A former Google software engineer has been convicted of stealing AI hardware secrets from the company for the benefit of two China-based firms, one of which he founded. The second startup intended to use these secrets to market its technology to PRC-controlled organizations.
On Thursday, Linwei (“Leon”) Ding, 38, was convicted on seven counts of economic espionage and seven counts of trade secret theft for stealing confidential information related to Google’s Tensor Processing Units (TPUs), Graphics Processing Units (GPUs), and SmartNIC network interface cards.
“We’re grateful to the jury for making sure justice was served today, sending a clear message that stealing trade secrets has serious consequences,” said Lee-Anne Mulholland, VP of regulatory affairs at Google, in a statement provided to The Register.
According to the second superseding indictment [PDF] filed in September 2025, Ding began working for Google on May 13, 2019. He was responsible for developing software that helps GPUs function more efficiently for machine learning applications at Google and Google Cloud. In that role, he had access to information Google deemed confidential.
Google employs various physical and network security measures, including security guards, cameras at building entrances, badge-based building access restrictions, guest registration and accompaniment requirements, network data loss prevention monitoring, device identification and authentication, and network activity logging.
The company checks physical and network access activity using both automated tools and human review to flag discrepancies like network access via an IP address that doesn’t match the location of the employee’s access badge.
These measures later helped reconstruct Ding’s activities for investigators, but did not prevent or immediately detect his initial data theft. Google’s spokesperson did not respond when asked whether the company has revised its security procedures and policies in the wake of this incident.
Around May 21, 2022, Ding began uploading more than 1,000 files containing trade secrets to his personal Google Cloud account.
“Ding exfiltrated these files by copying data from the Google source files into the Apple Notes application on his Google-issued MacBook laptop,” the indictment states. “Ding then converted the Apple Notes into PDF files and uploaded them from the Google network into [his personal Google Cloud account]. This method helped Ding evade immediate detection by Google.”
The following month, June 2022, Ding received a series of email messages from the Chief Executive Officer (CEO) of Beijing Rongshu Lianzhi Technology Co., Ltd. (“Rongshu”), a technology startup in China focused on machine learning acceleration. The messages included a job offer as CTO for 100,000 RMB per month, which was worth about $14,800 or $177,600 annually at the time, plus an annual bonus and company stock.
Ding traveled to China on October 29, 2022, staying there until March 25, 2023, during which time he participated in investor meetings to raise money for Rongshu. By May 30, 2023, according to the indictment, he founded Shanghai Zhisuan Technology Co. Ltd. (“Zhisuan”) and took the role of CEO. The company aimed to develop a Cluster Management System for accelerating machine learning workloads.
Ding applied to get Zhisuan into a China-based business incubation program called MiraclePlus. The company was accepted in November 2023 and Ding then traveled to Beijing to pitch investors.
A document he distributed around that time in a Zhisuan WeChat group noted, “we have experience with Google’s ten-thousand-card computational power platform; we just need to replicate and upgrade it – and then further develop a computational power platform suited to China’s national conditions.” An internal Zhisuan memo referenced in the indictment indicates that the company expected to market its technology to PRC-controlled entities, including government agencies and academic institutions.
Google became aware of Ding’s activities when he uploaded further files to a second personal Google Drive account while he was in China. On December 8, 2023, Ding offered reassurance to a Google investigator about his use of a personal account and signed a Self-Deletion Affidavit stating that he hasn’t retained any Google information – while not disclosing his prior use of a personal account to upload Google files.
On December 14, 2023, Ding booked a one-way ticket from San Francisco to Beijing, scheduled to depart January 7, 2024. On December 26, 2023, he emailed his manager to resign from Google.
Three days later, Google found out that Ding had presented at the MiraclePlus conference as the CEO of Zhisuan. Company investigators then suspended Ding’s network access, remotely locked his Google laptop, and began reviewing various security records.
They found surveillance footage that showed another employee scanning Ding’s building access badge earlier that month to make it seem as if Ding was in the US during dates he was in China.
On January 4, 2024, Google security personnel took Ding’s Google laptop and mobile device. Two days later, FBI investigators executed a search warrant. A grand jury indictment [PDF] was returned on March 5, 2024.
The court filings do not say whether the stolen trade secrets remain in the hands of PRC-affiliated individuals or companies. Google’s spokesperson did not respond to a request to elaborate on the status of its proprietary information.
Ding’s defense attorney filed a motion [PDF] to have the case dismissed, arguing that the government failed to allege that Ding ever handed the stolen secrets over to a foreign government entity; that he intended or knew his actions would benefit the PRC; or that the espionage was backed by the PRC.
Judge Chhabria subsequently rejected the defense motion, finding that the allegations and evidence were sufficient for a trial. He did however express skepticism of the government’s theories that Ding’s actions qualify as economic espionage under 18 U.S. Code § 1831 if they benefit China as a country, as opposed to the government of China.
According to the US Justice Department, trial evidence “showed that Ding intended to benefit two entities controlled by the government of China by assisting with the development of an AI supercomputer and collaborating on the research and development of custom machine learning chips.”
The jury found the government’s case convincing and voted unanimously to convict on all fourteen counts. Ding faces a maximum sentence of 10 years in prison for each count of trade secret theft and 15 years in prison for each count of economic espionage, subject to US Sentencing Guidelines and federal sentencing rules. ®
