Nishad Singh wasn't some low-level coder. He was FTX's Director of Engineering.

> "Hey, due to the way our accounting works I need you to subtract X from our dashboard."

That is not what happened here. The fact alone that very few people knew about Alameda's special treatment, and, importantly, deliberately conspired to keep that treatment secret is a pretty strong indicator that he knew it was wrong.

Director of engineering != product manager in charge of deciding what features to include. If somebody tells engineering, “we will not use this feature illegally,” then it’s the fault of the higher ups who are possibly (?) trying to scapegoat somebody to protect themselves

"I was just following orders" went out of style in 1946. Software engineers are not mindless drones.

Directors have specific, well defined legal duties to their company which includes a duty of fiduciary responsibility. That is why they're directors rather than "head of product" or "VP of marketing" or whatever other meaningless title people bestow on themselves. Saying "my boss told me to do it so it is not my fault" is nonsense because you have no boss beyond your shareholders.

That's Director as in Board of Directors. In this case, "Director of Engineering" probably just means "Manager of managers of engineers".

Holding the title "director of X" doesn't mean you're necessarily on the board of directors.

in fact, the two are probably anti-correlated

Isn't VP usually a higher title than director?

(Well, it's not in finance, but it could be in tech-like crypto finance.)

I have been working in finance my whole life.

A senior developer of anything in this area would be expected to fully understand the risk implications of this. I have written the code to closeout positions automatically multiple times in multiple jobs.

It may have been possible someone directed a junior developer to make this change, but then it would be a case of hunting down who told them. If that happened in my team I'd be documenting everything I saw and running, not walking, not walking briskly, out the door.

This said, nothing is black and white. For example, due to immature processes, they might have told the developer that the main account was only one of many accounts they can call on, but the code only allows for one, so we have to make an exception. I'd still be freaking out.

If Jamie Dimon asked a developer at the bank "hey can you have Chase ATMs allow these 10 accounts that are in my name to withdraw unlimited funds?" everyone involved would be in jail.

This is not dissimilar.

"For testing purposes, these 10 account numbers should be allowed to remove cash from any of our ATMs. The testers will put the money back." It doesn't sound that nefarious. If you told me this is how ATMs are currently being tested in the industry, I wouldn't be able to contradict you.

"In production, boss?" I don't think so.

That is very nefarious. You can cancel ATM fees but withdrawing unlimited money?

Just deposit the money before withdrawing it.

...A bench test of an ATM probably doesn't involve real money. No one in finance is stupid enough to use real money on production environments for testing purposes.

There is test... And there is PROD. Never do the two meet. Ever.

If someone out there does, please make yourself known so we can get the investigators over there ASAP.

Huh? You're telling me that you think they never test ATMs in prod? That's ridiculous.

You think they're just guessing that the test environment perfectly matches the prod environment?

You can test in production if you have multi-tenancy aware services, where tenancy is some string value like Foo to make sure reads to Foo can only read data that was written to Foo.

That's not testing in production, that's just the same as saying your test VMWare environment is in the same datacentre as your prod VMWare environment.

>If Jamie Dimon asked a developer at the bank "hey can you have Chase ATMs allow these 10 accounts that are in my name to withdraw unlimited funds?" everyone involved would be in jail.

This isn't true

I worked for a large bank. I managed data for their mortgages. We bought another bank and processed their mortgages with our systems. There were several thousand accounts that we called "friends of the <former CEO>" because they had really weird terms.

A noteworthy example is: $10m Home Equity loan, with 2% interest for 40 years, and the owner could refinance any anytime without any fees

In English, this means we can't repossess their loan, they pay a super low monthly payment, and the final amount is never really due.

I fail to see the equivalence. These are just loans with weirdly favorable terms. If the other bank had shareholders, then this would be a breach of the fiduciary duty. Otherwise it's just bad business? Bad business != fraud.

Isn't it fraud if you're telling you're customers you don't and can't do this?

I'm not sure why would that be fraud - who would be the defrauded party there? Offering wildly different conditions or prices to different customers definitely isn't fraud.

The other customers have no standing there, they have no relationship whatsoever that contract between the bank and another customer, they have no legal expectation to get the same conditions or to know what conditions other customers get. If the bank explicitly and intentionally lied that no other customers get so favorable conditions, that might be false advertising but I'm not sure, I'd expect a reasonable court to interpret that a bank "telling your customers you don't and can't do this" is exaggeration/puffery (i.e. permissible) and doesn't have to literally mean that they're not doing that for anyone, it means that they absolutely refuse to do it for you.

