15 ms·
Former Apple Employee Charged with Theft of Autonomous Car Project Trade Secrets
- trhway 8y ago>Shortly before Zhang's theft was discovered, Apple sent out a lengthy cautionary memo to employees warning them against leaking data to the media. In the letter, Apple said that in 2017, it caught 29 leakers, with 12 of those individuals being arrested and charged. being an Apple employee seems to come with statistically high risk of being arrested and charged :) And autonomous car projects across the industry remind the Klondike.
- Bahamut 8y agoCompared to over 120k employees? Most employees aren't leaking major secrets, much less leaking on a scale like this.
- trhway 8y agoNo, compared to Google, FB etc. 12/120K per year is a rate like that of being killed by a non-autonomous car or shot by a non-autonomous gun.
- terakilobyte 8y agoIt isn’t random though. A better statistic to compare to would be suicide rate. They do it to themselves.
- manicdee 8y agoThe corollary is that working for Apple has a higher chance of exposing you to technology that is interesting enough to steal.
- shostack 8y agoIt strikes me that people concerned with the risk of being charged for committing a crime like this are probably exactly who Apple is trying to deter with this messaging. For all other employees, it serves as a reminder that this stuff actually happens, to be on the lookout for it, and that Apple will protect the hard work they've done with their full legal might should someone try to do something like this.
- huebnerob 8y agoGood. This was a flagrant and deliberate violation. To argue Apple is overstepping here is to suggest Apple employees are exempt from the law.
- walshemj 8y agoSurprised that he is not being charged under the espionage act and also in a way why apple hired him - or is the USA less strict about hiring into sensitive industries.
- pm90 8y ago> or is the USA less strict about hiring into sensitive industries. No. On the contrary you need various kinds of security clearances to work in sensitive fields.
- anonnel 8y agoWhoa there buddy. How about we be a little careful with the xenophobic talk, no?
- andrestan 8y agoIt's not xenophobic to want or expect a country to protect its IP from a country known to openly flout such rules.
- anonnel 8y agoQuestioning why Chinese nationals are hired in tech is xenophobia. Period.
- chaostheory 8y agoYou should probably have made that clear in your original comment. I missed it myself.
- WilliamEdward 8y ago
- melling 8y agoThere’s information in the complaint that claims Apple has 5000 people working on its autonomous car project: https://www.cnbc.com/2018/07/10/ex-apple-employee-charged-with-stealing-autonomous-car-trade-secrets.html https://www.cnbc.com/2018/07/10/ex-apple-employee-charged-wi...
- andyfleming 8y ago"5,000 employees are working on it or know about it"
- melling 8y agoThey posted a correction. “Correction: A previous version of the story mistakenly said that 5,000 Apple employees are working on autonomous driving technology. The complaint says 5,000 people are "disclosed on the project," which includes employees working on it or familiar with it.”
- mark212 8y agofrom the article, about 2700 employees have access to the specific databases from which the guy pulled sensitive data. That seems like a very large group of people to me.
- duxup 8y ago>Zhang was interviewed by the FBI in late June, where he admitted to stealing the information, and he was later arrested attempting to leave to China on July 7. I guess he assumed he was going to get away with it but why wouldn't you just skedaddle ASAP when you moved the data and / or hardware? Granted he seems more like a flunky for someone rather than a super criminal as he talked to the FBI...and admitted it.
- gowld 8y agoHe might not have realized what he did was illegal. He might have thought that lying (or evading) the FBI is worse than the risk of being convicted for stealing secrets. (It usually is.)
- duxup 8y agoThe first I would have trouble believing... The second I could understand.
- infectoid 8y agoDoes the second apply to the POTUS though?!
- ShabbosGoy 8y agoAccording to executive privilege, it doesn’t.
- eganist 8y agoThere's a common misconception among many engineers that they own the code that they write when employed by many traditional valley firms. A thorough reading of the employment contract would usually resolve this, but how many engineers do you know who don't port some of their code between firms? There's also a separate cultural clash between many Eastern cultures and many Western cultures surrounding property and ownership rights around intangible assets. I'm not well versed enough to adequately enumerate them with the appropriate level of detail. I'll bet a dollar, though, that depending on this engineer's upbringing, one of these two applies and explains the "no big deal" mentality.
