described in Part II.) In other words, this Part challenges and disproves the conventional wisdom, first articulated in the Introduction, that agencies have some deep-seated legal obligation under federal statute or the U.S. Constitution to keep trade secrets and other corporate secrets secret. As this Part explains, the default rule is the reverse: disclosure is permitted unless something in the agency's enabling statute prohibits it.

Subpart III.A identifies the legal sources of federal regulators' wideranging authority to disclose information in their possession, on their own terms. Subpart III.B identifies the three major legal limits on agencies' authority to disclose trade secrets and related categories of commercially valuable confidential information: (1) agencies' respective enabling statutes, (2) the federal Trade Secrets Act (TSA), and (3) state trade secrecy law, made enforceable against the U.S. government through the Takings Clause of the U.S. Constitution and the Federal Tort Claims Act (FTCA). It then explains how most regulators can navigate these limits to achieve meaningful information publicity. Subpart III.C identifies the procedural steps that agencies contemplating information publicity programs should undertake before they begin disclosure. Finally, Subpart III.D briefly considers judicial review of federal regulators' information publicity programs and concludes that review will likely favor the regulators over aggrieved companies. background authority was recognized by President Obamafoot_35 and by the Department of Justice in both his administration and President Trump's. 287 Federal agencies' wide-ranging authority to disclose corporate secrets within their possession is subject only to three modest limits: (1) agencies' own enabling statutes, (2) the federal TSA, and (3) state trade secrecy law, made enforceable against the U.S. government to a limited extent by the Takings Clause of the U.S. Constitution and the FTCA. I deem these limits modest because they do not, as a blanket rule, prohibit federal agencies from disclosing even genuine trade secrets, so long as the agencies take appropriate steps to "authorize" disclosure.

First, a word on two sources of law that do not limit federal agencies' disclosure or use of trade secrets: FOIA and the federal Defend Trade Secrets Act (DTSA).

Despite frequent misconceptions, FOIA does not restrict federal agencies' power to disclose confidential information within their possession. As the Supreme Court has announced, "the FOIA is exclusively a disclosure statute."foot_37 "Congress did not design the FOIA exemptions to be mandatory bars to disclosure."foot_38 FOIA's Exemption 4 specifically permits but does not require agencies to withhold information that qualifies as a trade secret or as CCI. 290 Indeed, in 1977, Congress considered and rejected a statutory amendment to FOIA that would have made agency withholding of CCI and trade secrets mandatory rather than discretionary. 291 [Vol. 171: 1319

Agencies' enabling statutes are the most important, so I turn to them first. "Enabling statutes" are the statutes through which Congress establishes the powers and responsibilities of an administrative agency. 295 Through these statutes, Congress decides how much authority to delegate to each agency. (Congress itself has essentially unlimited power to demand trade secrets from private parties and then disclose them, 296 though in practice its investigations tend to be narrow, and it exercises this power sparingly.)

In the enabling statutes of several federal regulators, Congress chose to limit the corporate secrets those regulators are permitted to disclose. A handful of important federal regulators are statutorily prohibited from disclosing any and all "trade secrets" 297 obtained from regulated entities, unless those entities consent. 298 Most notably, the Federal Trade Commission Act prohibits FTC from disclosing to the public "any trade secret or any commercial or financial information which is obtained from any person and which is privileged or confidential." 299 The Federal Trade Commission Act's statutory prohibition on disclosure has major consequences, as FTC has more oversight and information-gathering resources than any other federal regulator. (FTC can and does publicize much other non-trade-secret information.) Similarly, the Consumer Product Safety Act prohibits the Consumer Product Safety Commission from disclosing trade secrets as defined by either the federal TSA 300 or FOIA. 301 Some agencies' enabling statutes do not prohibit disclosure of all trade secrets but do prohibit disclosure of certain trade secrets. The Food, Drug, and Cosmetic Act, for example, includes one provision that prohibits FDA from disclosing trade secret manufacturing processesfoot_41 and another that generally prohibits the agency from disclosing trade secrets submitted by medical device manufacturers. 303 The Patent Act prevents the Patent & Trademark Office from disclosing information submitted in patent applications until 18 months from filing, unless special circumstances apply. 304 However, many federal regulators do not face such agency-specific statutory restrictions on their power to gather and disclose corporate secrets. Among the major regulators whose enabling statutes do not categorically prohibit them from disclosing trade secrets are EPA, 305 FAA, 306 FCC, 307 FDA, 308 HHS (at least vis-à-vis its administration of Medicare 309 and HIPAA 310 ), NHTSA, 311 and NTSB. 312 The subset of federal regulators whose enabling statutes expressly limit disclosure of certain or all trade secrets must therefore tread carefully. Disclosure of trade secrets may subject them to litigation. 313 This is, of course,

