NY v. Aleynikov: NY Penal Code, Federal Criminal Law Unprepared to Deal with Source Code Theft

hacker-335zEmployers often assume that they have the same weapons in their arsenal to prevent theft of virtual trade secrets as they have against other types of loss. As the prosecution of Sergey Aleynikov in Federal and New York courts showed, however, that simply isn’t true. Even though juries in both courts found him guilty of downloading confidential computer code from his employer, judges ultimately found that the laws under which he was prosecuted did not cover the acts he committed. A careful employer should therefore make sure it puts precautions in place that prevent theft of computer code, rather than relying on the threat of criminal prosecution.

Aleynikov was a computer programmer employed by Goldman Sachs to write high-frequency trading code. In 2009, he accepted a job offer to join a potential competitor, where he would create a new high-frequency trading platform from the ground up. Before he left Goldman, however, he sent portions of Goldman’s high frequency trading code to a German server for his own future use. After Goldman found out, it went to the FBI; Aleynikov was then arrested on a flight home from a visit to Chicago. With that arrest began his circuitous journey through the U.S. legal system, governed by two different sovereigns and under two different legal regimes.

 

U.S. v. Aleynikov: Federal Prosecution of Aleynikov under the Economic Espionage Act and National Stolen Property Act

Aleynikov was first tried in the U.S. District Court for the Southern District of New York on charges of violating the Federal Economic Espionage Act of 1996 (“EEA”) and the National Stolen Property Act (“NSPA”). United States v. Aleynikov, 737 F. Supp. 2d 173 (S.D.N.Y. 2010). At that time, the EEA’s trade secret misappropriation section provided that “[w]hoever, with intent to convert a trade secret, that is related to or included in a product that is produced for or placed in interstate or foreign commerce, to the economic benefit of anyone other than the owner thereof, and intending or knowing that the offense will, injure any owner of that trade secret, knowingly . . . without authorization . . . downloads, uploads, . . . transmits, . . . or conveys such information” would be guilty of a criminal offense punishable by up to ten years in jail. 18 U.S.C. § 1832. The parties disputed the application of the EEA to Aleynikov’s behavior, Aleynikov’s intent in uploading the code to the German server, and the importance of the uploaded code. Ultimately, however, the jury found Aleynikov guilty under both the EEA and NSPA.

The U.S. Court of Appeals for the Second Circuit interpreted the NSPA and the EEA more narrowly than the trial court, and reversed the conviction. United States v. Aleynikov, 676 F.3d 71 (2d Cir. 2012). It stressed that the EEA had been adopted as a response to the Supreme Court’s decision that the relevant section of the NSPA (18 U.S.C. § 2314) did not apply to purely intangible property, as found in Dowling v. US, 473 U.S. 207 (1985). Thus, the NSPA should never have given rise to a conviction in the first place. Id. at 78. The Second Circuit then considered the differences in language between the economic espionage provision of the EEA (18 U.S.C. § 1831) and the trade secrets provision (18 U.S.C. § 1832). The former did not require that the information be “related to or included in a product that is produced for or placed in interstate or foreign commerce,” while the latter did. Id. at 79. Given the statutory language, the Second Circuit found that Goldman’s code was intended to remain confidential (and not be related to any product placed in interstate commerce), and therefore was not within the scope of the trade secrets provision as written. Id. at 82. It therefore overturned Aleynikov’s Federal conviction.

Remarkably, the Second Circuit’s decision in the Federal Aleynikov case promptly led to a Congressional change to the EEA. Although it cannot apply to the Aleynikov case or any other case that arose before the amendment, § 1832 was amended to apply to any trade secret “that is related to a product or service used in or intended for use in interstate or foreign commerce.” Thus, in the case of future misdeeds, misappropriation of computer code that is intended to remain confidential, but used in relation to a service performed in interstate commerce, may be an offense under the EEA.

[Hack]

 

New York v. Aleynikov: State Prosecution of Aleynikov for Unlawful Use of Secret Scientific Material and Unlawful Duplication of Computer Related Material

After sitting in prison for over a year awaiting resolution of the Federal claims against him, Aleynikov thought he was no longer in jeopardy when the Second Circuit absolved him of criminal liability. Not true. Rather than returning Aleynikov’s computer, other evidence, and passport, the U.S. Attorney’s Office turned it all over to the New York County (Manhattan) prosecutor’s office. Ultimately, that evidence was ruled to be illegally transferred and inadmissible as evidence against Aleynikov. But the prosecutor’s office nonetheless decided to prosecute Aleynikov.

