FinTech Update: New York’s Highest Court Upholds Conviction of Programmer Who Misappropriated Electronic Data

What is a “tangible reproduction or representation”? This was the question that New York state’s highest court confronted when it heard the case of a former Goldman Sachs employee who had misappropriated the company’s source code by uploading it to an external computer server. [1]

In a unanimous decision handed down in May 2018, the New York Court of Appeals upheld the former employee’s felony conviction, concluding that a purely electronic transfer of data constituted a “tangible reproduction or representation” within the meaning of the relevant state statute. [2] Here’s what you need to know about this decision, which has important implications for the fields of FinTech, data security, and intellectual property law.

Background of this Case

Sergey Aleynikov was a computer programmer at Goldman Sachs (“Goldman”) from 2007 to 2009. He developed source code for Goldman’s high-frequency trading (“HFT”) software, which was a closely guarded secret at Goldman. [3] While Aleynikov had access to edit the code, he and other programmers were not permitted to email the code to themselves or download it onto their desktops. Goldman also required its employees to sign confidentiality agreements that acknowledged that all the software they worked on or developed remained the property of the firm. [4]

In June 2009, Aleynikov left Goldman to join a startup company, where he was to be “the system architect” of the startup’s own, yet-to-be-designed HFT program. On his last day at Goldman, Aleynikov uploaded a large quantity of Goldman’s HFT source code to a remote server, or “subversion repository,” located in Germany. Aleynikov later downloaded the Goldman code from the subversion repository to his home computers and then transferred it to a website that the startup was using to develop its new code. [5]

Despite Aleynikov’s efforts to cover his tracks, Goldman’s information security team discovered the unauthorized upload of source code and traced it to Aleynikov, who was arrested by FBI agents on July 3, 2009. [6]

The Federal Prosecution

Aleynikov was charged in the U.S. District Court for the Southern District of New York with violating the National Stolen Property Act (“NSPA”) [7] and the Economic Espionage Act of 1996 (“EEA”). [8] The District Court denied Aleynikov’s motion to dismiss the indictment, [9] and, following trial, a jury convicted him of violating both the NSPA and the EEA. [10] Aleynikov appealed to the U.S. Court of Appeals for the Second Circuit, again arguing that the indictment was insufficient because his conduct did not constitute a violation of either the NSPA or the EEA. [11]

The NSPA, in pertinent part, makes it a crime to “transport[], transmit[], or transfer[] in interstate or foreign commerce any goods, wares, merchandise, securities or money, of the value of $5,000 or more, knowing the same to have been stolen, converted or taken by fraud[.]” [12] Aleynikov argued that the source code he uploaded to the German server did not constitute stolen “goods,” “wares,” or “merchandise” within the meaning of the statute. [13]

The Second Circuit agreed, concluding that “the theft and subsequent interstate transmission of purely intangible property is beyond the scope of the NSPA.” [14] This remained the case even though Aleynikov subsequently downloaded the source code onto his laptop and flash drive: “[t]he later storage of intangible property on a tangible medium does not transform the intangible property into a stolen good.” [15]

Likewise, the Second Circuit held that Aleynikov’s conduct fell outside the relevant prohibitions of the EEA, which at the time protected only those trade secrets “related to or included in a product that is produced for or placed in interstate or foreign commerce[.]” [16] Goldman’s HFT program was not a product “produced for or placed in” interstate or foreign commerce; rather, Goldman maintained it as a closely guarded secret purely for internal use. [17]

Aleynikov’s federal conviction was reversed in its entirety. [18]

The New York State Prosecution

In September 2012, Aleynikov was charged in New York state court with unlawful use of secret scientific material and unlawful duplication of computer related material. [19] A Manhattan jury acquitted Aleynikov of the unlawful duplication charge but convicted him on one count of unlawful use of secret scientific material under Penal Law § 165.07.

An individual is guilty of this crime

Aleynikov attacked his conviction, arguing that he had never made a “tangible reproduction or representation” of the source code. [21]

The Court of Appeals’ Statutory Analysis

The New York State Court of Appeals first confronted the question of what “tangible” means within the context of Penal Law § 165.07. Examining both the legislative history and dictionary definitions, the Court of Appeals rejected Aleynikov’s narrow construction of “tangible” as merely that which is “capable of being touched.” According to this limited definition, ink printed on paper would not be tangible either. Rather, the Court of Appeals accepted that “‘tangible’ can also denote ‘material’ or ‘having physical form.’” [22]

Having defined “tangible,” the Court of Appeals noted an important distinction between the state statute and the federal NSPA:

Here, the jury convicted Aleynikov “hear[ing] testimony that the representation of source code has physical form” and that the “source code that is stored on a computer takes up physical space in a computer hard drive.” [24] Thus, the jury could rationally find that Aleynikov made a “tangible reproduction or representation” of the source code.

Aleynikov also argued that this broad construction would render the word “tangible” redundant within the statute, as every “reproduction or representation” would necessarily have some physical form. The Court disagreed, noting that a hypothetical person might memorize secret scientific material and not run afoul of section 165.07: “the word ‘tangible’ … adds a modest element to ‘reproduction,’ serving to emphasize that the crime consists in making a physical, not a mental, copy of secret scientific material.” [25]

Finally, Aleynikov argued that the existence of Penal Law § 156.30 — the “unlawful duplication of computer related material” statute of which the jury acquitted Aleynikov — cut against a broad reading of section 165.07. Given that the New York State Legislature in 1986 enacted section 156.30 to prosecute computer-related crimes specifically, the legislators must have “believed that the existing statutes did not address computer crimes … . The argument is that the 1986 statute would not have been necessary if taking of computer data were included in the 1967 statute [(Penal Law § 165.07)].” [26]

The Court of Appeals rejected this argument, too, and noted that “[t]he two statutes criminalize two different types of conduct.” A person might be guilty of one, or both, but the enactment of the later statute does not limit the reach of the earlier one. [27]

The Court upheld Aleynikov’s conviction under section 165.07. [28]

Potential Implications of the Decision

As physical mediums of data transfer disappear, and as firms rely more and more on cloud storage and blockchain distribution, the law will need to keep pace with rapidly advancing technology. The unanimous Aleynikov decision shows that New York state judges are willing to apply analog-era laws to the digital context. Given that legislatures are often slow to enact new statutes, this sort of broad statutory construction offers firms important protection in the ever-changing realms of data security and protection of trade secrets.

[1] People v. Aleynikov, 2018 N.Y. Slip Op. 03174, 2018 WL 2048707 (N.Y. May 3, 2018).

[2] 2018 WL 2048707, at *10–11.

[3] Id. at *1.

[4] Id. at *2.

[5] Id. at *2.

[6] Id. at *2–3.

[7] 18 U.S.C. § 2314.

[8] 18 U.S.C. § 1832.

[9] The District Court did, however, dismiss a third charge against Aleynikov, under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. See United States v. Aleynikov, 737 F. Supp. 2d 173 (S.D.N.Y. 2010).

[10] United States v. Aleynikov, 676 F.3d 71, 74–75 (2d Cir. 2012).

[11] Id. at 75.

[12] 18 U.S.C. § 2314.

[13] 676 F.3d at 76.

[14] Id. at 77 (citing Dowling v. United States, 473 U.S. 207, 216 (1985)).

[15] Id. at 78.

[16] Id. at 79 (citing 18 U.S.C. § 1832(a) (2012)). Following the Second Circuit’s decision in Aleynikov, Congress amended the EEA to protect trade secrets “related to a product or service used in or intended for use in interstate or foreign commerce.” The Theft of Trade Secrets Clarification Act of 2012, Pub. L. 112-236, 126 Stat. 1627 (2012) (codified as amended at 18 U.S.C. § 1832) (emphasis added).

[17] Aleynikov, 676 F.3d at 82.

[18] Id.

[19] Aleynikov, 2018 WL 2048707, at *3 (citing N.Y. Penal L. §§ 156.30(1) & 165.07).

[20] Id. at *7 (quoting N.Y. Penal L. § 165.07) (brackets and ellipses in original).

[21] Id. at *4–5. Aleynikov also argued that he had not acted with the request “intent to appropriate … the use of” the source code. He did concede that the Goldman source code constituted “secret scientific material.” See id. at *4.

[22] Id. at *8.

[23] Id. at *8–9 (quoting Aleynikov, 676 F.3d at 78) (italics added; underlining in original).

[24] Id. at *9 (internal quotation marks omitted).

[25] Id.

[26] Id. at *10.

[27] Id.

[28] The court also concluded that Aleynikov possessed the requisite “intent to appropriate” the source code — which does not require that Aleynikov possessed the intent to deprive another of the property. See id. at *12–13.