9 ms·

I think the most troubling part was that a huge, powerful company can get a government agency on the phone and have someone locked up based pretty much exclusiv

I think the most troubling part was that a huge, powerful company can get a government agency on the phone and have someone locked up based pretty much exclusively on them saying "You won't understand why, but he did really bad stuff. Trust us."

rayiner 12y ago
But it wasn't just based on Goldman's word: > Then [the FBI agent] explained what he knew, or thought he knew: in April 2009, Serge had accepted a job at a new high-frequency-trading shop called Teza Technologies, but had remained at Goldman for the next six weeks, until June 5, during which time he sent himself, through a so-called “subversion repository,” 32 megabytes of source code from Goldman’s high-frequency stock-trading system. Lewis weaves a lot of editorializing and red-herrings into the account, but here's the punchline: > All of which was true, as far as it went... Nobody disputes that at the time Aleynikov was arrested, the FBI had evidence that he had sent himself a bunch of source code and covered his tracks. And at trial, the prosecution proved that he had in fact done that. So what the heck else was the FBI supposed to do?
- hamburglar 12y ago
  > he sent himself, through a so-called “subversion repository,” 32 megabytes of source code One wonders whether this would have seemed less nefarious if he'd used a VCS that wasn't called "subversion." :)
  - rayiner 12y ago
    Would it have? On my last day at work at Google, before I am slated to start working in the Bing group at Microsoft, I mail myself a copy of the PageRank source code. Does it matter what VCS I use?
    - fnordfnordfnord 12y ago
      Except the code copied by Aleynikov wasn't anything like PageRank. It was like some Go library that fetches the pages, and one that was primarily open source code to begin with.
      - rayiner 12y ago
        This was some initial (mis?)-information about the case, but at least according to the Second Circuit: > In addition to proprietary source code, Aleynikov also transferred some open source software licensed for use by the public that was mixed in with Goldman’s proprietary code. However, a substantially greater number of the uploaded files contained proprietary code than had open source software.
        fnordfnordfnord 12y ago
        Were the files source code or were they some sort of transaction logs, generated records, and what have you? Or were they various forks/branches of mostly the same thing intended for testing? If you don't know then you can't assess their relative "value".
    - hamburglar 12y ago
      I'm referring to the fact that no matter how damning the evidence is on its own, it probably seems even more damning to a layperson who doesn't know the name "subversion" is a pun and not something subversive.
    - jlarocco 12y ago
      That's not the point he was getting at. Most people have no idea what VCS is. To a lay person, "a so called 'mercurial repository'" would sound far less sinister than "a so called 'subversion repository'". The reality is that the repo probably had little to do with subverting anything, and was just a convenient way to transfer code. I have to admit, that line made me chuckle.
    - coldtea 12y ago
      Technically no. In a court description or in a press article, both addressed to people who are not technical, the name of the VCS is important. Consider the extreme case where the VCS was called "theft-assistance" for example. How does "He copied the code from a theft-assistance repository" would sound to a jury that doesn't know what a VCS is and that theft-assistance is just a name? If it was something generic and inoffensive, like Git, it would be OK, but "subversion" has a ...subversive undertone.
      - aragot 12y ago
        In a previous video posted on HN, a police officer explains how they would use a concession made by a honest humble person during an interview to boost their conviction rate: "Sure, I never like the guy. But I would never do anything malicious against anyone or even animals, especially not theft or murder which is totally against my conscience." would become big uppercase red letters on a videoprojector: "I NEVER LIKE THE GUY". Be sure you nail every emotional aspect to convince a jury.
  - rev_bird 12y ago
    That part made me kind of angry -- "so-called" makes the writer sound like they know something we don't, like "subversion" is some cool trick that smart people know.
    - dragonwriter 12y ago
      "so-called" here is a way of distinguishing the use of "subversion" as a name/description distinction (somewhat similar to a use/mention distinction, but not the right way of making that distinction, IMO, as correctly using "Subversion" as a proper noun would be better, though) as the common noun "subversion" has meaning, but the word "subversion" was not being used for that meaning, only as the name of a thing.
- fnordfnordfnord 12y ago
  >... covered his tracks. He deleted his bash history. For all you know, that may have been a standard procedure. user@somemachine.gs.com:~/ >svn export --username Aleynikov --password Hunter2 --non-interactive svn://subversion.ZOMG.think.of.the.children.com/espionage/exportFile user@somemachine.gs.com:~/ >rm .bash_history Would you "cover your tracks" if you for some reason typed a password into the console of a machine that you don't own?
  - hurin 12y ago
