Flash Memory and Corporate Espionage

Electronic gadgets are often fun but there is rarely one as propitious as this: a new type of flash memory stick that can self-destruct by remote control, causing me to speculate immediately on the immense possibilities. James Bond or Ethan Hunt, anyone?

The real implication is even more profound, given a recent US court ruling that dealt a setback to the fight against corporate espionage – that downloading proprietary data may not amount to a criminal offense after all. Hence this self-destruct flash memory stick could be critical in cases where it is a criminal offense to download proprietary data.

I wrote previously about the release of former Goldman Sachs computer programmer Sergey Aleynikov, who was acquitted by a US federal appeals court in mid-February after he had served 11 months of his eight-year sentence. Aleynikov was earlier convicted in December 2010 for stealing proprietary computer source code from Goldman Sachs’ high-frequency trading platform – a lucrative segment of Wall Street that uses complex computer algorithms to convert minute price discrepancies into quick profits through rapid-fire trades.

Aleynikov allegedly uploaded the source code onto a computer server in Germany, which he then encrypted and downloaded into his home computer, laptop and yes, a flash memory stick. He was convicted by a jury March 2010 of violating the Economic Espionage Act of 1996 and the Interstate Transportation of Stolen Property Act.

The three-judge panel in New York finally offered an explanation in mid-April for the decision on his acquittal.

“Because Aleynikov did not ‘assume physical control’ over anything when he took the source code, and because he did not thereby ‘deprive [Goldman] of its use,’ Aleynikov did not violate the [National Stolen Property Act],” according to the 2nd Circuit Court of Appeals. “We decline to stretch or update statutory words of plain and ordinary meaning in order to better accommodate the digital age.”

That could potentially lead to wrong conclusions and serious headline news: that the US legal system has not caught up with the modern digital sphere so the stealing of proprietary data is (still) not illegal? So corporate espionage – stealing trade secrets - is (still) not a crime?

I queried some legal experts with relevant knowledge and expertise in this field on a more pressing question: would Aleynikov be acquitted if the same case took place in other jurisdictions, say Mainland China and the Hong Kong Special Administrative Region where it is one country two systems on the legal front?

Aleynikov might get away with it in China but unlikely in Hong Kong, according to Hong Kong-based lawyer William Law, founder and partner of ATL Law Offices and specialized in intellectual property matters in both Hong Kong and China, including cases relating to the creation and protection of trade secrets.

There is no generality, it varies on a case to case basis, as there are two same criteria for trade secrets that apply to both jurisdictions, says Vivien Chan, a specialist in intellectual property matters and the founding partner of Vivien Chan & Co., a full-service law firm with offices in Hong Kong and China.

The employer must behave in such a way that the source code is treated and regarded as a trade secret, and demands the same from the employee in so far as the employee conduct in relation to the source code is concerned.

“These measures must be maintained and executed properly,” said Chan, who added that the employment contract needs to include a confidentiality clause so the employees understand clearly the circumscribed range of trade secrets within the company.

The definition of trade secrets is important in China’s case, Law says. According to Article 10 of the Competition Law, trade secrets must include the following elements: contain technical and business information; capable of bringing economic benefits to the owner; has practical applicability; is protected as confidential by the owner; and is not publicly known or available.

And there must be damage of at least RMB 500,000 (about US$79,300), according to Article 219 of the Criminal Law.

The stealing of a computer source code is not as straightforward as, say stealing a research patent. It is more like stealing “an idea” as computer source code is produced from programming language, knowledge also retained in the brain of the programmer – and computer programmers have different ways to derive the same code. It is like a “building block” with many components. Taking away one component does not equate to stealing trade secrets, Law explains.

“It is an expertise, otherwise you mean to say all research and development personnel cannot change jobs?” said Law.

Besides, he pointed out that arbitrage is a trade on asymmetric information which may not guarantee profits. The alleged party must also sell the stolen data to become a crime in China.

And what if the computer programmer even improved the end product after he joined a new employer, much like reverse engineering, which is legal in China? Consider the analogy that one were to take an iPad (in the public domain) and reconfigure the components to derive an improved product under a different label, Law explains.

The same case, however, is more straightforward if it happens in Hong Kong – Aleynikov would likely be charged with corporate espionage, Law added.

To prove a point, the in-house counsel of a global firm in Hong Kong recalled a case of stolen confidential data from a company computer was reported to the local police to follow up as a criminal investigation.

According to Chapter 20, Section 161 of the Crimes Ordinance, it is a crime if one “obtains access to a computer - with intent to commit an offense; with a dishonest intent to deceive; with a view to dishonest gain for himself or another; or with a dishonest intent to cause loss to another.”

Except the phrase “access to a computer” may be badly worded, says Law: the provision will also apply even if a computer was hacked.

Now, back to that promising new flash memory stick – bet there is no law against it yet. This memory stick, slightly bigger than those your colleagues are using, has an encrypted memory chip and a SIM card. The owner can track it by GPS if it is misplaced or stolen – or simply send a high-voltage killer bolt to the device, even without an Internet connection, which will melt the chip and accompanying data for good.

Self-destruct complete. No evidence, no footprint. Now that's innovation.

(Vanson Soo runs an independent business intelligence and commercial investigations practice specialized in the Greater China region. Another version of this runs in The Standard of Hong Kong. Email: soovans@gmail.com)