A former Google engineer was charged with stealing trade secrets related to the company’s AI technology while allegedly working with two firms in China. Linwei Ding, a 38-year-old Chinese national, was arrested in Newark, California, and faced four federal counts of trade-secret theft. Each count carried a possible sentence of up to ten years in prison.
The indictment alleged that Ding began transferring confidential information to a personal Google Cloud account in 2021. By 2 May 2023, prosecutors said he had uploaded more than 500 unique files. Ding had joined Google in 2019 to develop software for the company’s supercomputing data centres, giving him access to information at the infrastructure layer of its AI operations.
The Allegations Concern the Foundations of AI Compute
AI competition is often described through model benchmarks, but the systems that train and run models depend on specialised data-centre software and hardware. Knowledge about supercomputing design can reveal how a company coordinates accelerators, networks and storage at scale. Such information may represent years of engineering work even when it is not visible in a consumer product.
That makes infrastructure employees valuable and potentially sensitive insiders. They need sufficient access to build and maintain systems, yet the same privileges can expose large collections of proprietary material. Security cannot remove all access without preventing work. It must identify unusual transfers, limit information to genuine job requirements and ensure that sensitive exports receive scrutiny.
Personal Cloud Transfers Illustrate a Familiar Weak Point
Prosecutors alleged that Ding periodically uploaded files to his personal cloud account over an extended period. This pattern shows why insider risk differs from a dramatic external breach. An authorised employee may use ordinary tools and move information gradually, making each action appear less conspicuous than a single large intrusion.
Controls should therefore consider destination, sensitivity and behaviour over time. A transfer to an unapproved personal account can warrant review even if the individual file is small. Organisations also need clear policies so employees know which services are permitted and what information may leave managed systems. Monitoring is most effective when combined with proportionate access rather than applied as indiscriminate surveillance.
Outside Roles Can Create Undisclosed Conflicts
The indictment said Ding was offered a chief technology officer position at a Chinese AI startup and joined investor meetings for that company. Prosecutors also alleged that he founded and served as CEO of another China-based startup focused on training AI models with supercomputing chips. These relationships would have created a direct conflict with his responsibilities at Google if they occurred as alleged.
Employers need processes for declaring outside work, investment and advisory roles when they overlap with proprietary technology. Disclosure does not automatically prohibit every activity, but it allows conflicts to be assessed before information or loyalties become entangled. Managers must also act on unexplained changes in behaviour rather than treating conflict policies as annual paperwork.
The Case Sits Inside US-China Technology Tensions
US officials presented the charges as evidence of efforts connected to Chinese companies to obtain American innovation. The FBI argued that trade-secret theft can damage employment, the economy and national security. The case therefore became part of a wider contest over AI capability and intellectual property between the United States and China.
Legal allegations should still be separated from proven facts. Ding was charged, and the prosecution would need to establish its case through the judicial process. Nationality does not determine risk, and security programmes should not treat employees as suspicious based on origin. Effective controls focus on access, conflicts and conduct that can be evaluated consistently.
If convicted on all counts, Ding faced a maximum of 40 years in prison and a fine of up to $1 million. Those potential penalties demonstrate the seriousness with which US law treats the alleged theft. They do not restore knowledge once it has been copied, which is why prevention and early detection remain essential.
The case provides a practical lesson for AI companies: model security includes the people and systems around development. Strong external defences are incomplete if sensitive architecture can be moved through an authorised account without timely review. Access logging, approved cloud services, conflict disclosure and offboarding procedures all belong within the same protection strategy.
As AI infrastructure grows more valuable, insider threats will receive greater attention from companies and governments. The appropriate response is disciplined security rather than suspicion directed at broad groups. Organisations should protect their most important knowledge with controls tied to role and behaviour, while preserving fairness and due process for employees. That balance is necessary for both innovation and trust.
The alleged timeline also shows the importance of detecting slow accumulation. More than 500 files were reportedly transferred over roughly two years. Security tools that assess only one event at a time may miss the significance of repeated activity. Aggregating behaviour across weeks and months can reveal a pattern before a departure or external relationship makes it obvious.
Managers need a response process when monitoring produces an alert. An automated block may interrupt legitimate engineering, while ignoring repeated transfers leaves trade secrets exposed. A proportionate review can examine the employee’s role, the files involved and whether an approved business purpose exists.
Companies should also protect knowledge after an employee changes responsibilities or leaves. Access should be reviewed when roles shift, and departures should trigger prompt revocation and confirmation that confidential material remains on managed systems. These controls are ordinary security hygiene, but the value of AI infrastructure makes failures more consequential.
The charges show that economic security and cybersecurity increasingly overlap. The material at issue was not a customer password database or ransomware target; it was engineering knowledge that could accelerate a competitor. Protecting AI therefore means defending intellectual capital as carefully as operational systems.
