‘Flash Boys’ Programmer in Goldman Case Prevails Second Time
bloomberg.com
bloomberg.com
https://en.wikipedia.org/wiki/Sergey_Aleynikov
"On April 11, 2012, Dennis Jacobs, Chief Judge of the United States Court of Appeals, published a unanimous decision in a written opinion[11] stating:
On appeal, Aleynikov argues, inter alia, that his conduct did not constitute an offense under either statute. He argues that: [1] the source code was not a "stolen" "good" within the meaning of the NSPA, and [2] the source code was not “related to or included in a product that is produced for or placed in interstate or foreign commerce” within the meaning of the EEA. We agree, and reverse the judgment of the district court.[10]
In the course of these events, Aleynikov has spent 11 months in prison. Aleynikov has divorced, lost his savings,[12] and, according to his lawyer, "[his] life has been all but ruined".[13]
The government did not seek reconsideration of the Second Circuit's ruling, thus ending federal action against Aleynikov.[14]
Later, on December 18, 2012, the law was changed by Congress, in order to punish acts like the ones Aleynikov committed in future rulings, in a law referred to as the "Theft of trade secrets clarification act of 2012".[15]"
I used to work at Goldman's and can tell you that they are paranoid about this kind of thing. They are trying to make an example out of Sergey. We used to get daily updates (on the corporate intranet) about the progress of the case. There is no telling how much money Goldman's has spent going after this guy. Both directly and indirectly through lobbying. You have to ask why, after a year in jail with no conviction, the government still trying to prosecute him? Could it be because Goldman has a very powerful lobbying arm which is particularly strong in New York?
If you are leaving your employer, don't upload any code. Sure. ...but that was over 6 years ago and the guy has already done time. Try getting a job with a prison record. I can tell you that in the banking industry it will not happen.
I wouldn't be the least bit surprised if they keep coming after him. Poor guy.
One last point. There is no market for stolen code. If I stole Google's search algorithm, who would I sell it to? Microsoft wouldn't be interested and it is not like you can take out an ad on ebay. Who would have the brains to figure it out? If you had those brains, wouldn't it be easier to just write it yourself? What is true for Google's code is also true for any complex system such as trading software.
Except it takes months to recreate code. Much easier for you to walk up to your boss and show them a working prototype after a week of refactoring.
No. For a neanderthal leadership it doesn't take months to recreate code. It usually takes forever.
Goldman Sachs and many such large corporation, including the US Government, are led by a bunch of dinosaurs. People who do not understand what code is.
What they understand instead is bullying, setting an example like some sort of public execution, owning people to the point of slavery etc. They know what it means to prosecute and destroy lives of individuals. And enjoy parties and drinks on the side in the evenings.
And this is just one example of that tyrannical trait.
I'm not sure that follows. Many trading companies operate as black boxes, and there are a hell of a lot more of them, and they have much fewer employees, and seem to exemplify a "get rich quick" attitude.
Google's search algorithm might not be very marketable but I can think of tons of different uses for stolen proprietary trading algorithms. The potential for inflicting enormous economic damage is very real.
This doesn't mean that GS is doing the right thing going crazy after him, rather it's just an explanation that he could make money with it elsewhere.
Oh yeah. There's a big difference between doing the right thing and doing what's in GS's best interests.
If he took the former, then I'd side with him — he took nothing of genuine value. If he took the latter, then, très uncool. (I witnessed several incidents of model theft while serving time on Wall Street in the mid-2000s, and none were publicly pursued like this one.)
They don't provide a ton of detail in the book, but it seems that he wanted to take some FOSS code he modified himself while at Goldman. All code ever used on a Goldman machine is licensed as proprietary, even if it was downloaded from a FOSS repository 1 µs beforehand. It's mentioned that some irrelevant infrastructure code may have been intermingled with the modified FOSS he took, though it doesn't seem Goldman was particularly incensed by any particular piece of code, simply by the fact that he took any to begin with.
Also in the book, Michael Lewis brings together a panel of HFT technologists to interview Sergey and assess whether anything he took was consequential. Their collective conclusion after meeting with him for several hours was that he took absolutely nothing of value.
The person I was responding to said they took FOSS and made it proprietary in one microsecond.
You can't rip the copyright notices or license text off anything under the MIT license, for example.
The MIT license explicitly applies to those who obtain a copy of the code, not those who distribute it (although you are explicitly granted the right to distribute the code if you do obtain a copy of the code).