    Realistically (loopholes aside) - all of the code not under GPL would be theft no? (Goldman replacing the copyrights on other open-source stuff with their own is probably illegal (as long as the license stipulates that the original copyright notice must remain), but their modifications are still proprietary. He of course could have had proprietary source code in his repositories for work in the first place - but bundling and uploading everything does look highly suspicious - and he should have known better. [Goldman] called the F.B.I. in haste, just two days before, and then put their agent through what amounted to a crash course on high-frequency trading and computer programming. McSwain later conceded that he didn’t seek out independent expert advice to study the code Serge Aleynikov had taken. This is the very surprising part.
    - fnordfnordfnord 12y ago
      I'm not one of the people who would ever equate copying code to theft, regardless of intent. But Aleynikov admitted that he expected GS to be upset about it, mostly due to their cultural attitudes about IP (ie: everything is theirs). Note that he didn't "bundling and uploading everything" he specifically avoided uploading the trading strategies code. On the one hand, people seem to be giving GS a pass for stripping the copyright notices from GPL'd code they used, but taking them at their word and treating it as high treason when Aleynikov makes a copy of the modified GPL code for himself. >> "McSwain later conceded that he didn’t seek out independent expert advice to study the code Serge Aleynikov had taken." >This is the very surprising part. It's just the lazy careless work of a modern day Pinkerton man.
rhino369 12y ago
Most arrests are X telling government that you did Y, which the government didn't directly see. You don't have to understand the source code to know it is a trade secret with enough certainty for probable cause. Goldman could be lying, but so could the shop owner who claims you drove off without paying for your gasoline. If someone walked out of Intel with the design docs and recipe for the latest intel chipset, would you expect the FBI to understand it all before arresting the person?
- s_q_b 12y ago
  Yes. The FBI has technical specialists on staff that could very quickly say, "Yes, this complaint checks out." The problem here is that the agent apparently just took Goldman at their word, and didn't conduct an independent investigation of Goldman's claims, which is kind of their entire job. This is especially relevant because the value of stolen property can seriously affect charging and sentencing. If you or I called the FBI and said "An employee stole proprietary code worth millions," there's no way the FBI would take that at face value, if you could even get their attention. When the Federal government treats powerful corporations differently, to the point of effectively outsourcing its investigation, that severely undermines the principle of equality before the law.
  - deleted 12y ago
    [deleted]
  - rhino369 12y ago
    They confirmed that the guy took a ton of source code right? Taking Goldman at their word that it was their IP isn't a huge stretch. Taking the time to confirm that the code itself is a trade secret is a monumental task, one that isn't needed to determine if there was probable cause.
    - s_q_b 12y ago
      His argument was that most of it was open source, or modified open source with licenses that required contributing back the source code. Basically, it sounds like he grabbed his stuff because he wanted to get his utility functions and open source modifications. Here's the piece in Vanity Fair where the general consensus was that what his actions indicate his intent was defintely not to steal valuable IP. http://www.vanityfair.com/news/2013/09/michael-lewis-goldman-sachs-programmer http://www.vanityfair.com/news/2013/09/michael-lewis-goldman... Witness this exchange: “Did you take the strats?” asked one (meaning Goldman’s trading strategies). “No,” said Serge. That was one thing the prosecutors hadn’t accused him of. “But that’s the secret sauce, if there is one,” said the juror. “If you’re going to take something, take the strats.” “I wasn’t interested in the strats,” said Serge. “But that’s like stealing the jewelry box without the jewels,” said another juror. “You had super-user status!” said the first. “You could easily have taken the strats. Why didn’t you?” “To me, the technology really is not interesting,” said Serge. “You weren’t interested in how they made hundreds of millions of dollars?” asked someone else. “Not really,” said Serge. “It’s all one big gamble, one way or another.” So if the essence of the crime is theft of a trade secret, then you absolutely have to conduct an independent investigation that a trade secret was involved, and that it was stolen to have probable cause. The precedent here is a large corporation can use the government as an enforcement arm, and will be taken completely at face value. Simple allegations by individuals are subject to investigation prior to arrest, as should be all allegations. This boiled down to Goldman calling the FBI, and less than forty-eight hours later arresting the person Goldman told them to arrest. They didn't interview any witnesses or consult with any experts other than Goldman employees. That's terrifying.
abalone 12y ago
> have someone locked up based pretty much exclusively on them saying "You won't understand why, but he did really bad stuff. Trust us." At best that might extend to his initial arrest but not to his subsequent imprisonment. That was the result of a criminal trial that showed he violated the EEA. Which was subsequently overturned on appeal, but only because of a "technicality" in the phrasing of the law which has subsequently been clarified to explicitly and unreservedly criminalize the actions that he took.

