KCG Holdings, Inc. v. Khandekar

Decision Date12 March 2020
Docket Number17-CV-3533 (AJN)
PartiesKCG Holdings, Inc., et al., Plaintiffs, v. Rohit Khandekar, Defendant.
CourtU.S. District Court — Southern District of New York
OPINION & ORDER

ALISON J. NATHAN, District Judge:

KCG, a financial-services firm, brings this action against a former employee, Rohit Khandekar. KCG alleges that Khandekar improperly acquired and used several of its trade secrets between November 2016 and May 2017. The parties have cross moved for summary judgment.

The Court grants and denies summary judgment in part to each party. KCG is entitled to summary judgment on its breach-of-contract, Defend Trade Secrets Act, and New York common-law claims. KCG is also entitled to summary judgment on Khandekar's breach-of-contract and bad-faith counterclaims. Khandekar is entitled to summary judgment on KCG's claim under the Computer Fraud and Abuse Act. Khandekar is ORDERED to pay KCG's attorney's fees, costs, and expenses, including its investigation costs. Khandekar is further ENJOINED from using or disseminating, in any way, the trade secrets he reviewed without authorization at KCG between November 2016 and May 2017.

I. BACKGROUND
A. KCG Hires Khandekar to Work on Predictors

KCG is a financial-services firm. Chung Decl. ¶ 8. It "engages in propriety algorithmic trading and electronic market trading through exchanges and other computer-based platforms through the internet, in the United States and around the world." Defendant's Rule 56.1 Counterstatement (Def. 56.1 Ctr.), Dkt. No. 140, ¶ 1. In making its trading decisions, KCG relies on "predictive models that are designed to forecast price movements in securities markets." Id. These models are called Predictors, and they are developed and refined by Quantitative Strategists, who are colloquially referred to as Quants. Id. ¶ 3. "Quants research various events, such as news, social media or trading volumes, to identify 'signals' that correlate to changes in market pricing, and they write source code that computes a predictive-market-based reaction to that signal." Id. ¶ 4.

KCG's predecessor firm hired Rohit Khandekar as a Quant in March 2012. Id. He was hired as part of the "signal team," "a group of five or six Quants responsible for developing Predictors used in KCG's customer market-making business." Pl. Ex. 1, Khandekar Dep., 45:12-22; Def. Ctr. ¶ 5. Khandekar's team included fellow Quant Evan Wright, and it was led by Steve Liu. Def. Ctr. ¶ 5. Liu in turn reported to Vladamir Neyman, co-head of KCG's customer market-making business. Id. ¶¶ 6, 7. There were other teams of Quants at KCG. Def. Ctr. ¶ 8. Khandekar eventually became a "senior quant," meaning he was "expected to come up with ideas for [his] projects on [his] own" and mentor junior team members. Khandekar Dep. 46:12-25.

Quants developed Predictors through coding. Codes for predictors consisted of two parts: The first part was "plumbing," which dealt with nitty-gritty details like "injecting data, reading offline data, outputting certain things." Id. 57:18-24. Khandekar described plumbing as"the part of the source code that does all the peripheral things that a predictor has to do in order to work." Id. 192:8-18. The second part was "the most valuable, and thus the most secret, part of the code" and was known as the Predictor's "secret sauce." Def. Ctr. ¶ 16. The secret sauce "contains the types of information, the combinations of information and the mathematical formulas that forecast future prices." Id. Khandekar explained that the secret sauce "implements the core idea of the predictor" and governs "how [the Predictor] compute[s] those values, what values are computed and where they are stored, and how they are combined to compute an output value." Khandekar Dep. 192:8-18. In other words, the secret sauce contains formulas that forecast future market prices, and thus permit KCG to make profitable trades.

B. KCG's Efforts at Secrecy

Predictors are "some of KCG's most-closely guarded confidential and proprietary trade secrets." Plaintiff's Rule 56.1 Counterstatement (Pl. 56.1 Ctr.), Dkt. No. 149, ¶ 43. KCG therefore took various efforts to maintain the secrecy of Predictors. First, there was a policy at KCG prohibiting Quants from sharing, with other Quants or employees, any details regarding the secret sauce of their Predictors. Khandekar stated that Quants "worked in silos to the extent that they cannot discuss the very details of the predictors that they are working on or the details of the projects they are working on." Khandekar Dep. 94:8-11. He further stated that while he worked at KCG, he could not share "[t]he finer details" of the predictors he worked on. Id. 94:16-21. Quants thus could not discuss the secret sauce of predictors with one another. Id. 95:2-8. But KCG drew a line between secret sauce and plumbing. Khandekar made clear that Quants could "share tools, data, template predictors, for example, with other quants so as to -- so as to minimize the duplication of work." Id. 94:12-15.