- aresant 8y ago"[In their investigation] Apple found that just prior to Zhang's departure, his network activity had "increased exponentially" compared to the prior two years he had worked at Apple. He accessed content that included prototypes and prototype requirements. .." Seems like an oversight to find this out post-investigation vs. flagged up front? EG - seems like a basic usage algorithm could flag this stuff especially across a small <5000 person universe w/cost-benefit vs. theft of tens-of-billions in IP. Any corporate IT security officers care to comment on this?
- manicdee 8y agoIf you want to catch someone stealing, you don’t stop them trying.
- noobermin 8y agoThat implies the thing they're stealing isn't valuable enough keep from being be stolen.
- tzakrajs 8y agoAnd/or it implies that if anyone steals it, you can prove it and take ownership.
- sizzle 8y agoYou don't stop them from trying you just crack down once you have verifiable proof of the act for a court case.
- meowface 8y agoThis is known as insider threat detection / User Behavior Analytics (UBA). It could also be considered part of Data Loss Prevention (DLP). Insider threats are probably the hardest things to reliably detect on a large corporate network (compared to all of the other types of information threats), especially at a company where most of the employees are very active users of technology. The field is still in its infancy, with lots of cool-looking "AI-driven / ML-powered / buzzword-optimized" products from startups which typically end up generating an absurd amount of anomaly detections per day, usually with a 99.9% false positive rate. Of course I'm generalizing and I imagine some companies have implemented a fairly effective UBA program, but I think they're rare. It's just trying to find a needle in an extremely large haystack. When you're dealing with technology departments, normal behavior can easily be a modest amount of network traffic for a few days followed by a huge burst of downloads and uploads from/to internal services and databases and cloud storage and any number of things. Suspicious website browsing could be innocuous research and curiosity. That personal USB drive plugged in is probably some developer with a deadline who never got around to requesting a corporate drive and can't wait a few days for it to be approved and needs to physically transfer files ASAP. It's just not an easy problem. There are probably hundreds of other instances of an Apple employee not looking at any prototype data for months and suddenly poring over tons of it. Maybe they're preparing for a presentation or a new project. Adding lots of red tape and restrictions and wasting time investigating employees who've done nothing wrong (or perhaps who violated policy but with no real bad intent or serious negligence) and telling people they can't do certain things which make their job more efficient takes a huge toll on everyone. It's a necessary evil, but trade-offs always have to be considered. Apple wants their autonomous car program developed as quickly as possible, and the more they restrict access and require lengthy approval processes, the slower things will get done. And fundamentally, unless you're in a weird situation, probably ~0.1% of your employees are insider threats, and probably ~0.01% are significant insider threats which could actually affect your business. The odds are stacked against you. Occasionally you'll run across a smoking gun that's easy to detect with basic logic like "email sent to webmail account with no subject and over 6 attachments", but if you're dealing with a smart insider threat - especially one working on behalf of a superpower government's intelligence apparatus - you're not going to find something so blatant. I have sometimes run across things like that, but it's usually something gray like a developer emailing themselves some code so they can continue to work on it at home. The worst thing I've ever found was a salesperson emailing themselves proprietary leads/contact lists shortly before their resignation date. A spy is never going to get caught from such low-hanging fruit detections. You have to start with the basics: strict policy guidelines, least privilege principle, log everything, a good team of people to investigate anomalies and write up employees who are violating policy, and then finally you can shell out a lot of resources on automated detection and baseline and tune for a long time until you have a manageable number of dashboards and reports and alerts that the team can respond to. Apple will presumably restrict access more carefully after this incident, and implement some new statistical anomaly detection, but insider threats will always be hard to detect. Dabbling in UBA also made me realize some of the issues faced by agencies like NSA. I'm sure they have strong policies against unauthorized data access (like looking up information about romantic partners), fully intend to enforce them, and have lots of manual and automated detections, but in reality the amount of data and number of daily data accesses is probably way too high to consistently catch bad actors. I think that's one of many strong practical arguments to not let them have have easy access to such a big trove of sensitive data, even if you make the assumption they're behaving completely ethically and responsibly.
- jonknee 8y agoApple has 5,000 people working on a me too project that will likely never go anywhere while they are unable to ship announced products like AirPower and Mac Pro. Oh and they admitted to a known flaw in the keyboard of their current line of laptops that goes back years. This is frustrating.
