38 ms·
Best quote: "People working for Didi apply for intern jobs at Uber China and then exfiltrate our data. We can’t let them see the formulas or they’ll just copy w
by ipython 3y ago
Best quote: "People working for Didi apply for intern jobs at Uber China and then exfiltrate our data. We can’t let them see the formulas or they’ll just copy what we do!”
This is so true. People in the US just don't understand the level of economic and industrial espionage that happens in China on a daily basis. I was responding to an unrelated breach at an unnamed tech company back in mid-2000s time frame and had a side bar conversation that went like the following:
Them: "Yeah, we just opened a tech center in Xinjiang and ... wow, we've had quite the rash of lost ID badges there recently"
Me: "Have you considered that they're not 'lost', but rather 'sold' for profit?"
... silence ...
I don't know if executives are aware but just don't care, or if they're simply incompetent, but China has productized industrial espionage on a massive scale. GE Aviation was a victim more recently: https://www.cincinnati.com/story/news/2022/11/16/accused-chinese-spy-who-targeted-ge-aviation-sentenced-to-20-years/69653460007/ https://www.cincinnati.com/story/news/2022/11/16/accused-chi...
- fennecfoxy 3y agoYup, the Chinese government doesn't really care about infringement unless the IP is Chinese itself and being infringed upon by non-Chinese companies. I still remember the agency I worked for getting in an industrial designer to create some beautiful cases for some iBeacon hardware we were building. They looked great. We organise a Chinese company to do the injection moulding and are sent samples that look pretty good, so we decide to use them. Few weeks later we see OUR cases on Alibaba/Aliexpress. The West/other countries aren't perfect either, but that's not what we're talking about here. _Everyone_ I know who has worked with Chinese manufacturing/businesses has a "they ripped us off" "they sold our hard work to someone else" "they provided lower grade x than was agreed". And the counterarguments always come down to: "yeah but the West does X" or "you're just being racist". Chinese companies, especially the ones that do business on Ali-X _LOVE_ this as they can get the IP and use it for $0 and then undercut the original producer of the equipment. Plenty of makers find that their designs on Tindie etc are ripped off and appear on Ali, too.
- cflewis 3y agoWell, not just corporate espionage, right? State espionage is going to be at every large US company too. To speak to the article, I can only imagine how excited an agency would be to get real-time updates on the Uber movements of a target.
- ipython 3y agoTwo things. First, this isn't the same thing; you're talking about embedding a resource in a company to read out real time telemetry from internal systems (information with a short shelf life), not stealing industrial trade secrets (information with a very long shelf life). Second, I can assure you that, even with our imperfect systems, there is actually a set of checks and balances in place to prevent rampant (note I said rampant) abuse of this kind. Yes, agencies would be very excited for this sort of capability. Do they get it as a matter of course that easily? No. There are layers of accountability, legal authorities, and (warranted) push back from commercial entities.
- BlueTemplar 3y agoThe last bit strikes me as dubious, considering the Snowden revelations. Yeah, sure, I'd guess that what China does is at least an order of magnitude worse, and sure, because they're less democratic, but also because they are much often behind - and let's not kid ourselves, in the situations the US feels it's behind, it's also using the widespread backdoors they have access to (Crypto AG, Cisco routers, Juniper Networks, Windows, Intel&Ryzen CPUs...)
- nextaccountic 3y ago> State espionage is going to be at every large US company too. Snowden revealed, among other things, that the NSA did state espionage on Brazil's state oil company, Petrobras https://www.nytimes.com/2013/09/09/world/americas/nsa-spied-on-brazilian-oil-company-report-says.html https://www.nytimes.com/2013/09/09/world/americas/nsa-spied-... https://www.theguardian.com/world/2013/sep/09/nsa-spying-brazil-oil-petrobras https://www.theguardian.com/world/2013/sep/09/nsa-spying-bra... https://g1.globo.com/fantastico/noticia/2013/09/nsa-documents-show-united-states-spied-brazilian-oil-giant.html https://g1.globo.com/fantastico/noticia/2013/09/nsa-document... International relations are based on reciprocity. I sincerely think that if the US didn't think that industrial espionage would be a legitimate activity of intelligence agencies, they wouldn't practice it themselves.
- makeitdouble 3y agoThey don't understand it, because what you're quoting as a behavior is pretty standard anywhere in the world. That's why companies protect their secrets from low rank employees. Except if you're arguing that western companies are bound by stronger ethics, in which case I'd like to see some evidence.
- anikan_vader 3y agoLess so ethics and more so credible legal action against offending companies and individuals.
- ipython 3y agoIf a low ranking employee in Cincinnati divulged corporate trade secrets, they'd be tried and convicted. If a low ranking employee in Shanghai did the same, what can the US company do? Not much. So it's a low risk activity, that is also actively encouraged and in many cases financed by the Chinese government. This is in no way intended to be disparaging of folks who are of Chinese descent, but rather a reflection of the reality of contemporary Chinese government politics and policies.
