Source Code Is Tangible Property

The New York Court of Appeals (Fahey, J.) waxes lyrical in affirming the conviction of a former Goldman Sachs computer programmer who tripled his salary on departure

Ideas begin in the mind. By its very nature, an idea, be it a symphony or computer source code, begins as intangible property. However, the medium upon which an idea is stored is generally physical, whether it is represented on a computer hard drive, vinyl record, or compact disc. The changes made to a hard drive or disc when information is copied onto it are physical in nature. The representation occupies space. Consequently, a statute that criminalizes the making of a tangible reproduction or representation of secret scientific material by electronically copying or recording applies to the acts of a defendant who uploads proprietary source code to a computer server.

In May 2007, defendant Sergey Aleynikov began employment at Goldman Sachs (Goldman), the investment banking and financial services company, as a computer programmer working on the firm’s high-frequency trading software. High-frequency trading – which uses sophisticated, electronic trading tools, proprietary strategies, and computer algorithms to perform market data calculations and trade securities at very rapid speeds – is highly competitive. At the time, larger, established institutions competed with nimbler start-up companies, which were developing their software from scratch. As a senior employee in Goldman’s technology division explained at defendant’s trial, the firm sought to “stay competitive by constantly investing in and updating [its] software to be as fast . . . as possible, to have the best connectivity and infrastructure as possible and [to] have the best algorithm[s] as possible.”

The computer code for Goldman’s high-frequency trading system is a key to successful trading for several reasons, as the senior employee would testify. First, one essential value of the code is “[c]onnectivity,” which “allows [a] computer program to speak to various stock exchanges or to have market data about what’s going on in the world,” including the price of a stock at “any given second.” Second is its “business logic” component, the algorithms that permit Goldman employees “to make a decision about what trade to generate or price to advertise, which price [to] buy or sell a security at.” A third key component of the computer code is the “infrastructure” or “all the other software . . . to make [the] system run robustly through the trading day.” Goldman’s high-frequency trading software is a constantly updated version of a system acquired by the firm when it purchased a pioneering algorithmic trading company in 1999 for some half a billion dollars.

Defendant’s primary responsibilities at Goldman included “the infrastructure components” of the stock group and “upgrading one of the exchange connectivity components.” Defendant had complete access to the high-frequency trading system’s source code, i.e., computer instructions written in a human-readable programming language. The source code was contained in the firm’s “software repository” or library. A software developer such as defendant “could check out the code . . . make changes to it and test it locally, merge it with the changes of other individuals, and then have those changes become the production software that runs every day.”

Goldman employees, however, were not permitted to remove a copy of source code  from the company’s network. Every Goldman employee signed a confidentiality agreement acknowledging that any software the employee is creating is the property of the firm. The employee confidentiality agreement stated that “[c]onfidential and proprietary information and materials shall be used only as authorized and only for the purposes intended by Goldman Sachs.” Moreover, access to the source code while an employee was away from the office was restricted, with the only authorized access to the source code repository from home or while traveling being “remote log-in access to [the employee’s] desktop,” which gave an employee “a window onto” the employee’s Goldman desktop computer, while “all of the files and contents” would “stay inside Goldman Sachs.” Programmers were not permitted to email source code to themselves.

By late 2008, defendant’s annual remuneration at Goldman was $400,000, but, in the spring of 2009, defendant accepted an offer of employment at Teza Technologies (Teza), a Chicago-based start-up company, where his annual compensation would be $1.2 million. Teza had no equipment, connectivity, or software for high-frequency trading at the time. Its founder planned to develop high-frequency trading infrastructure and software from scratch, and urged new employees to “execute relentlessly” because the start-up was “up against experienced and very wealthy competitors.” Defendant was to be the “head of infrastructure” and “the system architect.”

On June 5, 2009, his last day at Goldman, defendant uploaded a large quantity of Goldman’s high-frequency trading source code, via a website, to a subversion repository, i.e., a remote server to which a user could transfer code. He used the same username, “saleyn,” that he had chosen for his personal email account. The internet security systems at Goldman generally blocked employee access to such websites, but had overlooked this one, based in Germany.

Goldman Sachs discovered the breach and went to the FBI. An ensuing federal conviction was reversed by the United States Court of Appeals for the Second Circuit.

Here

In September 2012, defendant was charged in state court (see CPL 40.20 [2] [f]) with two counts of unlawful use of secret scientific material (Penal Law § 165.07) and one count of unlawful duplication of computer related material in the first degree (Penal Law § 156.30 [1]).

The court here upheld a state felony conviction

Without leaving the confines of the trial evidence before us, we conclude that viewing the facts in the light most favorable to the People, a rational jury could have found that the “reproduction or representation” that defendant made of Goldman’s source code, when he uploaded it to the German server, was tangible in the sense of “material” or “having physical form.” The jury heard testimony that the representation of source code has physical form. Kumar, the computer engineer, testified that while source code, as abstract intellectual property, does not have physical form, the “[r]epresentation of it” is material. He explained that when computer files are stored on a hard drive or CD, they are physically present on that hard drive or disc, and further stated that data is visible “in aggregate” when stored on such a medium. The jury also heard testimony that source code that is stored on a computer “takes up physical space in a computer hard drive.” Given that a reproduction of computer code takes up space on a drive, it is clear that it is physical in nature. In short, the changes that are made to the hard drive or disc, when code or other information is stored, are physical.

The opinion of the First Department is linked here.  (Mike Frisch)