Slashdot Mirror
Programmer Admits Stealing US Gov't Accounting Software Source Code
An anonymous reader writes with this excerpt from NetSecurity.org: "A Chinese computer programmer that was charged with stealing the source code of software developed by the U.S. Treasury Department pleaded guilty to the charge on Tuesday. The 33-year-old Bo Zhang, legally employed by a U.S. consulting firm contracted by the Federal Reserve Bank of New York, admitted that he took advantage of the access he had to the Government-wide Accounting and Reporting Program (GWA) in order to copy the code onto an external hard disk and take it home." Just such things make me think that the default setting for software created with public money should be released with source code anyhow, barring context-specific reasons that it shouldn't be.
Just such things make me think that the default setting for software created with public money should be released with source code anyhow, barring context-specific reasons that it shouldn't be.
So that countries who have not spent money can use it for free?
if NON_DISCRET_SPENDING => WASTE
HIDE;
else
PROMOTE;
end
I swear they give me mod points to shut me up.
The ownership of the code can often get a little muddied, as the company who is paid to develop it may use their own funds at times too--or extend an existing product the company has for the government's needs--meaning some of it is proprietary and privately funded. This is why most such software is available for use within the government, but the private company maintains rights to continue to develop and sell it commercially as well.
A Chinese national who used to work at my company lifted our proprietary code and fled back to China as well.
US Govt accounting methods should be considered economic weapons of mass destruction. Also: First Post!
Not to sell the code afterwards but to keep at home so I can save some code patterns and ideas for future use.
The idea of "stealing" government information would normally be nonsensical but if the guy is Chinese I suppose a weird (but valid) argument could be made that he is not part of the public that paid for it. If you or I ask for the source code, it should either be supplied to us or else we should get a tax refund. This guy? Technically no; he has no claim.
What's really fucked up is the dollar amount. Everybody immediately knows massive fraud or incompetence has happened. That's embarrassing and just because US currently has no conservative parties, that doesn't mean it never will, so it could some day possibly become a political issue. If I worked in that department, I too would feel constant unease and shallowly-submerged yet intensely burning desire to mete our severe punishment against anyone who does anything to attract public attention to this system's existence. Who is to say (for sure) that a Congress couldn't be elected in 2014 that takes away your cushy taxpayer-funded job? Anyone related to this project who gets into the news needs to be skinned and burned alive.
You are not the "owner" of the NASA space shuttle either. (or the code that runs it). Just because you paid money to allow a government department to function doesn't mean you own them.
give him life and tell your lucky not to get the death penalty for treason
If you're going to steal something from the United States, I'd think it would be much better to steal something that works well!
I am officially gone from
Normally, works of the US federal government are in the public domain, and not protected by copyright. How is this not the case here?
On another note, Slashdot editors, please stop using the word "stealing" for immaterial right infringements.
This is about tax and accounting software.
Do you really think anyone would want to steal that? It is probably of no use at all except to those that pay taxes in america...
Given the way our government seems to run its accounts, perhaps we should hope that all potential competitors / adversaries steal it.
So is he Chinese as in decent, or Chinese as in citizen of China? Those are two very very different things. Even though the code may not be classified I'm typically against having non US citizens working on US funded code bases. This seems like a security and political issue to me. Though the code may not be classified it is likely subject to the same rigid standards that classified code is subject to. This seems like giving out too much information about how the US government requires code to be developed to a foreign body. I don't like it and politically I like it even less. When the government is outsourcing, even by proxy, it makes this country look like a bunch of morons who can't do anything themselves. We have out of work developers right here. Typically I have no problem whatsoever with using products from other countries. This country was founded on a principle that immigration and diversification make a wide open place where anyone on Earth is welcome. I do like that a lot, but national security is national security even when its something as small and seemingly meaningless as this.
Do you really think anyone would want to steal that?
Do you really think no-one would? What if there's a vulnerability in there that could send the entire tumbling down? I'm sure no foreign power would be interested in that.
systemd is Roko's Basilisk.
Bo went too far with his own bravado, he should have chosen a different alias. He also seems to have misunderstood his lawyer's advice when he was told: "Bo, you don't know Diddley!" and went ahead and pleaded guilty. Bo, you're a schmo!
since a Government employee can use Office in the course of their job affecting you would that mean that Microsoft must provide the source for viewing?
At what level would we set a limit? As the person you replied stated, most times government contracts are for making minor changes, many soft coded at that, to adapt existing proprietary software to the customer's needs.