- ohiovr 8y agoSo where was Zhang headded with this stash? I think I can be sure those people would just get a lawsuit instead of criminal charges.
- product50 8y agoCan China not innovate at all? Why are they so keen on stealing IP? Their other homegrown products such as WeChat and Xiaomi seem pretty competitive and very catered to the local market. This is just giving such a bad name to the country and supporting Trump's broad claims that China thrives on IP theft.
- jackvalentine 8y agoWhat makes you think this is anything other than an opportunistic individual trying to ensure a job/gain standing/'have all the answers' at a new company?
- nihonde 8y agoChina has a huge, captive local market. The business model of copying foreign ideas and applying low-cost local labor, and local marketing/distribution know-how has plenty of precedents in all kinds of developing markets. Hollywood itself is founded on so-called IP “theft”. Anyway, the legal barriers of intellectual property have proven again and again to be futile and problematic as a means to drive innovation. Just look at the huge waste in IP litigation, the perverse incentives of IP trolling, and the utter impotence of DRM as a legal mechanism. Trump’s claims about IP rights are as credible as his claims about bring manufacturing and coal mining jobs back to America. It’s just pandering to an audience that can’t or won’t keep up with the winds of change.
- princetontiger 8y agoChina has invented nothing. Look it up. Very sad. Hence, the lying, cheating, and stealing. The West has now seen this behavior, and China will be walled off/bombed if things persist. We've already occupied the forbidden city once (100 years ago). We'll do it again.
- sumedh 8y ago> Why are they so keen on stealing IP? That is how the game is played when you have nothing. You copy others, sell your product, use the profits for research and development and then come up with your own IP. Indian Pharma companies do the same thing.
- 8y ago
- chubbyrabbit 8y agoThese recent incidents make me wonder how many people got away with a little bit better op-sec.
- 8bitsrule 8y ago"he told his supervisor at Apple he was leaving the company and moving to China to work for XMotors" Doesn't sound like a heavy-duty spy ... else would never have admitted that. Probly a naif.
- Animats 8y agoThe comments from Apple indicate that what they're really concerned about is disclosure to the media, not someone copying their self-driving technology, such as it is. Apple put 5000 people on this project and failed. What they don't need is an insider writing an "Apple's Biggest Failure" book. I wonder if we'll ever see a technical post-mortem on this.
- trhway 8y ago>Apple put 5000 people on this project and failed. not sure. These are still driving around their Sunnyvale campus: https://www.macrumors.com/2017/08/25/apple-new-autonomous-driving-suvs/ https://www.macrumors.com/2017/08/25/apple-new-autonomous-dr... Btw, one of the best sensor suites around (except for Google who seems to have reached kind of optimization stage where they started to remove the "extra" sensors). And Apple has highest number of self-driving permits in CA if i remember correctly. Though i don't see them in "disengagement reports" (https://www.dmv.ca.gov/portal/dmv/detail/vr/autonomous/disengagement_report_2017 https://www.dmv.ca.gov/portal/dmv/detail/vr/autonomous/disen... - interesting reading, Google's average human driver reaction time was 0.91s)
- throwawayqdhd 8y agoI would be really interested in an Apple designed car, not exactly an Apple created self-driving tech suite. I trust Apple's design far more than I trust Apple's hard tech chops, especially when it comes to processing massive amounts of data
- jurip 8y agoI wonder about the assumption in that MacRumors article that it's a self-driving car, given this article about Apple building their own Maps data set: https://techcrunch.com/2018/06/29/apple-is-rebuilding-maps-from-the-ground-up/ https://techcrunch.com/2018/06/29/apple-is-rebuilding-maps-f... Given that the MacRumors article says that the Lexus was parked, it might be a human-driven car for gathering maps data?
- trhway 8y ago
- r32rawgraegwta 8y agoMy friend told me one of her coworkers left for a Chinese competitor without returning corporate laptop. There seems to be a pattern here.
- thorwwed9 8y agoWen Ho Lee, Sherry Chen, Xiaoxing Xi, Bo Jiang were all falsely accused of being spies. There seems to be a pattern here.
