This April, the United States Court of Appeals ruled that Sergey Aleynikov, former Goldman Sachs software developer-turned convicted thief and spy, was wrongly charged and convicted of theft and espionage under the rationale that software code is not physical property and thereby not subject to theft. This ruling sparks the debate about whether criminal courts are the proper forum for “theft” of intellectual property (IP) in the form of computer software code.
This case is particularly unique due to the criminal context. Typically, matters involving software code theft result in civil litigation rather than criminal prosecution. However, after Aleynikov resigned to join a similar start-up company and was found to have copied sections of “High-Frequency Throughput” software code (which facilitates automated, high-speed stock trading), Goldman used their stature to involve the FBI. Aleynikov was arrested for theft, resulting in a federal conviction and 97-month prison term. Despite this conviction and that his contract strictly prohibited the transfer of data, which became the IP of Goldman upon creation by Aleynikov, the appellate court deemed the code “purely intangible property…beyond the scope of the [criminal theft legislation].”
In Canada, Roman Cisar recently suffered the same fate at trial as Aleynikov, when he was sentenced to 30 months in prison for a similar software code theft from a former employer. However, in Cisar’s case, he utilized the code stolen from his relatively small-time employer to directly undercut their business through the creation of his own, while Aleynikov was only found to have copied the Goldman code for “personal use.” It is clear through these trial judgments that the courts are trying to develop criminal IP jurisprudence to protect companies from employees committing opportunistic digital thievery. Contrary to this end, by overturning the Aleynikov conviction under the premise that the code was not physical property, the Court deemed code as beyond the scope of criminal theft, leaving it to the realm of IP legislation. Thus, in future cases (e.g., the inevitable Cisar appeal), the role of the courts will be to establish whether such IP should be protected with criminal consequences.
A problem lies in the nature of the property being “stolen” and the scope of criminal laws against theft. Due to the nature of virtual data and the wording of legislation, it seems that the US Appellate Court made the correct ruling in Aleynikov. Unauthorized copying does not equal theft, as the copying of the code did not exclude the original owner from usage. With respect to Cisar (reasons of the court yet to be published), adoption of an intangible perspective of source code, should rule out criminal charges under s. 322 of the Criminal Code. Copying the code did not preclude usage of the original company, which is a defining feature of criminal theft. Although it could be argued that unauthorized copying causes economic detriment to the companies employing the code, it is still very difficult to argue that this type of IP can be subject to theft, as the Court made clear in Aleynikov.
There is limited criminal recourse if theft is unavailable to the Crown. Generally, industrial software code is not truly protected by copyright, as it would require disclosure of “trade secrets”, rendering s. 42 of the Copyright Act ineffective. Moreover, s. 42 of the Copyright Act typically applies criminal recourse to copyright infringement through distribution, which was not evident in either Aleynikov or Cisar. Limited criminal action may be permitted through s. 430 criminal mischief if the copying of the code is used such that it causes egregious detriment to the violated party. However, the Criminal Code does not serve to protect exclusively abstract economic interests and applying it as such is inconsistent with the application of the Code. Furthermore, due to the higher standard of proof in criminal cases and the lack of economic restitution to the wronged party, civil suits are a more favourable recourse.
Certainly unfaithful acts such as those committed by Aleynikov and Cisar should be subject to civil lawsuits and potential remedies for lost profits or similar losses as a result of the usage of the code (in addition to contract breach, if applicable), but the nature of the software code as intangible property should preclude criminal action. If the courts are going to trend towards imposing criminal penalties on these types of IP incidents, it is essential that the legislature update statutory definitions of property and its theft to reflect the changing nature of property in the digital age.
Ryan Heighton is a JD candidate at Osgoode Hall Law School.