It also requires that all copies or substantial portions of the software maintain the copyright notice and the license text. If Goldman is just ripping off copyright notices and MIT licenses and slapping on their own copyright notice and license (or lack, thereof), they are doing it wrong. Way wrong (would not surprise anyone though).
>Copyright (c) <year> <copyright holders>
>Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
>The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
>THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
If it's permissively licensed, sure. But not just any license.
http://code.google.com/p/svnarchive/source/browse/trunk
Source: http://zerohedge.blogspot.com/2009/07/aleynikov-code-dump-un...
https://en.wikipedia.org/wiki/Goldman_Sachs
It isn't:
Kroger -> Krogers Meijer -> Meijers
etc. I never noticed it until I went on a linguistics bender on Wikipedia where it was noted.
Microsoft might not be interested, but every SEO company out their would be.
1. There were definitely NOT daily updates about the progress of this case
2. He WAS absolutely trying to steal code. Goldman high-frequency code isn't great (except in options market making). The thing that ultimately flagged him was that he kept trying to clear his .history file.
3. He wasn't planning on selling it. He was planning on taking it to Teza, a place that has a notorious reputation for poaching people and code.
In fact, even if you don't believe me, that's okay--Goldman Sachs deserves to be given some crap!
This was an exaggeration that I did not think would be taken literally. We had updates as the case progressed. I would guess about once a month. These updates were on the corporate intranet home page which generally contained about 5 links to 'external news' or something.
>He WAS absolutely trying to steal code. Goldman high-frequency code isn't great...
You have written this in a weird way. I agree he was trying to steal code. The quality of what he stole is not relevant. The way you have written this, it could be read: "He tried to steal high-frequency code". This is very much debatable. I could easily argue that Log4J is part of Goldman's high-frequency code.
He did try to cover his tracks. What he did was wrong and he knew at the time it was wrong. Six years later, does the punishment fit the crime?
>He wasn't planning on selling it. He was planning on taking it to Teza
Yes. This is the interesting point. He wasn't planning on selling it because there is no market for it. By this, I mean that there is no place he could list the code for purchase because:
1. It would be illegal and other companies frown on that kind of thing (at least on paper).
2. The code would not be worth much without an understanding of what it does in the wider ecosystem.
Point two is key. Sergey understood the code. He was uploading it to help him remember the work he had done at Goldman's. There is very much a market for, "I did XYZ at Goldman's, I can do it for you too." I have no doubt that he would have been able to do it again without the source code, but he wanted his 'notes'.
GS didn't want him to apply his trade at another firm. Hence the 'vindictive employer' remark.
How long before another developer gets harassed by Goldman's because they printed off some technical documentation before leaving? What if the documentation is printed a month before leaving? ...a year? ...where is the line, exactly?
For those interested, Teza uses (single-threaded) Java and Hadoop (or at least they used to), and Goldman Sach's high-frequency code was written in C++.
I'll assume you mean .bash_history This discussion has been had here before. There are plenty of good non-sketchy reasons to delete it, and at some places it is mandatory.
There are many shells aside from bash. My systems don't even have bash installed.
He also encrypted the files, uploaded them to his remote computer, and then deleted the programs used to encrypt and upload them.
user@somemachine.gs.com:~/ >svn export --username Aleynikov --password Hunter2 \
--non-interactive svn://subversion.ZOMG.think.of.the.children.com/plundered/exportFile
user@somemachine.gs.com:~/ >rm .bash_history
You may criticize him for using encryption but what would you have him use, plaintext and ftp?
Microsoft would not buy it because that would be illegal on their part as well.
However, if I can reverse engineer Google's code, I can put myself at the top of the search rankings.
Sell that, rather than selling the code.
I can't find a citation, but he was worth that much to Teza precisely because of the HF trading models he was bringing with him. I've worked at hedge funds where quants did have rights to their own trading algorithms and under their agreement they could leave and take them to the next shop. If Sergey did not have such agreement, taking anything (even his own code) would be considered company property.
I am not familiar enough to say he did or didn't steal company property, but I would certainly not say that "there is no market for stolen code". If all he really took was open source code than this is indeed a witch hunt, but I don't see why any company would pay so much if they could just get the free open source code.
[1] http://www.bloomberg.com/news/articles/2015-04-21/goldman-co...
He hasn't stolen anything (since the source code is still on GS' computers), he just copied it illegaly. Using the word "stealing" for this is plain propaganda.
> https://www.youtube.com/watch?v=IeTybKL1pM4 [Copying Is Not Theft]
This is just not the case. Google "sued trade secret misappropriation." The classic example is a company hiring someone with a wink and nod and they bring over all sorts of stolen documents.
