People v. Aleynikov

• Decision Date: 24 January 2017
• Citation: 48 N.Y.S.3d 9,148 A.D.3d 77
• Parties: The PEOPLE of the State of New York, Appellant, v. Sergey ALEYNIKOV, Defendant–Respondent.
• Court: New York Supreme Court — Appellate Division

148 A.D.3d 77

48 N.Y.S.3d 9

The PEOPLE of the State of New York, Appellant,

v.Sergey ALEYNIKOV, Defendant–Respondent.

Supreme Court, Appellate Division, First Department, New York.

Jan. 24, 2017.

Cyrus R. Vance, Jr., District Attorney, New York, NY (Elizabeth Roper, Daniel Holmes and Jeremy Glickman of counsel), for appellant.

Marino, Tortorella & Boyle, P.C., New York (John D. Tortorella, Kevin H. Marino of the bar of the State of New Jersey, admitted pro hac vice, John Boyle and Erez Davy of counsel), for respondent.

ROLANDO T. ACOSTA, J.P., ROSALYN H. RICHTER, ANGELA M. MAZZARELLI, BARBARA R. KAPNICK, ELLEN GESMER, JJ.

RICHTER, J.

Defendant was formerly employed by Goldman Sachs as a computer programmer. Prior to leaving Goldman to work for a potential competitor, defendant made a digital copy of Goldman's proprietary computer source code by uploading and saving it to a hard drive of a server located outside the Goldman network. After surreptitiously uploading the source code, defendant transferred copies of it to several of his personal computing devices, and subsequently shared it with his new employer. As a result, defendant was charged with unlawful use of secret scientific material (Penal Law § 165.07 ). After a jury convicted defendant of this crime, the trial court set aside the verdict.

In this appeal, we are asked to decide whether defendant's actions constitute legally sufficient evidence to establish that he made a "tangible reproduction or representation" of the source code, and did so with the "intent to appropriate ... [its] use," within the meaning of the unlawful use statute. We conclude that, viewed in the light most favorable to the People, the evidence was legally sufficient as to both of these elements. Accordingly, we reverse the trial court's decision, reinstate the jury's verdict and remand the matter for sentencing.

The evidence at trial, which is largely undisputed, established the following. In May 2007, Goldman hired defendant as a computer programmer to write and maintain software for the company's high-frequency trading system. High-frequency trading entails the use of computers to make very rapid decisions concerning pricing of securities, and to quickly generate trades and orders. It is a competitive business that depends in large part on the speed with which information can be processed to seize fleeting market opportunities. High-frequency trading can be very lucrative, earning Goldman about $300 million in profits in 2009.

The infrastructure that supported Goldman's high-frequency trading business was based on a system the firm had purchased in 1999. Since that purchase, Goldman has regularly updated the system by incorporating new pieces of software into it. As a programmer at Goldman, defendant had access to the source code that ran the high-frequency trading system. Source code is a set of computer instructions written in a human-readable programming language. Defendant's programming duties included copying source code from Goldman's source code repository, modifying and testing it, and then integrating it into the existing software.

Because the high-frequency source code was so valuable, Goldman took a variety of steps to safeguard its secrecy. These measures included physical security of the corporate building, a limit on the number of people who had access to the software, and the creation of an information security group responsible for ensuring that Goldman's systems were not vulnerable to attack. Further, every Goldman employee signed confidentiality and nondisclosure agreements wherein they acknowledged that they could not use Goldman's confidential information for their own purposes. Goldman programmers were forbidden from copying Goldman's source code outside of Goldman's network. Although employees were allowed to work from home, they had to use remote access or a firm laptop to ensure that all the source code stayed within the Goldman network.

In the spring of 2009, defendant was hired by Teza Technologies, a startup high-frequency trading firm. At that time, Teza had no software, connectivity or equipment for high-frequency trading activities, but hoped to build a system from scratch and be operational by the end of 2009. Teza hired defendant as a systems architect for its new trading platform. His annual salary was $1.2 million, about three times his salary at Goldman. At the end of May 2009, Teza's principal sent defendant an email emphasizing that the company had less than six months to launch the new system, and that the group developing the system had to "move fast."

