11 ms·

Really? I feel like intent would be really hard to prove. "Hey, due to the way our accounting works I need you to subtract X from our dashboard." "Ok boss."

by alar44 4y ago

Really? I feel like intent would be really hard to prove. "Hey, due to the way our accounting works I need you to subtract X from our dashboard." "Ok boss." Are programmers expected to know finance law? If I build a program for a dairy farmer am I supposed to know the laws of the interstate dairy trade? I can't believe that would be the case.

hn_throwaway_99 4y ago
Nishad Singh wasn't some low-level coder. He was FTX's Director of Engineering. > "Hey, due to the way our accounting works I need you to subtract X from our dashboard." That is not what happened here. The fact alone that very few people knew about Alameda's special treatment, and, importantly, deliberately conspired to keep that treatment secret is a pretty strong indicator that he knew it was wrong.
- barbariangrunge 4y ago
  Director of engineering != product manager in charge of deciding what features to include. If somebody tells engineering, “we will not use this feature illegally,” then it’s the fault of the higher ups who are possibly (?) trying to scapegoat somebody to protect themselves
  - oshkarr 4y ago
    "I was just following orders" went out of style in 1946. Software engineers are not mindless drones.
  - r_hoods_ghost 4y ago
    Directors have specific, well defined legal duties to their company which includes a duty of fiduciary responsibility. That is why they're directors rather than "head of product" or "VP of marketing" or whatever other meaningless title people bestow on themselves. Saying "my boss told me to do it so it is not my fault" is nonsense because you have no boss beyond your shareholders.
    - astrange 4y ago
      Isn't VP usually a higher title than director? (Well, it's not in finance, but it could be in tech-like crypto finance.)
    - reverius42 4y ago
      That's Director as in Board of Directors. In this case, "Director of Engineering" probably just means "Manager of managers of engineers".
    - ummonk 4y ago
      Holding the title "director of X" doesn't mean you're necessarily on the board of directors.
      - xdavidliu 4y ago
        in fact, the two are probably anti-correlated
echelon 4y ago
> Are programmers expected to know finance law? Working on fintech and transaction rails? Probably. I had to know regulations when I worked in fintech. Plus, you don't have to know the law to be found guilty of breaking it. The engineers working on this are innocent until proven guilty, but you'd better believe all internal comms, meeting notes, and commit messages will be scrutinized. Someone had to ask for the system to behave this way, and that will have produced certain artifacts. Engineers with knowledge may be cut deals to testify against the bigger players.
- eternalban 4y ago
  > The engineers working on this are innocent until proven guilty I believe in due process [& friendship, too]. But alas for the engineers concerned, SBF does not: https://www.businessinsider.com/ftx-collapse-bankman-fried-execs-quit-gary-wang-nishad-singh-2022-11 https://www.businessinsider.com/ftx-collapse-bankman-fried-e... "When asked to clarify whether they were both gone, Bankman-Fried said that Wang was "scared" and Singh was "ashamed and guilty" because FTX customers' deposits had been lost." Isn't that a strange thing to say? Singh is the guy who made the change, per Reuters, and this snake knew that.
- jacquesm 4y ago
  > Plus, you don't have to know the law to be found guilty of breaking it. Precisely, ignorance is never a valid defense.
jerrysievert 4y ago
i worked for a fintech startup in a similar space: > Are programmers expected to know finance law? in our case, we were. it was drilled in, and tested, reviewed, and audited. i’m not saying that something like this couldn’t have happened, but in my case anyone who would have been involved would definitely have known the legality.
arcbyte 4y ago
Developers need to know the business better than the business people. Always. Otherwise you can't implement the software very well.
- parksoha 4y ago
  Isn't it completely unscalable? I work for a big automaker, there's literally people whose only job is to be compliant and inform the necessary leads about it. There's hundreds of countries, each with very specific things. If I study everything, I can't code. When knowledge arrives at my team, is already condensed to the point of: "in X country, you must tell the prices of a call if you show a phone number for assistance" Why should I explore every loophole of law to be compliant? That's the companies job, not mine.
  - acdha 4y ago
    Down to the trivia level for an entire global company, sure, but this is a lot more general and bigger. Like if you have rules against accepting gifts from vendors, maybe you don’t remember if the threshold is $10 or $15, but you shouldn’t need to ask to know it’s not $30k in a suitcase.
  - hn_throwaway_99 4y ago
    For some reason, I've seen a lot of people try to make arguments around FTX that completely miss the scale and malfeasance that occurred. This wasn't a case of "oh, you got some esoteric GAAP depreciation rule wrong". This was an engineering leader putting a ton of special cases in the code saying "For our most beloved partner, none of the rules apply, including letting them take unlimited amounts of customer funds. Oh, and be sure to hide this from the dashboards the rest of the company uses." This is not hard. Nobody needs to be versed in the ins-and-outs of jurisdictional compliance rules to see this was blatant and egregious. If any of this looks remotely familiar to any software devs out there, you should really re-examine your morals. Or at least hire a lawyer.
    - parksoha 4y ago
dereg 4y ago
This is why Caroline is an important witness for the prosecution. It seems like most of the nefarious stuff occurred in Signal.
tekla 4y ago
Developers should know to ask questions when a weird request is made. Developers presumably know how to think and have a vague idea of what the business does to know that a ask to futz with internal financials programmatically is fucking wierd.
- deathanatos 4y ago
  IME, it depends on your chain of command. I've literally been reprimanded in my career for asking questions. My boss at that time was crap. I didn't choose him. Asking questions can very likely get you fired. Also got reprimanded for disobeying an order at once; my boss — same one as above — would not take "no, we are in a regulated industry, and I cannot do that" for an answer. I ended up going behind his back, getting the approvals he should have gotten himself, and once I'd secured those, granted him the access he wanted. I also tried to escalate to his boss (my grand-boss) … but he didn't respond until it was all moot. But there is a lot of stress when you're fearing for your job, even though you're just trying to do things by the book. I'm inclined to side with engineers, to a degree: the chain of command's responsibility is to never put eng in that position. (Although here, the eng in question seems far higher up than I am. I'm just a bottom rung eng…) > Developers presumably know how to think and have a vague idea of what the business does to know that a ask to futz with internal financials programmatically is fucking wierd. They should but IME they often don't, and even if they do, people are lazy. It's a struggle to get people to do the things they should do some days.