rayiner 12y ago

But it wasn't just based on Goldman's word: > Then [the FBI agent] explained what he knew, or thought he knew: in April 2009, Serge had accepted a job at a new high-frequency-trading shop called Teza Technologies, but had remained at Goldman for the next six weeks, until June 5, during which time he sent himself, through a so-called “subversion repository,” 32 megabytes of source code from Goldman’s high-frequency stock-trading system. Lewis weaves a lot of editorializing and red-herrings into the account, but here's the punchline: > All of which was true, as far as it went... Nobody disputes that at the time Aleynikov was arrested, the FBI had evidence that he had sent himself a bunch of source code and covered his tracks. And at trial, the prosecution proved that he had in fact done that. So what the heck else was the FBI supposed to do?

hamburglar 12y ago
> he sent himself, through a so-called “subversion repository,” 32 megabytes of source code One wonders whether this would have seemed less nefarious if he'd used a VCS that wasn't called "subversion." :)
- rayiner 12y ago
  Would it have? On my last day at work at Google, before I am slated to start working in the Bing group at Microsoft, I mail myself a copy of the PageRank source code. Does it matter what VCS I use?
  - fnordfnordfnord 12y ago
    Except the code copied by Aleynikov wasn't anything like PageRank. It was like some Go library that fetches the pages, and one that was primarily open source code to begin with.
    - rayiner 12y ago
      This was some initial (mis?)-information about the case, but at least according to the Second Circuit: > In addition to proprietary source code, Aleynikov also transferred some open source software licensed for use by the public that was mixed in with Goldman’s proprietary code. However, a substantially greater number of the uploaded files contained proprietary code than had open source software.
      - fnordfnordfnord 12y ago
        Were the files source code or were they some sort of transaction logs, generated records, and what have you? Or were they various forks/branches of mostly the same thing intended for testing? If you don't know then you can't assess their relative "value".
  - hamburglar 12y ago
    I'm referring to the fact that no matter how damning the evidence is on its own, it probably seems even more damning to a layperson who doesn't know the name "subversion" is a pun and not something subversive.
  - jlarocco 12y ago
    That's not the point he was getting at. Most people have no idea what VCS is. To a lay person, "a so called 'mercurial repository'" would sound far less sinister than "a so called 'subversion repository'". The reality is that the repo probably had little to do with subverting anything, and was just a convenient way to transfer code. I have to admit, that line made me chuckle.
  - coldtea 12y ago
    Technically no. In a court description or in a press article, both addressed to people who are not technical, the name of the VCS is important. Consider the extreme case where the VCS was called "theft-assistance" for example. How does "He copied the code from a theft-assistance repository" would sound to a jury that doesn't know what a VCS is and that theft-assistance is just a name? If it was something generic and inoffensive, like Git, it would be OK, but "subversion" has a ...subversive undertone.
    - aragot 12y ago
      In a previous video posted on HN, a police officer explains how they would use a concession made by a honest humble person during an interview to boost their conviction rate: "Sure, I never like the guy. But I would never do anything malicious against anyone or even animals, especially not theft or murder which is totally against my conscience." would become big uppercase red letters on a videoprojector: "I NEVER LIKE THE GUY". Be sure you nail every emotional aspect to convince a jury.
- rev_bird 12y ago
  That part made me kind of angry -- "so-called" makes the writer sound like they know something we don't, like "subversion" is some cool trick that smart people know.
  - dragonwriter 12y ago
    "so-called" here is a way of distinguishing the use of "subversion" as a name/description distinction (somewhat similar to a use/mention distinction, but not the right way of making that distinction, IMO, as correctly using "Subversion" as a proper noun would be better, though) as the common noun "subversion" has meaning, but the word "subversion" was not being used for that meaning, only as the name of a thing.
fnordfnordfnord 12y ago
>... covered his tracks. He deleted his bash history. For all you know, that may have been a standard procedure. user@somemachine.gs.com:~/ >svn export --username Aleynikov --password Hunter2 --non-interactive svn://subversion.ZOMG.think.of.the.children.com/espionage/exportFile user@somemachine.gs.com:~/ >rm .bash_history Would you "cover your tracks" if you for some reason typed a password into the console of a machine that you don't own?
- hurin 12y ago
  Realistically (loopholes aside) - all of the code not under GPL would be theft no? (Goldman replacing the copyrights on other open-source stuff with their own is probably illegal (as long as the license stipulates that the original copyright notice must remain), but their modifications are still proprietary. He of course could have had proprietary source code in his repositories for work in the first place - but bundling and uploading everything does look highly suspicious - and he should have known better. [Goldman] called the F.B.I. in haste, just two days before, and then put their agent through what amounted to a crash course on high-frequency trading and computer programming. McSwain later conceded that he didn’t seek out independent expert advice to study the code Serge Aleynikov had taken. This is the very surprising part.
  - fnordfnordfnord 12y ago
    I'm not one of the people who would ever equate copying code to theft, regardless of intent. But Aleynikov admitted that he expected GS to be upset about it, mostly due to their cultural attitudes about IP (ie: everything is theirs). Note that he didn't "bundling and uploading everything" he specifically avoided uploading the trading strategies code. On the one hand, people seem to be giving GS a pass for stripping the copyright notices from GPL'd code they used, but taking them at their word and treating it as high treason when Aleynikov makes a copy of the modified GPL code for himself. >> "McSwain later conceded that he didn’t seek out independent expert advice to study the code Serge Aleynikov had taken." >This is the very surprising part. It's just the lazy careless work of a modern day Pinkerton man.