No.

A car salesman telling you they can't sell you the new Buick for $42,000, when they sold one to their neighbor yesterday for $41,000 is not fraud.

Yeah but if the salesman told you it's a brand new Buick never been driven that they've actually been lending out to friends and driving around?

In english it means the terms are 40 years to repay the loan at a 2% rate. Not sure how that translates to never really due.

I’m assuming the poster meant refinance with the same terms. So the borrower can get another 40 years to pay back the remaining balance anytime they like.

You're right. I believe the technical term is "recast" where you take all of the outstanding balance and spread it over the course of "the next 40 years" with the same interest rate.

Another fact I omitted is that the interest rate is 2%, but the minimum payment is lower. So the borrower is accumulating owed balance because they are paying less than interesting accruing.

Given the market of the last couple of years they may actually have been able to re-finance that loan with a different bank and gotten better terms. 40 years is a long time.

> and the final amount is never really due.

Yeah??

$10M ona 40 year term and a 2% rate is like $30k/mo in payments. I wouldn't say most people would think of $30k a month a super low payment.

And now that the bank has new ownership they might be able to refinance again and continue to kick the can down the road, but they're less likely to get as favorable of terms I'd imagine.

Your math is right. I forgot to mention than the minimum payment might be less than the interest rate.

And the technical term for the type of refinance is "recast" (iirc) - so the "new bank" honors the terms because it is a part of the originating documents.

Developers need to know the business better than the business people. Always. Otherwise you can't implement the software very well.

Isn't it completely unscalable? I work for a big automaker, there's literally people whose only job is to be compliant and inform the necessary leads about it. There's hundreds of countries, each with very specific things. If I study everything, I can't code.

When knowledge arrives at my team, is already condensed to the point of: "in X country, you must tell the prices of a call if you show a phone number for assistance"

Why should I explore every loophole of law to be compliant? That's the companies job, not mine.

For some reason, I've seen a lot of people try to make arguments around FTX that completely miss the scale and malfeasance that occurred. This wasn't a case of "oh, you got some esoteric GAAP depreciation rule wrong". This was an engineering leader putting a ton of special cases in the code saying "For our most beloved partner, none of the rules apply, including letting them take unlimited amounts of customer funds. Oh, and be sure to hide this from the dashboards the rest of the company uses."

This is not hard. Nobody needs to be versed in the ins-and-outs of jurisdictional compliance rules to see this was blatant and egregious.

If any of this looks remotely familiar to any software devs out there, you should really re-examine your morals. Or at least hire a lawyer.

The thing is, the comment I'm answering, is not about FTX. I'm not talking about FTX. The user was making a very broad statement based on this case.

Down to the trivia level for an entire global company, sure, but this is a lot more general and bigger. Like if you have rules against accepting gifts from vendors, maybe you don’t remember if the threshold is $10 or $15, but you shouldn’t need to ask to know it’s not $30k in a suitcase.

Probably yes. What about the Volkswagen diesel emissions cheating that was approved and implemented by engineers?

It also might depend on seniority so you might not be on the hook.

I would say no. They just need to know how to implement what they are asked to implement.

Say you are an engineer working for a gun manufacturer. You need to know how to manufacture the gun. You don't need to know what it is used for or by whom or even how much it is sold for.

If you are aware that a crime is going on you in principle are required to report it, but not doing so is not nearly at the same level of crime as actually doing the crime. So here I think the court will look at two things?

Did the engineer know that a crime was being committed?

Did the engineer personally benefit from the proceeds of the crime more than their ordinary salary?

I am not a lawyer though so don't take my advise.:-)

That is a very bad analogy. Guns are not illegal, what people do with them might be. What these developers made had no lawful use. A better analogy would be if some engineers in a gun factory were making chemical weapons.

There are laws against chemical weapons but I don't think there are laws against producing any kind of software. It's more what you do with the software. Whereas with chemical weapons they are criminalized as such because it is clear they can be used only for one purpose.

What about the laws against helping or enabling criminal activities? There is no need to mention software specifically.

True, depends on the facts of the case.

I’m sorry, what?

That's why I'm getting a MBA.

That's a nice little fantasy. In the real world, competent developers with that level of domain knowledge mostly don't exist at any price. In the healthcare field where I work, not many developers have ever gone to medical school.

would you program the software to allow your friend to obtain drugs from the hospital without deducting it from inventory so nobody would notice?

