It is one of the most brazen cases of intellectual property theft ever brought by the Department of Justice. Over 11 months, Chinese national Ding Linwei allegedly stole information related to cutting-edge artificial intelligence (AI) technologies being developed by Google, his then-employer, including designs for a next generation chip that hasn’t even been announced. 

All the while, Ding held leading roles at two Chinese firms developing competing technology. 

What’s more, these were no ordinary companies. Records reviewed by The Wire show that both firms received backing from powerful names in China’s tech sector, including a venture capital firm affiliated with Tsinghua University; and a prestigious incubator formerly affiliated with Y Combinator, whose limited partners include Hillhouse Capital and HongShan, formerly known as Sequoia Capital China.

To the U.S., the alleged theft is a brazen example of how China is tapping its citizens abroad to advance the country’s technological goals. The case is one of several brought by the DOJ’s year-old Disruptive Technology Strike Force, which aims to prevent “authoritarian regimes and hostile nation-states” from acquiring sensitive technologies.

There is no evidence to suggest that Ding’s Chinese investors colluded with him to steal information. Neither company was charged by the DOJ. But Ding’s social media profiles — since taken down — show that he made little effort to hide his continued employment at Google, raising questions about the due diligence done by Ding’s backers, and whether they were aware of his double life as a top software engineer in Silicon Valley.

“China’s VC industry is very driven by government priorities, and AI is the thing that the government is supporting right now,” says Ivy Yang, founder of Wavelet Strategy, a New York-based consultancy. “These incubators and companies are in a sense all fighting for the same deals and talent. With his experience, illustrious career, and pristine background, Ding had all the right credentials. They likely wanted him to be as perfect as he sounded.”

With a master’s degree from the University of Southern California, Ding, who also goes by Leon, started his career in 2012 with stints at Marvell Semiconductor and Cadence Design Systems — leading firms focused on chip design. After joining Google in 2019, Ding worked on a team that designed AI supercomputers. That gave him access to blueprints for Google’s Tensor Processing Units (TPUs) — powerful, proprietary chips used to train Google’s AI chatbot, Gemini — and DeepMind, the unit working to develop artificial general intelligence. 

Left: A single Google Cloud TPU v3 device. Right: A Cloud TPU v3 Pod. Each TPU pod contains 256 individual TPU devices. Credit: Google Cloud

“After Nvidia, Google is arguably second in AI hardware,” says Lennart Heim, a research fellow at the Centre for the Governance of AI, a research nonprofit. The DOJ’s indictment alleges that Ding stole chip architecture and software design specifications related to Google’s version 4 and version 6 TPUs, a theft that Heim describes as a “big deal.” 

“Version 4 is publicly accessible; version 5 is available for select customers. Version 6 is not even announced yet,” he explains. 

…to find those with the right expertise, who are willing to leave cushy U.S. jobs at places like Google, and be public about their work — that funnel gets smaller and smaller.

Ivy Yang, founder of Wavelet Strategy, a New York-based consultancy

China has turbocharged its efforts to build cutting edge AI chips since October 2022, when Washington imposed sweeping chip export controls on the country. Google’s blueprints are the kind of technology that Beijing covets. 

One company courting Ding was Beijing Rongshu Lianzhi Technology Co., a three-year-old tech firm initially focused on privacy computing, a subfield focused on data security and encryption. That business drew the interest of investors including Ant Group, the online payment giant founded by Alibaba founder Jack Ma, as well as Innoangel Fund, an angel investor whose track record includes investments in video game developer Yoozoo and food delivery platform Meituan. Another shareholder is Tsinghua Capital, a venture capital firm affiliated with Tsinghua University.

All of the firms did not respond to requests for comment.

Starting in June 2022, prosecutors claim that Rongshu’s chief executive began communicating with Ding. Soon after, the company pivoted away from privacy computing and started focusing on AI. Rongshu Lianzhi would eventually name Ding as the company’s chief technology officer, describing him on their website as a former “chief engineer” at Google. 

By April 2023, Ding’s pilfering from Google had stopped. In May, he set up his own company in China, Shanghai Zhisuan Technology Co. (also known as Lyceum Technology Co.), and was quickly accepted into a startup incubation program called MiraclePlus. 

MiraclePlus was founded in 2019 by Lu Qi, a talented former Microsoft and Baidu engineer who founded the China unit of Y Combinator, one of Silicon Valley’s most prestigious startup accelerators. The company makes a fixed investment of $300,000 for a 7 percent stake in startups accepted into its program. In return, it provides founders with guidance including legal support, connections with local government resources, and advice on intellectual property rights. 

Data from WireScreen,¹WireScreen is a corporate intelligence platform focused on China and global supply chains and PitchBook show that MiraclePlus’ limited partners (LPs) include HongShan and JD Technology, a subsidiary of the e-commerce giant JD.com, as well as Hillhouse Capital, Softbank’s Masayoshi Son, and LinkedIn founder Reid Hoffman’s private foundation.

Hillhouse Capital declined to comment. The other firms did not respond to requests for comment.

Policymakers in Washington have sought to restrict outbound U.S. investment into high-tech industries in China. In August, President Biden issued a narrowly tailored executive order that required U.S. investors to notify the Treasury Department of investments in Chinese AI systems designed for military, government or mass surveillance end uses. But these controls do not target other AI applications, nor do they restrict the activities of limited partners (LPs) in investment funds. 

…for all of the guardrails put in place by companies, in the case of an insider threat, there isn’t a foolproof policy that can fully prevent something like this.

Ngor Luong, a senior research analyst at Georgetown’s Center for Security and Emerging Technology

“The executive order is mainly concerned with investment in problematic entities, and the transfer of intangible benefits like knowledge and expertise,” says Ngor Luong, a senior research analyst at Georgetown’s Center for Security and Emerging Technology, a Washington D.C.-based think tank. “With LPs, it’s unclear whether there is a knowledge transfer. They don’t tend to provide assistance to portfolio companies beyond the investment itself. ”

In November, Ding traveled to Beijing to pitch investors at MiraclePlus’ fall roadshow. Citing his experience at Google, Ding claimed to be one of fewer than 10 people in the world capable of building a supercomputing platform with more than 10,000 chips. Prosecutors allege that Ding stole specifications for Google’s “cluster management system” (CMS), the crucial software that instructs its tens of thousands of TPUs on how to work together. 

“We have experience with Google’s 10,000 chip computational power platform,” read one of Ding’s slides. “We just need to copy and upgrade it — and then further develop a computational power platform suited to China’s national conditions.”

Several factors explain why Chinese investors may have failed to carry out detailed due diligence on Ding. 

Startup founders often pursue funding for their startups before quitting their day jobs, even in Silicon Valley. Moreover, external pressures — including Beijing’s call for the financial sector to support national priorities such as AI — could incentivize investors to put up their money and not to ask too many questions. 

“Big investors seeking opportunities covet Chinese talent and the companies they want to start,” says Yang. “But to find those with the right expertise, who are willing to leave cushy U.S. jobs at places like Google, and be public about their work — that funnel gets smaller and smaller.”

A recent report by MacroPolo, a think tank, found that while China was the source of almost half of the world’s top-tier AI researchers, only 28 percent ended up working in the country. Many of those top researchers work in the U.S., which accounts for 42 percent of top AI talent in terms of employment. 

But the report also found that China is catching up. The challenge for U.S. AI firms is preventing talent from walking out the door — and potentially taking valuable IP. 

“This is a massive problem that costs the U.S. billions of dollars a year,” says Luong. “But for all of the guardrails put in place by companies, in the case of an insider threat, there isn’t a foolproof policy that can fully prevent something like this.”

---