- deleted 8y ago[deleted]
- exolymph 8y agoComically, what you're doing is called the Chinese robber fallacy: https://rationalconspiracy.com/2015/03/08/the-chinese-robber-fallacy/ https://rationalconspiracy.com/2015/03/08/the-chinese-robber... Also just an absurdly small sample of "one news story" and "something I heard secondhand."
- thelastidiot 8y agoDidn't most of the people involved with this project, leave and went to work for Tesla, Lyft, Uber, Waymo and NIO anyway? In that case, one can imagine the bleeding of IP that went away will all this exodus of knowledge.
- deleted 8y ago[deleted]
- Proven 8y agoAnd passed it to a China based company? How unusual!
- antpls 8y agoI want to work for a world with free flow of information, where individuals should not be responsible alone for the mistakes of a multi-billions organization. If any company can do it better than Apple somewhere in the world, then let them build on what Apple developed. The culture of open source should spread at all levels of research & engineering, in all fields. Cost of information transmission and movements of people will continue to decrease. We should respect individuals rights about privacy, but disregard organization level's attempt at secrecy, and aim for transparent organizations all around the world. Such big organization should not be able to attack individuals without anyone questioning the processes going on inside of it.
- eanzenberg 8y agoI dont want my country’s IP obtained by totalitarian governments with awful human rights track records.
- antpls 8y agoThen work harder and faster than the people of that "totalitarian" country. I don't want to rise a child who will waste his/her time with artificial problems created by fake country's level competition. We don't live in the 70s anymore. Stop putting countries and governments before common-sense and people happiness. A copy-paste of 1Go file is so easy to do, it's ridiculous. IPs and patents were not created for the happiness of the majority. Maybe that engineer is simply passionated about knowledge and building autonomous cars, and he would like to make it happen wherever he goes. Why stop him? If Apple really wanted to protect that IP, then just publish a patent about it? Instead of using the existing organizational systems, aka Patents (patents are already bad enough), they attack an individual.
- SXX 8y ago> Then work harder and faster than the people of that "totalitarian" country. I really hope it's some very well hidden sarcasm. > I don't want to rise a child who will waste his/her time with artificial problems created by fake country's level competition. We don't live in the 70s anymore. Playing citizen of Earth is fun and well until you find yourself or your family in said totalitarian country.
- _cs2017_ 8y agoSo the guy stole data and hardware. Instead of leaving immediately for China before it's discovered, he went back to Apple and told them that he's leaving. And not just leaving, but leaving to work for a competitor in the self-driving car industry. If he wanted to raise any more suspicion, he'd need to show up to the exit interview in a ski mask, carrying a crowbar. And after that, he still stayed in the US for over two months (April 28 - July 7). This simply defies belief. I don't even mention the fact that he admitted to the Apple security team that he stole stuff. Presumably without any lawyer since no lawyer would let him admit to anything. Why would he even meet with a security team, if he's not under arrest? Even if he thought he can't get caught, surely he knew something was wrong when the security team called him for an interview? Maybe he thought it's impossible to prove what he did? But the guy is intelligent, he was hired to an important project at Apple. He must know that corporations have security cameras and also can check corporate device usage. So I'm down to my final two guesses. Either the guy thought he didn't do anything wrong (really? taking confidential documents and hardware??). Or the article heavily distorts the facts. Anyone has better explanations? Edit: just saw the official FBI court filing at the end of the article. The article did not distort anything. I have no words.
- slivym 8y agoIt could be that it simply never occured to him that he would get caught. When you work somewhere for years you don't think "This security cameras on the entrance could technically be used to track my activity". As the article says, the repositories that he accessed are restricted to THOUSANDS of people. So really the guy was probably right - if he hadn't been a dumbass and said that he was going to work for a chinese competitor then his boss likely wouldn't have thought to ask questions, no one would've noticed.
- antpls 8y agoI don't understand how you can blame him and call someone a "dumbass" for being honest. It looks like the dumbasses are Apple project managers, or Apple lawyers, or Apple security admins or whoever write Apple's policies
- amarant 8y agothere needs to be a verb for this. i suggest "levandowski" ex: "Former Apple employee levandowskies his way into a chinese startup" levandowski -verb, reffering to the stealing of tradesecrets from self-driving car project with the intention of bringing said secrets to a competitor, especially if one is caught.