The second legal limit on federal agencies' legal authority to disclose corporate secrets is the federal TSA. 314 Despite widespread misperception that the TSA constitutes an outright prohibition on federal agencies' disclosure of private trade secrets, 315 the statute's constraints are as much procedural as substantive and can be overcome by any federal agency whose enabling statute permits the disclosure of trade secrets.

The TSA is a criminal statute that prohibits federal employees from disclosing certain confidential information (including "trade secrets") when not "authorized by law": Whoever, being an officer or employee of the United States or of any department or agency thereof, . . . publishes, divulges, discloses, or makes known in any manner or to any extent not authorized by law any information coming to him in the course of his employment or official duties or by reason of any examination or investigation made by, or return, report or record made to or filed with, such department or agency or officer or employee thereof, which information concerns or relates to the trade secrets, processes, operations, style of work, or apparatus, or to the identity, confidential statistical data, amount or source of any income, profits, losses, or expenditures of any person, firm, partnership, corporation, or association; . . . shall be fined under this title, or imprisoned not more than one year, or both; and shall be removed from office or employment. 316 The most severe criminal penalties contemplated by the TSAimprisonment and termination of employment-have apparently never been applied in the TSA's many decades of existence. 317 314 See 18 U.S.C. § § 1905-1909 [Vol. 171: 1319[Vol. 171: § 1905. 324 . 324 In most cases, however, Congress has more broadly delegated authority to define a set of information, including trade secret information, that regulators may disclose in service of their regulatory functions. Agencies can then formalize their disclosure authority through regulations that have "force and effect of law." 325 As the D.C. Circuit has explained:

[T]he [TSA] seems to embody a congressional judgment that private commercial and financial information should not be revealed by agencies that gather it, absent a conscious choice in favor of disclosure by someone with power to impart the force of law to that decision. The Act attempts to forestall casual or thoughtless divulgence-disclosure made without first going through a deliberative process-with an opportunity for input from concerned parties. 326

With an appropriate rule in place, disclosure of trade secrets is authorized and therefore entirely legal under the TSA.

The Supreme Court has explained that "force and effect of law" inures when a regulation is a "substantive" or "legislative-type" rule "affecting individual rights and obligations" and is properly promulgated pursuant to an appropriate delegation by Congress of authority to disclose. 327 Assuming it is promulgated with proper process (e.g., notice and comment), a regulation effectively authorizes disclosure so long as it meets the "nexus test" articulated in the Court's landmark Chrysler decision: there must be "a nexus between the regulation[] and some delegation of the requisite legislative authority by Congress." 328 The question of whether Congress delegated the requisite authority is precisely the same enabling statute question addressed in the preceding subpart: if an agency's enabling statute permits the agency to obtain and disclose a specific secret, the agency has the requisite "legislative authority." 329 The nexus standard is relaxed and permissive; as the Supreme Court has held, "[t]he pertinent inquiry is whether under any of the arguable 324 See, e.g., 15 U.S.C. § 2217 (empowering the Federal Emergency Management Agency to make disclosures, notwithstanding 18 U.S.C. § 1905, when, for instance, necessary to protect health and safety). 325 See Chrysler Corp. v. Brown, 441 U.S. 281, 301 (1979) ("In order for a regulation to have the 'force and effect of law,' it must have certain substantive charcteristics and be the product of certain procedural requisites.").