- makeitdouble 3y agoWould you get tried in the US for interning at a company and then go to a competitor with all your inside knowledge ? [edit: barring a paid non compete agreement] Then a step further from that, sure there are laws to prevent you from wholesale lifting corporate data and bringing them out as you leave, but as many laws it will be extremely difficult to detect and prove that happened in many low profile cases. That's why instead of just relying on the law you'll lock usb ports monitor network activity and get laptops returned when someone leaves. It's kinda like preventing shop lifting, you know it will happen at some scale. > US company / Chinese gov How much leverage do you thing a Chinese company has to if a three letter US agency spies on them and pass the info to US companies ? And would you argue that scenario wouldn't happen if a specific Chinese company had a decisive advantage that could severly hurt US interests ?
- deleted 3y ago
- deleted 3y ago[deleted]
- mmcwilliams 3y agoIt's somewhat ironic to frame that as a problem that "isn't understood" in the US considering what the CEO of this company was convicted of.
- deleted 3y ago[deleted]
- mkii 3y agoAnd yet, when the author takes code from one company to use for another, or releases company code on Github, nobody bats an eyelid.
- stickfigure 3y agoIf we're being generous, the author may have had permission to do so. It's not inconceivable; the code was abandoned. If one of my reports had asked, I would have approved.
- Kon-Peki 3y agoYou probably don't have the authority to allow your report to release "company code" on their personal Github account.
- justinwp 3y agoI think you might be surprised how easy this process is at some big tech companies. For me the bigger hurdle is getting past a privacy review, not the issue of the license.
- crazygringo 3y agoYes, I would be surprised. What big tech company makes it easy for you to take code written and deployed there while you were employed, and just open-source it? I know there are big tech firms that own everything you do outside of work, but have a fairly easy process to allow you to release that as open-source. But this is different, this is about code written for and deployed by the company itself, that isn't part of any corporate open-source strategy.
- closeparen 3y ago“Corporate open source strategy” where I work is just having a form that engineers can fill out to request to open source things, and a committee on the other end of the form to sign off. It’s similar to the process for speaking at a conference or publishing on the company blog. Management sometimes steers in the direction of more or less public content, but specific releases are always individual initiative by engineers who want to develop their project in the open. Tech brand wants our name associated with high quality work.
- endisneigh 3y agoWell information wants to be free, copyright shouldn’t exist, piracy is ok yadda yadda
- deleted 3y ago[deleted]
- aurareturn 3y ago[flagged]
- aintgonnatakeit 3y agoSup PLA. The Chinese people are intelligent and strong. Why don’t you let them express that strength freely?
- aurareturn 3y agoPLA. What? I don’t even know what that stands for. I assume it’s the Chinese army right? Any post that is isn’t anti China here is now labeled as paid for by the Chinese government right? It shows how much anti-China propaganda has gotten since Trump came into power and how much the US has turned nationalist. People here have drank so much anti China propaganda that any neutral to positive post about China is immediately condemned.
- ipython 3y agoTo be clear I am no Trump supporter. Feel free to check my comment history if you don’t believe me.
- aurareturn 3y agoYou don’t have to be a Trump supporter. Both liberal and conservative media have been 100% anti-China since Trump came into power. Both sides use anti-China rhetorics to generate views and votes. The consequences trickle down to the opinions and views of the average HN poster.
- LAC-Tech 3y agoIf it makes you feel any better I've hated communist china for as long as I can remember, decades before Trump. Free Tibet!
- deleted 3y ago[deleted]
- diogenes4 3y ago> People in the US just don't understand the level of economic and industrial espionage that happens in China on a daily basis. Back in my day this was called "competition" and worked for the consumer, not against them. I find the espionage factor to be theatrical hogwash trotted out by the corporate types. We americans love competition, right? Stfu and compete.
- oh_sigh 3y agoWhat it would do is punish companies that do real R&D, and reward companies that have no actual talent in that area. So ultimately the field would stagnate because no one would invest in R&D.
- Proziam 3y agoIs it "competition" when you're up against state-sponsored actors who will use tactics the rest of the world would consider illegal?
- phendrenad2 3y agoYou're missing a huge part of this: The "competition" you think you're referring to had, you know, actual rules. Sending people to get jobs at a rival, and steal all of their internal documents and trade secrets, is illegal in most countries.
- diogenes4 3y ago> You're missing a huge part of this: The "competition" you think you're referring to had, you know, actual rules This is, of course, false.
- phendrenad2 3y agoCompetition has no rules? Jury awards ZeniMax $500 million in Oculus VR lawsuit? I guess they made up some rules, no?
- 3y ago
- pbj1968 3y agoAnd I was called a racist 25 years ago when I said, “like, our engineering school is, like, crawling with Chinese nationals.” We said like a lot on the 90s.
- chaostheory 3y agoThat’s because you were being a racist. Most people reserve the word “crawling” for insects and other small pests. Only racists apply it to an entire set of people.
- aurareturn 3y ago[flagged]
- seabrookmx 3y agoIs it the phrasing you think is racist? I don't think pointing out the fact that the student body of a given school is, for example, 20% Chinese, is racist. It's merely a statement of fact.
