5 ms·

TFA makes it sound as if the entirety of the blame can be placed on one employee. Sure, his actions do seem to support that view, but then again, Nvidia did hir

TFA makes it sound as if the entirety of the blame can be placed on one employee. Sure, his actions do seem to support that view, but then again, Nvidia did hire him precisely for his previous experience at this rival company, on the very same project that the two companies were partnered on, which is the same project that Nvidia hired him for. There is no argument to be made that Nvidia wasn't aware he'd be coming with secrets. The argument that that's precisely why he was hired, OTOH, is looking very strong.

juunpp 3y ago
> Nvidia did hire him precisely for his previous experience at this rival company, on the very same project that the two companies were partnered on, which is the same project that Nvidia hired him for. Yes, this happens all the time. > There is no argument to be made that Nvidia wasn't aware he'd be coming with secrets. This is not a logical conclusion from the above. Hiring for the exp is fine. Hiring for the trade secrets obviously is not. No serious company would do the latter, esp a company the size of Nvidia.
- devmor 3y ago
  [flagged]
  - takinola 3y ago
    Risk is always balanced against reward. I doubt Nvidia is culpable here not because I have some strong belief in their morality but because I trust they would not take stupid tradeoffs.
    - Retric 3y ago
      The exposure was unexpected so the risk was likely perceived as low. That said, the discovery process could clear NVIDA.
    - actionfromafar 3y ago
      That puts a lot of faith in a lot employees.
    - margalabargala 3y ago
      IMO this is more of a "don't ask don't tell" thing. I'm sure there was never an explicit agreement that the employee would bring trade secrets, but they can promise to be able to build for Nvidia what was built at the last company, and Nvidia could say "yes I want that", and not audit the new employee's dev environment.
      - FirmwareBurner 3y ago
        >IMO this is more of a "don't ask don't tell" thing. I assure you isn't. If your company (in the law abiding west) has any suspicion you're using another company's illegally obtained proprietary IP, they won't see you as some hero doing God's work and put you on the promotion track wile closing a blind eye to what you're doing, but they immediately ask you to delete everything and every trace related to that. Foreign IP is radioactive and they don't want to get sued because you're bringing some source code and PDFs from their competitor, which might not even be that useful for them anyway. There were even cases of companies ratting out their employees they found using IP they stolen from their previous employers and getting them arrested, because if you stole IP from their competitor what's stopping you from also stealing from them? >not audit the new employee's dev environment Audit how? Against what? Stolen foreign source code you don't have? That's just not realistically possible to audit every employees work and accurately determine if they are or not reusing source code they stolen form a competitor, especially if the employee doing this is careful to change or redact what he's checking in. Only thing you can audit is against FOSS code that is public, but not if it's stolen proprietary code and the employee made sure to not check-in anything giving away the origin of the original IP holder. They didn't catch this guy until he got sloppy and made this huge blunder. You can never secure everything and audit everyone, especially if you want people to get any work done and not feel violated, so everything boils down to trusting employees they won't steal from you, and trusting the legal framework and law enforcement they'll do their job when in need, so you just have everyone sign NDAs and hope for the best.
- winocm 3y ago
  A thought that came to me recently in the shower: Isn't all knowledge effectively based on previous knowledge, and by extension, experience? i.e: A programmer knows how to do X, leaves a company to do Y, where Y is in the same field of work as X. Doesn't X still affect the programmer on a subconscious level and henceforth, their thoughts indirectly?
  - jfim 3y ago