Different scenarios are different.

But not that different.

You're telling me a software engineer could make a change that allowed spending money a company could not legally spend and he had no idea about it? Come on. That is preposterous. At any respectable company alarm bells would be going off everywhere and fingers would all start pointing to that change. Theres virtually 0 chance that there was not intent.

i worked for a fintech startup in a similar space:

> Are programmers expected to know finance law?

in our case, we were. it was drilled in, and tested, reviewed, and audited. i’m not saying that something like this couldn’t have happened, but in my case anyone who would have been involved would definitely have known the legality.

Most companies in financial services require training around compliance topics such as AML.

If you are trading or working with customer money, you usually have to take the Series 7 exam.

So I would say for regulated industries, programmers are expected to know some degree of financial law.

Developers should know to ask questions when a weird request is made.

Developers presumably know how to think and have a vague idea of what the business does to know that a ask to futz with internal financials programmatically is fucking wierd.

IME, it depends on your chain of command. I've literally been reprimanded in my career for asking questions. My boss at that time was crap. I didn't choose him. Asking questions can very likely get you fired.

Also got reprimanded for disobeying an order at once; my boss — same one as above — would not take "no, we are in a regulated industry, and I cannot do that" for an answer. I ended up going behind his back, getting the approvals he should have gotten himself, and once I'd secured those, granted him the access he wanted. I also tried to escalate to his boss (my grand-boss) … but he didn't respond until it was all moot.

But there is a lot of stress when you're fearing for your job, even though you're just trying to do things by the book. I'm inclined to side with engineers, to a degree: the chain of command's responsibility is to never put eng in that position. (Although here, the eng in question seems far higher up than I am. I'm just a bottom rung eng…)

> Developers presumably know how to think and have a vague idea of what the business does to know that a ask to futz with internal financials programmatically is fucking wierd.

They should but IME they often don't, and even if they do, people are lazy. It's a struggle to get people to do the things they should do some days.

I'm in an industry with a lot of migrant workers, I was asked to write software that would change the time records for migrant workers so they never get overtime.

I said I wouldn't do it unless they showed me the legal advise saying that it was ok. The office sycophant piped up and said "I'll do it". From then on I stopped being invited to meetings and my job transitioned into answering the phone and then out the door.

I hope they jail the developers for 500 years, that's the sort of signal that needs to be sent.

(especially) if you have left this business you should blow the whistle on this. Have you thought about doing it? What are the main barriers?

They probably weren't paying taxes on the overtime either. The IRS pays whistleblowers.

Being fired for asking questions handily beats going to jail for not asking questions.

You want Engineer in your job title? Then you say no, and you damned well ask questions, and you damned well make sure to leave the moment they make it impossible for you to act ethically.

This sounds great on paper. However, the reason "Engineer" matters is because regulation requires it. If my company is required to get a sign off from an Engineer before software is updated, then you can be 100% sure those who are qualified to sign off take their title seriously. Until then, it is just a fancy title.

My impression is that this title comes from the practice of "software engineering", not necessarily that the practitioners are licensed Engineers.

This should apply to anyone. IMO engineers aren't special. As a human you should try not to fuck over other people.

I assume this is a reference to other engineering disciplines, where an engineer signing off on something has real meaning.

Right, "software engineer" is often used just as a synonym for "Programmer". That's just how the industry is, currently.

There are no regulations as to who can develop what software as far as I know. Whereas there are for who can design a bridge, act as your lawyer, or prescribe you medicine.

Yes and when we as software engineers / programmers act as if we don‘t care we should not be surprised if software engineering / programming gets regulated, too.

Right

People gatekeeping the word “engineer” is a bit annoying, since the word “engineer” dates to at least 1380 and originally just means someone who works on engines. “Engineer” as a legally super special class of job is a thing that came much later and only ever applied to certain jurisdictions anyway.

“Software engineer” is just a synonym for “programmer”, in the actually existing practice of the English language.

And 'doctor' means someone with a PhD. I know a lot of doctors. However, when you talk about medicine, we mean 'Doctor' with an M.D. and they are literally held to higher standards of ethics and liability. They are licensed and people who practice professionally without a license are subject to legal ramifications.

Call yourself whatever you want, but that doesn't mean you get to define what 'Engineers' are and what ethics they are bound to. Just because you use the term in your title and say it is used properly in English, doesn't mean that you won't get treated any different than someone with a PhD demanding to be called Doctor and pretending there is no difference between them an and M.D.