- aurareturn 3y agoIt's both the phrasing and the content.
- stormfather 3y agoI don't see the content as racist. If a wikipedia article lists the proportion of ethnic Chinese in Malaysia, is that a racist article too?
- blackqueeriroh 3y agoWhat is with the constant need to deploy logical fallacies? Here, you’re deploying false equivalence - what some person said as a first-person out loud based on unknown evidence that compared people to animals of some sort that walk on all fours is completely different than a Wikipedia article that contains sourced objective comparative data and shares it in third-person. And why are these two things different? Context. Nothing exists without context, and analysis of a thing or an action or a situation without considering context is pointless and, frankly, bad analysis. In fact, it’s bad science. Understanding, recognizing, accounting for, and sometimes mitigating context is crucial to being an engineer, a software developer, a rocket scientist, et al. So honestly, I don’t particularly care if it’s racist or not (it is, but not because P necessarily hates Chinese people, but because it reinforces ideas and beliefs that contribute to the systemic oppression of Chinese people in the US), I just think your argument is so flimsy a stiff breeze would tear it apart. Do better.
- iancmceachern 3y agoI've watched this happen. I've watched key, core engineers and technical leaders work for US and European companies, develop their next generation products, then turn around and design and develop essentially the exact same thing for the Chinese market. They then build a company, in China, that makes essentially the same product, but for the Chinese Market, and with Chinese investors, etc. Examples: Thoratec/Abbot Heartmate III & CH Biomedical Auris/Verb/J&J Robotic & Digital Solutions & Renovo Surgical The ironic thing, is that some of these companies after success in China are working to sell and be competitive in the US and Europe. It's not even secret or under the table anymore, it's overt and largely accepted as the way it is in our industry. A brave new world. The other factor, is that it is very very difficult for a foreign company to do business and protect their assets in China, so often the wise companies don't even try. They often just license their stuff for the Chinese market to a Chinese company. That way they at least have a chance of not having it all just stolen.
- htss2013 3y ago>it's overt and largely accepted as the way it is in our industry. A brave new world. What alternative is there? The only protection there ever was for taking business secrets was patent enforcement, civil lawsuits or prison. If a foreign government won't cooperate on any of those things, what can you do? The only answer humanity has ever come up with is something like a government intelligence agency, where everything is obfuscated by clearance levels and need to know compartmentalization, and any violations are handled criminally, with armies of full time counter espionage people. That just wouldn't work in the corporate world.
- noobface 3y agoEveryone should've seen what happened to Cisco and thought better, but short sighted execs focused only on next quarter gladly opened the gates and accepted the horse.
- swader999 3y agoNortel too.
- 3y ago
- choppaface 3y agoGiven Uber's efforts on Greyballing, booking fake Lyft rides, hiring Anthony Levandowski etc etc ... it's very on-brand for them to (1) fall into an espionage war with Didi (wonder where all their Vertica data came from?) and (2) have an engineer write about using code he lifted from a prior gig and then also self-published. https://www.nytimes.com/2017/03/03/technology/uber-greyball-program-evade-authorities.html https://www.nytimes.com/2017/03/03/technology/uber-greyball-... https://www.theverge.com/2014/8/12/5994077/uber-cancellation-accusations https://www.theverge.com/2014/8/12/5994077/uber-cancellation...
- willcipriano 3y agoIntellectual property is a western invention as I understand it. I don't think China agrees that you can own an idea like we assert that we do.
- layer8 3y agoChina certainly did agree in various ways: https://en.wikipedia.org/wiki/Intellectual_property_in_China https://en.wikipedia.org/wiki/Intellectual_property_in_China
- willcipriano 3y agoInteresting commentary on the talk page there.
- BeFlatXIII 3y agoThere's a vast difference between passing laws to appear palatable to the international community and enforcing those laws.
- deleted 3y ago[deleted]
- pjmlp 3y agoNot only there, everywhere. Since I also wear a security hat, when doing code reviews, architecture and devops stuff, it is surprising how much stuff regular developers never think about in regards to security.
- IG_Semmelweiss 3y agoIts not only that, but when they can't beat them...they make them join: startups with valuable market intelligence get bought all the time by Chinese companies. See for example the case of DEAR systems, which is a cloud-based WMS that is particularly useful for intelligence as to how much (US) importers are paying for worldwide goods, and what is the cost of shipping from A to B. It was bought by a chinese company not long ago. That's 1 example. https://www.prnewswire.com/news-releases/cin7-acquires-dear-systems-orderhive-to-create-saas-inventory-and-order-management-leader-301229621.html https://www.prnewswire.com/news-releases/cin7-acquires-dear-...
- iaseiadit 3y agoSimilar reports were widespread 20+ years ago, when I worked in aerospace. Bad faith partnerships, industrial espionage, and companies barred from competing after all useful information was extracted. It has gone on for decades and nobody will do anything about it. Executives and shareholders get dollar signs in their eyes over the thought of tapping into the Chinese market, and let themselves get burned over and over again.