326 CNA Fin. Corp. v. Donovan, 830 F.2d 1132, 1141 (D.C. Cir. 1987) (emphasis added). 327 Chrysler, 441 U.S. at 301-03. 328 Id. at 304. 329 See id. at 310, 312 (reviewing the statute at issue and concluding that its legislative intent did not authorize regulations permitting disclosure of trade secrets). Thus, an agency seeking to promulgate a rule authorizing disclosure of trade secrets must do so under authority conferred by its enabling statute(s), not the housekeeping statute. statutory grants of authority the . . . disclosure regulations . . . are reasonably within the contemplation of that grant of authority." 330 The D.C. Circuit has elaborated that Congress need not expressly mention "trade secrets" in its delegation of information-gathering and disclosing authority for an agency's regulation authorizing disclosure to pass muster under § 1905. 331 What kinds of authorizing regulations legalize agencies' disclosure of trade secrets, bypassing the restrictions of the TSA? Here are four examples. All four are little-noticed in the legal academic literature on trade secrecy and intellectual property more broadly. Ye t three of the four are good law, "on the books" today. These examples prove that federal regulators can and do formalize their legal authority to "break" trade secrets.

The Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA) requires that pesticide manufacturers submit detailed, otherwise confidential information about the formulas and properties of their pesticides to the EPA. 332 FIFRA also delegates to EPA authority to determine whether and when this secret information can be disclosed outside the agency. 333 Pursuant to this delegation, EPA promulgated a rule authorizing disclosure to certain parties outside the agency: EPA gives itself "authority to disclose any information to which this section applies to physicians, pharmacists, and other qualified persons needing such information for the performance of their duties, notwithstanding the fact that the information might otherwise be 330 entitled to confidential treatment under this subpart." 334 The rule also permits disclosure of pesticides' formulas to the public: "[i]nformation to which this section applies, and which relates to formulas of products, may be disclosed at any public hearing or in findings of fact issued by the Administrator, to the extent and in the manner authorized by the Administrator or his designee." 335 A different section of the same rule explicitly references the TSA and specifies the agency can disclose trade secrets. 336 This rule has been on the books since 1978 337 and has seemingly never been challenged in court-likely because EPA has never actually exercised its authority under the rule to disclose pesticide data directly to the public. 338 b. FDA In 2001, FDA proposed a rule that would have authorized the agency to begin disclosing secret data submitted by regulated entities on the safety and efficacy of gene therapies. 339 The statutory basis of the proposed rule was 21 U.S.C. § 371, the provision of FDA's enabling statute (the FDCA) that grants the agency general-purpose rulemaking authority: "authority to issue regulations for the efficient enforcement of " the FDCA as a whole. 340 According to FDA, disclosure of secret data would be properly authorized "even if the information to be disclosed could be considered . . . within the scope of protection of the Trade Secrets Act (18 U.S.C. 1905)." 341 FDA ultimately withdrew the proposed rule for undisclosed reasons, but it never repudiated its interpretation of § 371 as sufficient to support regulations authorizing disclosure of trade secrets. 342

Pursuant to the Food and Drug Administration Amendments Act of 2007 (FDAAA), NIH operates the ClinicalTrials.gov website, the world's largest public database of clinical trial data. 343 NIH operates the website and manages submission and publication of data from hundreds of thousands of clinical trials. 344 In 2014, NIH and its parent department, HHS, jointly proposed a rule that interprets FDAAA to require the sponsors of clinical trials of unapproved drugs, vaccines, and medical devices to report results of their trials to ClinicalTrials.gov. 345 During the notice-and-comment period, industry commenters challenged the proposed rule on the basis that requiring submission and publication of results of trials of products not yet approved by FDA would violate the TSA. 346 HHS and NIH responded that Congress had, through FDAAA, delegated to these agencies legal authority to gather trade secrets and subsequently to disclose them to the public through ClinicalTrials.gov:

[T]o the extent that clinical trial information, including but not limited to results information from applicable clinical trials of unapproved, unlicensed, or uncleared drugs and devices, described in [the relevant provisions of the FDAAA] and this final rule may contain trade secret and/or confidential commercial information, the requirement that such information be posted on ClinicalTrials.gov is authorized by law for the purposes of the U.S. TSA. 347 Since the FDAAA Final Rule took effect in 2017, trial sponsors have been legally required to submit protocols and results of trials of unapproved These examples show that any regulatory agency empowered by its enabling statute to gather and disseminate trade secrets can promulgate an "authorizing" regulation that formalizes this power. With the authorizing regulation in place, the agency need not evaluate whether a given secret is a "trade secret" for purposes of the TSA; the disclosure is legal. This is a feature, not a bug, of the TSA. 355