  - salawat 4y ago
    You want Engineer in your job title? Then you say no, and you damned well ask questions, and you damned well make sure to leave the moment they make it impossible for you to act ethically.
    - notch656a 4y ago
      This should apply to anyone. IMO engineers aren't special. As a human you should try not to fuck over other people.
steveBK123 4y ago
If Jamie Dimon asked a developer at the bank "hey can you have Chase ATMs allow these 10 accounts that are in my name to withdraw unlimited funds?" everyone involved would be in jail. This is not dissimilar.
- stickfigure 4y ago
  "For testing purposes, these 10 account numbers should be allowed to remove cash from any of our ATMs. The testers will put the money back." It doesn't sound that nefarious. If you told me this is how ATMs are currently being tested in the industry, I wouldn't be able to contradict you.
  - salawat 4y ago
    ...A bench test of an ATM probably doesn't involve real money. No one in finance is stupid enough to use real money on production environments for testing purposes. There is test... And there is PROD. Never do the two meet. Ever. If someone out there does, please make yourself known so we can get the investigators over there ASAP.
    - ragtete 4y ago
      Huh? You're telling me that you think they never test ATMs in prod? That's ridiculous. You think they're just guessing that the test environment perfectly matches the prod environment?
    - malandrew 4y ago
      You can test in production if you have multi-tenancy aware services, where tenancy is some string value like Foo to make sure reads to Foo can only read data that was written to Foo.
      - headsoup 4y ago
        That's not testing in production, that's just the same as saying your test VMWare environment is in the same datacentre as your prod VMWare environment.
MonkeyMalarky 4y ago
I don't know about finance but for HIPAA and CCPA, the answer is yes. Is there an accounting equivalent to the yearly, mandatory 20 minute compliance training videos?
- drunkpotato 4y ago
  Yes, in US fintech there are mandatory courses in anti-money laundering and know your customer laws that programmers are required to take along with everyone else. I don’t know what exists in the crypto world operating in the Bahamas, but I’m not going to lose a lot of sleep if the FTX director of engineering winds up going to prison for this.
mianos 4y ago
I have been working in finance my whole life. A senior developer of anything in this area would be expected to fully understand the risk implications of this. I have written the code to closeout positions automatically multiple times in multiple jobs. It may have been possible someone directed a junior developer to make this change, but then it would be a case of hunting down who told them. If that happened in my team I'd be documenting everything I saw and running, not walking, not walking briskly, out the door. This said, nothing is black and white. For example, due to immature processes, they might have told the developer that the main account was only one of many accounts they can call on, but the code only allows for one, so we have to make an exception. I'd still be freaking out.
tmaly 4y ago
Most companies in financial services require training around compliance topics such as AML. If you are trading or working with customer money, you usually have to take the Series 7 exam. So I would say for regulated industries, programmers are expected to know some degree of financial law.
bigger_cheese 4y ago
I think it depends a lot on the jurisdiction. In some countries there are laws around ethics and disclosure especially if you work in a certified occupation (i.e. a licensed profession, such as traditional engineering). Software probably makes things even more hazy but in traditional engineering world there are very clear cut rules around professional ethics, personal liability and disclosure.
TuringNYC 4y ago
>> Are programmers expected to know finance law? https://adage.com/article/marketing-news-strategy/tom-brady-and-gisele-bundchen-star-ftx-crypto-campaign/2363821 https://adage.com/article/marketing-news-strategy/tom-brady-... I'm surprised that even Football players are being expected to have evaluated the company's legitimacy, which seems unreasonable.
- thombat 4y ago
  Interesting article! So Brady took "an equity stake in the company and [got] a signing bonus in crypto", then went on to make advertisements even though "The NFL has banned cryptocurrency and NFT sponsorships for its teams". Seems that he, or likely his lawyer and/or financial adviser, will have been evaluated the legitimacy since he's deep into caveat emptor territory. Like innocently buying a stolen car: you're unlikely to be in legal peril but you will lose the car (and gain a claim against the thief that sold it to you)
jacquesm 4y ago
Ignorance of the law is never an excuse if you are found to be breaking the law. So if you think what you are doing is possibly in violation of the law you better bone up or ask a lawyer for a statement on letterhead that what you are doing is ok.
- megablast 4y ago
  So every dev needs to also be an expert lawyer and financier??? OK.
  - jacquesm 4y ago
    No, not every dev.
  - hef19898 4y ago
    Propably not, but a solid understanding of the rules and regulations, and legal requirements, of your field and thebindustry your working in is actually a pretty good thing.
  - baq 4y ago
    If you are in finance or law it is a good idea to know what you can go to jail for. Engineers are people and people can go to jail for breaking laws they didn’t know about.
  - VBprogrammer 4y ago
    There are blatantly illegal things you can do in any field of work. You need to be aware of what is and isn't within the law on a loose basis yes. Even labourers on a building site have to do some training to avoid breaching health and safety legislation (or at least to minimise the companies liability when they error). You also need to have faith in the compliance team and senior management. If your company works in legally sticky territory like crypto doubly so.
  - headsoup 4y ago
    If you work in a company where there is no one that has some idea about the laws that apply to what you do that you could check with, you would be a little concerned.