    You can bring your expertise in X without the source code that does X. The former is legal, the latter is not.
  - FirmwareBurner 3y ago
    Bringing knowledge is one thing, which is legal, but stealing source code and design files from your employer to copy it to the systems of their competitor where you now work is a completely different thing which is illegal. Companies want your knowledge, not you bringing proprietary IP from their competitor to work, as they know that's a very expensive lawsuit waiting to happen.
    - wombatpm 3y ago
      But what if I have an idemic memory?
      - FirmwareBurner 3y ago
        Then you'd be able to draw and type out everything from scratch directly on your employer's PC and not have to download it via USB drives or email, like this guy did.
        chii 3y ago
        So if you obtained an idemic memory via installing a camera, flash drive and io ports into your brain? How or why is the mere transport method of information the distinction between infringement of IP vs not?
- zik 3y ago
  > No serious company would do the latter It happens literally all the time: [1] https://www.theguardian.com/technology/2019/aug/27/anthony-levandowski-google-trade-secrets-theft https://www.theguardian.com/technology/2019/aug/27/anthony-l... [2] https://www.theverge.com/2022/8/22/23317502/xiaolang-zhang-pleads-guilty-trade-secret-theft-xpeng-self-driving-car https://www.theverge.com/2022/8/22/23317502/xiaolang-zhang-p... [3] https://www.justice.gov/usao-ma/pr/former-engineer-sentenced-possessing-stolen-semiconductor-trade-secret https://www.justice.gov/usao-ma/pr/former-engineer-sentenced... [4] https://apnews.com/article/korea-samsung-china-copycat-semiconductor-bfdf3ad9f817f646d0d47294f62e334f https://apnews.com/article/korea-samsung-china-copycat-semic... [5] https://www.reuters.com/technology/twitter-may-face-difficulties-showing-meta-stole-trade-secrets-2023-07-07/ https://www.reuters.com/technology/twitter-may-face-difficul...
  - beardedwizard 3y ago
    This proves individual employees routinely steal trade secrets; yes, they do. It does not prove that the companies they join (US public companies in the United States anyway) willfully use it. Think about the large scale conspiracy required to keep something like that secret from an entire company.
    - mcpackieh 3y ago
      There's no need to rope conspiracies into this. The structure of incentives in corporate environments have people in the company not looking for something they don't want to find. Managers would rather not know about violations and be able to tell their boss that their team are pros who got the job done fast, than investigate their reports for violations and quite possibly find a big mess that needs to be cleaned up. Point is, shit that shouldn't happen routinely does happen anyway. "That wouldn't happen because it would be illegal" is generally bullshit.
      - juunpp 3y ago
        Companies of this size have routine code audits that would find copyright infringements of this sort. If the employee literally brought in source code files and not even change the name of the directory like it was highlighted here, it'd have been caught. The audit is also not conducted by the manager, but a third party. There is no possible way this would fly unless the individual intentionally stripped the source of copyright notices (the individual's fault), or the source code was just sitting on their laptop and never acted upon, etc. So I think the question (and I'm not a lawyer...) is whether Nvidia conducted such audit and to what extent (if any) the other company's source code was merged into theirs (versus just sitting on the laptop).
- Guthur 3y ago
  [flagged]
  - bsder 3y ago
    Agreed. NVIDIA has always been a no holds barred competitor willing to push the boundaries of both truth and legality.
- fnord77 3y ago
  And nobody at NVDA noticed when the employee pushed several GB of code into NVDA's repos?
  - juunpp 3y ago
    Where is the proof that the source code was merged? The article only mentions that former employees caught an eye of the source on the individual's computer; it does not mean the source code was merged or acted upon.
takinola 3y ago