The third and final significant legal limit on federal agencies' authority to disclose corporate secrets is state trade secrecy law, which is made enforceable against the U.S. government, in different ways, by the Takings Clause of the Fifth Amendment and the Federal Tort Claims Act (FTCA). The relevant analyses are complex, but the ultimate punchline is simple: So long as disclosure serves some public purpose, state trade secrecy law cannot stop federal agencies from disclosing trade secrets. State trade secrecy law can only give rise to claims for money damages after disclosure occurs, and even then only under limited circumstances.

Some scholars have concluded that the Takings Clause poses a significant, even impassable, barrier to agency disclosure. 356 That view is incorrect.

Let's begin at the beginning. The Fifth Amendment's Takings Clause guarantees that "private property" will not "be taken for public use, without just compensation." 357 Not everything is protected "property" eligible for protection under the Takings Clause 358 ; while the Supreme Court and the federal circuits have held some intangible assets-e.g., certain liens, contracts, and trade secrets-to be "property" eligible for protection under the Takings 355 See Chrysler, 441 U.S. at 298 ("We find nothing in the legislative history of [the TSA] and its predecessors which lends support to [the] contention that Congress intended the phrase 'authorized by law,' as used in [the TSA], to have a special, limited meaning."). 356 See, e.g., Janka, supra note 44, at 367-68 ("Monsanto should be read as mandating full protection to the core common law right of trade secret protection."); Epstein, supra note 94, at 300 (arguing that the Biologics Price Competition and Innovation Act of 2009, which requires disclosure of trade secret information in its biosimilar application process, effects both a per se and regulatory taking); Erika Lietzan, A New Framework for Assessing Clinical Data The Court has never articulated a precise test for determining whether a particular intangible asset qualifies as property eligible for protection by the Takings Clause. However, Ruckelshaus did identify one dispositive feature of trade secrets that make them protectable under the Takings Clause: whether state law treats them like property. 361 The same portions of Ruckelshaus suggest that any corporate secrets that do not meet the relevant state law definition of a trade secret are ineligible for protection under the Takings Clause, and can be disclosed freely by federal agencies without troubling it. 362 FOIA confirms this: For decades, federal agencies have disclosed information that qualifies as CCI under FOIA exemption 4 but does not qualify as a trade secret without effecting a taking. 363 That said, much confidential information important to regulators and to the public does qualify as a trade secret for purposes of state law and consequently does implicate the Takings Clause. 364 Now that the vast majority of states have adopted the UTSA, which defines a "trade secret" broadly, 365 state-law definitions of a "trade secret" cover a wide swath of information. 366 Moreover, the law of trade secrecy varies state-to-state and is 359 Ruckelshaus, 467 U.S. at 1003. 360 Bowen v. Gilliard, 483 U.S. 587, 605 (1987). The Federal Circuit recently observed that the question of whether patents constitute "property" eligible for protection under the Takings Clause is an open one. See Golden v. United States, 955 F.3d 981, 989 n.7 (Fed. Cir. 2020) ("Despite the Claims Court's express finding on the status of patent rights under the Fifth Amendment, we decline to address that question here."). 361 See Ruckelshaus, 467 U.S. at 1001 ("Monsanto asserts that the health, safety, and environmental data it has submitted to EPA are property under Missouri law, which recognizes trade secrets, as defined in § 757, Comment b, of the Restatement of Torts, as property."); Id. at 1003 ("That intangible property rights protected by state law are deserving of the protection of the Taking Clause has long been implicit in the thinking of this Court."). 362 See Pamela Samuelson, Principles for Resolving Conflicts between Trade Secrets and the First Amendment, 58 HASTINGS L.J. 777, 809 (2006) ("While proponents of the trade-secrets-as-property conception tend to invoke Ruckelshaus as supporting the property concept, a fuller review of the Court's ruling demonstrates that trade secret interests are balanced against other societal interests, and sometimes the larger societal interests override trade secret interests."). 363 See, e.g., RECOMMENDATION 82-1 (June 17, 1982) https://www.acus.gov/sites/default/files/documents/82-1.pdf ("Agencies currently have discretion, subject to the limitations of the Trade Secrets Act (18 U.S.C. 1905), to release a submitter's exempt (b)(4) information, even though disclosure might cause damage to the submitter."). 364 See supra note 363 (summarizing Ruckelshaus's holding that state-law definitions of "trade secret" control whether information is "property" for the purposes of the Takings Clause). 365 The UTSA defines a trade secret as any information that "is the subject of efforts that are reasonable . . . to maintain its secrecy" and that "derives independent economic value, actual or potential," from being secret from competitors who can "obtain economic value from its disclosure or use." UNIF. TRADE SECRET ACT § 1.4 (UNIF. L. COMM 'N 1985). 366 The federal DTSA does not create claims for trade secret misappropriation against the U.S. government-see supra note 291-but it does provide a distinct definition of "trade secret," very less than crystal clear; 367 as such, federal regulators may be understandably anxious to conclude incorrectly that a particular piece of information is not a trade secret.

