Google AI trade secret case: the logs held, intent didn't

On August 20, U.S. District Judge Vince Chhabria threw out seven economic espionage convictions against former Google engineer Linwei Ding, ruling there was insufficient evidence Ding intended or knew his conduct would benefit the Chinese government. Seven trade secret theft convictions stood. That split is the lesson for anyone running a software business: the charges that depended on proving what someone was thinking collapsed, and the charges that depended on proving what files moved did not.

What actually happened

Ding was convicted in January 2026 after an 11-day trial on all fourteen counts. Prosecutors said he took confidential material about the hardware infrastructure and software platform Google uses to train large models in its supercomputing data centers. Chhabria's ruling, reported by Reuters, left the theft convictions intact and vacated the espionage counts, each of which carried up to 15 years and a $5 million fine. Sentencing is set for September 1. The Justice Department and Google did not immediately comment.

The exfiltration method is the part worth studying. According to the Justice Department's case, between May 2022 and December 2023 Ding copied more than 1,000 files containing over 2,000 pages of confidential material — not by attaching them to email, but by pasting the contents into Apple Notes on his Google-issued MacBook, converting the notes to PDF, and uploading those PDFs to his personal Google Cloud account from inside Google's network. The format shift is what bought him time. Meanwhile, as The Register reported, another employee scanned Ding's badge at a U.S. office in December 2023 while he was in China.

Why insider data loss matters for your business

Content-matching DLP loses to a copy-paste. Most data loss prevention rules fingerprint documents and watch for those fingerprints leaving. Paste the text into a notes app and export a PDF and the fingerprint is gone — same information, new container. If your controls only inspect content, budget for the case where the content arrives in a shape you never trained on. Egress volume and destination are harder to disguise than file contents.

Correlate identity signals across systems. A badge swipe in one country and a login from another is not a subtle tell, and it is the kind of thing nobody catches because badge data lives with facilities and login data lives with IT. You do not need a security operations center to do this. You need the two logs in one place and one query that runs weekly.

Eighteen months is the number to react to. The activity ran from May 2022 to December 2023. Nothing about the method was sophisticated. What made it work was duration — no periodic review of what a single engineer was uploading to personal cloud accounts from the corporate network. For a small studio, the equivalent review is an hour a quarter.

Offboarding is evidence, not paperwork. The counts that survived were the ones supported by records of what left and when. If a contractor walks off with your client's schema and your architecture docs, the difference between a demand letter and a lawsuit you can win is whether you can produce access logs, a signed confidentiality agreement, and proof you revoked credentials on a specific date. Treat that trail as a deliverable of every engagement, not a thing you assemble after something goes wrong.

Sources: Reuters via Investing.com, U.S. Department of Justice, The Register.