The Development Environment

It's important to choose service providers that enforce physical protection. With proper safeguards, employees have no way of copying code or sending it outside the workplace. For example, one multinational with a development centre in Hangzhou uses diskless computers on a closed network with no external connection and no printers. Access to the centre is strictly controlled, and programmers may only download or upload data or code from the central server under strict supervision.

Key measures:

• Use computers with no USB or disk drives and no external network connection to prevent copying.
• Split the project into different pieces and different locations, so that no single employee has the complete code base.
• Use biometric and fingerprinting techniques to track who is doing what.
• Use a strict code-tracing technique to monitor copying.

Staff Education and Training

Successful companies proactively educate their staff about the legal aspects of IP, and they manage those issues on an ongoing basis. For the CEO of a 120-person company, "IP issues are central to the corporate culture and are reinforced by ongoing workshops and training".

Key activities:

• Enforce IP protection in employment contracts, for example, through tough penalties.
• Have employees leave their personal effects in a locker room, then go to the computer room to work.
• Educate employees on IP rights and create an IP-focused environment.

Legal Enforcement

It's important to know that your outsourcing provider will aggressively pursue breaches and users. Choose companies with local assets where your legal agreement can be easily enforced and is legally binding for both partners.

Key measures:

• Use a nondisclosure agreement and related contract regulated under local jurisdiction.
• Prioritize companies with local operations so you can sue their local subsidiaries under overseas law.
• Require that all employees and subcontractors sign a nondisclosure agreement as part of their employment contract.
• Hire detectives to identify users of illegal copies and approach top management with your evidence.
• Maintain and publish lists of culprits and breaches.

Despite the perception that software piracy in China is rampant, there are few cases where foreign companies have been harmed by outsourcing to China. That's because many foreign companies have managed to effectively deal with piracy and the leading outsourcing companies in China by adopting these measures.

Multinational companies planning to outsource will soon face a shortage of skilled resources in the traditional outsourcing countries and must consider how to leverage the engineering talent pool that China offers.

Giuseppe De Filippo is an associate principal with McKinsey's Shanghai office, and Chris Ip is a principal in the Hong Kong office