Given all that, I turn to whether the Takings Clause actually prohibits disclosure of trade secrets, as defined under federal or state law. The answer is no, so long as the agency takes a single step: It makes no promise of ongoing confidentiality when it obtains the secret. Ruckelshaus expressly held that agency disclosure of information obtained from a regulated entity can constitute a taking if and only if the agency provides an assurance of ongoing secrecy. 368 If an agency provides no assurance of secrecy, disclosure of the secret effects no taking. That makes the takings analysis easy for federal regulatory agencies contemplating implementing forward-looking information publicity programs: Takings liability can be averted simply by refraining from any assurances of secrecy, whether through contract, policy, regulation, or direct communication with the regulated entity. similar to the UTSA's. See 18 U.S.C. § 1839(3) (defining a "trade secret" as any information that the owner has "taken reasonable measures to keep . . . secret," and that "derives independent economic value, actual or potential, from" being kept secret from competitors). It is conceivable that future courts and administrative agencies could someday recognize the DTSA as having created a new form of "property" protected by the Takings Clause, with protections that mirror existing protections accorded state-law trade secrets.

367 Ira S. Matsil, Government Seizures of Trade Secrets: What Protection Does the Takings Clause Provide?, 48 SMU L. REV. 687, 698-700 (1995) (summarizing the variation of definitions for "trade secret" in different states). 368 As the Court stated in Ruckelshaus, "[T]he statute . . . gave Monsanto explicit assurance that EPA was prohibited from disclosing publicly . . . any data submitted by an applicant if both the applicant and EPA determined the data to constitute trade secrets. Thus, . . . the Federal Government had explicitly guaranteed . . . an extensive measure of confidentiality and exclusive use. This explicit governmental guarantee formed the basis of a reasonable investment-backed expectation." 467 U.S. at 1011 (citation omitted). See also id. at 1007 ("[A]s long as Monsanto is aware of the conditions under which the data are submitted, and the conditions are rationally related to a legitimate Government interest, a voluntary submission of data by an applicant in exchange for the economic advantages of a registration can hardly be called a taking."); Love Te rminal Partners, L.P. v. United States, 889 F.3d 1331, 1345 (Fed. Cir. 2018), cert. denied, 139 S. Ct. 2744 (2019) ("In Ruckelshaus, . . . the Supreme Court concluded that plaintiffs only had a reasonable expectation in the confidentiality of trade secrets disclosed to the EPA in pesticide registration applications to the extent that the relevant statute explicitly guaranteed confidentiality at the time of submission."); Rowe, Striking A Balance, supra note 68, at 802 ("Monsanto is . . . a mixed bag for trade-secret owners . . . . There is a real risk that when a company submits business information to an agency and it falls into the hands of a competitor, a court could find there was no promise of confidentiality, and thus no taking."). In this regard, the takings analysis for corporate secrets and other secret information dovetails with broader regulatory takings doctrine, which focuses on "the character of the governmental action, its economic impact, and its interference with reasonable investment-backed expectations." Pruneyard Shopping Ctr. v. Robins, 447 U.S. 74, 83 (1980). If the submitter of confidential information to the government receives no assurance of continuing secrecy, then it has no "reasonable investment-backed expectation" of the same. Id. [Vol. 171: 1319 What about corporate secrets that regulators currently hold and have already promised to keep confidential? For these secrets, the takings analysis is more complex, but disclosure is nonetheless legal so long as it serves some public purpose. That is, so long as the regulator can articulate some public benefit that flows from the disclosure-straightforward enough in cases of publicizing corporate malfeasance, hazards to safety, public health, or the environment, and so on-then the taking will be deemed one for public use rather than private. 369 A recent Supreme Court decision confirms a centuriesold principle: If a taking is for public use, the taking cannot be enjoined. 370 The Takings Clause "is designed not to limit the governmental interference with property rights per se, but rather to secure compensation in the event of otherwise proper interference amounting to a taking." 371 Because a regulated entity whose secret has been disclosed by the U.S. government to serve the public interest cannot use the Takings Clause enjoin the disclosure, it may only seek money damages sufficient to make it wholeotherwise known as "just compensation." 372 The appropriate "just compensation" owed for an agency's disclosure of a corporate secret shared pursuant to some assurance of secrecy may be small or large, depending on the scale of economic harm. 373 369 Even the First Circuit's errant Philip Morris decision acknowledges that disclosure of a trade secret to serve a significant state interest may be constitutional. 312 F.3d at 44 (noting that Massachusetts' interest in promoting the health of its citizens could have been compelling enough to alter the court's holding, but nevertheless finding a taking because the regulation was not sufficiently tailored to achieve this interest). 370 See Knick v. Twp. of Scott, Pa., 139 S. Ct. 2162, 2179 (2019) ("As long as just compensation remedies are available . . . injunctive relief will be foreclosed."); see also Ruckelshaus, 467 U.S. at 1016 ("Equitable relief is not available to enjoin an alleged taking of private property for a public use, duly authorized by law, when a suit for compensation can be brought against the sovereign subsequent to the taking."); Vogel, supra note 49, at 180 ("[I]f the Government misappropriates the secret for a public use, the owner is entitled only to just compensation . . . .").