I would agree with software created expressly for the government, as in it was the original customer.
* Winners compare their achievements to their goals, losers compare theirs to that of others.
Think about if all this software you claim should be open source. Let's see: software NASA develops, software for our military systems, satellites, infrastructure, etc. Yeah, let's make it open so everyone in the world can copy it for free. What are you thinking?
... it was written in Ada, so nobody knows what to do with it anyway.
Slightly disreputable, albeit gregarious
So he risked 10 years in jail just for bedtime reading? Seems improbable. And seems likely he will jump bail and pull another Charlie Trie.
GREAT! Now release the code so we can finally understand HOW TO DO OUR TAXES. :D
Obviously....
Not quite. It's true that a work of a U.S. federal government employee, performed as part of their official duties, cannot normally have copyright in the U.S. HOWEVER... most software developed for the government is developed by contractors, at least in part, and those parts DO have a copyright. (There are even a few exceptions for government employees, but they practically never apply.) Also, the term "public domain" has multiple meanings, presumably you mean public domain in the copyright sense (not the export control sense, which is different).
To see when contractors or the U.S. government can currently release software as OSS, see Publicly Releasing Open Source Software Developed for the U.S. Government by David A. Wheeler (me), Journal of Software Technology, February 2011. That's the current state of affairs.
I agree with the poster above: When "we the people" pay for software, then by default "we the people" should get it. I even posted an entry about that in 2010. Sure, there need to be exceptions, but they should be exceptions; it's not obvious why accounting software developed by the government is treated this way! I also agree that we should use clearer terms like intellectual rights (and intellectual works) - not "intellectual property" - because "intellectual property" is a fundamentally misleading term.
- David A. Wheeler (see my Secure Programming HOWTO)
Should the public also have keys to the government offices? The reasoning around here being if we paid with our tax dollars for the software, we should get the source code. Should we also get all the keys to all the doors? Or should we just not have locks on the doors to the gov't buildings?
Hey, my taxes pay for that building, I should be able to nap on the Oval Office couches any time I want!
Ummm - am I the only one that would wonder why anybody would want this?
I can't imagine why? In cases like tax info, it's the data that's valuable, not the over-engineered lovecraftian spreadsheet that are the tax calculations.
I quite agree w/ this. In fact, despite my general disagreement w/ the GPL, this is one of those rare cases where I think GPLv3 is useful: the original software written, since it's done for the US taxpayer, should be public domain, and any modifications made to it should be available under the same T&C. That way, businesses normally wouldn't want to touch it and taxpayers wouldn't be subsidizing free work for them, any improvements made to it will be publicly viewable, and so on. IRS written software would be one of the best examples of what should be GPL'ed.
If other countries or entities then want to use it, they can, but any changes they make would have to be made available. Which can then be determined whether it's useful to its original creators and included in the main branch. Same goes for other individuals or organizations doing it.
Only exception to the above rule is if the government software in question is needed to work on classified information, or for things like the military, in which case, secrecy is important. In such cases, a good idea would be to have such software w/ source code under limited distribution, so that it doesn't fall into the hands of enemies.
The Federal Reserve is actually a public-private corporation that happens to do some important Treasury-related functions. They're not an actual federal agency like the US Mint.
Yeah. I am sure that somebody that wants to attack the west would never be interested in getting access to our software. I mean how useful would it be for China to see where we are spending money at (note that this was about REPORTING) or being able to change the numbers so as to cause chaos within the gov. Likewise, they would never want to control our utilities, our transportation, etc.
I prefer the "u" in honour as it seems to be missing these days.
You'll see that the main reason they went after him was because he took the source code in order to use it for his personal profit, and it hadn't gone through the proper channels to make it public-ready. In other words, what he did with the accounting software was roughly equivalent to taking classified missile control software home in order to either start a competing business or use it to help his current one. Technically, the software is "public domain," but the Federal Reserve had not actually gone through the process of making it ready to be released to the public.
I have no problem with him doing a few years for that because what he did is no different than taking a work-for-hire work home to use for a customer who didn't pay for it nor was authorized by the paying customer to have it. That's for-profit copyright violation in the private sector, and since he intended to derive private benefits from it, I don't see much of a difference. It's not like he took it home, modified it to be attractive to the Department of the Treasury and tried to demo it to another part of the government (since the Federal Reserve is a quasi-federal agency, taking their code to show to the Treasury would have been less legally problematic)
The Federal Reserve Bank of New York is private bank, with special privaleges from the government. It is not part of of the government.
https://en.wikipedia.org/wiki/The_Federal_Reserve_Bank_of_New_York
"US Government Accounting".
