Opinion
May 15, 1997
Freeman, Nooter Ginsburg, New York City (Louis A. Freeman of counsel), for defendant.
Robert M. Morgenthau, District Attorney of New York County (George M. Donahue of counsel), for plaintiff.
Defendant moves to dismiss the indictment on the ground that the evidence before the Grand Jury was insufficient and related grounds. He also seeks to dismiss the indictment in furtherance of justice.
This case brings into question the applicability and reach of various sections of Penal Law article 156, which was enacted in 1986 to "adapt New York's statutes to the realities of the computer age. By prohibiting the unethical and illegal use of computers, the bill provides the first line of defense against the burgeoning threat of computer crime" (Governor's Mem approving L 1986, ch 514, 1986 McKinney's Session Laws of NY, at 3172). Curiously, despite the bill's laudable goals and the ubiquitous use of computers in business and personal affairs, the number of computer crime prosecutions is exceedingly modest. To this date, there are but a handful of reported decisions involving Penal Law article 156.
The evidence before the Grand Jury established that defendant was a computer consultant employed by the investment banking firm of Goldman Sachs in its Fixed Income Group. His duties included helping employees gain and maintain access to the firm's computers. To this end he was given computer privileges which included access to computer directories on which utility files were kept. Among these were script files which administered one of Goldman Sachs's LAN networks. On October 10, 1995 he left his position to take one with J.P. Morgan. That same day, before leaving, he accessed the trunk file which contained the script libraries, compressed it and put it in a file in his personal directory. He named the file Anil-Kat-Tar. Approximately two weeks later defendant called a former co-worker at Goldman Sachs and asked that person to e-mail his personal files, including the Anil-Kat-Tar file, to him at his new place of employment. The associate asked a superior in the department whether he should forward defendant's personal computer files to him and, upon being told that it was permissible, did so. The file was so large that when it was received at J.P. Morgan it clogged the gateways that connect J.P. Morgan to the Internet, and eventually came to the attention of the firm's computer security department. They, in turn, alerted their counterparts at Goldman Sachs.
Defendant is charged in a five-count indictment with two counts of unlawful duplication of computer-related material (one count each of Penal Law § 156.30, [2]), one count of criminal possession of computer-related material (Penal Law § 156.35) and two counts of computer trespass (Penal Law § 156.10). He contends that the evidence before the Grand Jury was insufficient to establish his guilt of these crimes.
Defendant asserts that he cannot have committed the crime charged in count one, which charges him with unlawful duplication of computer-related matter under subdivision (1), because, although he copied some of Goldman Sachs's computer programs without having a right to do so, he did not "thereby intentionally and wrongfully deprive or appropriate from an owner thereof an economic value or benefit in excess of two thousand five hundred dollars" (Penal Law § 156.30). He argues at great length, and persuasively, that the great majority of the material he copied was either worthless (core dumps) or freely available (e.g., "shareware"). Defendant is mistaken in believing that the duplication of these programs, or of various copyrighted and widely available commercial and business programs, is at issue. His criminal liability is predicated solely upon his duplication of the scripts which were specifically written to accommodate the requirements and peculiarities of Goldman Sachs's computer system. Although he acknowledges that he copied these files as well, he contends that the brokerage house's needs were so unique and the scripts so specialized that they are unusable outside the computer environment of Goldman Sachs. They are, thus, virtually without value to anyone else.
The argument that by duplicating a series of programs which are unusable by any other firm, defendant did not appropriate anything of value, is one which he may chose to present at trial. He declined to testify and refused the People's offer to have an expert testify on his behalf as to these matters. His position was, thus, not presented to the Grand Jury and the People's evidence was to the contrary. The testimony was that the cost of typing the programs alone exceeded $27,000. Their design and development cost the company approximately $700,000. The Grand Jury could, thus, well presume that the programs would have considerable value to a competitor and that it was this value that defendant appropriated by his actions. As the Grand Jury was presented with competent evidence that the value of the duplicated programs far exceeded $2,500, there was sufficient evidence to sustain his liability for the crime in question.
That being the case, there was also a sufficient basis upon which to charge him with count three of the indictment, criminal possession of computer-related material (Penal Law § 156.35). This charge imposes criminal liability upon an individual "when having no right to do so, he knowingly possesses, in any form, any copy, reproduction or duplicate of any computer data or computer program which was copied, reproduced or duplicated in violation of section 156.30 of this article, with intent to benefit himself or a person other than an owner thereof."
There was ample reason for the Grand Jury to presume that defendant was aware that, in copying the entire trunk file, he had duplicated the firm's proprietary script files and was in possession of them. The testimony of Goldman Sachs's vice-president for Worldwide Information Security clearly established that defendant had no right to possess these programs.
The personal agreement signed by defendant when he was hired as a consultant by Goldman Sachs contains a provision forbidding him from disclosing information contained in the firm's computers. The Grand Jury could have inferred from all of this evidence that defendant's actions in gaining access to Goldman Sachs's script files were motivated either by an intention to sell them, to use them in his new position in order to advance himself or to save himself labor, or, at the very least, to study and learn from them. Any of these intentions satisfy the requirement that he intend to benefit himself. Accordingly, the People established every element of Penal Law § 156.35.
