3 Hours Was All It Took: Google Engineer Convicted of AI Espionage

One Engineer, 14,000 Pages, and a Betrayal That Made History

Think of it like this: imagine you work in the kitchen of the world's best restaurant. You have access to every secret recipe, every proprietary technique, every ingredient that makes the magic happen. One day, you decide to copy everything into a notebook, upload it to your personal cloud, and open your own restaurant on the other side of the world using those exact recipes.

That's essentially what Linwei Ding did. A 38-year-old software engineer who worked at Google since 2019, Ding didn't steal recipes — he stole the blueprints for Google's TPU chips, the custom-designed technology that powers some of the most advanced artificial intelligence on the planet. And his "restaurant" was a startup in Shanghai backed by the Chinese government.

On January 29, 2026, a federal jury in San Francisco found him guilty on all 14 counts: 7 counts of economic espionage and 7 counts of trade secret theft. The jury deliberated for just 3 hours after an 11-day trial. It's the first-ever conviction for AI-related espionage in United States history.

And what he stole wasn't just any technology.

What Are TPUs and Why Are They Worth More Than Gold

Let me break this down: TPUs (Tensor Processing Units) are chips that Google designed from scratch specifically to train and run AI models. While Nvidia makes GPUs that serve many purposes — gaming, crypto mining, AI — Google built TPUs with one single goal: to be the most efficient machines in the world for artificial intelligence.

Google has been developing this technology since 2013 and put it into production in 2016. TPUs use an architecture called "Systolic Array" that strips out everything except pure AI computation — no graphics, no textures, just neural network calculations at brutal speed.

To put the value in perspective: D.A. Davidson estimates that Google's TPU + DeepMind division could be worth approximately $900 billion as a standalone entity. Morgan Stanley projects TPU production could reach 7 million units by 2028, generating $13 billion in new revenue.

The current generation, called Ironwood (TPUv7), can link over 9,000 processors in a single "superpod" with 9.6 terabits per second bandwidth and 1.77 petabytes of shared memory. Scale that to 9,216 chips and you get 42.5 exaflops of computing power — more than 24 times the capacity of the world's largest supercomputer, El Capitan.

That's what Linwei Ding tried to copy and take to China.

How He Did It: Apple Notes, PDFs, and a Personal Cloud

The trick is how embarrassingly simple his method was. Ding didn't use a USB drive or sophisticated hacking software. What most guides won't tell you is that Google's security system — a company that manages the data of billions of people — was circumvented using the Apple Notes app.

Here's how it worked:

1. He copied data from Google source files into Apple Notes on his company-issued MacBook
2. He converted the notes into PDF files
3. He uploaded the PDFs to his personal Google Cloud account

This method evaded Google's internal detection systems, which monitored direct file transfers but not content from Apple Notes converted to PDF.

Between May 2022 and April 2023 — approximately one year — Ding transferred over 1,000 unique files containing roughly 14,000 pages of confidential information. Of those files, 105 documents contained core trade secrets about:

• TPU chip architecture and design
• Google's GPU systems
• Specialized network interface cards (SmartNICs) enabling ultra-fast communication between chips
• Orchestration software that coordinates thousands of chips into AI supercomputers

A computer science expert from Cornell University, Professor Bart Selman, testified that the stolen technology represented 10 to 15 years of work by Google scientists.

The Double Life: Engineer in California, CEO in Shanghai

While still collecting his Google paycheck in California, Ding was building something in parallel. By June 2022, he was already in talks to become CTO of a China-based tech company. Shortly after, he founded Shanghai Zhisuan Technology Co. Ltd., appointing himself CEO.

Zhisuan's goal was to develop a cluster management system for accelerating machine learning workloads. In plain English: replicate exactly what Google had spent a decade building.

Ding wasn't exactly subtle about it. He told investors he was "one of 10 people in the world" capable of replicating Google's supercomputing platform. He was accepted into MiraclePlus, a Chinese startup incubator, and traveled to Beijing to pitch investors.

But what really sank him was even more brazen: he applied for a "talent plan" sponsored by the Shanghai government. In his application, he stated his goal was to help China achieve "computing power infrastructure capabilities on par with the international level" by working with two Chinese government-controlled entities to develop an AI supercomputer.

Meanwhile, back at Google, someone was swiping his building access badge at the office to make it look like he was still showing up. That "someone" was a former intern Ding had recruited to maintain the charade.

How He Got Caught

Google discovered the scheme when it learned Ding had given a public presentation at a Chinese tech conference where he explained to potential investors how his startup could replicate Google's supercomputing platform.

The company immediately cut off his network access. In late December 2023, when Ding told his manager he was leaving and booked a one-way flight to Beijing, Google confiscated his laptop and mobile devices on January 4, 2024.

Two days later, the FBI executed a search warrant.

Before that, Ding had signed a "Self-Deletion Affidavit" to a Google investigator, claiming he hadn't retained any company documents. He lied. In fact, on December 14, 2023 — six days after signing that affidavit — he downloaded the stolen secrets to his personal computer.