rhino369 12y ago

Most arrests are X telling government that you did Y, which the government didn't directly see. You don't have to understand the source code to know it is a trade secret with enough certainty for probable cause. Goldman could be lying, but so could the shop owner who claims you drove off without paying for your gasoline. If someone walked out of Intel with the design docs and recipe for the latest intel chipset, would you expect the FBI to understand it all before arresting the person?

s_q_b 12y ago
Yes. The FBI has technical specialists on staff that could very quickly say, "Yes, this complaint checks out." The problem here is that the agent apparently just took Goldman at their word, and didn't conduct an independent investigation of Goldman's claims, which is kind of their entire job. This is especially relevant because the value of stolen property can seriously affect charging and sentencing. If you or I called the FBI and said "An employee stole proprietary code worth millions," there's no way the FBI would take that at face value, if you could even get their attention. When the Federal government treats powerful corporations differently, to the point of effectively outsourcing its investigation, that severely undermines the principle of equality before the law.
- deleted 12y ago
  [deleted]
- rhino369 12y ago
  They confirmed that the guy took a ton of source code right? Taking Goldman at their word that it was their IP isn't a huge stretch. Taking the time to confirm that the code itself is a trade secret is a monumental task, one that isn't needed to determine if there was probable cause.
  - s_q_b 12y ago
    His argument was that most of it was open source, or modified open source with licenses that required contributing back the source code. Basically, it sounds like he grabbed his stuff because he wanted to get his utility functions and open source modifications. Here's the piece in Vanity Fair where the general consensus was that what his actions indicate his intent was defintely not to steal valuable IP. http://www.vanityfair.com/news/2013/09/michael-lewis-goldman-sachs-programmer http://www.vanityfair.com/news/2013/09/michael-lewis-goldman... Witness this exchange: “Did you take the strats?” asked one (meaning Goldman’s trading strategies). “No,” said Serge. That was one thing the prosecutors hadn’t accused him of. “But that’s the secret sauce, if there is one,” said the juror. “If you’re going to take something, take the strats.” “I wasn’t interested in the strats,” said Serge. “But that’s like stealing the jewelry box without the jewels,” said another juror. “You had super-user status!” said the first. “You could easily have taken the strats. Why didn’t you?” “To me, the technology really is not interesting,” said Serge. “You weren’t interested in how they made hundreds of millions of dollars?” asked someone else. “Not really,” said Serge. “It’s all one big gamble, one way or another.” So if the essence of the crime is theft of a trade secret, then you absolutely have to conduct an independent investigation that a trade secret was involved, and that it was stolen to have probable cause. The precedent here is a large corporation can use the government as an enforcement arm, and will be taken completely at face value. Simple allegations by individuals are subject to investigation prior to arrest, as should be all allegations. This boiled down to Goldman calling the FBI, and less than forty-eight hours later arresting the person Goldman told them to arrest. They didn't interview any witnesses or consult with any experts other than Goldman employees. That's terrifying.

abalone 12y ago

> have someone locked up based pretty much exclusively on them saying "You won't understand why, but he did really bad stuff. Trust us." At best that might extend to his initial arrest but not to his subsequent imprisonment. That was the result of a criminal trial that showed he violated the EEA. Which was subsequently overturned on appeal, but only because of a "technicality" in the phrasing of the law which has subsequently been clarified to explicitly and unreservedly criminalize the actions that he took.