Personal accountability is a good thing, and at the very least we shouldn't be repeating the whole "hey, they didn't make the rules" post hoc rationalization on people. Vance could have said no to pressure. The fact that he didn't is a very individual problem.
And, it smokes out the Godwin trolls whose sole "contribution" is taking offense to everything.
I think Vance should have left well enough alone after the first prosecution failed, and the New York "scientific material" charge was clearly the weakest of the three. But the federal prosecution was perfectly reasonable. The statutes at issue were intended to make that sort of conduct illegal. But they hadn't been updated for the digital era. Had Aleynikov made photocopies of the code instead of uploading it, the first conviction would have been upheld.
My personal opinion is that Aleynikov violated the intent of the law, but not the wording. He basically got off on a technicality, a "bug" in the law that was quickly patched afterwards.
And the other statute on which the prosecutor lost was because the court didn't believe code on a usb was a "good." But if it had printed on paper it would have counted. A sort of stupid distinction.
The prosecutors lost on two narrow statutory interpretations. It happens and it isn't some sort of negligence.
Had he stolen the code from Windows division of Microsoft or had he printed it on paper he'd be guilty.
Sounds like trumped up bullshit, actually.
According to Wikipedia, this guy was also pursued by the State of New York after being released from jail (since he did nothing wrong) on the same conduct and lost his double jeopardy appeal because a State judge claimed New York was a sovereign entity from the US Federal government and so his constitutional right to not be tried multiple times for the same behavior does not exist.
The State of New York also ultimately lost by failing to show actual violation of claimed statute.
Goldman was performing commerce: trading securities and commodities. And the software in question was used to perform that commerce.
Before it was amended, 18 USC 1832 applied to a "product that is produced for or placed in interstate or foreign commerce." The issue was what "produced for" meant. Was it enough that the product be "produced for" the purpose of effecting commerce, which the software was, or did the product itself need to be sold in commerce?
No, the distinction was that it was a service they used in commerce when the law only said "product." Now the law was amended to say product or service in interstate commerce.
>and so his constitutional right to not be tried multiple times for the same behavior does not exist.
Double Jeopardy only applies to to the same sovereign entity. If you do something that breaks federal and state law, that is on you.
That is how it has always been, it wasn't surprising that the court didn't agree with double jeopardy.
I wouldn't go so far as to call him "innocent", but it sounds to me like his defence is perfectly reasonable. What he did may have been a breach of contract, copyright, and common decency, but it wasn't illegal. And given the way Goldman is clearly out to get him, and the abuse of power on display by both the federal and state prosecutors, he's the least dirty of all the parties involved.
"prosecution failed to prove that Aleynikov made a tangible reproduction of the source code he was accused of appropriating, as required by the statutory language."
Damn this guy keeps winning on statutory issues. This must be pretty damn embarrassing for the state's attorney.
The guy served a year in prison and there is no indication that he used the misappropriated code. I can't imagine the judicial resources are best used continuing the case.
Though, anyone leaving a company shouldn't take this as a signal that you are allowed to just take code and run out of the door. The federal law he was acquitted under was amended to make what he did illegal. And in most states he's definitely flirting with trade secret misappropriation laws. Don't take any code with you.
Are you kidding? Its Goldman Sachs we are talking about here, nothing is too good for our banker overlords.
edit: forgot to mention it wasn't the us. but the banks were american.
That whole thing had to have been hugely distracting, though.
EDIT: Of course, breaking into a building or hacking a network to get it is a different matter altogether.
If one person had exclusive use of "Word", the "IP" would be worth a great deal less than it is right now, when almost everyone has "Word". The property here is called "network effects", and it also applies to physical property. If only two telephones exist, they're a good deal less valuable than if everyone has a telephone.
The difference between stealing a car and putting it in a garage and stealing code and letting it sit on a flash drive in an office drawer is that the original owner of the car no longer has exclusive rights to use it, but the rightful owner of the code can continue to use their original property, often times exclusively. It's only when, as you eluded to, the stolen code gets used that a financial loss can be justified and I wouldn't argue against prison as a punishment.
But, I'm not really arguing that stealing code or any other intellectual property is _not_ wrong, but there really is a difference between the common analogy of stealing a car, which I think most people who do argue that position are trying to justify. I don't think that a person or company can truly claim a financial loss if they become aware of someone else or another company is in possession of their code until they have proof that the code was used either as reference or directly.