Wright explained that this policy operated like a sliding scale. The secret sauce could not be shared: "there is a general rule . . . that details specific to a predictor, exactly what thecalculation is are totally off limits." Wright Dep. 97:5-10. But general concepts could: "Some aspects that are not specific to a single predictor are okay [to share] as concepts, if not as implementation." Id. 97:11-13. And "in the gray area between that, you should ask [Neyman] or [Liu]." Id. 97:14-15. Khandekar's manager, Liu, confirmed that discussions between Quants "regarding the work they were doing" were "only limited to high level ideas." Liu Dep. 65:23-66:11; see also id. 67:14-19 ("we encourage collaboration, sharing, and brainstorming high-level research ideas.").

Second, Quants used access restrictions to protect certain codes. KCG uses the Unix/Linux operating system to run its servers and computers. Def. Ctr. ¶ 24. In that system, "every file and every directory has 'permissions' that govern who can read, write or execute a file . . . Unix permissions can be set for the user, group (a collection of users) or everyone with Unix credentials (the 'world.')". Id. Access permissions thus "enable a user to specifically authorize another user or group of users to access a directory or read or otherwise use a file." Pl. Ctr. ¶ 51; see also id. ¶ 52. KCG instructs Quants "to create a default setting ensuring that no new directors and files have any group or other access permissions," meaning that they should be accessible only to their creator. Id. ¶ 53.

Third, Quants use encryption to protect codes. See Pl. Ctr. ¶ 46 ("KCG Quants use two primary ways to restrict other KCG employees from electronically accessing confidential Predictor files: 'encryption' and 'access permissions.'"). To understand how encryption works, some background is helpful: Quants develop and work on Predictors "in their personal directors within KCG's servers." Def. Ctr. ¶ 24; see also Pl. Ctr. ¶ 66 ("KCG also allocates every Quant specific space on the Linux system, to store his or her work-related directories and files."). In order to access the secure servers containing Predictors, "an individual must have a valid Unixlogin and password credentials." Def. Ctr. ¶ 22. After a Quant completes a Predictor, she must encrypt its source code and check it into a source-code repository on the KCG servers. "Encryption renders a file unreadable and un-editable unless someone has the required de-encryption 'key' which will enable them to unencrypt the file, and only in [its] unencrypted form [can they] read it or edit it." Pl. Ctr. ¶ 47. When encrypting a Predictor, the Quant can input a list of authorized users, who will be "given the technical ability to decrypt the file." Def. Ctr. ¶ 23. These other users are called "Additional PGP Recipients." Id. The list of users on this list appears "in text at the top of the file." Id. In other words, once a file is encrypted, only the individuals on this list are capable of decrypting and viewing its contents.

Another KCG employee, Philip Chung, testified that "predictors . . . were meant for only certain eyes only. And it was very explicit, because they all contained a line of text, which is additional PGP recipients, that lists those users that that file was meant for." Chung Dep. 37:3-8; see also id. 114:9-12 ("There was very explicit intent for those files to be only accessible by the people listed on the additional PGP recipients line."), 148:8-14. So long as the code is encrypted, "[i]ndividuals who are not listed as Additional PGP recipients cannot decrypt or view the secret code." Def. Ctr. ¶ 23. "To work on a Predictor after the source code has been encrypted and committed to the [source-code repository,] a Quant with PGP credentials must download a copy of the encrypted code from the [repository] to his or her personal directory, and unencrypt the source code." Def. Ctr. ¶ 24. However, if an authorized user unencrypts the source code and removes any access restrictions, then even users who are not listed on the authorized list can access and view its contents. Def. Ctr. ¶ 23. Even after decryption, the Recipients List still appears on the file. Pl. Ctr. ¶ 50.

Fourth, KCG instructed its Quants on how to protect sensitive information. For example, KCG promulgated instructions on "how to use secret servers . . . [and] how to typically put secret code into production" to all new Quants, and employees often referred back to these materials. Liu Dep. 80:14-81:19. Liu stated that "from time-to-time" he would "remind quants . . . to either use encryption or access restrictions to protect secret code that they were working on." See id. 78:6-15; Def. Ctr. ¶ 26. KCG also "developed a number of informational pages for employees on how to set up their environment, protect source code with Unix permissions, and encrypt secret source code files in accordance with Company policy." Def. Ctr. ¶ 26....

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT