Linwei Ding: Ex-Google Engineer Gets 12-Month Prison Term

Former Google software engineer Linwei Ding, also known as Leon Ding, has been sentenced to 12 months minus one day in prison after being found guilty of stealing confidential technology linked to Google’s Artificial Intelligence Infrastructure.

A US court also ordered Ding to serve two years of supervised release after his prison term, pay more than $189,000 in restitution and a $25,000 fine.

The case attracted significant attention because the information Ding obtained was not ordinary corporate data. Prosecutors said the stolen material included details about Google’s specialised Tensor Processing Units (TPUs), graphics processing units (GPUs), networking technology and software architecture used to connect thousands of chips and operate large AI computing systems.

The material was allegedly transferred while Ding was working at Google and developing links with technology companies in China. Prosecutors argued that the information could help Chinese companies reproduce elements of sophisticated AI computing infrastructure without having to develop every component independently.

The case also arrives against the backdrop of an intensifying technology competition between the United States and China, particularly over advanced AI chips and the computing infrastructure required to train increasingly capable AI models.

Who is Linwei Ding?

Linwei Ding is a Chinese national who moved to the United States in 2010 to pursue a master’s degree. He subsequently worked for several technology companies in Silicon Valley before joining Google as a software engineer in 2019.

Ding became a lawful permanent resident of the United States in 2021.

His position at Google gave him access to confidential information concerning the company’s hardware and software infrastructure. Prosecutors said this included technology deployed in Google’s supercomputing data centres for training large AI models.

That access became central to the government’s case. The prosecution argued that Ding used his legitimate access to confidential systems to collect and transfer information that he was not authorised to provide to outside companies.

A jury in San Francisco found Ding guilty in January following an 11-day trial. The verdict covered seven counts of theft of trade secrets and seven counts of economic espionage. The economic espionage counts were subsequently set aside by the judge.

What Google AI technology did Ding steal?

The stolen information reportedly covered several layers of Google’s AI computing infrastructure.

One important category involved Google’s Tensor Processing Units. TPUs are Google’s custom-designed AI accelerators, developed specifically to support machine-learning workloads. They form an important part of the computing infrastructure Google uses for training and running large AI systems.

The documents also contained information concerning GPUs and the systems that allow computing hardware to operate together at large scale.

According to the prosecution’s evidence, the material included software responsible for communication between chips and software used to coordinate thousands of processors as part of a larger supercomputer.

The information also involved Google’s custom-designed SmartNIC, a networking component used in AI supercomputers and cloud networking products.

These components may appear separate, but they are closely connected in large-scale AI computing. Training a modern large AI model requires far more than simply having powerful individual processors. Thousands of computing units need to communicate, exchange data and operate together efficiently.

That makes the surrounding software and networking architecture an important part of an AI computing platform.

How the confidential files were transferred

Prosecutors said Ding began moving confidential material from Google’s network to a personal Google Cloud account on May 21, 2022.

The transfers allegedly continued until May 2, 2023.

At trial, prosecutors said Ding uploaded more than 500 confidential files during roughly a year. A later superseding indictment alleged that the material involved more than 1,000 unique files, while prosecutors presented evidence relating to more than 2,000 pages of confidential information.

The figures illustrate the scale of the alleged data collection, although the precise number of files at issue varied across the stages of the prosecution.

Court documents also stated that Ding downloaded the material onto his personal computer in December 2023, less than two weeks before leaving Google.

The government’s case therefore focused not on a single accidental disclosure but on a prolonged pattern of accessing and transferring confidential information.

Why the stolen information was valuable

The significance of the material lies in what it could potentially save a competing company from having to develop independently.

Large AI computing systems are built from multiple layers: processors, networking equipment, storage, software, communication systems and orchestration tools. Getting thousands of chips to work together efficiently is itself a complex engineering challenge.

Information about how those systems are designed and operated can therefore provide insight into years of engineering work.

Experts cited in the case indicated that the documents could allow a recipient to skip substantial portions of the design process for an AI supercomputer.

That is particularly important in a sector where access to computing infrastructure can influence how quickly companies can train large models and bring new AI products to market.

Ding’s connections with Chinese AI companies

The case became more serious because of Ding’s activities involving Chinese technology companies while he was still associated with Google.

According to prosecutors, months after the confidential uploads began, a Chinese early-stage technology company called Rongshu offered Ding a position as chief technology officer.

Ding visited the company in late 2022 and participated in investor meetings from around December, according to the prosecution’s account.

He later founded another China-based technology company, Zhisuan, which proposed developing infrastructure for training large AI models.

Prosecutors pointed to a Zhisuan document circulated by Ding in November 2023 as evidence of the company’s ambitions. The document described experience with Google’s large-scale computing platform and proposed replicating and upgrading it for China’s requirements.

The language became an important part of the government’s argument that Ding’s access to Google’s technology was connected to his plans for Chinese AI ventures.

The allegation involving his Google access card

The prosecution also presented evidence concerning Ding’s efforts to conceal his activities while still connected to Google.

According to prosecutors, while in China promoting Zhisuan, Ding arranged for an intern to swipe his Google identification card several times. The alleged purpose was to make it appear that he was working from his Google office.

The allegation added another dimension to the case because it suggested an effort to disguise Ding’s physical whereabouts and activities.

However, the court drew an important distinction when considering the government’s broader claims.

The judge later determined that the evidence was insufficient to establish that Ding knew or intended, during the May 2022 to April 2023 period, that his conduct would benefit the Chinese government.

That distinction matters because the case involved both the theft of Google’s confidential information and allegations concerning economic espionage. Ding was convicted on the trade-secret theft charges, while the economic espionage counts were later set aside.

Why the judge called the conduct serious

US District Judge Vince Chhabria described Ding’s conduct as a “systematic, brazen effort to steal Google’s property.”

The sentence reflects the court’s assessment of the seriousness of the offence while also stopping short of a longer prison term.

Ding received a sentence of 12 months minus one day, followed by two years of supervised release. He must also pay more than $189,000 in restitution and a $25,000 fine.

The restitution and fine add a financial consequence to the prison sentence, while supervised release places Ding under additional legal restrictions following his incarceration.

Why Google’s AI chips are strategically important

The technology at the centre of the case illustrates why AI hardware has become a strategic asset for major technology companies.

Google’s custom TPUs are designed to support machine-learning workloads and allow the company to build and operate AI computing systems without depending entirely on commercially available processors.

That matters in an industry where high-end AI computing has become closely associated with specialised accelerator chips.

Nvidia remains a major supplier of advanced AI GPUs, while companies including Google have developed their own specialised hardware. Google’s approach gives it greater control over parts of the computing stack used by its AI systems and cloud services.

Consequently, confidential information about the design and operation of those systems can have commercial value beyond the hardware itself.

The surrounding infrastructure can be equally important. Efficient AI computing requires processors to communicate rapidly, workloads to be distributed across large numbers of chips and software to coordinate those resources.

That broader ecosystem was reportedly represented in the material Ding transferred.

The case comes amid US-China AI competition

Ding’s prosecution comes during a period of intense competition between the United States and China over artificial intelligence.

The US government has imposed restrictions aimed at limiting China’s access to certain advanced semiconductor technologies and AI computing capabilities. These measures have made access to cutting-edge processors an important part of the wider technology rivalry between the two countries.

China, meanwhile, has been pursuing greater domestic capability in AI hardware and computing infrastructure.

The strategic importance of AI computing means that semiconductor technology is no longer viewed solely through the lens of commercial competition. Advanced chips and the systems required to use them effectively have become part of a much wider technology and national-Security debate.

That backdrop helps explain why the theft of proprietary AI infrastructure can attract significantly more attention than a conventional corporate data theft case.

Why copying AI infrastructure is difficult but valuable

It would be an oversimplification to suggest that possessing Google’s documents automatically allows another company to recreate Google’s AI infrastructure.

Large-scale computing systems involve hardware manufacturing, software engineering, networking, data-centre operations and extensive testing. Documentation can provide valuable technical knowledge, but turning that knowledge into a working commercial system still requires resources and engineering capability.

Nevertheless, proprietary documents can shorten the development process by revealing engineering approaches that would otherwise have to be discovered through years of experimentation.

This is the central economic value of trade secrets.

A company that develops a specialised system invests money, personnel and time to solve difficult engineering problems. If a competitor obtains detailed internal information, it may gain insight into solutions that the original company spent years developing.

In AI, where companies are racing to increase computing capacity and train larger models, even reducing development time can be strategically significant.

What the case says about AI trade-secret security

The Ding case also highlights a growing security challenge for technology companies.

As AI systems become more valuable, sensitive information is no longer limited to source code or research papers. Confidentiality can extend to chip architecture, networking designs, infrastructure diagrams, training systems and software used to coordinate massive computing clusters.

Employees with legitimate access to these systems can potentially see information that would be extremely difficult for an outsider to obtain.

That makes internal controls increasingly important for companies building advanced AI platforms.

The case also demonstrates the difficulty of protecting information across multiple environments. Confidential files may be accessible through corporate systems, cloud accounts and employee devices, creating several potential points at which sensitive information could be transferred.

For companies competing in advanced AI, protecting these assets is therefore part of protecting the technology itself.

What happens next for Linwei Ding?

Ding’s immediate legal consequences include his prison sentence, supervised release, restitution and fine.

The broader significance of the case, however, extends beyond one former employee.

It demonstrates how seriously US authorities are treating the unauthorised transfer of advanced AI technology, particularly when the information is connected to strategic computing infrastructure and foreign technology ventures.

At the same time, the court’s treatment of the economic espionage allegations shows why it is important to distinguish between stealing trade secrets and proving the specific legal elements required for economic espionage.

The case ultimately centres on a simple but increasingly consequential issue: who controls the engineering knowledge behind the world’s most advanced AI infrastructure?

For Google, the episode underscores the commercial value of its custom chips and AI supercomputing systems. For US technology companies, it highlights the security risks surrounding employees with access to high-value AI infrastructure. And for the wider US-China technology rivalry, it shows why intellectual property and semiconductor expertise have become central to the competition over artificial intelligence.