People v. Aleynikov

• Decision Date: 03 May 2018
• Docket Number: No. 47,47
• Citation: 79 N.Y.S.3d 583,31 N.Y.3d 383,104 N.E.3d 687
• Parties: The PEOPLE of the State of New York, Respondent, v. Sergey ALEYNIKOV, Appellant.
• Court: New York Court of Appeals Court of Appeals

31 N.Y.3d 383
104 N.E.3d 687
79 N.Y.S.3d 583

The PEOPLE of the State of New York, Respondent,
v.
Sergey ALEYNIKOV, Appellant.

No. 47

Court of Appeals of New York.

May 3, 2018

Marino, Tortorella & Boyle, P.C., Chatham, New Jersey (Kevin H. Marino, John D. Tortorella, John A. Boyle and Erez J. Davy of counsel), and New York City, for appellant.

Cyrus R. Vance, Jr., District Attorney, New York City (Elizabeth Roper, Hilary Hassler, Daniel Holmes and Jeremy Glickman of counsel), for respondent.

OPINION OF THE COURT

FAHEY, J.

104 N.E.3d 688

31 N.Y.3d 386

79 N.Y.S.3d 584

Ideas begin in the mind. By its very nature, an idea, be it a symphony or computer source code, begins as intangible property. However, the medium upon which an idea is stored is generally physical, whether it is represented on a computer hard drive, vinyl record, or compact disc. The changes made to a hard drive or disc when information is copied onto it are physical in nature. The representation occupies space. Consequently, a statute that criminalizes the making of a tangible reproduction or representation of secret scientific material by electronically copying or recording applies to the acts of a defendant who uploads proprietary source code to a computer server.

Background

In May 2007, defendant Sergey Aleynikov began employment at Goldman Sachs (Goldman), the investment banking and financial services company, as a computer programmer working on the firm's high-frequency trading software. High–frequency trading—which uses sophisticated, electronic trading tools, proprietary strategies, and computer algorithms to perform market data calculations and trade securities at very rapid speeds—is highly competitive. At the time, larger, established institutions competed with nimbler start-up companies, which were developing their software from scratch. As a senior employee in Goldman's technology division explained at defendant's trial, the firm sought to "stay competitive by constantly investing in and updating [its] software to be as fast ... as possible, to have the best connectivity and infrastructure as possible and [to] have the best algorithm[s] as possible."

The computer code for Goldman's high-frequency trading system is a key to successful trading for several reasons, as the senior employee would testify. First, one essential value of the code is "[c]onnectivity," which "allows [a] computer program to speak to various stock exchanges or to have market data about what's going on in the world," including the price of a stock at "any given second." Second is its "business logic" component,

31 N.Y.3d 387

the algorithms that permit Goldman employees "to make a decision about what trade to generate or what price to advertise, which price [to] buy or sell a security at." A third key component of the computer code is the "infrastructure" or "all the other software ... to make [the] system run robustly throughout the trading day." Goldman's high-frequency trading software is a constantly updated version of a system acquired by the firm when it purchased a pioneering algorithmic trading company in 1999 for some half a billion dollars.

Defendant's primary responsibilities at Goldman included "the infrastructure components" of the stock group and "upgrading one of the exchange connectivity components." Defendant had complete access to the high-frequency trading system's source code, i.e., computer instructions written in a human-readable programming language. The source code was contained in the firm's "software repository" or library. A software developer such as defendant "could check out the code ... make changes to it and test it locally, merge it with the changes of other individuals, and then have those changes become the production software that runs every day."

104 N.E.3d 689

79 N.Y.S.3d 585

Goldman employees, however, were not permitted to remove a copy of source code from the company's network. Every Goldman employee signed a confidentiality agreement acknowledging that any software the employee is creating is the property of the firm. The employee confidentiality agreement stated that "[c]onfidential and proprietary information and materials shall be used only as authorized and only for the purposes intended by Goldman Sachs." Moreover, access to the source code while an employee was away from the office was restricted, with the only authorized access to the source code repository from home or while traveling being "remote log-in access to [the employee's] desktop," which gave an employee "a window onto" the employee's Goldman desktop computer, while "all of the files and contents" would "stay inside Goldman Sachs." Programmers were not permitted to email source code to themselves.

By late 2008, defendant's annual remuneration at Goldman was $400,000, but, in the spring of 2009, defendant accepted an offer of employment at Teza Technologies (Teza), a Chicago–based start-up company, where his annual compensation would be $1.2 million. Teza had no equipment, connectivity, or software for high-frequency trading at the time. Its founder planned to develop high-frequency trading infrastructure and software from scratch, and urged new employees to "execute

31 N.Y.3d 388

relentlessly" because the start-up was "up against experienced and very wealthy competitors." Defendant was to be the "head of infrastructure" and "the system architect."

On June 5, 2009, his last day at Goldman, defendant uploaded a large quantity of Goldman's high-frequency trading source code, via a website, to a subversion repository, i.e., a remote server to which a user could transfer code. He used the same username, "saleyn," that he had chosen for his personal email account. The internet security systems at Goldman generally blocked employee access to such websites, but had overlooked this one, based in Germany.

Defendant wrote a computer script to compress data from Goldman's source code repository into files known as "tarballs." Defendant ran this program, encrypted the resulting tarballs, and uploaded the source code to the German server. In particular, defendant uploaded Goldman's "Order Book Builder" or OBB software, used to process market data from stock exchanges. Defendant then erased the tarballs. He also "back dated the script" to make it appear that it had been created two years earlier.

Subsequently, defendant downloaded the source code to his home computers. On June 9, 2009, Teza created an account on a website that allowed companies to share source code within a select group of users. Later that month, defendant placed high-frequency trading software in a source code repository on that website.

In late June 2009, Goldman employees responsible for the firm's information security discovered that unauthorized transfers of data from Goldman's repository had occurred in the early evening of June 5, 2009: over 13 megabytes of data in one transfer and over 4.5 megabytes of data in the other. The investigating team at Goldman identified the device from which the transfers had been conducted as defendant's work computer, and inspected its BASH history, which is a "record of commands issued by a given user to [a] computer."

The team retrieved the BASH history "from a snapshot directory"—saved on Goldman's computer network (rather than on defendant's computer itself)—showing

104 N.E.3d 690

79 N.Y.S.3d 586

recent past activity on defendant's computer. In this back-up BASH history, the investigators found "data transfer commands" related to the June 5 source code transfers. Moreover, the back-up BASH history revealed that defendant had entered a command to

31 N.Y.3d 389

selectively remove, from the BASH history stored on his own computer, the copying of source code. Goldman contacted the Federal Bureau of Investigation.

Federal Action

FBI agents arrested defendant on July 3, 2009, after he returned from a trip to Teza's headquarters in Chicago. Defendant waived his Miranda rights and admitted that he had uploaded files from his work at Goldman to the German website and had subsequently downloaded the data to his home desktop computer. Defendant indicated that the data could also be found on his laptop computer, USB flash drive, and external hard drive. Defendant told an FBI agent that he had signed up for an account on the German website because Goldman had not "blocked" the site. Defendant suggested that he had kept the software because "he wanted to inspect the files much like a person in college would go back and read a paper." At first, defendant told the agent that he had uploaded and downloaded only files that contained open-source code, i.e., software developed by programmers in a collaborative manner and readily available to the public on the internet. However, after the...