Why are developers so eager to deny that code has any value?
with code, you are only depriving the owner of exclusivity, and then only if you use that code in the real world. and even then, it only becomes material harm if you actually use it to compete with them.
it's vastly different.
I feel the same should be done for counterfeit goods.
What an interesting opinion.
The value of a thing comes, in part, from the labor to get it. His employer paid hundreds of thousands of dollars to make this code. On the other hand, stealing it, unlike a car, results in a duplication with the original still in working condition.
Was anything lost, physically no, but he did commit a serious breach of contract rather than theft.
Property rights don't just grant you the right not to be made worse off, they grant you the exclusive right to profit from something.
Now, whether non-violent violations of property rights should be punished by jail time is a separate issue.
If you can do that I'm prepared to give code all the same rights as traditional property. If you can't then you might consider that physical goods and intellectual ones aren't the same and MAYBE different rules should apply.
What real actual things is the code representative of?
Further I was talking about code in general. To have separate laws or treatment of "financial" code versus "regular" code would be pretty silly. How would you even draw the line between the two?
Rivalrous and non-rivalrous goods: https://en.wikipedia.org/wiki/Rivalry_(economics)
I'd also argue that stealing code is depriving the owner the control of the code. The property interest is in the code in the non-tangible sense. It doesn't matter that I still have a copy.
This is especially true for code that is confidential. A lot of the value of Goldman's code is that nobody else knows it. Otherwise you can predict their trades, which can cost them money.
I just don't get the idea that millions of dollars of hard work can be stolen and it isn't a big deal because it's not physical. But everyone is okay when you throw a kid in jail for stealing a pair of Beats that cost 20 bucks to assemble.
Because it changes the nature of the harm caused.
Stealing a car is a crime not because the defendant has a car, it's a crime because the true owner no longer has his car.
Stealing code... the true owner still has it. And while there may still be harm, it's certainly of a lesser sort.
And in this case in particular, no harm occurred or could reasonably have occurred in any variation of the scenario.
This is a craftsman keeping a photograph of his work for a portfolio. Nothing more.
> A lot of the value of Goldman's code is that nobody else knows it.
If that's the value... then that code has no value.
> Otherwise you can predict their trades,
Then their trades amount to gambling, and I don't see why the taxpayer should have to pay for security for their vice.
It's a crime because he has someone else's car. A property interest in the US common law system has always carried a right of exclusion and a right of control.
You are trying to limit it to just a right of possession.
>And while there may still be harm, it's certainly of a lesser sort.
Only because you insist that physical loss is always worse. Don't you think Goldman would be worse off if this code was taken vs. one of their cars? One is worth millions and the other several thousand dollars.
In fact, we have a very easy way of deciding which is worse. The economic damage is causes. That is actually how society judges how bad stealing is. Theft over a certain amount is worse than petty theft.
>This is a craftsman keeping a photograph of his work for a portfolio. Nothing more.
That is another matter entirely. I do agree the state should have to prove he intended to use it or disclose it to the public/goldman competitors.
It's sort analogous to borrowing vs stealing. Not every instance of taking without permission is stealing.
By that definition code is not property.
That doesn't make any sense.
It's a crime because the someone else doesn't have their car.
If he could somehow have the car and the owner still have it, then there'd be no harm. Arguably even no crime.
What you describe doesn't criminalize theft... it criminalizes possession.
Seriously, wtf?
Is it common for both jurors to be dismissed in such a case? Or is it determined on a case by case basis?
No hard feelings. Cheers, sir.
Tptacek can bother me because he often presents the best possible form of the counterposition, as can Rayiner. We have different minds about jurisprudence, but I respect them both tremendously.
The discussion was in large part about the legality of the actions, as you can see through Rayiner's comment: >"The Court concluded that he had in fact tried to take 500,000 lines of valuable and mostly proprietary source code, but that his conduct didn't fall within the reach of the two laws charged in the indictment. Solid legal analysis, but an ordinary person would say that he got off on a technicality."
Although my central point was indeed regarding the FBI's outsourcing of its investigation to Goldman Sachs, a private corporation and interested party, which seemed to offend fundamental notions of justice.
But the discussion most definitely significantly touched upon the legality of Aleynikov's actions.
See e.g. Rhino paraphrasing Rayiner's analysis: >"Aleynikov definitely violated New York trade secret law.
He got off the federal charge because the trading software wasn't a product for sale, it was a product for internal use. The law was poorly drafted and once that came to light it was immediately fixed.
Like Rayiner said, in layman's terms, he got off on a technicality."
