On October 19, 2026, the U.S. Department of State announced sanctions on five entities connected to Linwei Ding, the former Google software engineer convicted earlier this year of stealing Google’s artificial intelligence trade secrets for the benefit of China-based companies. The State Department said the designations, made under the Protecting American Intellectual Property Act, follow a Department of Justice and FBI investigation of Ding.
The sanctions are a new chapter in a case that began inside one company’s network. A trusted engineer with legitimate access moved thousands of pages of confidential material to a personal account over roughly a year, while quietly building ties to foreign firms. For any organization that holds valuable technology, including every Department of War (DoD) contractor, the pattern is worth studying closely.
What Happened
According to the State Department and the Department of Justice:
- Ding, 38, also known as Leon Ding, worked as a software engineer at Google.
- From about May 2022 to April 2023, while still employed there, he took more than 2,000 pages of confidential AI trade secrets from Google’s network and uploaded them to his personal Google Cloud account.
- In December 2023, less than two weeks before he resigned, he downloaded the stolen trade secrets to his personal computer.
- Around June 2022, he discussed becoming Chief Technology Officer of an early-stage technology company in the People’s Republic of China (PRC). By early 2023, he was founding his own PRC-based AI and machine learning company and acting as its CEO. He kept these affiliations secret from Google.
- He told potential investors he could build an AI supercomputer by copying and modifying Google’s technology. In late 2023, he applied to a Shanghai government “talent plan.”
- The stolen material covered Google’s AI supercomputing hardware and software, including its custom Tensor Processing Unit chips, GPU systems, orchestration software for thousands of chips, and its custom SmartNIC network card.
- After an 11-day trial in federal court in San Francisco, a jury convicted Ding in January 2026 on seven counts of economic espionage and seven counts of theft of trade secrets.
- On October 19, 2026, the State Department sanctioned five entities connected to Ding, describing the theft as “a serious threat to U.S. economic, foreign policy, and national security interests.”
Lessons for Every Insider Threat Program
1. Watch where data goes, not just who touches it. Ding had legitimate access to the material. The warning sign was movement: company data flowing to a personal cloud account over many months. User activity monitoring (UAM) and data loss prevention (DLP) controls should flag transfers from corporate systems to personal storage, and someone should review those alerts promptly.
2. Treat the resignation window as high risk. The final download to a personal computer came less than two weeks before Ding resigned. Programs should increase monitoring when an employee gives notice, review recent activity for bulk downloads, and close off access as soon as the departure is known.
3. Make outside affiliations reportable, and check them. Ding concealed that he was in talks to be a CTO and was running his own company. Clear outside-employment and conflict-of-interest policies, periodic attestations, and open-source review of public business records help surface undisclosed roles before they become a loss.
4. Know the foreign recruitment programs. Ding applied to a foreign government talent plan while still holding his employer’s trade secrets. Training should help managers and coworkers understand how these programs work and how to report concerns without fear of reprisal.
5. Plan for the long tail. This case moved from an FBI investigation to a criminal conviction to foreign-policy sanctions. Organizations need preserved logs, documented investigative steps, and early coordination with legal counsel and law enforcement so that evidence holds up across every stage.
How TMPC Helps
Our team brings more than 30 years of combined insider threat experience and the proprietary processes built from it. For 8 years, TMPC has delivered continuous counter-insider threat and user activity monitoring support to USSOCOM and JSOC, work that drove that program to a #1 ranking among 24 DoW (DoD) components by DCSA and DIA.
We help organizations:
- Deploy and tune user activity monitoring and DLP to detect data movement to personal accounts and devices
- Build departure and offboarding protocols that tighten monitoring when employees give notice
- Train workforces and managers to recognize foreign recruitment indicators and report concerns through clear procedures
To talk with our team, contact info@tmpcinc.com or 813.524.6935.