The Trial: 11 Days, 3 Hours of Deliberation

The trial took place at the U.S. District Court for the Northern District of California, before Judge Vince Chhabria. The case was coordinated by the Disruptive Technology Strike Force, an inter-agency group created in 2023 specifically to combat advanced technology theft.

The defense, led by attorney Grant Fondo of Goodwin Procter, argued that Google "chose openness over security." According to the defense, the documents were available to thousands of employees and therefore "could not have contained trade secrets."

The jury disagreed. After 11 days of trial, they deliberated for just 3 hours before returning a unanimous verdict: guilty on all 14 counts.

The maximum penalties are staggering:

The actual sentence will be lower, but the message is clear. As U.S. Attorney Craig H. Missakian said: "The jury delivered a clear message today that the theft of this valuable technology will not go unpunished."

What This Means for the US-China Tech War

This case doesn't exist in a vacuum. It arrives at a moment when the AI competition between the United States and China is at its most intense.

The House Select Committee on China estimates that Chinese intellectual property theft costs the US approximately $600 billion per year. The same committee published a report revealing that DeepSeek poses a "profound threat" to US national security, possesses at least 60,000 Nvidia processors (restricted from export to China), and has "highly likely" used illegal distillation techniques on leading US AI models.

FBI Assistant Director Roman Rozhavsky was direct: "In today's high-stakes race to dominate artificial intelligence, Linwei Ding betrayed both the U.S. and his employer by stealing trade secrets about Google's AI technology on behalf of China's government."

Google, for its part, issued a statement through VP of Regulatory Affairs Lee-Anne Mulholland: "We're grateful to the jury for making sure justice was served today, sending a clear message that stealing trade secrets has serious consequences."

But when asked whether the company had revised its security procedures... Google declined to comment.

The Uncomfortable Questions This Case Leaves Open

Beyond the conviction, the Ding case exposes troubling gaps:

1. How did Apple Notes bypass Google's security? The company that manages Gmail, Google Cloud, and the data of billions of users failed to detect an employee converting classified documents into PDFs through a notes app. Their data loss prevention (DLP) systems clearly had a blind spot.

2. Do thousands of employees need access to TPU secrets? The defense argued the documents were available to thousands of employees. If true, the question isn't just about Ding — it's about how many others could have done the same thing.

3. What happens to trust in Chinese-origin employees? This is the most delicate side effect. Civil liberties groups warn that cases like this can generate ethnic profiling in tech companies. The vast majority of Chinese engineers in Silicon Valley are honest professionals who contribute enormously to American innovation.

4. Is this case the tip of the iceberg? The Chinese government actively runs "talent plans" to recruit individuals to bring technology expertise back to China. If Ding was discovered because he gave a public presentation... how many others have been more careful?

For professionals who work with AI tools daily, this case is a reminder that data security is a fragile link, even at the world's most advanced companies. And for those using browser extensions with access to AI chats, the principle is the same: where there's valuable AI data, someone is trying to steal it.

Frequently Asked Questions

Who is Linwei Ding and what did he do?

Linwei Ding (also known as Leon Ding) is a 38-year-old software engineer who worked at Google from 2019 to late 2023. He stole over 14,000 pages of trade secrets about Google's TPU chips — the technology that powers its AI infrastructure — and transferred them to build a startup in Shanghai with Chinese government backing.

How many years in prison could he receive?

Each of the 7 economic espionage counts carries up to 15 years in prison and a $5 million fine. Each of the 7 trade secret theft counts carries up to 10 years and $250,000. The theoretical maximum is 175 years, though the actual sentence will be significantly lower. The sentencing date has not yet been set.

What are Google's TPUs?

TPUs (Tensor Processing Units) are chips designed by Google exclusively for processing AI workloads. Unlike Nvidia's GPUs, which serve multiple purposes, TPUs are maximally optimized for training and running AI models. Analysts estimate Google's TPU division could be worth up to $900 billion as a standalone entity.

How did he steal the secrets without being detected for a year?

Ding copied files from Google into the Apple Notes app on his corporate MacBook, converted them to PDFs, and uploaded them to his personal Google Cloud account. This method bypassed detection systems that monitored direct file transfers. Additionally, a former intern swiped his building access badge at Google offices while Ding was in China.

How does this case affect the tech industry?

It's a historic legal precedent: the first AI espionage conviction in the US. It will likely accelerate reviews of internal security protocols at tech companies, particularly regarding access to sensitive intellectual property and data loss prevention systems. It will also intensify the debate around AI technology export controls to China.

A Precedent That Changes the Rules

The Linwei Ding case marks a before and after in the protection of AI intellectual property. For the first time, a US court has convicted someone specifically for espionage of artificial intelligence technology.

But the most telling detail may not be the conviction itself — it's the 3 hours of jury deliberation. In a case with 14 charges and 11 days of trial, that speed speaks volumes about how overwhelming the evidence was.

As Google invests $93 billion in AI infrastructure and companies like Nvidia navigate dealings with China amid scandals and export controls, this case is a reminder that the race for AI supremacy isn't just fought in labs and data centers. It's also fought in courtrooms, in personal Google Cloud accounts, and apparently, in the Apple Notes app on a corporate laptop.

Ding's sentencing will be set in the coming weeks. But the true impact of this case is just beginning.