371 First Eng. Evangelical Lutheran Church v. Cnty. of Los Angeles, 482 U.S. 304, 315 (1987) (emphasis in original). 372 See Katrina Miriam Wyman, The Measure of Just Compensation, 41 U.C. DAVIS L. REV. 239, 248-50, 252 (2008) (analogizing the purpose of takings compensation to corrective justice's goal of returning victims to their baseline and making them whole); see also Christopher Serkin, The Meaning of Va lue: Assessing Just Compensation for Regulatory Takings, 99 NW. U. L. REV. 677, 678 (2005) (discussing valuation theories of just compensation). In this scenario, the Taking Clause functions as a liability rule, entitling a party injured by government disclosure of its trade secret to some courtordered measure of compensatory damages but not permitting it to charge an arbitrary price or prevent disclosure altogether. 373 See United States v. 564.54 Acres of Land, 441 U.S. 506, 511 (1979) (articulating the objective standard for just compensation). In this case, the court reasoned that just compensation was the "fair market value" of the property, which equaled "'what a willing buyer would pay in cash to a willing seller' at the time of the taking" and excluded the value that "springs from [an owner's] subjective needs and attitudes" (citations omitted); see also Fla. Rock Indus. v. United States, 18 F.3d 1560, 1569 (Fed. Cir. 1994) ("[T]he amount of just compensation should be proportional to the value of the interest taken as compared to the total value of the property . . . .").

As a background rule, the U.S. government enjoys sovereign immunity and may only be sued if it has waived that immunity. 374 Via the Federal Tort Claims Act (FTCA), Congress enacted a limited waiver of immunity to permit private parties to sue the U.S. government in federal district court for some state law torts committed by its officials and agencies. 375 The Second, 376 Fifth, 377 D.C., 378 and Federal Circuits 379 have held that the FTCA authorizes aggrieved plaintiffs to bring claims against the U.S. government for state-law trade secret misappropriation. Such claims are limited to compensatory money damages and can be brought only after agency disclosure occurs; trade secret holders cannot use the FTCA to enjoin agency disclosure or obtain punitive damages. 380 These circuits agree that in this sort of FTCA case, just as in takings and state law trade secret misappropriation cases, the defendant's assurance of ongoing secrecy is key. 381 The Supreme Court itself has observed, "[a]s a matter of state law, property rights in a trade secret are extinguished when a company discloses its trade secret to persons not obligated to protect the confidentiality of the information." 382 381 See Kramer, 653 F.3d at 730 ("{G]overnment employees agreed to honor [Kramer's] demand that the information, once disclosed, be treated in confidence, and that she disclosed it only in reliance on this commitment."); see also Jerome, supra note 376, at 1256 ("FDA induced JSP to disclose its trade secrets in confidence, and then it divulged that information to others in breach of that confidence.").