Defendant ended his employment with Goldman on June 5, 2009. Later that month, Goldman's information security department noticed unusual activity while reviewing a report generated by Goldman's computer monitoring systems. Specifically, the monitoring report showed that on June 1, 2009 and June 5, 2009, large amounts of data had been uploaded from the Goldman network to a Germany-based "subversion website," which is a website designed to allow a user to move, copy and store source code. Although Goldman's security system normally would block access to such websites, it somehow missed this one.

The monitoring report indicated that the transfers were made from defendant's work computer. Examination of defendant's computer showed that on his last day of work, he executed a program he had written to copy thousands of proprietary files from Goldman's source code repository. The files transferred that day included components of Goldman's high-frequency trading platform that would be highly valuable to any competitor. The files were compressed into smaller files called "tarballs," encrypted, and then uploaded onto the German subversion website.

Goldman's investigation revealed that the program defendant used to transfer the files had been backdated to make it seem two years older than it really was. The investigation also revealed that after running the program, defendant deleted it from his work computer, along with his "bash history," which is a list of the most recent commands a user has typed into his computer. According to testimony at trial, deleting a bash history is not common, and there is no reason why a user would do so.¹ Police in Germany located the server of the subversion website, removed the hard drives and made forensic copies of them. A search of the information on those drives revealed that an individual with the username "saleyn" had uploaded information onto the server and then later retrieved it. Defendant had used this same username—which consists of his first initial and the first five letters of his last name—as his personal email address. The investigation further showed that by the end of June 2009, defendant had placed some source code into a " repository" account that Teza had created on a third-party website. A review of that code revealed that it was based upon the Goldman high-frequency trading programs that defendant had copied to the German server.

On July 3, 2009, defendant was arrested by the Federal Bureau of Investigation (FBI); Teza immediately terminated his employment. A search of two personal computers and a digital storage device found in defendant's home revealed that all three contained data from Goldman. When questioned by the FBI, defendant at first denied transferring any proprietary information from Goldman. Upon further inquiry, however, defendant made a series of incriminating statements. In particular, defendant admitted that (i) he uploaded material from Goldman to the German server; (ii) he specifically chose that server because it was not blocked by Goldman's security system; (iii) he subsequently downloaded the material from the German server to his home computer and other storage devices; and (iv) he purposely erased the encryption software, the tarballs and his bash history because he knew his actions had violated Goldman's security policies.

In February 2010, defendant was charged in a federal indictment with transferring the Goldman source code in violation of, inter alia, the National Stolen Property Act (18 U.S.C. § 2314 ).

On December 10, 2010, defendant was convicted following a jury trial in the District Court for the Southern District of New York. Defendant subsequently appealed his conviction to the Court of Appeals for the Second Circuit. On April 11, 2012, the Second Circuit reversed the conviction, concluding that defendant's actions did not violate the federal statute (see United States v. Aleynikov, 676 F.3d 71 [2d Cir.2012] ).

In September 2012, defendant was charged in a New York County indictment with two counts of unlawful use of secret scientific material (Penal Law § 165.07 ) (one count based on defendant's transfer of data on June 1, 2009, and the other based on his June 5, 2009 transfer), and one count of unlawful duplication of computer related material in the first degree (Penal Law § 156.30[1] ). These state charges were based on the same conduct that led to his federal prosecution.² On April 8, 2015, defendant proceeded to a trial before a jury. At the close of the People's case, defendant moved, pursuant to CPL 290.10, for a trial order of dismissal as to all counts of the indictment; the court reserved decision on the motion.³

The jury returned a verdict of guilty on the count of the indictment charging unlawful use of secret scientific material arising from the June 5, 2009 transfer. The jury could not reach a unanimous verdict on the unlawful use count based on the June 1, 2009 transfer, and acquitted defendant of unlawful duplication of computer related material in the first degree.⁴ In a decision entered on or about July 6, 2015, as amended July 7, 2015, the trial court granted defendant's motion for a trial order of dismissal as to the two counts of unlawful use. The court concluded that the evidence was insufficient to show that: (i) defendant made a "tangible reproduction or representation" of the source code; and (ii) h...