The same cannot be said of counts four and five, which charge the defendant with computer trespass (Penal Law § 156.10). This statute provides that:
"A person is guilty of computer trespass when he knowingly uses or causes to be used a computer or computer service without authorization and:
"1. he does so with an intent to commit or attempt to commit or further the commission of any felony; or
"2. he thereby knowingly gains access to computer material."
Defendant has no culpability under either of the two subdivisions because there was no proof before the Grand Jury that he used the Goldman Sachs's computers without authorization. Penal Law § 156.00 (6) provides in pertinent part: "`Uses a computer or computer service without authorization' means the use of a computer or computer service without the permission of, or in excess of the permission of, the owner * * * after notice to that effect to the user of the computer or computer service has been given".
At the close of the presentation a grand juror asked a question about the issue of authorization. Wasn't it true that a supervisor at Goldman Sachs authorized defendant's request to e-mail his files to J.P. Morgan? The People explained that this count was not focused upon defendant's request that the duplicated file be sent to him at J.P. Morgan, but only with "accessing the system administration file. That's what we're concerned about * * * We're focusing on the conduct of Mr. Katakam going to the trunk of this system, the script file. That's what we're concentrating on".
There was no evidence before the Grand Jury, however, that accessing the trunk file was forbidden to defendant, or that he had received notice that it was forbidden. The only testimony as to what was forbidden to employees was that the programs on the firm's computers were for business use and that employees were not allowed to give them to outsiders. Accessing the trunk file, and even duplicating certain files and renaming them constituted neither a personal or nonbusiness use nor a disclosure to an outsider. Moreover, defendant's actions do not smack of computer trespass. Within the limited area of the Fixed Income Group, defendant had fairly wide access to the firm's computer directories, including those on which its utilities were kept. He was not acting in excess of authorization when he accessed these files. For this reason, counts four and five are dismissed.
Defendant is charged in count two with unlawful duplication of computer-related material under subdivision (2) (Penal Law § 156.30). This provision makes criminal the copying of computer material when the actor has no right to do so and when he acts "with an intent to commit or attempt to commit or further the commission of any felony". Upon being asked to explain the different charges upon which the grand jurors were being asked to vote, the Assistant District Attorney restricted the definition as follows: "In effect what's happening is unlawful duplication he's [sic] furthering the commission of computer trespass, computer trespass is furthering the commission of unlawful duplication of computer related material, both crimes being a [sic] felony."
By giving this instruction, the People limited the Grand Jury to the consideration whether defendant had committed the crime of unlawful duplication of computer-related material because he also intended to commit computer trespass. Had they been charged otherwise, it is possible that the grand jurors could have found that, in duplicating the script files, the defendant intended to commit a felony other than computer trespass (e.g., grand larceny). As defendant did not commit the crime of computer trespass, and he cannot be said to have formulated an intent to commit such a crime (since he was aware of the authority that had been given him), the Grand Jury could not have found that he unlawfully duplicated the scripts with the intent to further this crime. Accordingly, count two is dismissed.
Defendant's motion to dismiss the indictment in furtherance of justice is predicated upon his contentions that the evidence against him is weak and that, if he committed violations of the Penal Law, they were de minimis. He claims that there is no proof that, when he duplicated the programs, he possessed "an intent to commit or attempt to commit or further the commission of any felony". (Penal Law § 156.30.) He did not gain by his actions and there is no evidence that he had some larger criminal purpose. It is his position that he did not fully realize that he was sweeping up proprietary programs belonging to Goldman Sachs when he duplicated the trunk file, and that he merely wanted access to those programs which would be useful in his new position and to which he was fully entitled. Further, no harm was done to Goldman Sachs. Their files were not corrupted, sabotaged or divulged to another party, nor did they lose anything of value. He also states that he has no prior conflict with the criminal justice system and contends that, as he is a resident alien, a conviction would result in dire and unmerited consequences to him. Last, he claims that he has suffered humiliation and economic loss and has been punished enough.
Defendant's motion to dismiss pursuant to CPL 210.40 is denied. It is far from clear that defendant was, as he claims, without evil intent when he copied Goldman Sachs's files. He was put on notice by his employer that he had no right to the firm's proprietary files when he was hired. I am likewise unconvinced that someone of his expertise could have unknowingly duplicated the files, or failed to realize their importance to the firm. Even if he believed that he was duplicating something of little or no value, he was aware that the files were not his to appropriate.
The harm suffered by Goldman Sachs and J.P. Morgan can be measured by the cost of their investigations into this matter and the disruptions they may have suffered. The argument that the indictment should be dismissed because defendant has already suffered economic loss and humiliation as a result of these events is not compelling. The same argument can be made by anyone in defendant's position, and ignores the fact that the Legislature intended to criminalize the type of behavior of which he is accused in order to deter it. Society is ever more dependent on the computer and the potential to cause harm by those who are in a position to abuse their expertise is considerable. It is unfortunate that there may be collateral consequences to defendant should he be convicted, but these do not warrant dismissal of the indictment. Accordingly, the motion to dismiss in furtherance of justice is denied.