I don't have direct knowledge of this company or the parties involved but I would be highly doubtful that Nvidia would want to have an employee steal the secrets of a competitor/partner. In my experience, companies of this size would aggressively not want tainted IP inside their companies. He would need to be bringing across something as valuable as AGI, cure for cancer, etc for it to be even worth considering. There are numerous examples of companies being offered trade secrets of their competitors and reporting it back to the FBI just so they can avoid even the suspicion of stealing corporate secrets. If you think about it for a second, it is kind of obvious. Pretty much every technology is reproducible with the right amount of talent, funding and time. Why commit a crime when you can simply throw money (of which you have a lot) at the problem? Responsible corporate officers know this and act accordingly.
- aaomidi 3y ago
  > Why commit a crime when you can simply throw money (of which you have a lot) at the problem? Indeed. But the stupidity of committing a crime does not actually stop companies from doing so. Mainly because the penalties for it are never harsh enough.
  - szundi 3y ago
    Stupidity in this case probably means low level employees cheating for benefits and career Nvidia can get out of this fairly low cost then Who knows
    - FirmwareBurner 3y ago
      >Stupidity in this case probably means low level employees cheating for benefits and career That's most likely the case here. FFS, the guy stole 6GB of proprietary data and police found the stolen design files pinned on his wall at home, so the guy was fully committed to his scammer role, and not just an accidental "oopsie I walked out with some proprietary IP by mistake, better discard it and keep this low key so nobody finds out". By the looks of it, this guy, most likely a Bluecard(German equivalent of H1B) was just cheating and stealing his way up the career chain through the revolving door of the blue-chip automotive sector, until he got caught. Companies both big and small, never ever encourage you to bring to work proprietary files and data from your previous workplaces, since that's a guaranteed lawsuit as these things always get out eventually.
AshamedCaptain 3y ago
A problem here is that while the companies will generally make very clear that they don't want you to have any single line of code, any schematic, any drawing, anything at all from your previous company; they may also expect you to bring "experience" from the previous company, thereby pressuring more junior employees into doing exactly that - bringing some docs from the previous company - but not telling about it. Through my career I have been to several meetings where everyone was, notebook in hand, expecting to hear the "experience" from the new guy. That is obviously as legal as it gets, but the pressure for the junior employee to have kept a couple of notes is there, and you'd never know. i.e. I suppose no one was aware that he had this code, and it's unlikely it went into nvidia's codebases or that nvidia wanted it; but it also doesn't mean nvidia did not pressure the guy into doing that.
- FirmwareBurner 3y ago
  That sounds wrong in so many ways. Do you live in China or something where this is expected? I've worked at about 10 or so companies in 3 countries and it was never expected for the juniors to ever "bring documents from previous workplaces as knowledge and not tell about it". Bringing your "experience" means only the experience and problem solving skills that are in your head as we're in the knowledge work business. Bringing documents to regurgitate just means IP theft, not knowledge work and is no guarantee to make you a productive employee, and no company would ever touch you for ever doing that.
  - chii 3y ago
    > Bringing your "experience" means only the experience and problem solving skills that are in your head it's hard to differentiate experience with IP. For example, there might be a tricky problem (say, in manufacturing), and the solution is a trade secret. The "experience" from said employee is really just relaying that trade secret.
- userbinator 3y ago
  Some people have very, very good memories and can bring all of that in their brain. Does that make it legal or not, just because it's in someone's brain and can be easily regurgigated at will? It's a subtle question.
varelse 3y ago
[dead]
tedunangst 3y ago
So... noncompetes, except for the hiring company?