In New York v. Aleynikov, Aleynikov was prosecuted under two New York state statutes: Unlawful Use of Secret Scientific Material (N.Y. Pen. L. § 165.07) and one count of Unlawful Duplication of Computer Related Material (N.Y. Pen. L. § 156.30). People v. Aleynikov, No. 04447/12, slip. op. 1 (N.Y. Sup. Ct. July 6, 2015).The former statute provides, “[a] person is guilty of unlawful use of secret scientific material when, with intent to appropriate to himself or another the use of secret scientific material, and having no right to do so and no reasonable ground to believe that he has such right, he makes a tangible reproduction or representation of such secret scientific material by means of writing, photographing, drawing, mechanically or electronically reproducing or recording such secret scientific material.” Aleynikov challenged his state indictment on numerous grounds, ranging from double jeopardy to the high-frequency trading code not being “secret scientific material” to not having made a “tangible reproduction or representation.” The trial court judge rejected those arguments and allowed the case to go forward to trial.

At trial in April 2015, Aleynikov argued that he had committed no crime, based both on his own lack of culpable intent and the technical language of the relevant statutes. The jury returned with a split verdict: guilty on one count of Unlawful Use of Secret Scientific Material, hung on another count of Unlawful Use of Secret Scientific Material, and not guilty of Unlawful Duplication of Computer Related Material. After the verdict, Aleynikov renewed his motion to dismiss both counts of Unlawful Use of Secret Scientific Material; the trial court granted the renewed motion in a carefully reasoned 72-page decision issued on July 6, 2015.

The court’s dismissal of the two counts of Unlawful Use of Secret Scientific Material rested on two separate grounds. First, it found that the prosecution had not proved that Aleynikov had made “a tangible reproduction or representation of [any] secret scientific material.” Second, it found that the prosecution had not proved that Aleynikov had the “intent to appropriate to himself or another the use of secret scientific material.” In both cases, the trial court’s decision was not based on a lack of evidence; rather, it found that the act of making a copy of computer code could not violate the statute for either reason.

The trial court began its consideration of the renewed motion to dismiss with a consideration of the origins of the Unlawful Use of Secret Scientific Material statute. The law was intended to be a counterpart to an existing larceny statute (N.Y. Pen. L. § 155.30(3)), which made it a felony to “steal property” which consisted of “secret scientific material.” Slip Op. at 26-27. The difference between the two statutes was the physical act proscribed: in the case of the unlawful use statute, it was making a tangible reproduction or representation of scientific material; in the case of the larceny statute, it was taking the scientific material itself. Id. at 27. For example, the unlawful use statute would be violated by writing down the synthetic steps required to make a secret product, whereas the larceny statute would be violated by stealing the product itself. In both cases, a violation required the accused to have the same intent to steal. Id.

The first key question confronting the trial court was what would constitute a “tangible” reproduction or representation because Aleynikov had made only a virtual copy of the disputed code; he had not printed it or otherwise copied it down. The trial court turned first to the dictionary for a definition of “tangible.” Black’s Law Dictionary (which the court found representative of dictionaries generally) had three definitions:

  1. Having or possessing physical form; corporeal. 2. Capable of being touched and seen; perceptible to the touch; capable of being possessed or realized. 3. Capable of being understood by the mind.

The first two definitions would exempt Aleynikov from liability, but the third would not. Aleynikov had argued for the first definition, the prosecution had urged the court to adopt the third. In determining which definition of “tangible” would apply, the court turned to four sources: canons of statutory construction, decisions under the EEA (based on the prior Aleynikov prosecution), New York state decisions construing similar statutes, and the Rule of Lenity.

The most important canon of construction for the trial court was the principle that every word in a statute must have a meaning and was assumed to have been inserted for a purpose. Id. at 32. The statute would not have been violated if a representation or reproduction had been imaginary or incomprehensible because there would be no economic value to appropriate, so tangible had to mean something other than merely real or comprehensible. In addressing that canon, the prosecution first argued that tangible meant that the reproduction or representation itself need not be tangible, only that it be able to be physically reproduced or represented. In the alternate, the prosecution argued that the term “tangible” was intended to distinguish memories. The court found the first option would still render the word superfluous in the statute, and the second defied common sense. Further, the prosecution’s proposed construction violated a second canon of construction, which was that statutes are to be construed according to their meaning at the time of enactment. When the statute was enacted in 1967, even the computer-related media that were available (like fax machines or photocopiers) yielded tangible, paper copies of original documents. Thus, the court found that a physical definition of “tangible” was required.