Have gnu, will travel.
He said to the FBI that he did so that the code would be available to him in the event of losing his job, and to use it for his private business, which is teaching computer programming.
How much involvement did he have with the code? Meaning how much of it did he write?
Even in a complex system, a hands on developer should know enough of the concepts that they could mock up something for later. Not necessarily a functioning application, but pseudo-coding at a high level to re-evaluate later.
Seriously, if someone is teaching computer programming, how much specifics are you going into? You don't need the line by line, but the concepts.
Well maybe if you are teaching how to debug large scale code, I could see the need to have a library.
Maybe he is an example of the old joke, "those who can't, teach." I'm not a fan of the joke as it was good teachers who helped me to hone my analysis skills.
But for security reasons there are some good things about closed source.
Lets be real here, we're talking about root financial systems. Neither individuals nor most corporations have any interest in this software. This is the prevue of nations and huge trade alliances.
Keeping the code secret makes it more secure. Yes, it can't be used as the only level of security. It must be on TOP of everything else. I don't think giving the chinese access to our treasury accounting software is going to make the world a better place.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
I can't believe the comments I'm reading here. The crime, as I understand it, is that a Chinese citizen used his trusted access to US government goods to STEAL US government goods. I don't care what it is...if he stole staples, it's still stealing.
The comments here all seem to think that, simply because the US government paid for the code at some point *then* everyone in the world should have access to that code. Surely you're joking, right?
He said to the FBI that he did so that the code would be available to him in the event of losing his job, and to use it for his private business, which is teaching computer programming.
So, as I understand it, his defense is that he stole the code for his own commercial use. He admits to stealing code "for his own commercial use". I put the second half in quote, because we have no proof as to his ultimate intentions. He could have been planning to bring that code back to China with him and share it with the Chinese government in a private, espionage sense. It doesn't matter if the code is the most boring, useless code...it's still US government property. Even if all US government property is "US public property" - you still have to be a US citizen to legally lay use to that property in any legal way. What he did was illegal and highly suspicious.
PS: I don't reply to ACs.
That's a good point. As a minor point of clarification, the Board of Governors in DC is part of the Federal Government (an agency within the US Treasury), whereas the reserve banks and branches are public-private corporations, as described. Since this happened at the New York reserve bank, your comment applies. I just wanted pipe up with that minor distinction.
This space intentionally left blank.
Software is acquired from a contractor, so the Federal Acquisition Rules and various tailored versions, e.g., DFARS, apply. It is not developed by the USG, unless specifically talking about something that a USG civilian employee (__not__ a contractor) authored.
The government purchases systems, writes contracts to acquire systems. Source code is considered data -- so the applicable FARS and DFARS are technical rights to data. Data rights are negotiated separately from software (system) rights and source code is delivered as part of a separate contract deliverable requirement list (CDRL) item, if the source code is even delivered. In 99.999% of contracts I've seen, source code is never delivered and when it is delivered, the most restrictive data rights are applied.
A lot, though, is changing through the DoD's Open Architecture initiatives (formerly the Navy's Open Architecture Program). Source code is expected to be delivered as a CDRL item with unrestricted rights as the default. And it turns out that the GPL is a version of a unrestricted license (I know because I spent a week with the SFLC and a Navy IP attorney collecting the information), so there's some hope on the horizon.
Bad news for those of you hoping to get a major weapons system's source code: The USG is the owner of the conveyed executable, so only the USG gets the source code.
"Bo Zhang .. said .. he did so that the code would be available to him in the event of losing his job, and to use it for his private business, which is teaching computer programming".
...
'The software in question keeps track of money exchanged between US government agencies and, according to the authorities, its development cost nearly $10 millionsM`.
This is, of course, bullShit
AccountKiller
(too late, I suspect), but the first thing that came to mind while reading TFS are all the tech companies yet again whining for even more work visas because they just can't find 'good enough' US citizens. 'Good enough' being a working definition for mole, nationalist, or just straight-up thief. But hey, they work hard and cheap (discounting the rather negative ROI of IP theft).
Is that "public domain" in the US doesn't mean "available to the public".
Who knew?
To have a right to do a thing is not at all the same as to be right in doing it
Stop sticking your fucking opinion in the posts and shut the fuck up.
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.