A Chinese computer programmer on Tuesday pleaded guilty to stealing software code from the Federal Reserve Bank of New York in a case that raised cyber-security concerns when he was arrested five months ago.
Bo Zhang, 33, admitted last August that he illegally copied the software code to an external hard drive and took it home. The FBI questioned him when he admitted the theft but did not arrest him until January.
Congressional investigators became concerned that the New York Fed was vulnerable to cyber attacks after the arrest.
Zhang has been cooperating and has been free on bail and prosecutors have recommended that he be sentenced to no more than 1-to-1-1/2 years in prison. He faces deportation after he serves his prison sentence.
Instead of prosecuting Zhang under trade secrets or computer fraud and abuse statutes, U.S. authorities charged him with theft of government property.
The New York Federal Reserve was given the task of moving the Government Wide Accounting program, developed to help track the billions of dollars the United States government transfers daily, from an antiquated IBM mainframe computer to the Internet, according to a person familiar with the project.
Zhang was hired in May 2011 as a contractor to help with the project. Three months later, he copied part of the software code for the Treasury program onto a New York Fed-owned portable drive, took it home and made more copies of it, according to the criminal complaint.
A month later, Zhang told a colleague he had lost one of the drives holding the code and the bank's officials alerted the FBI, the complaint said.
When FBI investigators questioned Zhang on Aug. 11, Zhang admitted taking the code "for private use and in order to ensure that it was available to him in the event that he lost his job," the complaint said.
Details about how the Fed came to hire Zhang and whether he was subject to any kind of security clearance are unclear. The New York Fed, unlike federal agencies, has no obligation to reveal how it hires outside contractors.
A spokesman for the New York Fed declined to discuss how it conducts background checks or what systems it has in place to prevent theft. The spokesman did say that security checks were strengthened after Zhang stole the software, but declined to give details.
Along with the FBI, the inspector general for the Treasury Department has reviewed the alleged theft. The incident also drew scrutiny from two Congressional panels, according to documents reviewed by Reuters. A spokesman for the Treasury's inspector general declined comment on the inquiry.
The Congressional panels — the House Financial Services Committee and Senate Banking Committee — contacted the Federal Reserve in Washington after committee members read about the arrest in news reports, according to Treasury and Federal Reserve email correspondence. Spokesmen for both committees declined to comment.
Zhang also pleaded guilty to one charge of immigration fraud. He is currently free on $200,000 bail and is due to be sentenced on October 1.
According to an April plea agreement with Zhang, prosecutors recommended he be sentenced to one to 1-1/2 years in prison, much less than the potential 10-year maximum term the theft charge carries.
The case is USA v. Bo Zhang, U.S. District Court for the Southern District of New York, No. 12-0390.
Additional reporting by Emily Flitter and Carrick Mollenkamp.