382 Thomas v. Union Carbide Agric. Prods. Co., 473 U.S. 568, 584 (citing Ruckelshaus, 467 U.S. at 1002 ).

By undertaking the controlled information publicity I propose in Part II, federal agencies can limit their liability under the Takings Clause and FTCA. Part II's "bounded garden" model of information discourages commercial uses of publicized trade secrets, which limits financial harm inflicted on the source of the secret. By limiting this harm, agencies correspondingly limit their own financial downside. In this regard, the goals of regulators and regulated entities are helpfully aligned; regulators also have financial incentives to get the bounds on information publicity right.

Here is one example. In earlier work, Kapczynski and I proposed that the FDA begin disclosing certain currently-secret data on the safety and efficacy of pharmaceuticals submitted by pharmaceutical companies, despite past assurances of secrecy by the agency. The FDA can do this in harmony with the Takings Clause and FTCA by imposing data use agreements on any users of the data that prohibit them from using the data to compete directly with the companies that submitted the data. 383 These agreements limit the risk of financial harm to the sources of this data and thereby limit the FDA's own financial risk. In effect, they make information publicity affordable and pragmatic even for a cautious and penny-pinching federal agency-especially given the large social benefits of (controlled) disclosure and cost savings from mooting complex FOIA requests. 384 FDA's counterparts in Canada and the European Union already publicize exactly this kind of data and impose exactly this kind of data use agreement on data users-with a growing track record of success. 385

This Part's preceding sections explained the wide-ranging legal authority that federal regulators have to disclose corporate secrets and the significant but navigable legal limits on that authority: (1) agencies' enabling statutes, (2) the federal TSA, and (3) state trade secrecy law, made enforceable against the U.S. government via the Takings Clause and FTCA.

A bit of synthesis is in order. Imagine a federal regulator that seeks to build a long-term program of information publicity to inform the public of corporate activities and technologies that affect public welfare. What should that regulator do to ensure the program's legality? secrets. When the agency has an appropriate authorizing regulation in place, sanctioning disclosure of trade secrets, agencies win these APA challenges. 406 In fact, I can find just one APA case decided since the Supreme Court's 1979 Chrysler decision-which clarified the reach of the federal TSA 407 -in which a court actually enjoined a federal agency from proactive disclosure of alleged trade secrets because of what the court concluded was a violation of the TSA. 408 That case concerned the Navy's attempt to disclose confidential drawings and data a military contractor, Dowty Decoto, had submitted to the agency when fulfilling a supply contract. 409 Over a decade after first submission of the information, the Navy informed Dowty Decoto that it intended to "disclose the data to third parties for the purpose of obtaining competitive bids." 410 In Dowty Decoto, the Ninth Circuit observed, correctly, that disclosure of trade secrets is permissible under the TSA whenever "authorized by law" and so focused on the Navy's own "regulations governing [its] authority to disclose the data." 411 The court concluded that the relevant 407 See supra section III.B. 408 The case is Dowty Decoto, Inc. v. Dep't of Navy, 883 F.2d 774, 781 (9th Cir. 1989). To be sure, other courts have, since Chrysler, restated the legal principle that a private entity can use APA litigation in federal district court enjoin a federal agency from disclosing trade secrets if such disclosure would violate the Trade Secrets Act or other federal law. See, e.g., Megapulse, Inc. v. Lewis, 672 F.2d 959, 971 (D.C. Cir. 1982) (holding that Megapulse's suit alleging a violation of the Trade Secrets Act "was properly brought under the APA, and injunctive relief, preliminary or permanent, is available in the district court"). Some courts have enjoined federal agencies' reactive disclosures to third party FOIA requests in so-called "reverse FOIA" APA litigation; in these cases, the sources of secret information can prove that the information requested by the FOIA requester is a trade secret for purposes of § 1905, that agency disclosure is "not authorized by law," and thus that an injunction barring release is appropriate. See, e.g., Sealed Appellee #1 v. Sealed Appellant, 199 F.3d 437 (5th Cir. 1999) (prohibiting disclosure of certain materials); Canadian Com. Corp. v. Dep't of Air Force, 514 F.3d 37, 43 (D.C. Cir. 2008) (holding that disclosure of materials is prohibited). In some of these "reverse FOIA" cases, courts have mistakenly conflated the proper APA analysis with the separate question of whether the information at issue is covered by FOIA exemption 4. See, e.g., Canadian Com., 514 F.3d at 39 (conflating those two separate analyses). As noted above, supra § III.A, this is incorrect, as FOIA itself should never bar an agency from disclosure.

