Russian programmer fights Goldman Sachs and wins one round
blogs.marketwatch.com
blogs.marketwatch.com
https://ia700209.us.archive.org/9/items/gov.uscourts.nysd.35...
The basic argument hinges on the three counts, related to three laws he was alleged to have broken: the Economic Espionage Act, the National Stolen Property Act, and the Computer Fraud and Abuse act. The third charge was dismissed by the district court because it rested on the fact that he had either accessed systems he was not authorized to or exceeded authorized access. However, he was authorized to access the source code in question, and what he did with it afterwards has no bearing on whether he exceeded his authorization, so it doesn't fall under the CFAA.
The district court did convict him on the first two counts, but the Appeals Court reversed. Their argument is that the National Stolen Property Act doesn't apply because it applies only to actual physical goods, not mere intangible ideas. Had he photocopied the source and walked out with it, or loaded it onto a thumb drive at the office and taken that with him, it would have counted as stealing a physical good, but merely uploading it to a server and downloading it onto a thumb drive later does not count.
The court further argues that he did not violate the Economic Espionage Act because the clause in question he was prosecuted under specifically requires that the "trade secret ... is related to or included in a product that is produced for or placed in interstate or foreign commerce". Since Goldman Sachs' HFT trading system entirely proprietary and internal and not produced for or placed in interstate commerce, that particular law does not apply. Apparently Congress specifically intended this restriction, because earlier drafts of the statute had broader language that merely included "proprietary economic information having a value of not less than $100,000". The fact that Goldman Sachs uses the product for interstate commerce is not compelling, it had to itself be produced for or placed in interstate commerce.
That last part is interesting. It implies that if you run proprietary, internal code that is not sold or intended to be sold in the future, you appear to lose federal criminal trade secret protections. It's interesting that they tried to prosecute him on theft, trade secret infringement, and exceeding authorized access, but not copyright infringement. From my reading even unpublished work is subject to copyright.
Neither the original conviction nor the appeals court opinion ever addressed the copyright issue. In order for him to have stolen something, it would have had to be something of value; so why wasn't he further prosecuted for copyright violation? From the documents I read (not all are available on PACER), the copyright question never even came up.
More documents from the case:
Motion to dismiss the original case in district court: https://ia600209.us.archive.org/9/items/gov.uscourts.nysd.35...
Government's response to the motion: http://www.archive.org/download/gov.uscourts.nysd.358303/gov...
Affadavit of the investigating officer: http://www.archive.org/download/gov.uscourts.nysd.358303/gov...
District court's opinion dismissing the third count but refusing to dismiss the first two: https://ia600209.us.archive.org/9/items/gov.uscourts.nysd.35...
List of files requested in discovery, to demonstrate that what he took was insubstantial and not proprietary: http://www.archive.org/download/gov.uscourts.nysd.358303/gov...
A few of the things he had downloaded were their version of the Erlang platform, which is available under the Erlang Public License, a derivative of the Mozilla Public License. So it would be more fruitful to debate the merits of that license, not the GPL.
All of the currently uploaded items in the docket: https://ia600209.us.archive.org/9/items/gov.uscourts.nysd.35...
Aleynikov has pleaded not guilty and is waiting for his trial in New York State Court.
Does "not guilty" refer to the trial in which he's suing them? Or is there another trial even though he's already been found not guilty (double jeopardy)?
So, he's been found not to be guilty of those particular federal crimes, but there may be state crimes that he could still be found guilty of. They are separate jurisdictions and separate laws, so it doesn't count as double jeopardy.
So the clear text of the Constitution, as the drafters understood it, did not prohibit concurrent federal and state criminal trials for the same crime. Indeed, it imposed no limits on state criminal procedure at all. No due process, no nothing.
Copyright in this kind of case is usable almost exclusively by GPL style licenses, where the code is already available.
Registering allows you to sue for more money than if you don't register, but any creative work is automatically protected by copyright law (including full rights to control and prevent reproduction/distribution) automatically as of the moment the work is first fixed into a "tangible form of expression".
That's not entirely correct. From the U.S. copyright statute, 17 USC 411: "... no civil action for infringement of the copyright in any United States work shall be instituted until preregistration or registration of the copyright claim has been made in accordance with this title." [1]
(The term "United States work" is defined in 17 USC 101 [2]. There are certain exceptions, unlikely to be relevant.)
Technically that's correct -- but there are some possible adverse consequences if you don't register before the infringement begins (or alternatively within a three-month window after first publication). Specifically:
a) you forfeit the option of seeking "statutory damages," and instead you have to prove up your actual economic loss and any additional profits made by the infringer arising from the infringement; and
b) you don't get to seek attorneys' fees from the infringer if you win --- but if the infringer wins, the infringer can still seek attorneys' fees from you.
Maximum is $250,000 per infringement if it is registered (and possible jail time for 10 or more infringements). If it is not registered then liabilty is just (simplified version) the retail price of each work infringed.
So, without registering it and without ever pricing it for sale, it could be argued that the damages would be $0.
