First AI Espionage Conviction Faces Legal Challenge as Judge Questions Charges

A federal jury’s conviction of former Google engineer Linwei Ding on economic espionage charges — the first of its kind for AI-related theft — is already facing judicial scrutiny that could undermine the Justice Department’s broader strategy against Chinese intellectual property theft.

Ding, 38, was found guilty on 30 January 2026 of seven counts of economic Espionage and seven counts of trade secret theft for stealing over 2,000 pages of confidential Google AI documentation between May 2022 and April 2023, according to the Department of Justice. The stolen materials detailed Google’s Tensor Processing Units, Graphics Processing Units, and SmartNIC network interface cards — the compute infrastructure that powers large-scale AI training.

But on 13 May, U.S. District Judge Vince Chhabria told prosecutors they face an “uphill battle” defending the economic espionage charges during a hearing on Ding’s motion for a new trial, per Courthouse News Service. Chhabria questioned whether Ding committed theft when he downloaded files in December 2023, noting he had “already stolen the trade secrets” months earlier when he first accessed them without authorisation in May 2023.

The Technical Breach

Ding joined Google on 13 May 2019 as a software engineer responsible for optimising GPUs for machine learning applications. Over 11 months beginning in spring 2022, he transferred 1,255 documents totaling approximately 14,000 pages to his personal Google Cloud account, The Register reported. His method: convert files to PDFs using the Apple Notes app on his company MacBook, then upload them from Google’s network to evade detection systems.

The stolen documentation covered Google’s proprietary AI compute architecture — the hardware and software stack that determines training speed, cost efficiency, and model performance. In the race to artificial general intelligence, this infrastructure represents billions in R&D investment and a material competitive edge.

The Chinese Connection

While stealing Google’s secrets, Ding accepted a chief technology officer position at Beijing Rongshu Lianzhi Technology Co., a machine learning startup, at 100,000 RMB monthly (roughly $177,600 annually) plus equity. He also applied for a Shanghai government-sponsored talent program, stating his goal was to “help China to have computing power infrastructure capabilities that are on par with the international level,” according to trial evidence cited by The Hacker News.

These talent programs, funded by Beijing, explicitly recruit researchers and engineers working abroad to transfer expertise back to China — a model U.S. counterintelligence officials describe as state-directed IP acquisition. “In today’s high-stakes race to dominate the field of artificial intelligence, Linwei Ding betrayed both the U.S. and his employer by stealing trade secrets about Google’s AI technology on behalf of China’s government,” said Roman Rozhavsky, assistant director of the FBI’s Counterintelligence Division.

Regulatory Fallout

One day after the conviction, Senators Chuck Grassley and Jim Banks sent letters to nine major AI companies — OpenAI, Anthropic, Google, Meta, Microsoft, Amazon, x.AI, Safe Superintelligence, and Thinking Machines Lab — demanding detailed disclosures of their espionage safeguards and insider threat programs, per the Senate Judiciary Committee. The letters signal Congress intends to use the Ding case as leverage for legislation mandating stricter vetting of foreign nationals in sensitive AI roles.

Separately, the Foundation for Defense of Democracies called for increased export control enforcement by the Commerce Department’s Bureau of Industry and Security, and tighter National Science Foundation oversight of foreign researcher access to U.S. AI infrastructure.

The Legal Vulnerability

Judge Chhabria’s skepticism centres on temporal logic: the economic espionage statute requires proving the defendant stole trade secrets to benefit a foreign government. But if Ding “already committed the crime” when he first accessed files without authorisation in May 2023, later downloads may not constitute separate theft — they’re simply copying material he’d already misappropriated.

This technical distinction could unravel the DOJ’s strategy. Economic espionage carries a 15-year maximum per count versus 10 years for trade secret theft. More importantly, espionage charges frame the case as state-directed aggression rather than individual malfeasance — a narrative the Justice Department needs to justify broader counterintelligence resources and legislative action.

If Chhabria overturns the espionage counts, the conviction would stand only on trade secret theft — a routine IP case, not a landmark national security prosecution. That outcome would complicate the DOJ’s efforts to secure harsher penalties and expanded surveillance authorities for AI-related espionage.

What to Watch

Judge Chhabria is expected to rule on Ding’s motion for a new trial within 60 days. If he overturns the economic espionage convictions, the DOJ will likely appeal to the Ninth Circuit, setting up a precedent-defining case on what constitutes “theft” under the Economic Espionage Act when digital information is copied rather than physically removed.

Separately, responses from the nine AI companies to the Senate Judiciary Committee letters — due by 15 June — will reveal whether Silicon Valley views insider threats as a compliance checkbox or an existential risk. Companies that disclose weak vetting protocols for foreign nationals with access to frontier model training infrastructure will face immediate pressure to overhaul hiring and access controls.

The broader question is whether the U.S. can secure its AI supply chain without crippling the international talent pipeline that built Silicon Valley in the first place. Chinese nationals represent a significant share of AI researchers at leading labs; blanket restrictions would slow innovation. The answer will likely involve more aggressive monitoring of employees with access to core infrastructure, stricter enforcement of non-disclosure agreements, and technical controls that limit bulk data exfiltration — measures that add friction to collaboration but may be unavoidable as the stakes of the AI race escalate. Whether those safeguards emerge from voluntary industry action or mandatory regulation will depend largely on whether Chhabria’s doubts translate into a weakened conviction, signalling that courts view current espionage statutes as ill-suited to the digital theft era, or whether the verdict stands and establishes a legal template for aggressive prosecution of state-directed IP theft in the AGI age.