Ex-Google Engineer Convicted of Economic Espionage and AI Trade Secret Theft
A U.S. federal jury convicted former Google engineer Linwei Ding (aka Leon Ding) on 14 counts spanning economic espionage and theft of trade secrets after prosecutors said he stole thousands of confidential Google documents tied to the company’s artificial intelligence technology for the benefit of a China-based startup. The U.S. Department of Justice framed the case as protection of U.S. intellectual property and national security, alleging the theft was intended to advantage the People’s Republic of China (PRC).
Reporting indicates Ding began exfiltrating internal materials as early as May 2022, including by copying content into the Apple Notes app, converting it to PDFs, and uploading it to a personal cloud account. The stolen information reportedly covered sensitive AI infrastructure and chip-related technology, including details associated with Google’s AI supercomputing environment (e.g., data center/cluster management components) and hardware/software used to run AI workloads (including TPU/GPU systems and related networking components). Ding was initially indicted in March 2024, with subsequent superseding indictments expanding the alleged timeframe and charges; the case is cited as USA v. Ding, N.D. Cal., No. 3:24-cr-00141.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
8 events from the most recent confirmed update back to the earliest known activity.
Status conference scheduled following conviction
Following the guilty verdict, the court scheduled a status conference for Ding as the case moved toward sentencing.
Federal jury convicts Ding on 14 counts
A federal jury in the Northern District of California found Ding guilty after an 11-day trial on seven counts of economic espionage and seven counts of theft of trade secrets related to Google's AI technology.
Superseding indictment adds economic espionage charges
In February 2025, prosecutors filed a superseding indictment expanding the alleged offense period and adding economic espionage charges, including allegations the theft was intended to benefit the People's Republic of China.
U.S. indicts and arrests Ding on trade-secret charges
In March 2024, federal authorities indicted and arrested Ding in California on initial theft-of-trade-secrets charges tied to the alleged transfer of Google's proprietary AI technology.
Ding downloads exfiltrated Google data to personal computer
Court records cited in coverage say Ding downloaded confidential Google information from his personal cloud account to a personal computer in December 2023, shortly before resigning.
Google learns of Ding's China startup activity
In late 2023, Google discovered that Ding had publicly presented in China to potential investors about a China-based startup he founded while still employed by Google, helping bring the scheme to light.
Google trade-secret theft continues for about a year
Between May 2022 and April 2023, Ding allegedly transferred more than 1,000 to 2,000 confidential Google files or pages covering TPU, GPU, SmartNIC, data center, and cluster-management technology to personal accounts.
Ding begins copying Google AI documents to personal storage
Prosecutors said Linwei Ding started exfiltrating confidential Google AI and supercomputing documents in May 2022, using methods such as copying material into Apple Notes, converting it to PDFs, and uploading it to personal cloud storage.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
7 references tracked. Mallory keeps watching after this page renders.
Ex-Google engineer convicted of stealing AI secrets for China-based firms | SC Media
scworld.com
Open sourceFormer Google engineer convicted of stealing GPU and TPU trade secrets for 'Chinese interests' - tried to raise funding for his own start-up | Tom's Hardware
tomshardware.com
Open sourceU.S. convicts ex-Google engineer for sending AI tech data to China
bleepingcomputer.com
Open sourceEx-Google Engineer Convicted of Stealing Google’s AI Secrets For China
cybersecuritynews.com
Open sourceEx-Google engineer found guilty of stealing AI secrets - Help Net Security
helpnetsecurity.com
Open sourceEx-Google Engineer Convicted for Stealing 2,000 AI Trade Secrets for China Startup
thehackernews.com
Open sourceEx-Google Engineer Guilty of Stealing AI Tech for Chinese Firm - DataBreaches.Net
databreaches.net
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-Linked Espionage Targeting U.S. Government and Technology Talent
U.S. authorities and researchers are highlighting **China-linked espionage** that increasingly leverages online recruitment and employment channels to access sensitive information. Reporting on recent federal cases describes foreign intelligence services posing as consulting firms, research groups, or recruiters to approach current and former U.S. government personnel—often starting via email or job platforms and escalating through staged interviews, fake websites, and payment offers—to solicit **classified or sensitive information**; multiple Justice Department actions in 2025 reportedly involved such virtual-first recruitment approaches. Separately, a former Google engineer, **Linwei Ding**, was found guilty of **economic espionage and trade secret theft** after prosecutors said he exfiltrated over 2,000 pages of confidential AI supercomputing documents (including TPU/GPU architecture details, orchestration software, SmartNIC networking designs, and internal system configurations) and uploaded them to a personal cloud account while maintaining undisclosed ties to China-based companies and engaging with a Shanghai-sponsored talent program. Broader context from CSIS’ long-running survey of Chinese espionage cases underscores that these incidents fit a sustained pattern since 2000 spanning both **human intelligence** and **cyber-enabled theft** targeting U.S. government and commercial technologies, while noting open-source case lists likely undercount the true scope.
Mar 21, 2026
Former Google Engineers Indicted for Alleged Theft of Chip Security and Cryptography Trade Secrets Sent to Iran
US federal prosecutors indicted **Samaneh Ghandali** and **Soroor Ghandali** (former Google engineers) and **Mohammadjavad Khosravi** (Samaneh’s husband, employed at another unnamed tech firm) for alleged **trade secret theft**, **conspiracy**, and **obstruction of justice** tied to the exfiltration of sensitive processor-related information. The Department of Justice alleges the trio used their roles at multiple Silicon Valley companies to access and steal confidential documents covering **processor security** and **cryptography**, and moved the material to unauthorized third-party and personal locations, including destinations linked to **Iran**. Investigators allege the activity included transferring large volumes of internal files to external communications platforms and sharing them in channels associated with the defendants, with additional copies later found on personal devices and systems connected to the group. Prosecutors also claim the defendants attempted to conceal the scheme through actions such as destroying records, making false statements, and photographing screens to avoid direct document transfers. Google said it enhanced safeguards and alerted law enforcement after discovering the incident; the alleged stolen trade secrets reportedly included information related to Google’s **Tensor** processor used in *Pixel* phones.
Mar 21, 2026
Chinese Phishing Campaign Stole NASA and Defense Software Source Code
NASA's Office of Inspector General disclosed that Chinese national **Song Wu** allegedly conducted a years-long spear-phishing and impersonation campaign to obtain sensitive aerospace and defense-related software, source code, and other controlled technical information from NASA personnel, other U.S. government agencies, universities, and private companies. U.S. authorities said the operation ran from **2017 through 2021** and relied on fraudulent emails and false identities, with Wu posing as U.S. engineers, friends, and colleagues to persuade victims to share restricted data in violation of export control laws. The U.S. Department of Justice charged Wu in **September 2024** with wire fraud and aggravated identity theft, and the FBI has since placed him on its **Most Wanted** list. Investigators identified him as an engineer at the Aviation Industry Corporation of China (**AVIC**) and assessed the stolen software as having both industrial and military applications, including advanced tactical missile development and aerodynamic weapons design, underscoring the campaign's significance for U.S. national security and the defense industrial base.
Apr 28, 2026