juunpp 3y ago

> Nvidia did hire him precisely for his previous experience at this rival company, on the very same project that the two companies were partnered on, which is the same project that Nvidia hired him for. Yes, this happens all the time. > There is no argument to be made that Nvidia wasn't aware he'd be coming with secrets. This is not a logical conclusion from the above. Hiring for the exp is fine. Hiring for the trade secrets obviously is not. No serious company would do the latter, esp a company the size of Nvidia.

devmor 3y ago
[flagged]
- takinola 3y ago
  Risk is always balanced against reward. I doubt Nvidia is culpable here not because I have some strong belief in their morality but because I trust they would not take stupid tradeoffs.
  - Retric 3y ago
    The exposure was unexpected so the risk was likely perceived as low. That said, the discovery process could clear NVIDA.
  - actionfromafar 3y ago
    That puts a lot of faith in a lot employees.
  - margalabargala 3y ago
    IMO this is more of a "don't ask don't tell" thing. I'm sure there was never an explicit agreement that the employee would bring trade secrets, but they can promise to be able to build for Nvidia what was built at the last company, and Nvidia could say "yes I want that", and not audit the new employee's dev environment.
    - FirmwareBurner 3y ago
      >IMO this is more of a "don't ask don't tell" thing. I assure you isn't. If your company (in the law abiding west) has any suspicion you're using another company's illegally obtained proprietary IP, they won't see you as some hero doing God's work and put you on the promotion track wile closing a blind eye to what you're doing, but they immediately ask you to delete everything and every trace related to that. Foreign IP is radioactive and they don't want to get sued because you're bringing some source code and PDFs from their competitor, which might not even be that useful for them anyway. There were even cases of companies ratting out their employees they found using IP they stolen from their previous employers and getting them arrested, because if you stole IP from their competitor what's stopping you from also stealing from them? >not audit the new employee's dev environment Audit how? Against what? Stolen foreign source code you don't have? That's just not realistically possible to audit every employees work and accurately determine if they are or not reusing source code they stolen form a competitor, especially if the employee doing this is careful to change or redact what he's checking in. Only thing you can audit is against FOSS code that is public, but not if it's stolen proprietary code and the employee made sure to not check-in anything giving away the origin of the original IP holder. They didn't catch this guy until he got sloppy and made this huge blunder. You can never secure everything and audit everyone, especially if you want people to get any work done and not feel violated, so everything boils down to trusting employees they won't steal from you, and trusting the legal framework and law enforcement they'll do their job when in need, so you just have everyone sign NDAs and hope for the best.
winocm 3y ago
A thought that came to me recently in the shower: Isn't all knowledge effectively based on previous knowledge, and by extension, experience? i.e: A programmer knows how to do X, leaves a company to do Y, where Y is in the same field of work as X. Doesn't X still affect the programmer on a subconscious level and henceforth, their thoughts indirectly?
- jfim 3y ago
  You can bring your expertise in X without the source code that does X. The former is legal, the latter is not.
- FirmwareBurner 3y ago
  Bringing knowledge is one thing, which is legal, but stealing source code and design files from your employer to copy it to the systems of their competitor where you now work is a completely different thing which is illegal. Companies want your knowledge, not you bringing proprietary IP from their competitor to work, as they know that's a very expensive lawsuit waiting to happen.
  - wombatpm 3y ago
    But what if I have an idemic memory?
    - FirmwareBurner 3y ago
      Then you'd be able to draw and type out everything from scratch directly on your employer's PC and not have to download it via USB drives or email, like this guy did.
      - chii 3y ago
        So if you obtained an idemic memory via installing a camera, flash drive and io ports into your brain? How or why is the mere transport method of information the distinction between infringement of IP vs not?
zik 3y ago
> No serious company would do the latter It happens literally all the time: [1] https://www.theguardian.com/technology/2019/aug/27/anthony-levandowski-google-trade-secrets-theft https://www.theguardian.com/technology/2019/aug/27/anthony-l... [2] https://www.theverge.com/2022/8/22/23317502/xiaolang-zhang-pleads-guilty-trade-secret-theft-xpeng-self-driving-car https://www.theverge.com/2022/8/22/23317502/xiaolang-zhang-p... [3] https://www.justice.gov/usao-ma/pr/former-engineer-sentenced-possessing-stolen-semiconductor-trade-secret https://www.justice.gov/usao-ma/pr/former-engineer-sentenced... [4] https://apnews.com/article/korea-samsung-china-copycat-semiconductor-bfdf3ad9f817f646d0d47294f62e334f https://apnews.com/article/korea-samsung-china-copycat-semic... [5] https://www.reuters.com/technology/twitter-may-face-difficulties-showing-meta-stole-trade-secrets-2023-07-07/ https://www.reuters.com/technology/twitter-may-face-difficul...
- beardedwizard 3y ago
  This proves individual employees routinely steal trade secrets; yes, they do. It does not prove that the companies they join (US public companies in the United States anyway) willfully use it. Think about the large scale conspiracy required to keep something like that secret from an entire company.
  - mcpackieh 3y ago
    There's no need to rope conspiracies into this. The structure of incentives in corporate environments have people in the company not looking for something they don't want to find. Managers would rather not know about violations and be able to tell their boss that their team are pros who got the job done fast, than investigate their reports for violations and quite possibly find a big mess that needs to be cleaned up. Point is, shit that shouldn't happen routinely does happen anyway. "That wouldn't happen because it would be illegal" is generally bullshit.
    - juunpp 3y ago
      Companies of this size have routine code audits that would find copyright infringements of this sort. If the employee literally brought in source code files and not even change the name of the directory like it was highlighted here, it'd have been caught. The audit is also not conducted by the manager, but a third party. There is no possible way this would fly unless the individual intentionally stripped the source of copyright notices (the individual's fault), or the source code was just sitting on their laptop and never acted upon, etc. So I think the question (and I'm not a lawyer...) is whether Nvidia conducted such audit and to what extent (if any) the other company's source code was merged into theirs (versus just sitting on the laptop).
Guthur 3y ago
[flagged]
- bsder 3y ago
  Agreed. NVIDIA has always been a no holds barred competitor willing to push the boundaries of both truth and legality.
fnord77 3y ago
And nobody at NVDA noticed when the employee pushed several GB of code into NVDA's repos?
- juunpp 3y ago
  Where is the proof that the source code was merged? The article only mentions that former employees caught an eye of the source on the individual's computer; it does not mean the source code was merged or acted upon.

