Big Tech has a spy problem

The PC revolution was upon us, and American tech companies were running circles around Compagnie des Machines Bull, the legendary but struggling French computer company.

France was determined to find out how and why. Between 1987 and 1989, the Direction Générale de la Sécurité Extérieure, France’s equivalent of the CIA, planted moles inside the offices of Bull’s biggest American competitors, IBM and Texas Instruments, where the spies passed trade secrets back to the French company. The FBI and CIA ultimately uncovered the scheme and the employees were fired.

Four decades later, the global Big Tech corporate espionage problem has grown – and so have the stakes.

US-based Nvidia, the world’s largest and most important AI chipmaker, is investigating reports that it was a victim of a foreign surveillance effort. CEO Jensen Huang also acknowledged he had an extramarital affair. Although Huang and Nvidia haven’t provided details or connected those two revelations, The New York Times reported last week that the US State Department developed significant scrutiny of Huang’s relationship with an executive from Singapore-based tech company Megaspeed.

Silicon Valley is particularly vulnerable to corporate espionage: The cutting-edge technologies it develops have grown vital to the global economy, and OpenAI, Google, Apple and many other high-profile tech companies in recent weeks and months have reported foreign and domestic spying attempts at their companies.

“Corporate espionage has always been a big challenge, but today it’s especially so in areas where US firms are building technologies that are foundational to economic, military and other forms of power,” said Matthew Waxman, cybersecurity law professor at Columbia University.

But Big Tech’s spy problem is almost certainly a lot bigger than anyone realizes.

As IT exploded in economic import over the past several decades, information has become one of the world’s most valuable commodities. That has turned Big Tech’s secrets into the gold sitting in the underground vault – and made it rife for theft.

AI has significantly intensified the battle for trade secrets.

Cyberattacks and digital intrusions aren’t going anywhere. But the higher stakes of acquiring trade secrets have placed a renewed emphasis on human espionage inside corporations, said Greg Pollock, director of research and insights at risk management company UpGuard.

“It’s true that huge amounts of data have been compromised through hacking, but the most important information is still what’s said in private,” Pollock said.

The most sophisticated actors don’t choose only one path to gain access to trade secrets: Cyberattacks can help countries and companies steal information, but a human source can help advise what secrets matter and what decisions will be made about them, noted Rebecca Krauthamer, CEO and cofounder of QuSecure, a cryptography provider for the US government.

Adversaries looking to obtain trade secrets through old-fashioned in-person espionage tend to accomplish that in one of two ways: hiring away employees who are willing to spill the beans or plant moles who befriend people.

Having a human on the inside gives companies a potentially much longer timeframe to obtain information than via cyberattack alone – which tend to trip alarm bells after a while. Humans, by contrast, may be able to access key documents that could be related to their everyday tasks – or at least appear to be, noted Madhu Shashanka, cofounder of security firm Concentric AI.

And, unlike computers, humans can gain the trust of employees, many of whom hold keys to crucial information. That makes anyone a target.

“It’s not just the CEOs who are targeted, and it doesn’t all look like a James Bond movie,” said Krauthamer. “The average Silicon Valley employee knows to be on the lookout for phishing scams. But humans trust other humans. That’s just a growing risk.”

That risk long predates the computer era.

Corporate espionage dates back to at least 1700, when French Jesuit priest François Xavier d’Entrecolles was sent on a mission to Jingdezhen, China – but not the kind of mission you’re probably thinking of.

Imported Chinese porcelain was flooding the dining rooms of Europe’s elite in the early 18th century, and d’Entrecolles was sent to Jingdezhen, home of the country’s porcelain factories, to determine the manufacturing process that had stumped European porcelain makers. D’Entrecolles, who spoke Chinese, spent the next two decades touring factories and interviewing families to determine the secret behind Chinese porcelain. In 1712, he wrote his first letter to the treasurer of the Jesuits’ China missions with a details of the materials used, as well as the process for purifying, molding and firing the porcelain.

Security experts agree that the corporate espionage problem has grown significantly over the past several hundred years – and particularly in the past decade. But how much it’s expanding can’t be fully known.

US federal courts saw a record 1,500 trade secret cases filed last year. And high-profile cases have been a constant in the news lately. A month before the revelations of Huang’s affair, OpenAI said it discovered a “sophisticated recording device” in one of its US offices planted by a Saudi employee who had used an internal productivity tool to determine when and where high-profile executives were meeting. (The former employee pleaded not guilty to the charges.) And in February, the US Justice Department indicted three former Google employees who were spying for foreign countries, including Iran.

But the cases we know about are just scratching the surface of a potentially much more prevalent concern, said Elizabeth Rowe, a University of Virginia law professor specializing in trade secrets and intellectual property.

“It’s a bigger problem than we are aware of,” said Rowe. “The ways these cases come to our attention tend to undercount how pervasive it is.”

The most recent federal statute that criminalizes this espionage, passed in the late 1990s, relies heavily on companies self-reporting. Companies can also take civil action against adversaries, but that still relies on corporations speaking out.

The problem: Businesses have many incentives not to talk about the problem of corporate espionage.

Companies that go to court signal to investors that they lost potentially crucial information. Civil suits – particularly those dealing with complex trade-secret lawsuits – can be incredibly expensive.

The biggest barrier: Filing a complaint exposes the trade secrets and makes them vulnerable to being lost through the lawsuit or the press.

“All this suggests when you see a case that makes headlines, there are many, many more that never made it to the public,” said Rowe.