Judge: Code Can't Be Stolen Because It Isn't Property
In a case against a former Goldman Sachs programmer who knowingly violated the bank’s confidentiality policy and downloaded source code for its high-speed trading system, a three-judge panel in New York ruled that he was wrongfully charged with theft of property. Why? Because the code did not qualify as a physical object under a federal theft statute.
"Because Aleynikov did not 'assume physical control' over anything when he took the source code, and because he did not thereby 'deprive [Goldman] of its use,' Aleynikov did not violate the [National Stolen Property Act]," the 2nd Circuit Court of Appeals wrote in its opinion (pdf).
42-year-old Sergey Aleynikov was charged and convicted in 2010 under the Economic Espionage Act of 1996 (EEA). Aleynikov had no problems acknowledging what he did, but he also pointed out that downloading code from the bank was not a criminal act under the EEA because the code wasn't used in interstate commerce. The EEA only covers products that are designed for interstate or foreign commerce.
The federal appeals court agreed with his argument back in February and reversed the conviction. The judges announced their ruling without explanation, adding that a written explanation would follow "in due course." With the explanation now published, the document reveals that Goldman's trading system was considered as neither "produced for" or "placed in" interstate or foreign commerce. The company also didn't have any intention of selling its system or licensing it to anyone.
"The enormous profits the system yielded for Goldman depended on no one else having it," the judges wrote. "Because the HFT system was not designed to enter or pass in commerce, or to make something that does, Aleynikov’s theft of source code relating to that system was not an offense under the EEA."
The ruling also addresses an argument by the government which claims that code is considered physical property and covered under a 1988 amendment to the NSPA. Prosecutors insisted that the amendment reflected an intent by Congress to include non-physical forms of property in the law such as Aleynikov’s theft of the source code. But the judges denied the claim, stating that the 24-year-old amendment referred to the transfer and transmission of money.
"We decline to stretch or update statutory words of plain and ordinary meaning in order to better accommodate the digital age," the judges wrote.
Circuit Judge Guido Calabresi, who agreed with the majority opinion and the way the judges had reached it, said Aleynikov would not have gotten off if the EEA had been better written. “[It] is hard for me to conclude that Congress, in this law, actually meant to exempt the kind of behavior in which Aleynikov engaged" he said. "[I] hope that Congress will return to the issue and state, in appropriate language, what I believe they meant to make criminal in the EEA."
Aleynikov allegedly made several copies of the code and had it on his laptop when he met his new employers at Teza Technologies in Chicago. Goldman Sachs discovered the theft after it began monitoring HTTPS transfers and saw a large volume of data leaving its network. Once arrested, Aleynikov acknowledged taking the code, but was primarily trying to get open source software files on which he had worked. The collection of proprietary files was merely accidental, he claimed.