Second, the distinction between a virtual copy of computer code and a “tangible” physical copy was also starkly shown in Federal jurisprudence under the EEA. After Aleynikov had been absolved of criminal liability by the Second Circuit, another defendant argued that his conviction should also be reversed. See United States v. Agrawal, 726 F.3d 235 (2d Cir. 2013). But Agrawal, unlike Aleynikov, had printed out code from his employer’s high-frequency trading system on paper. As the Second Circuit found there, “[t]his makes all the difference.” In addition, earlier in the state Aleynikov case, a different justice of the New York Supreme Court had suggested that the misappropriated source code was “intangible property” in contrasting the Agrawal case.

Third, the court considered other criminal cases in which the nature of computer data was considered. New York’s child pornography statute required possession of illicit images; the New York Court of Appeals found that merely viewing, without knowledge that the images would be stored in a computer’s cache, did not satisfy that requirement. Slip Op. at 40 (citing People v. Kent, 19 N.Y.3d 290 (2012)). The court relied heavily on that decision’s reasoning, as well as other cases in which computer data had been characterized as “intangible items,” to support a finding that computer data would not be a “tangible reproduction or representation.” Id. at 41-44.

Finally, the court considered the Rule of Lenity. In addition to all of the evidence that suggested that the term “tangible” did not apply, the Rule counsels that “[i]f two constructions of a criminal statute are plausible, the one more favorable to the defendant should be adopted.” Thus, the court found that virtual computer code could not support a finding that Aleynikov made a “tangible reproduction or representation” and the conviction had to be overturned.

Similarly, the court found that Aleynikov could not have had an “intent to appropriate the use” of the high-frequency trading code. Under the New York Penal Law,

To “appropriate” property of another to oneself or a third person means (a) to exercise control over it, or to aid a third person to exercise control over it, permanently or for so extended a period or under such circumstances as to acquire the major portion of its economic value or benefit, or (b) to dispose of the property for the benefit of oneself or a third person.

N.Y. Pen. L. § 155.00(4). The former definition applies to the Unlawful Use of Secret Scientific Material statute, the latter definition to larceny. Thus, there were two questions that the court had to answer. First, what does “the major portion of [property’s] economic value or benefit” mean? And second, can it be defined independently from the rightful owner’s retained value or is it a zero-sum definition?

Based on dictionary definitions and the context of the statute, the court found that “the major portion” would have to be the majority of the value. Slip Op. at 49. Importantly, the definitional statute for “appropriate” uses the definite article, indicating that there can be only one major portion. And a Federal district court considering the same question came to the same result, rejecting arguments that “the major portion” could be a significant, but minority, portion. Id. 50 (quoting Perfect Curve Inc. v. Hat World Inc., 988 F. Supp. 2d. 38, 60–61 (D. Mass. 2013)).

The court also found that appropriation would have to be a “zero-sum game,” where a defendant would not only obtain benefits but also deprive the rightful owner of the same benefits. To the extent that such a result was not compelled by the relative definition of “the major portion,” it was supported by case law on larceny and the Rule of Lenity. Id. at 51-57. Because Aleynikov had not taken most of the value of the code from Goldman (and no evidence was introduced that supported a valuation of the code, its value to Aleynikov, or its remaining value to Goldman), his conviction could not stand.

Finally, despite the outcome of the Aleynikov case itself, the court noted that efforts were underway in the New York legislature to plug the holes into which the conviction had fallen. While those updates to the law wouldn’t rescue Aleynikov’s conviction, they would have the same effect as the amendments of the EEA in preventing further misdeeds.

Despite the court’s careful decision and the steps already being taken to fix the statute, the prosecution chose to appeal the court’s dismissal of Aleynikov’s conviction. On July 24, 2015, it filed a notice of appeal. Thus, an appellate panel will consider whether conduct like Aleynikov’s could violate the Unlawful Use of Secret Scientific Material statute.

 

Conclusion

While there are efforts underway to update the law – both civil and criminal – to plug the hole into which the Aleynikov convictions fell, those efforts are not complete. There is no Federal cause of action for civil trade secret misappropriation, nor a New York criminal statute that would cover similar actions today. And while both have been proposed, neither type of enforcement is as valuable as preventing misappropriation of computer code in the first place.

Critical steps for an employer to take in order to lessen the risk of misappropriation of computer code include:

  • Limiting access to critical computer data or source code on a “need to know” basis
  • Prohibiting and/or preventing “checking out” or printing of critical computer data or source code, including by preventing such data from being copied to USB drives, portable hard drives, or cloud storage
  • Tracking those who have accessed critical computer data or source code and what they have done with it
  • Putting in place a team (both technical and legal) that can advise on concerns about protections and how to remedy breaches

While these steps must be tailored (and likely augmented) based on the nature of a company’s business, they are vital to consider in some form in order to avoid the expense, disruption, and difficulty of trying to enforce intellectual property rights after the fact.