Or Rayiner himself: >"That was his defense. But the jury found that he had in fact grabbed valuable proprietary software, and the Second Circuit agreed that the 500,000 lines that he uploaded were mostly proprietary, valuable code."
For example, this exchange:
"tptacek: >I have a passing understanding of the policies and procedures binding on developers at trading firms. I dispute the idea that any senior developer could work at Goldman Sachs on an HFT infrastructure and believe that they were authorized to --- or, indeed, that they would not be immeditely fired for --- uploading the code to a proprietary automated trading system to a random SVN host in a different country. This is the code we, as security testers, were never allowed to see, even after owning up the machines hosting it. These firms are not kidding around about this stuff. It is a huge smoking gun to have uploaded any of it to some off-brand foreign svn host.
These are firms where you can be fired for plugging a thumb drive into your computer, or for using the company network to access Dropbox. I have worked for more than one financial firm that spent literally millions of dollars merely on the problem of detecting their network users trying to reach Google Mail. I also dispute the idea that because developers commonly use ssh, gzip, and svn, that it is common practice to (1) gzip a tarball of source code, (2) encrypt that source code, (3) commit that compressed encrypted blob to svn, (4) remove all traces of the encryption key from their work computer. That's something happens zero times on normal dev machines. The conviction was overturned because the technical details of exactly what Aleynikov took from GS didn't fit the ambitious charge the DOJ filed against him. But the appeal doesn't refute the finding of facts from the original trial, which include: There was more than sufficient evidence presented at trial, however, for a rational juror to conclude that Aleynikov intended to steal Goldman Sachs' proprietary source code. First, it was undisputed at trial that Aleynikov actually did take proprietary source code from Goldman Sachs. As Aleynikov concedes in his motion papers, the code he took from Goldman Sachs included a “purposefully designed” portion of the Goldman Sachs “proprietary, custom-built trading system.” Indeed, the evidence showed that Aleynikov took a significant percentage of the proprietary source code for that system. While Aleynikov attempted to show that there was open source code embedded within the proprietary code and to identify the files in which that might be true, his expert witness was only able to identify one file among those taken by Aleynikov that both bore a Goldman Sachs copyright banner and appeared to contain open source code.
I'm just fine with Aleynikov's conviction being overturned. Again, the charges against him seemed ambitious. But this is a forum full of software developers.
Rayiner is a lawyer and a compiler developer. It's somewhat insulting to everyone's intelligence to pretend that people here are unfamiliar with ssh and svn. We understand how software development works. What happened here was extremely sketchy. You can't play the "well in the world of software development, this is totally normal" card on HN.""
s_q_b: > "...Agreed, but it was established that he did this fairly consistently throughout the course of his employment. It's idiosyncratic, but not unexplainable. Sure, it was poor development practice, but I'm not convinced it was malicious.
Again, if the intent was trade secret theft, why not take the valuable part, the trading strategies?"
I held that his actions violated neither state nor Federal law, so I'm razzing those that insisted his action were criminal, just a bit, all intended in fun. Perhaps the language could have used a bit of softening :)
In a 71-page opinion, Justice Ronald A. Zweibel of State Supreme Court in Manhattan ruled that the F.B.I. “did not have probable cause to arrest defendant, let alone search him or his home.” The arrest was “illegal,” Justice Zweibel wrote, and Mr. Aleynikov’s “Fourth Amendment rights were violated as a result of a mistake of law.”
I am not "pro-prosecution", but I am anti-"default position that evil banksters are behind prosecutions".
And in this case, it was not so much the default position as the actual position.
He stole that code for use in his next job, for which he was paid handsomely, and recruited based on his experience working with that code at GS.
What does "for profit" mean, if not "for use in a commercial project"?
Allow me to rephrase.
Assuming arguendo that their was any such admittance, which there was not, in plain English two courts have now found him legally not liable for any crime, and one court found that he was subject to an illegal arrest and search.
No crime was committed. I cannot write this either in more simple English, nor in more precise terms.
I refer you to the court documents and the appeals court decisions for further discussion of this now legally established fact.
Since we're at that unproductive point in the discussion where we're spending more time parsing than actually discussing, I'm going to go ahead and bow out now.
And you're right, we're parsing semantics and having meta-arguments now. We've said our peace, and as usual we can let the readers can decide.
(Checks morning toast for image of Blessed Virgin.)
But seriously, why is basic respect so hard over the internet that it's an extraordinary exception when people are civil? The pseudonymity perhaps.