The US Copyright Office has a FAQ document which explains what registration does:
http://www.copyright.gov/help/faq/faq-general.html
A more detailed explanation is in this pamphlet:
I down-voted you because people keep saying that and it is false.
The Vanity Fair article uses the qualifier "possibly" when talking about GS violating the licenses and that's because none of the major license families (BSD, GPL, MPL, etc) have a requirement to release modifications if the whole is not released outside the organization that made them. The Vanity Fair article does not say that the code was ever distributed out of Goldman.
http://www.vanityfair.com/business/2013/09/michael-lewis-gol...
Oh noes, now we can't have nice things anymore...
http://www.gnu.org/licenses/gpl-faq.html#GPLRequireSourcePos...
According to the article Goldman would routinely strip off the license/copyright from off of the open source code file and replace it with their own copyright. And that is a violation of many open source licenses.
You only need to release the source if you're distributing the modified code, which GS obviously would never do...
No, GS will have to pay because the defendant was an officer at GS.
I don't think this is at all what happened. I think a judge ruled that he was a director at the company and therefor the company had to cover any legal costs he incured due to being a director of the company.
As far as I can tell, Goldman's actions had nothing to do with them paying his legal bills.
That might be clear to rubes who believe everything that they see on television.
What's clear to me is that Goldman Sachs wants to ruin this guy's life. Which, to some people, makes him a stand-up guy.
He works in an industry that does not allow you to email
code home or copy it off of company computers.
For example:
The defense will demonstrate at trial that Aleynikov
regularly transferred files offsite and to a local
directory on hosts at Goldman’s development network so
that he would be able to continue working productively in
case of a network outage at Goldman to servers hosting
repositories with platform source code. The records
requested in Item 21 will demonstrate that shortly before
Aleynikov left Goldman, there was an outage that made
access to source code unavailable at least for several
hours that impacted developers’ productivity. This
information will aid the defense in demonstrating that
Aleynikov did not have the specific intent necessary to
commit the crimes with which he was been charged.
Except he wasn't fired; he was sent to federal prison. Those two results are not equivalent.
At best this should have been a civil lawsuit. The public almost certainly has no interest in what happened.
Goldman Sachs have come out of this as the bad guy, throwing their massive legal resources against a single individual.
You can certainly make the case that Goldman paid for that code, and if they didn't want it pushed upstream that's their prerogative, but it's a very different thing to sell trade secrets to a competitor (how the mass media has reported the case) and to make a backup of an open-source library you modified at work.
If he incorporated other's insight in to his open source code by adding more code, I would view his actions in an extremely negative light.
When a single bug can do a billion dollars in damage or bankrupt you, nothing is left to chance...
That doesn't make any sense. If the code truly were FOSS, why on earth would he copy it from his employer when he could eliminate legal risk by downloading it off the open internet? We know he's not stupid.
He had made changes/improvements to various FOSS projects he was using at Goldman that he wanted to submit as patches upstream but his bosses wouldn't let him. He figured that since he was leaving he might as well take the FOSS code he had modified with him so he could submit patches later. The legality of this maneuver is tenuous at best, as others in this thread have noted, but in my opinion probably doesn't merit years of hounding prosecution and criminal charges.
You haven't met many programmers, have you?
(I'm speaking of myself as well as friends and associates, here.)
(1) Mechanical changes specific to the company -- this could be as simple as hardcoded hostnames that match the deployment environment.
(2) Implementations of algorithms. In this case it isn't the code that is proprietary so much as the algorithm that the code is an expression of.
I suspect that downandout is talking about defintion #1 and the court is talking about definition #2. Hard to say without seeing the code itself.
I don't know the exact details of the case, but just to clarify: under the GPL, you don't have to release your changes if you aren't distributing that commercial product.
e.g., If he modified it for in-house use, there is, AFAIK, no legal obligation to release those modifications (under the GPL).
I'm just saying if you're just relying on employees not exercising rights they have - after which something you've been trying to prevent distribution of can be freely distributed - your situation is somewhat fragile.
I hadn't heard this part of it - what was the license in question?
Do you have facts to back this up? People join and leave jobs in the financial industry every day. Is Goldman Sachs special in this regard?
If anything, the NSA revelations have given conspiracy theorists carte blanche to go full steam on their theories. You'll hardly find a thread related to Google on HN without the obligatory "Well, now that we know that Google has given NSA has unfettered access to all data..."
Were conspiracy theorists justified in believing their theories prior to the NSA leaks? Maybe, maybe not. But we should probably consider that independently of whether or not their theories turned out to be right. After all, we can never be 100% sure of our knowledge; the best we can do is seek the most reliable methods of inquiry. If a conspiracy theorist makes 50 predictions and 45 of them turn out to be correct, then we might have a reason to adopt their thought patterns; if someone has one big suspicion and that suspicion turns out to be true, I'm not sure how much we can conclude from that.
(Sorry, I know this discussion is getting off-topic... I just have a mild fascination with conspiracy theories and epistemology.)
