Argued May 26, 2015
[Copyrighted Material Omitted]
Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 11 CR 00699 -- Charles R. Norgle, Judge.
For United States of America, Plaintiff - Appellee: Patrick M. Otlewski, Attorney, Office of The United States Attorney, Chicago, IL.
For Yihao PU, also known as: Ben Pu, Defendant - Appellant: William Flachsbart, Attorney, Travis Campbell, Attorney, Flachsbart & Greenspoon, LLC, Chicago, IL.
Before BAUER, KANNE, and WILLIAMS, Circuit Judges.
Williams, Circuit Judge.
Yihao Pu worked for two companies, " Company A" and Citadel, which are financial institutions that traded stocks and other assets on behalf of clients. While working at each company, Pu copied computer files from his employer's system to personal storage devices. The files were part of each company's proprietary software that allowed them to execute strategic trades at high speeds. The files were company trade secrets, and Pu's copying of the files was a significant data breach.
Normally, crimes involving the theft of computer data trade secrets lead to the sale of the data to, or the thief being hired by, a company that will use the data. But here, Pu used the data to conduct computerized stock market trades for himself and lost approximately $40,000.
Pu was indicted and pleaded guilty to one count of unlawful possession of a trade secret belonging to Company A, and one count of unlawful transmission of a trade secret belonging to Citadel. The district court sentenced him to 36 months in prison and ordered him to pay over $750,000 in restitution. Pu appeals, arguing that the district court's factual findings did not support its conclusion that Pu intended to cause a loss to the companies of approximately $12 million. We agree. Pu also challenges the district court's failure to require the government to provide a complete accounting of the loss caused by his offense before it determined the amount of restitution owed. We also agree that the district court erred by awarding restitution without evidence that reflected a complete accounting of the victims' investigation costs.
Yihao Pu is a twenty-eight-year-old quantitative finance (" QF" ) professional. Pu worked as a QF analyst at Company A from July 2009 to March 2010 and as a QF engineer at Citadel from May 2010 to August 2011.
Company A and Citadel, the victims in this case, are financial firms that engage in high frequency trading (" HFT" ). HFT is the rapid buying and selling of publicly traded stocks. Both companies developed proprietary computer programs, which we will call HFT platforms, that perform the tasks necessary to execute trades at lightning fast speeds when certain market events occur. Company A and Citadel's HFT platforms are valuable trade secrets. Both companies use their HFT platforms to conduct trades for themselves or their clients. Company A also developed infrastructure software, which is sold to customers and allows them to execute their own high frequency trades using Company A's technology.
Each company put substantial money and time into creating its unique HFT platform. For their respective entities, Company A and Citadel employees developed and implemented HFT strategies by analyzing and utilizing mathematical and statistical models of investment instruments and market activities. The HFT strategies identified short-term investment opportunities in the stock market or other asset markets. This information was then translated into algorithms. The algorithms were basically computerized instructions
for when to order a trade. They were incorporated into the computer source code that ran the HFT platforms or Company A's infrastructure software. Citadel's algorithms also generated outputs that were expressed as numerical values, which Citadel called alpha data. The algorithms also contained alpha terms, which generated numerical values, which Citadel called alpha term data. Both alpha data and alpha term data are component parts of Citadel algorithms and not algorithms or source code themselves. The numerical value derived from this application reflects a specific moment in time. Lastly, Citadel's trade secrets also included program files in the " R" and " C" programming languages (" R/C files" ) that are not algorithms themselves, but are used to test and optimize an algorithm's effectiveness.
While working at Company A and then Citadel, Pu illegally copied files that were trade secrets belonging to each company and transferred the files to personal electronic storage devices. Specifically, he copied Files 1 and 2 from Company A's HFT platform and infrastructure source code. Pu copied Files 3-9 of alpha and alpha term data owned by Citadel. Files 3-6 were alpha data owned by Citadel. Files 3-4 also included alpha term data. Files 7-9 were R/C files owned by Citadel. Suspicious of the activity on Pu's work computer, Citadel questioned Pu and conducted an internal investigation to figure out the extent of the data breach related to Pu's criminal activity.
The grand jury charged Pu with nine counts of wire fraud, 18 U.S.C. § 1343, four counts of unlawful transmission of trade secrets, 18 U.S.C. § 1832(a)(2), six counts of unlawful possession of trade secrets, 18 U.S.C. § 1832(a)(3), three counts of unauthorized access of a protected computer, 18 U.S.C. § 1030(a)(2)(C), and one count of obstruction of justice, 18 U.S.C. § 1519. Pursuant to a written plea agreement, Pu pleaded guilty to one count of unlawful possession of a trade secret belonging to Company A and one count of unlawful transmission of a trade secret belonging to Citadel.
At sentencing, the district court adopted the Presentence Investigation Report (" PSR" ) and its findings for sentencing purposes. The parties agreed, and the district court found, that there was no actual monetary loss. Pu objected to the PSR's loss calculation with respect to the intended loss amount arguing that there was no intended loss. However, the district court disagreed. Relying on the government's calculation and the findings in the PSR, the district court found that total development costs of the algorithms or source code was the appropriate metric to value the files Pu stole. From the evidence, the district court concluded that Files 1 and 2 cost Company A $2,192,250 to develop and Files 3-9 cost Citadel $10,102,647 to develop. Ten million dollars was attributed to Files 3-6 and $102,647 was attributed to Files 7-9. These figures essentially represent how much money the companies paid their respective employees to develop the algorithms or source code, excluding overhead. The district court added these totals and found that the intended loss amount was $12,294,897.
In calculating Pu's advisory guidelines sentence under U.S.S.G. § 2B1.1 (2014), the district court determined that Pu's base offense level was a six. The court imposed a two-level increase for each of the following: (a) use of a specialized skill, (b) sophisticated means, and (c) obstruction of justice. This brought his offense level to 12. As stated above, the district court found that the government had met its burden to prove intended loss and held that the combined intended loss to both victims was approximately $12,000,000.
This loss calculation resulted in an additional twenty-level increase. After factoring in a two-level decrease for acceptance of responsibility and one-level decrease for a timely guilty plea, the sentencing judge reduced Pu's offense level to 29. Because he has a criminal history category I, his guideline-recommended sentence was 87-108 months.
While examining the sentencing factors under 18 U.S.C. § 3553, the district court found that although there was evidence that hinted that Pu had a larger scheme to use the stolen files, the only criminal conduct here that was proven was that Pu copied the files onto his personal electronic storage device, and the government had not presented sufficient evidence of a greater plan than what Pu actually achieved. Noting Pu's youth, his family ties, and his lack of prior criminal history, and balancing this information with the seriousness of the crime, the district court determined that the guidelines sentence overstated the seriousness of the offense and departed downward, sentencing Pu to 36 months' incarceration. The district court also sentenced Pu to three years of supervised release.
The district court found that although there was no actual loss for guidelines purposes, Citadel incurred an actual loss for restitution purposes. Citadel spent money on computer forensic analysts and attorneys during its internal investigation after the initial discovery of Pu's criminal activity, which is recoverable as restitution. Because Citadel also has ongoing civil litigation against Pu and the lack of detail in the government's letter from Citadel regarding restitution, Pu argued that Citadel had included in its restitution figure analysts and attorneys' fees associated with the civil litigation and objected to the restitution figure. The district court overruled the objection, relying on a letter from Citadel that stated that the restitution amount requested did " not include the amount that Citadel paid other outside legal counsel to represent Citadel ...