by alar44 4y ago

hn_throwaway_99 4y ago

Nishad Singh wasn't some low-level coder. He was FTX's Director of Engineering. > "Hey, due to the way our accounting works I need you to subtract X from our dashboard." That is not what happened here. The fact alone that very few people knew about Alameda's special treatment, and, importantly, deliberately conspired to keep that treatment secret is a pretty strong indicator that he knew it was wrong.

barbariangrunge 4y ago
Director of engineering != product manager in charge of deciding what features to include. If somebody tells engineering, “we will not use this feature illegally,” then it’s the fault of the higher ups who are possibly (?) trying to scapegoat somebody to protect themselves
- oshkarr 4y ago
  "I was just following orders" went out of style in 1946. Software engineers are not mindless drones.
- r_hoods_ghost 4y ago
  Directors have specific, well defined legal duties to their company which includes a duty of fiduciary responsibility. That is why they're directors rather than "head of product" or "VP of marketing" or whatever other meaningless title people bestow on themselves. Saying "my boss told me to do it so it is not my fault" is nonsense because you have no boss beyond your shareholders.
  - astrange 4y ago
    Isn't VP usually a higher title than director? (Well, it's not in finance, but it could be in tech-like crypto finance.)
  - reverius42 4y ago
    That's Director as in Board of Directors. In this case, "Director of Engineering" probably just means "Manager of managers of engineers".
  - ummonk 4y ago
    Holding the title "director of X" doesn't mean you're necessarily on the board of directors.
    - xdavidliu 4y ago
      in fact, the two are probably anti-correlated

echelon 4y ago

> Are programmers expected to know finance law? Working on fintech and transaction rails? Probably. I had to know regulations when I worked in fintech. Plus, you don't have to know the law to be found guilty of breaking it. The engineers working on this are innocent until proven guilty, but you'd better believe all internal comms, meeting notes, and commit messages will be scrutinized. Someone had to ask for the system to behave this way, and that will have produced certain artifacts. Engineers with knowledge may be cut deals to testify against the bigger players.

