> Since when were NDAs routinely limited to 10 years?

I'm not seeing an indication that it was routine, just that all the people involved happened to have 10 year NDAs in place. Might've been RSA-specific, potentially as a consequence of the breach or just an artifact of RSA's own policies; it's not actually mentioned. I'm also only familiar with 5 year NDAs.

I just went through all the Confidentiality agreements I could find in my mail spool and none of them had an explicit time limit. Is it normal for people to have 5-year NDAs, or even 10-years, for company secrets? How does that make sense? One of the main characters in this story had a tenure at RSA that exceeded 10 years.

It's standard-ish to be able to request a 10-year NDA for anything that your not part of / on your way out, e.g. I know people that have them for severance / mutual non-disparagement packages.

Could it be a matter of state law?

I've got an equal mix of 5 year and unrestricted NDAs, no 10 year NDAs, oddly enough.

Lasership, Inc. v. Watson. Found a NDA unenforceable because the term was indefinite that the court deemed to be an unreasonable term for the agreement - It is important that contracts have a well-defined start date and end date.

An agreement cannot be perpetual.. A contract without a specific time period stated may potentially be terminable by either party with notice once the business relationship ends after a reasonable amount of time. So stating a number of years (less than 50) may strengthen the NDA in some respect - The "indefinite" NDA of an employee may possibly be terminated unilaterally by the employee with written notice after they left the job, so better for the employer to have them signing a new NDA at the time of separation giving a time period for the agreement.

My thoughts exactly. I'm curious if these people thought their NDAs expired after 10 years.

Some searching tells me 1 to 5 years is considered normal.