Summary: On January 29, 2026, a federal jury convicted former Google engineer Linwei Ding on seven economic-espionage counts and seven trade-secret theft counts after copying more than 2,000 pages of confidential AI infrastructure material. The DOJ described it as the first conviction on AI-related economic espionage charges. The article urges stricter least-privilege controls, DLP for personal cloud uploads, and review of conflict disclosures.
A federal jury in San Francisco reached its decision on January 29, 2026, after 11 days of trial: Linwei Ding — also known as Leon Ding, a 38-year-old Chinese national who had worked at Google as a software engineer — stood convicted on every count he faced, seven economic espionage counts and seven counts of stealing trade secrets. The Justice Department put out its announcement the following day, and FBI Assistant Director Roman Rozhavsky described the case as marking “the first-ever conviction on AI-related economic espionage charges.” At the center of the prosecution’s case sat one claim: while employed by Google, Ding copied 2,000-plus pages of confidential material spanning the hardware and software Google relies on to train and serve large AI models in its supercomputing data centers, all to the benefit of two China-based companies.
For the AI industry, the case redraws an enforcement boundary. What was taken was never model weights; it was the infrastructure technology without which frontier models cannot be trained. The US government has now demonstrated its willingness to reach for its heaviest trade-secret instrument — economic espionage charges that carry up to 15 years per count — to defend that layer.
What Happened, When: Two Chinese Companies and a 2,000-Page Trail
The DOJ press release lays out an approximate chronology:
- May 2022 to April 2023: during his employment at Google, Ding copied in excess of 2,000 pages of confidential material off the company’s internal network and uploaded them to a personal Google Cloud account
- Around June 2022: conversations started about his taking a CTO position at an early-stage Chinese company; by early 2023, he had founded his own AI/machine-learning company in China and was serving as its CEO
- What he told investors: Google’s technology, once copied and modified, would let him build an AI supercomputer
- December 2023: with under two weeks to go before his resignation, he moved the files onto his own computer; that same quarter, he submitted an application to a Shanghai government “talent program,” stating that he would “help China to have computing power infrastructure capabilities that are on par with” global standards
- The indictment arrived in March 2024 and was superseded in February 2025 with 14 counts; the guilty verdict came on January 29, 2026, a status conference was set for February 3, and sentencing remains unannounced
The Stolen Material: TPU Chips, SmartNICs, and Cluster Software
Seven categories make up the DOJ’s inventory of secrets, and they all point the same way: architectural and functional design details of Google’s custom Tensor Processing Unit (TPU) chips and systems; its GPU systems; the software through which chips communicate and execute tasks; the scheduling software that arranges thousands of chips into a single supercomputer for AI workloads; and Google’s custom-built SmartNIC network card for high-speed communication.
Strip it down and this is engineering know-how: how to turn thousands of chips into a machine capable of training large models. Technology of this kind is worth at least as much as model weights — weights are the end product, and this is the capacity to produce them. For any organization hoping to rebuild frontier-grade training capability, these documents amount to skipping years of infrastructure trial and error.
What Makes This “First” Conviction Significant
In the reading of both the FBI and the Foundation for Defense of Democracies, this case stands as the first successful prosecution of Chinese AI-related economic espionage. Two consequences follow. For one, prosecutors attached 18 U.S.C. § 1831 economic espionage charges to an AI technology theft case and walked away with a jury conviction, giving future prosecutions a ready-made template. For another, enforcement attention has formally stretched beyond traditional semiconductors to the AI supercomputing stack. John A. Eisenberg of the Justice Department’s National Security Division put it without hedging: “Ding abused his privileged access to steal AI trade secrets while pursuing PRC government-aligned ventures.”
Insider-Threat Takeaways for AI Teams
Three conclusions a team can act on right away. One, access architecture: a single engineer held simultaneous reach over secrets spanning chips, network cards, and cluster orchestration, so the perimeter around infrastructure-class secrets was drawn far too broadly — least privilege deserves stricter enforcement on these assets than on model weights. Two, the exfiltration route could hardly have been less exotic: a copy into a personal cloud account was enough, which is exactly why DLP must watch the plainest path of all, internal network to personal SaaS. Three, the warning signs were already on record: an outside CTO negotiation, a startup launched abroad, an application to a government talent program — each later joined the evidence chain. Conflict-of-interest disclosures should be read not as compliance paperwork but as early-warning data.