eternalban 4y ago
> The engineers working on this are innocent until proven guilty I believe in due process [& friendship, too]. But alas for the engineers concerned, SBF does not: https://www.businessinsider.com/ftx-collapse-bankman-fried-execs-quit-gary-wang-nishad-singh-2022-11 https://www.businessinsider.com/ftx-collapse-bankman-fried-e... "When asked to clarify whether they were both gone, Bankman-Fried said that Wang was "scared" and Singh was "ashamed and guilty" because FTX customers' deposits had been lost." Isn't that a strange thing to say? Singh is the guy who made the change, per Reuters, and this snake knew that.
jacquesm 4y ago
> Plus, you don't have to know the law to be found guilty of breaking it. Precisely, ignorance is never a valid defense.

jerrysievert 4y ago

i worked for a fintech startup in a similar space: > Are programmers expected to know finance law? in our case, we were. it was drilled in, and tested, reviewed, and audited. i’m not saying that something like this couldn’t have happened, but in my case anyone who would have been involved would definitely have known the legality.

arcbyte 4y ago

Developers need to know the business better than the business people. Always. Otherwise you can't implement the software very well.

parksoha 4y ago
Isn't it completely unscalable? I work for a big automaker, there's literally people whose only job is to be compliant and inform the necessary leads about it. There's hundreds of countries, each with very specific things. If I study everything, I can't code. When knowledge arrives at my team, is already condensed to the point of: "in X country, you must tell the prices of a call if you show a phone number for assistance" Why should I explore every loophole of law to be compliant? That's the companies job, not mine.
- acdha 4y ago
  Down to the trivia level for an entire global company, sure, but this is a lot more general and bigger. Like if you have rules against accepting gifts from vendors, maybe you don’t remember if the threshold is $10 or $15, but you shouldn’t need to ask to know it’s not $30k in a suitcase.
- hn_throwaway_99 4y ago
  For some reason, I've seen a lot of people try to make arguments around FTX that completely miss the scale and malfeasance that occurred. This wasn't a case of "oh, you got some esoteric GAAP depreciation rule wrong". This was an engineering leader putting a ton of special cases in the code saying "For our most beloved partner, none of the rules apply, including letting them take unlimited amounts of customer funds. Oh, and be sure to hide this from the dashboards the rest of the company uses." This is not hard. Nobody needs to be versed in the ins-and-outs of jurisdictional compliance rules to see this was blatant and egregious. If any of this looks remotely familiar to any software devs out there, you should really re-examine your morals. Or at least hire a lawyer.
  - parksoha 4y ago

dereg 4y ago

This is why Caroline is an important witness for the prosecution. It seems like most of the nefarious stuff occurred in Signal.

tekla 4y ago

Developers should know to ask questions when a weird request is made. Developers presumably know how to think and have a vague idea of what the business does to know that a ask to futz with internal financials programmatically is fucking wierd.

deathanatos 4y ago
IME, it depends on your chain of command. I've literally been reprimanded in my career for asking questions. My boss at that time was crap. I didn't choose him. Asking questions can very likely get you fired. Also got reprimanded for disobeying an order at once; my boss — same one as above — would not take "no, we are in a regulated industry, and I cannot do that" for an answer. I ended up going behind his back, getting the approvals he should have gotten himself, and once I'd secured those, granted him the access he wanted. I also tried to escalate to his boss (my grand-boss) … but he didn't respond until it was all moot. But there is a lot of stress when you're fearing for your job, even though you're just trying to do things by the book. I'm inclined to side with engineers, to a degree: the chain of command's responsibility is to never put eng in that position. (Although here, the eng in question seems far higher up than I am. I'm just a bottom rung eng…) > Developers presumably know how to think and have a vague idea of what the business does to know that a ask to futz with internal financials programmatically is fucking wierd. They should but IME they often don't, and even if they do, people are lazy. It's a struggle to get people to do the things they should do some days.
- salawat 4y ago
  You want Engineer in your job title? Then you say no, and you damned well ask questions, and you damned well make sure to leave the moment they make it impossible for you to act ethically.
  - notch656a 4y ago
    This should apply to anyone. IMO engineers aren't special. As a human you should try not to fuck over other people.

steveBK123 4y ago

If Jamie Dimon asked a developer at the bank "hey can you have Chase ATMs allow these 10 accounts that are in my name to withdraw unlimited funds?" everyone involved would be in jail. This is not dissimilar.

