July 06, 2009

Programmer steals Wall Street trading code, FBI alleges

Reuters, LinkedIn connect Sergey Aleynikov to Goldman Sachs

A high-level developer for a major Wall Street firm was arrested by the FBI on Friday and charged with stealing computer code that automates high-volume trading on stock and commodities markets, according to court documents.

The Reuters news service, which broke the story yesterday, tied the developer, Sergey Aleynikov, to Goldman Sachs, where he was allegedly a vice president of equity strategy.

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

In the days before his June 5 resignation from Goldman Sachs, Aleynikov copied, encrypted and transferred approximately 32MB of proprietary code to a server located in Germany, the FBI claimed in the complaint filed July 4 by Special Agent Michael McSwain, a member of the agency's securities fraud squad.

Aleynikov resigned to take a job with a new company "that intended to engage in high-volume automated trading," for triple his $400,000 salary, the complaint said.

McSwain spelled out four data transfers from Aleynikov's workstation -- both locally and remotely -- on June 1, June 4 and June 5, then tied the dates and times to Aleynikov's use of his keycard to access the office, or logging in remotely from his home computer.

Aleynikov tried to cover his tracks, alleged McSwain. "The program used to encrypt the files was then erased," the FBI agent swore in the complaint. "An attempt was also made to erase the bash history, which was unsuccessful, because of a feature of the Financial Institution's computer system that retains a back-up copy of each user's bash history."

A "bash history" is a log of the most-recently-executed commands by a user on a Unix-based operating system.

The FBI arrested Aleynikov late Friday night at the Newark Airport, and charged him with theft of trade secrets and transporting stolen property.

The complaint said that Aleynikov had made a statement after his arrest, admitting that he had copied and encrypted files from his company's servers, then transferred them to the remote server, deleted the encryption software and attempted to erase the bash history. "Aleynikov claimed, however, that he only intended to collect 'open source' files on which he had worked, but later realized that he had obtained more files than he had intended," McSwain said.

Facts in the FBI's complaint match a LinkedIn profile for someone named "Serge Aleynikov," including his May 2007 start date with Goldman Sachs -- identified only as the "Financial Institution" in the legal filing -- and the description of his job. In the complaint, for example, McSwain said Aleynikov worked as a computer programmer on a platform that "allows the Financial Institution to engage in sophisticated, high-speed, and high-volume trades on various stocks and commodities markets."

In the LinkedIn profile, meanwhile, Aleynikov notes his position with Goldman Sachs and says he "lead development of a distributed real-time co-located high-frequency trading (HFT) platform" at the firm.

As of 2:30 p.m. ET Monday, Aleynikov was still being held in federal custody, pending bail. A Saturday hearing had set bail at $750,000, and placed both travel restrictions and computer access limitations on him assuming he posts a bond. A spokeswoman for the U.S. Attorney in the Southern District of New York declined to comment further on the case.

Close

On Twitter now

Security

Powered by Twitter

On Twitter now

White Paper

D2D Virtual Tape Library Replication Primer

This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.

Download now »

Trial

Free 30-Day Desktop Virtualization Trial

Download a free 30–day trial and experience how XenDesktop delivers a pristine, on–demand desktop experience to users on whatever device they choose, while cutting IT complexity and costs.

Download now »

White Paper

Why Your Firewall, VPN, and IEEE 802.11i Aren't Enough to Protect Your Network

The emergence of WLANs has created a new breed of security threats to enterprise networks.

Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation

Download now »

Sign up to receive Security Resource Alerts

Subscribe to the Security Central Newsletter

Stay informed of the latest security threats and fixes.

White paper

Comprehensive Data Protection for Storage Appliances

With the continuous expansion of data capacity, completing the full cycle of a scheduled scan can be a very time consuming process. Find out how to efficiently secure EMC Celerra with centralized virus scanning, virus pattern file updates, event reporting and antivirus configuration.

Download now! »

White paper

Secure Celerra Environments with Minimal Overhead

A single virus-infected file in a storage system can be responsible for infecting large amounts of data. This white paper details the architecture and product features of Trend Micro's data storage security solution, ServerProtect, and discusses how it has been designed to protect EMC Celerra file servers with minimal overhead.

Download now! »
White paper

Keep Linux Servers Free from Malware

The increase in Linux popularity has increased the frequency and sophistication of malware attacks. Learn how you can protect your Linux environment with real-time protection that is certified by all major Linux vendors.

Download now! »

White paper

Centrally Managed Virus Protection for Windows and NetWare

With the emergence of mixed threat attacks, a failure on a single server can quickly impact the entire network. Learn how a technology that is designed to remove and block infected files on application and file servers prevents the virus from reaching users and keeps your Windows network free from malware.

Download now! »
©1994-2009 Infoworld, Inc.