Few people connected the NSA dots because few people connect any dots. There are dozens of other important stories snowed under by the same blizzard of laziness and stupidity.
Really? Even the more paranoid conspiracy theorists didn't think that the Government could read the address and subject of your emails? The same people that think the Government did 9/11 and faked the moon landing?
Don't even get me started on chemtrails...
> The GPL does not require you to release your modified version. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization. But if you release the modified version to the public in some way, the GPL requires you to make the modified source code available to the program's users, under the GPL.
http://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.html#GP...
Distributing the code within a company/organization does NOT constitute 'distribution', and does NOT require you to release your code.
Edit - and in the licence itself - Version 3 of the GPL
> “The Program” refers to any copyrightable work licensed under this License. Each licensee is addressed as “you”. “Licensees” and “recipients” may be individuals or organizations. And
> To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
I can't find any mention of "organization", but I do find these parts (GPLv2):
3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: [give access to the sourcecode]
Meaning everyone you distribute a copy to, you have to give access to the sourcecode, too, or provide instructions on how to get the sourcecode.
6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein.
Meaning distributing the program to someone gives them the full rights under the GPL.
(IANAL, so I'd be very pleased to be corrected here. Maybe the FAQ made the assumption that corporations have other means to keep employees from exercising GPL rights? Or maybe the license is to the corporation as a whole, and it itself can't break the GPL unless it distributes it to different entities?)
> “The Program” refers to any copyrightable work licensed under this License. Each licensee is addressed as “you”. “Licensees” and “recipients” may be individuals or organizations.
And
> To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
I learned relatively early that above some level (that's not even all that high), you'll find that you're dealing primarily with people whose sole purpose in life seems to be to serve their love of money and quest for validation. They are like insects drawn to a light and about as thoughtful.
Suffice to say that when you find that you have to play harder and harder to make up for the stress of your daily work life, it's time to take a look at what you really want and why you're doing what you're doing.
There are many people in business that are literal sociopaths. They will bury and burn any and all barriers on their path to making an increase in share price. "I will not let this company flounder on my watch!", they hypothetically say in my mind. To these mythical business people, the share price is an extension of their character. Maybe that's a bit extreme and that's not why I'm investing.
But it's why the market doesn't scare me. Too many sociopaths all want one thing: the numbers to go up.
I know I'm right too. Just rewind to 2002-2008.
He is active in on the Erlang mailing list. He wrote a cool C++ to Erlang interface. Here is his Github account:
I am happy for him. He is a great asset to the open source community.
https://github.com/saleyn/erlexec/commits/master?page=2
Nice, and helpful person.
i just can imagine how every FBI agent jumps when reading that there is a whole repository of subversion (or subversions?) out there.
I can't help smile at the thought of what non-CS people might mistake a "subversion repository" for.
"On 8 September 2005, the Seoul Central District Court ruled that the GPL was not material to a case dealing with trade secrets derived from GPL-licensed work. Defendants argued that since it is impossible to maintain trade secrets while being compliant with GPL and distributing the work, they are not in breach of trade secrets. This argument was considered without ground."
But really it's a judge ruling that the original trial was all effed up and that a new trial would need to take place in order to do justice.
The state prosecution was an entirely different matter, which is why they had to strain to pretend it wasn't double jeopardy. The "acts" were the same but they had decided to classify them as different, lesser crimes. In fact he had already served more time than he could have been sentenced under those, rendering the whole proceeding nothing more than a farcical publicity stunt.
PS: If i remember correctly, hadn't Sergey resigned from GS by then? I thought he was just hanging around an extra week or two to train his successors.
It is uncommon in the United States. Which is why it's surprising.
In the last 200 years, American common law has diverged a great deal from British/Commonwealth common law, both in the law itself, and in how it's practiced.
http://online.wsj.com/public/resources/documents/021110aleyn...
It pretty explicitly details how the "backup" program he wrote had flags to select what to copy and some of those flags specifically copied GS option pricing code that he had never worked on.
I see that he wrote a backup script that could backup two distinct groups of files depending on what argument he passed on the command-line.
While the indictment mentions that some of the files included stuff he didn't work on, it doesn't say he set flags specifically to grab stuff he hadn't worked on. Only that it was getting swept up as part of a larger backup operation.
It also said he ran the backup on many occasions throughout his employment at Goldman. That doesn't sound like someone who only absconded with code after he got an offer to work at a competitor.
As an aside -- I'm wondering if "the website" referenced in the filing was rapidshare. Weren't they in Germany?
1) Did he copy propriety GS code that he had no involvement with. A lot of people seem in this thread seem to think he didn't, but as far as I can tell from the indictment it's pretty explicit that he did and I don't think that it's disputed by either side.
2) Was his intention out of malice (intention to steal trade secrets), stupidity or something in between.
The first is the point I'm making without commenting on the second.
Trade secrets, which is likely what such software is likely to be declared to be, is, well, secret. As such, it has legal protection different than patents or copyrights.
Patents restrict use, copyright restricts copies. AFAIK, he didn't actually run the 'stolen' software, only copied it.