stickfigure 4y ago
"For testing purposes, these 10 account numbers should be allowed to remove cash from any of our ATMs. The testers will put the money back." It doesn't sound that nefarious. If you told me this is how ATMs are currently being tested in the industry, I wouldn't be able to contradict you.
- salawat 4y ago
  ...A bench test of an ATM probably doesn't involve real money. No one in finance is stupid enough to use real money on production environments for testing purposes. There is test... And there is PROD. Never do the two meet. Ever. If someone out there does, please make yourself known so we can get the investigators over there ASAP.
  - ragtete 4y ago
    Huh? You're telling me that you think they never test ATMs in prod? That's ridiculous. You think they're just guessing that the test environment perfectly matches the prod environment?
  - malandrew 4y ago
    You can test in production if you have multi-tenancy aware services, where tenancy is some string value like Foo to make sure reads to Foo can only read data that was written to Foo.
    - headsoup 4y ago
      That's not testing in production, that's just the same as saying your test VMWare environment is in the same datacentre as your prod VMWare environment.

MonkeyMalarky 4y ago

I don't know about finance but for HIPAA and CCPA, the answer is yes. Is there an accounting equivalent to the yearly, mandatory 20 minute compliance training videos?

drunkpotato 4y ago
Yes, in US fintech there are mandatory courses in anti-money laundering and know your customer laws that programmers are required to take along with everyone else. I don’t know what exists in the crypto world operating in the Bahamas, but I’m not going to lose a lot of sleep if the FTX director of engineering winds up going to prison for this.

mianos 4y ago

I have been working in finance my whole life. A senior developer of anything in this area would be expected to fully understand the risk implications of this. I have written the code to closeout positions automatically multiple times in multiple jobs. It may have been possible someone directed a junior developer to make this change, but then it would be a case of hunting down who told them. If that happened in my team I'd be documenting everything I saw and running, not walking, not walking briskly, out the door. This said, nothing is black and white. For example, due to immature processes, they might have told the developer that the main account was only one of many accounts they can call on, but the code only allows for one, so we have to make an exception. I'd still be freaking out.

tmaly 4y ago

Most companies in financial services require training around compliance topics such as AML. If you are trading or working with customer money, you usually have to take the Series 7 exam. So I would say for regulated industries, programmers are expected to know some degree of financial law.

bigger_cheese 4y ago

I think it depends a lot on the jurisdiction. In some countries there are laws around ethics and disclosure especially if you work in a certified occupation (i.e. a licensed profession, such as traditional engineering). Software probably makes things even more hazy but in traditional engineering world there are very clear cut rules around professional ethics, personal liability and disclosure.

TuringNYC 4y ago

>> Are programmers expected to know finance law? https://adage.com/article/marketing-news-strategy/tom-brady-and-gisele-bundchen-star-ftx-crypto-campaign/2363821 https://adage.com/article/marketing-news-strategy/tom-brady-... I'm surprised that even Football players are being expected to have evaluated the company's legitimacy, which seems unreasonable.

thombat 4y ago
Interesting article! So Brady took "an equity stake in the company and [got] a signing bonus in crypto", then went on to make advertisements even though "The NFL has banned cryptocurrency and NFT sponsorships for its teams". Seems that he, or likely his lawyer and/or financial adviser, will have been evaluated the legitimacy since he's deep into caveat emptor territory. Like innocently buying a stolen car: you're unlikely to be in legal peril but you will lose the car (and gain a claim against the thief that sold it to you)

jacquesm 4y ago

Ignorance of the law is never an excuse if you are found to be breaking the law. So if you think what you are doing is possibly in violation of the law you better bone up or ask a lawyer for a statement on letterhead that what you are doing is ok.

megablast 4y ago
So every dev needs to also be an expert lawyer and financier??? OK.
- jacquesm 4y ago
  No, not every dev.
- hef19898 4y ago
  Propably not, but a solid understanding of the rules and regulations, and legal requirements, of your field and thebindustry your working in is actually a pretty good thing.
- baq 4y ago
  If you are in finance or law it is a good idea to know what you can go to jail for. Engineers are people and people can go to jail for breaking laws they didn’t know about.
- VBprogrammer 4y ago
  There are blatantly illegal things you can do in any field of work. You need to be aware of what is and isn't within the law on a loose basis yes. Even labourers on a building site have to do some training to avoid breaching health and safety legislation (or at least to minimise the companies liability when they error). You also need to have faith in the compliance team and senior management. If your company works in legally sticky territory like crypto doubly so.
- headsoup 4y ago
  If you work in a company where there is no one that has some idea about the laws that apply to what you do that you could check with, you would be a little concerned.