Share

Warning & Disclaimer: The pages, articles and comments on IPWatchdog.com do not constitute legal advice, nor do they create any attorney-client relationship. The articles published express the personal opinion and views of the author as of the time of publication and should not be attributed to the author’s employer, clients or the sponsors of IPWatchdog.com.

Join the Discussion

8 comments so far.

  • [Avatar for Arturo]
    Arturo
    October 20, 2015 01:02 pm

    I would like some feedback on some concerns that I have based on this case:
    -The case did not go into the extent to which the information is known outside the claimant’s business and I think this could be really important for similar cases as this. As opposed to a trade secret such as chemical formulas which are a combinatorial explosion and there is no algorithm to derive a specific formula. On the other hand, the space of flash trading is restrained to several well known algorithms of which rely on “training” based on historical analysis. The sources are well known and the “tweaks” of the algorithm are a restricted combinatorial space that can be devised. So does, more than likely, other parts of the ambiguously described code.
    – Based on this above point, it worries me that employers are tagging as “proprietary information” algorithms and scientific knowledge that can be derived by outside sources and punish employees unjustly because they have a ” take it or leave it policy” with regards to proprietary information and trade secrets.

    While I know the details of the specific algorithm are not disclosed and there lies the difference, it has opened a door for my concern since the moment I came across this case.

    Thanks in advance

  • [Avatar for angry dude]
    angry dude
    October 20, 2015 10:05 am

    Anon@6

    “…and make it corporal again somewhere else…”

    Then copyright on the code itself won’t apply – it will be a different code by then, e.g. it can be rewritten in a different programming language but still doing the same thing

  • [Avatar for Anon]
    Anon
    October 20, 2015 07:02 am

    angry dude,

    Notwithstanding the point that what is in the mind is not controlled, the effective use of that something in the mind is very much controlled – and controllable – and is so without the dire consequences and dark images that you wish to portray.

    All this does is point out the truism that software is not the thought of software.
    Nothing more.

    So the individual remains free to carry what is in his mind. As it should be.
    Also, if that individual were to do more, were to take that out of his mind and make it corporal again somewhere else, well, the aforementioned laws then become applicable. Your attempted point does not reach.

  • [Avatar for angry dude]
    angry dude
    October 19, 2015 10:16 pm

    Anon @4

    Sure it IS possible

    Stalin did it very “effectively” without resorting to “employment law”

    Just read “In the First Circle” by Solzhenitsyn

    The point I want to make is this: If I work on some piece of my own code it is impractical and pretty much impossible to limit my “possession” (not to be confused with “legal ownership” – copyrights, patents, trade secrets etc) of that particular piece of code … unless I’m put under 24 hour surveillance

  • [Avatar for Anon]
    Anon
    October 19, 2015 09:45 pm

    angry dude,

    The point Gene was making in reply was that you are not correct.

    It IS possible to limit a creator’s access to his own creation – at least “effectively” so.

    This happens all the time in employment law.

  • [Avatar for angry dude]
    angry dude
    October 19, 2015 04:32 pm

    Gene,

    The point I want to make is not to state that he owned any rights in the code, but that he already had it since he wrote it: it is impossible to limit creator’s access to his own creation during work period.
    If I were a software company owner I would not prevent people taking their work home or working remotely, but I would make it very difficult to copy someone else’s source code.
    But why upload a copy of the code to offshore server through company’s firewall (which logs all transactions) is beyond my comprehension…
    Well, I guess sometimes clever people do very stupid things

  • [Avatar for Gene Quinn]
    Gene Quinn
    October 19, 2015 01:18 pm

    Angry dude-

    You are simply wrong. When you are an employee it doesn’t matter if you wrote the code or not. Ownership is what matters. If you are paid to write code and you write code then the code you write is owned by the employer, period. It is really a pretty simple concept. The idea of steal code is not at all bogus.

    -Gene

  • [Avatar for angry dude]
    angry dude
    October 19, 2015 12:17 pm

    The right question to ask: was this the code he wrote himself ?
    If yes, then this whole premise of stealing source code is bogus – the code is in his head and he can easily rewrite it, maybe write a better code (I can write much better code on a second pass because I know all design mistakes I made the first time)
    So they can only use non-compete and non-disclosure clause in his employment contract whatever it is (why he uploaded the code to some server abroad presumably through Goldman’s firewall is another matter and is beyond my comprehension 🙂

    The more serious and offensive thing to me is this: When Goldman Sachs feels that someone stole “their” code (the High Frequency Trading code they use daily to rip off the rest of us – ordinary stock holders btw) they go directly to FBI and the guy gets arrested.
    And when I know that Apple stole my PATENTED code I have no legal remedy at present (other than jumping through the hoops for many years and possibly paying their lawyers’s fees at the end)

    Strange world