takinola 3y ago

I don't have direct knowledge of this company or the parties involved but I would be highly doubtful that Nvidia would want to have an employee steal the secrets of a competitor/partner. In my experience, companies of this size would aggressively not want tainted IP inside their companies. He would need to be bringing across something as valuable as AGI, cure for cancer, etc for it to be even worth considering. There are numerous examples of companies being offered trade secrets of their competitors and reporting it back to the FBI just so they can avoid even the suspicion of stealing corporate secrets. If you think about it for a second, it is kind of obvious. Pretty much every technology is reproducible with the right amount of talent, funding and time. Why commit a crime when you can simply throw money (of which you have a lot) at the problem? Responsible corporate officers know this and act accordingly.

aaomidi 3y ago
> Why commit a crime when you can simply throw money (of which you have a lot) at the problem? Indeed. But the stupidity of committing a crime does not actually stop companies from doing so. Mainly because the penalties for it are never harsh enough.
- szundi 3y ago
  Stupidity in this case probably means low level employees cheating for benefits and career Nvidia can get out of this fairly low cost then Who knows
  - FirmwareBurner 3y ago
    >Stupidity in this case probably means low level employees cheating for benefits and career That's most likely the case here. FFS, the guy stole 6GB of proprietary data and police found the stolen design files pinned on his wall at home, so the guy was fully committed to his scammer role, and not just an accidental "oopsie I walked out with some proprietary IP by mistake, better discard it and keep this low key so nobody finds out". By the looks of it, this guy, most likely a Bluecard(German equivalent of H1B) was just cheating and stealing his way up the career chain through the revolving door of the blue-chip automotive sector, until he got caught. Companies both big and small, never ever encourage you to bring to work proprietary files and data from your previous workplaces, since that's a guaranteed lawsuit as these things always get out eventually.

AshamedCaptain 3y ago

A problem here is that while the companies will generally make very clear that they don't want you to have any single line of code, any schematic, any drawing, anything at all from your previous company; they may also expect you to bring "experience" from the previous company, thereby pressuring more junior employees into doing exactly that - bringing some docs from the previous company - but not telling about it. Through my career I have been to several meetings where everyone was, notebook in hand, expecting to hear the "experience" from the new guy. That is obviously as legal as it gets, but the pressure for the junior employee to have kept a couple of notes is there, and you'd never know. i.e. I suppose no one was aware that he had this code, and it's unlikely it went into nvidia's codebases or that nvidia wanted it; but it also doesn't mean nvidia did not pressure the guy into doing that.

FirmwareBurner 3y ago
That sounds wrong in so many ways. Do you live in China or something where this is expected? I've worked at about 10 or so companies in 3 countries and it was never expected for the juniors to ever "bring documents from previous workplaces as knowledge and not tell about it". Bringing your "experience" means only the experience and problem solving skills that are in your head as we're in the knowledge work business. Bringing documents to regurgitate just means IP theft, not knowledge work and is no guarantee to make you a productive employee, and no company would ever touch you for ever doing that.
- chii 3y ago
  > Bringing your "experience" means only the experience and problem solving skills that are in your head it's hard to differentiate experience with IP. For example, there might be a tricky problem (say, in manufacturing), and the solution is a trade secret. The "experience" from said employee is really just relaying that trade secret.
userbinator 3y ago
Some people have very, very good memories and can bring all of that in their brain. Does that make it legal or not, just because it's in someone's brain and can be easily regurgigated at will? It's a subtle question.

varelse 3y ago

[dead]

tedunangst 3y ago

So... noncompetes, except for the hiring company?