Of course the word “doctor” means different things, just like “engineer”. The OP is the one who was trying to conflate them. It’s like if you told someone with a PhD in CS “if you want to be called ‘doctor’, you had better be able to heal sick people”.

In Denmark you need to hold a degree of engineering for you to call you an engineer of any kind. It's a protected term. As I remember, in the US it is not protected and anyone can call themselves engineers.

It varies by state.

Ignorance of the law is never an excuse if you are found to be breaking the law. So if you think what you are doing is possibly in violation of the law you better bone up or ask a lawyer for a statement on letterhead that what you are doing is ok.

> Ignorance of the law is never an excuse if you are found to be breaking the law.

That’s true, but ignorance of the facts often can be. “I didn’t know I was doing X” rather than “I didn’t know X was illegal”.

For C-level execs that is probably not going to work, but for people lower on the totem pole it may well give at least some relief. You might end up convicted anyway but with a more lenient sentence if the argument is considered believable.

So every dev needs to also be an expert lawyer and financier??? OK.

There are blatantly illegal things you can do in any field of work. You need to be aware of what is and isn't within the law on a loose basis yes. Even labourers on a building site have to do some training to avoid breaching health and safety legislation (or at least to minimise the companies liability when they error).

You also need to have faith in the compliance team and senior management. If your company works in legally sticky territory like crypto doubly so.

If you are in finance or law it is a good idea to know what you can go to jail for. Engineers are people and people can go to jail for breaking laws they didn’t know about.

If you work in a company where there is no one that has some idea about the laws that apply to what you do that you could check with, you would be a little concerned.

Propably not, but a solid understanding of the rules and regulations, and legal requirements, of your field and thebindustry your working in is actually a pretty good thing.

No, not every dev.

If you want to write code for a financial institution? You bet you should be expected to know what you are doing, and understand there are relevant laws, and also not violate those laws. It's not hard. I know the relevant laws to my domain of job.

I don't know about finance but for HIPAA and CCPA, the answer is yes. Is there an accounting equivalent to the yearly, mandatory 20 minute compliance training videos?

Yes, in US fintech there are mandatory courses in anti-money laundering and know your customer laws that programmers are required to take along with everyone else.

I don’t know what exists in the crypto world operating in the Bahamas, but I’m not going to lose a lot of sleep if the FTX director of engineering winds up going to prison for this.

>> Are programmers expected to know finance law?

https://adage.com/article/marketing-news-strategy/tom-brady-...

I'm surprised that even Football players are being expected to have evaluated the company's legitimacy, which seems unreasonable.

Interesting article! So Brady took "an equity stake in the company and [got] a signing bonus in crypto", then went on to make advertisements even though "The NFL has banned cryptocurrency and NFT sponsorships for its teams". Seems that he, or likely his lawyer and/or financial adviser, will have been evaluated the legitimacy since he's deep into caveat emptor territory. Like innocently buying a stolen car: you're unlikely to be in legal peril but you will lose the car (and gain a claim against the thief that sold it to you)

I think it depends a lot on the jurisdiction. In some countries there are laws around ethics and disclosure especially if you work in a certified occupation (i.e. a licensed profession, such as traditional engineering).

Software probably makes things even more hazy but in traditional engineering world there are very clear cut rules around professional ethics, personal liability and disclosure.

This is why Caroline is an important witness for the prosecution. It seems like most of the nefarious stuff occurred in Signal.

> Are programmers expected to know finance law?

Working on fintech and transaction rails? Probably. I had to know regulations when I worked in fintech. Plus, you don't have to know the law to be found guilty of breaking it.

The engineers working on this are innocent until proven guilty, but you'd better believe all internal comms, meeting notes, and commit messages will be scrutinized.

Someone had to ask for the system to behave this way, and that will have produced certain artifacts.

Engineers with knowledge may be cut deals to testify against the bigger players.

> Plus, you don't have to know the law to be found guilty of breaking it.

Precisely, ignorance is never a valid defense.

> The engineers working on this are innocent until proven guilty

I believe in due process [& friendship, too]. But alas for the engineers concerned, SBF does not:

https://www.businessinsider.com/ftx-collapse-bankman-fried-e...

"When asked to clarify whether they were both gone, Bankman-Fried said that Wang was "scared" and Singh was "ashamed and guilty" because FTX customers' deposits had been lost."

Isn't that a strange thing to say? Singh is the guy who made the change, per Reuters, and this snake knew that.