409 The drawings and data described "repeatable holdback bars" used in launching fighter planes from aircraft carrier decks. Dowty Decoto, 883 F.2d at 775. 410 Id. 411 Id. at 776. [Vol. 171: 1319 regulations did not authorize disclosure and that an injunction was therefore appropriate.foot_46

This article has argued that federal regulators can and should embrace "information publicity": controlled sharing with the public of certain secret information gathered from the industries they regulate. Regulators can and should legally share corporate secrets of intense public interest, even when those secrets are trade secrets. Rather than disclose trade secrets without condition, regulators should publicize these secrets in carefully bounded "gardens" that privilege socially valuable noncommercial users and uses while simultaneously protecting the information's legitimate commercial value by thwarting competitive uses. By embracing information publicity, regulators can reconceive and reestablish their relationship the public they represent. In so doing, regulators can protect and educate the public and embrace, anew, a core feature of the original big-P Progressive vision of federal regulation.

Of course, not all agency-held secrets should be publicized. When prospective users of corporate secrets, and regulators themselves, cannot articulate socially valuable uses of the information, the secrets should stay secret. Likewise, secrecy should prevail when the regulator determines the risk of harm to a secret's source or to other stakeholders to be particularly high. As I've argued above, the decision of whether and how to publicize information is a quintessential question for agency expertise and discretionand for democratic contestation.

The preceding Parts presented a handful of pressing, practical examples where we might today imagine urging federal regulators to implement and expand information publicity: EPA with still-secret information on the safety of fracking; FAA and NHTSA with secret information on the "smart" software that governs the latest generation of autonomous transportation technology; FDA with secret data on the safety and efficacy of drugs, vaccines, and medical devices; and on and on. There are more potential applications of information publicity within the existing federal regulatory state that I lack space to sketch here but intend to explore in future work. I will mention one such application: HHS's Office for Civil Rights (OCR) may have both authority 413 and resources to investigate and publicize the uses that data brokers and artificial intelligence developers, including Google and course, when agencies hand trade secrets to competitors of the secrets' sources, the normative considerations involved are very different. So too when agencies themselves enter into competition with a secret's source. I suspect that there are relatively few instances where this sort of exercise of regulators' discretionary power over information is wise public policy. But the possibility is interesting indeed. Perhaps scholars preoccupied with the arm-in-arm march of corporate power and economic inequality should investigate the possibility of federal regulatory agencies as vehicles to "socialize" valuable information and bring it under public control.

I will close with an observation on both the present-day limits of information publicity and of its grander potential. Part III showed that the single most important constraint on federal regulators' information publicity powers, and their governance of information more broadly, is federal statute. If Congress wishes to encourage, or even mandate, existing federal agencies to publicize more, it can do so simply by rewriting federal statute-especially the federal TSA and individual regulators' enabling statutes. In addition, at this moment, essential spheres of social and economic activity exist largely or entirely outside the clear jurisdiction of an extant federal regulator, and a colorful panoply of legislators, policymakers, and scholars of many ideological persuasions have proposed to legislate new ones into being: a federal "Data Protection Agency," 419 a "Federal Robotics Commission," 420 an "FDA for Algorithms," 421 and so on. As we collectively debate the wisdom of these proposals, I think it is worth asking how, exactly, these would-be agencies would govern secrets, including trade secrets, drawn from the secretive industries they would regulate. Information publicity was once conceived as a core function of the federal regulatory state, and it could be again.