Originally Posted by Wired.com
Former Goldman Sachs programmer Sergey Aleynikov, who downloaded source code for the investment firm’s high-speed trading system from the company’s computers, was wrongly charged with theft of property because the code did not qualify as a physical object under a federal theft statute, according to a court opinion published Wednesday.
“Because Aleynikov did not ‘assume physical control’ over anything when he took the source code, and because he did not thereby ‘deprive [Goldman] of its use,’ Aleynikov did not violate the [National Stolen Property Act],” the 2nd Circuit Court of Appeals wrote in its opinion (.pdf).
The three-judge panel in New York also ruled that Aleynikov was wrongly charged with espionage, since the code was not a product designed for interstate or foreign commerce, a requirement under the Economic Espionage Act with which he was charged and convicted. The court found that Goldman’s system was neither “produced for” nor “placed in” interstate or foreign commerce, nor did the company have any intention of selling its system or licensing it to anyone.
The opinion finally provides explanation for why the judges delivered a surprise ruling last February that reversed Aleynikov’s conviction and sprung him from prison a year after he had begun to serve an eight-year sentence.
The ruling also deals a blow to the government’s ability to prosecute others for similar thefts of trade secrets under the EEA.
Aleynikov, 42, was convicted in 2010 under the Economic Espionage Act of 1996 (EEA), in a high-profile case that was held up by federal prosecutors as an example of the Justice Department’s serious intent to prosecute the theft of intellectual property and trade secrets.
Aleynikov had acknowledged that he violated the bank’s confidentiality policy in downloading the source code from the company’s computers, but he’d asserted that what he’d done was not a criminal act under the EEA because the code wasn’t used in interstate commerce.
In February, the federal appeals court, led by Chief Justice Dennis G. Jacobs, agreed and reversed the conviction. The judges announced their ruling without explanation just hours after hearing Aleynikov’s attorney argue the appeal. Chief Justice Jacobs said at the time that the court’s written opinion explaining the ruling would follow “in due course.”
In discussing whether the code qualified as a product of commerce under the EEA, the judges wrote in their opinion this week that contrary to Goldman Sachs’ source code being something the company distributed in the commercial realm, the company “went to great lengths to maintain the secrecy of its system.
“The enormous profits the system yielded for Goldman depended on no one else having it,” the judges wrote. “Because the HFT system was not designed to enter or pass in commerce, or to make something that does, Aleynikov’s theft of source code relating to that system was not an offense under the EEA.”
The judges also addressed the government’s argument that the code was physical property under a 1988 amendment to the NSPA. Prosecutors had asserted that the amendment reflected an intent by Congress to include the transfer and transmission of non-physical forms of stolen property in the law, thereby covering the theft of source code. But the judges rejected this claim, stating that the 20-year-old amendment clearly had been meant to cover the transfer and transmission of money, not the theft of source code in the computer age.
“We decline to stretch or update statutory words of plain and ordinary meaning in order to better accommodate the digital age,” the judges wrote.
They added that although Aleynikov should have known that his actions were in breach of his confidentiality agreement with Goldman Sachs, and were dishonest in ways that would subject him to sanctions, he “could not have known that it would offend this criminal law or this particular sovereign.”
Circuit Judge Guido Calabresi agreed with the majority opinion and the way the judges had reached it, but at the same time suggested in a concurring opinion that Aleynikov would not have gotten off if the Electronic Espionage Act had been better written.
“[I]t is hard for me to conclude that Congress, in this law, actually meant to exempt the kind of behavior in which Aleynikov engaged” he wrote. He also expressed “hope that Congress will return to the issue and state, in appropriate language, what I believe they meant to make criminal in the EEA.”
The Russian-born Aleynikov worked for Goldman Sachs until June 2009, when authorities said he siphoned source code for the company’s valuable software on his way out the door to take a new job with another company.
Aleynikov, a naturalized U.S. citizen who emigrated from the disintegrating Soviet Union in 1991, earned nearly $400,000 a year as a vice president with Goldman Sachs. He was arrested in July 2009 at the Newark Airport in New Jersey as he returned from a trip to Chicago to meet his new employers.
Authorities said he stole “hundreds of thousands of lines” of source code from Goldman Sachs in the days before he left the company, downloading various software from the Goldman Sachs network and transferring it to a storage website hosted in Germany, before trying to erase his tracks from Goldman Sachs’ network.
The software is used to make sophisticated, high-speed, high-volume stock and commodities trades and had earned the company “many millions of dollars in profits” each year, according to prosecutors.
Prosecutors said Aleynikov made several copies of the code and had it on his laptop when he met his new employers at Teza Technologies in Chicago, although a later search of Teza computers uncovered no copies of Goldman Sachs’ source code.
Goldman Sachs only uncovered the theft after it began monitoring HTTPS transfers and saw a large volume of data leaving its network, according to court documents. The company initiated the monitoring after noticing suspicious activity on the network.
At the time of his arrest, Aleynikov acknowledged taking the code, but told FBI agents he only intended to collect open source software files on which he had worked, and that his collection of proprietary files on his last day of work had been inadvertent.
