CEO Catches Stranger After Hours, Prompting Espionage Charges (wsj.com)

An anonymous reader shares a report: Samuel Straface thought he was the last one out the door one recent evening at the medical-technology startup he leads in suburban Boston. But as he passed a glass-walled conference room on the second floor, Dr. Straface says he saw a man he didn't recognize, sitting by himself in front of two open laptops and a tablet device. He continued walking a few steps toward the exit, but then, feeling uneasy, he turned back (Editor's note: the submitted link could be paywalled; alternative source). The man was later identified as Dong Liu, a dual citizen of China and Canada. And his after-hours computing at Medrobotics is at the center of an economic-espionage case brought by U.S. prosecutors. Mr. Liu is in federal custody, charged with attempting to steal trade secrets and trying to gain unauthorized access to the company's computer system, prosecutors said. If convicted of both charges, he could face a maximum sentence of 15 years in prison. "Mr. Liu adamantly asserts his innocence and we fully expect he'll be exonerated after a careful review of the evidence," said Robert Goldstein, Mr. Liu's defense attorney. The U.S. attorney's office for the District of Massachusetts declined to comment on the case beyond details in court records. Before his arrest, police said Mr. Liu told them he was there to discuss doing business with the company -- but Dr. Straface says no one had scheduled a meeting with Mr. Liu.

Comments

Paywall.

[Jahoda]

I don't understand why we have paywall-ed links on the front page.

Re:Paywall.

[rsmith-mac]

Because often those are the original source of a story, and when doing a meta-story like this it's good journalism (and manners) to acknowledge and link to the original source.

If Slashdot doesn't link to the original source, then they're doing readers a disfavor by linking to a second-hand account. But at the same time if the original source is paywalled, then it's not going to be accessible to everyone. So linking to the original and offering an alternative link, they're both properly citing the original source and making sure a longer story is available to everyone.

Computer security.

[Gravis Zero]

Honestly, if you are in a field that is competitive enough where others would want to copy your work, you should at least take the proper measures to ensure that somebody cannot just walk in the building and access your data. Your drives should be encrypted at the very least.

Re:Doesn't surprise me...

[GameboyRMH]

Came here to post that he wouldn't have got a second look if he was wearing a hardhat and reflective vest. Yes, even on the computers.

Re:Non paywalled versions

[Tailhook]

The Internet perceives paywalls as damage and routes around them.

Re:"There for a meeting"

[dysmal]

https://www.csoonline.com/arti...

As the article stated, the CEO (Straface) was the last one out of the building which implies it's late (7pm? 8pm?). Regardless, if you're in an office to meet with someone and you notice that no one else is around after 2.5 hours, that's usually a sign that your meeting has been canceled!

Re:No more business as usual

[wickerprints]

While I agree with the principle of some form of financial/economic penalty along the lines of what you propose, I am unclear as to how this could be implemented effectively.

The problem with simply voiding any US debts to China (or any other sovereign nation) because we catch their agents committing corporate or military espionage, at least in my own naive understanding, is that it basically sends a signal to the world that the repayment of our debts is conditional and uncertain: should the US government simply decide "we don't like something you're doing so we will refuse to pay you back," this would have clear repercussions with respect to the ability for the US to borrow money. It's a bit like saying that because Volkswagen was caught manipulating vehicle emissions in some of their models, you don't have to pay back the loan on your vehicle whose emissions are compliant and therefore whose market value was not affected. There's no contractual basis for that unilateral decision on the borrower's part.

But again, I absolutely agree that such flagrant actions (and let's be real here, there is and has been widespread and pervasive and extremely successful corporate espionage committed by China for decades) should be punished so severely that it should cost significant amounts of money to ensure mere compliance. I just don't know how it could be done.

Re:I'm normally against overcharging

[BlueStrat]

If he is actually in the employ of the Chinese state and is an illegal agent it's a fair bet the Chinese will do anything and everything to get him back...

Why would you think they'd do that? It's not like the Chinese value individual lives a great deal.

More than likely they'd either leave him to twist in the wind if he knows little that could hurt the Chinese government, or they'd simply have him killed while in custody by someone who has access to him and something to be blackmailed with or also otherwise in the Chinese government's employ.

Strat

Re:Of course he was there for business reasons!

[Tjp($)pjT]

Yes, as people often do business with a company by hiding in a bathroom with their feet on the toilet seat, waiting for the lights to go off, then making their way to a room with good guest WiFi, other networking and power easily accessible when they suspect no one is left in the office. Then we set up shop and probe their networks and download information, solely to prepare to do business with them. And bright and early the next day we'll be there waiting to start work with them! Yes, that has to be it!

People need to have their WiFi, and general network to offices cut-off when it is after hours. Heck, cut power to conference rooms after hours. We have sufficiently smart devices that swiping an access card could turn on lights to your office, and the power and network outlets in your office. WiFi is one of the biggest vulnerabilities to data security. Guest WiFi even more so as it is often left without a password requirement or the password is posted in conference rooms for all visitors to easily use. And often seldom if ever changes. Work smarter people. Intellectual property is one of the major items America still has significant "wealth" and contributions to the GDP.

Re:I'm normally against overcharging

[liquid_schwartz]

When Western countries were tripping over themselves to help China build high speed trains eagerly agreeing to conditions like doing the fabrication in China, I just shook my head at their naivete. And predictably, after China had gleaned enough knowledge to build the trains themselves - either by direct observation of the construction machines and plans, or by outright theft - they booted the Western companies out and began building the trains themselves. The Western reaction is "that's not fair!". The East Asian reaction is "how stupid can these guys be?"

To be fair most citizens and employees fully expected the Chinese to steal the plans and copy the trains and were generally these deals. The CEOs who got paid well to sell out the company are almost as guilty as the Chinese. Certainly accomplices. The politicians who turn a blind eye to forced technology transfers should be punished as well.

Re:No more business as usual

[tlhIngan]

The sword of Damocles works because it hangs, not because it falls.

The *potential* for voiding Chinese holdings of US treasuries should be held over them not because it's effective in any small case, but because it's an existential threat against any large-scale Chinese sell-off or other manipulation based on them.

We could void them selectively if we wanted, but ultimately the market would just price in that risk and raise interest rates.

That's exactly what happens. Right now, people love US debt because in general, the US is a very trustworthy country that will repay the debt.

Threaten to invalidate that debt (i.e., fail to repay) and the US goes from "trustworthy" to "banana republic" - think of other countries failing to repay debt (like say, Greece). This means any time the US wants to borrow money, people will require a higher interest rate just because they're not sure the US will repay it.

It's just like a credit rating - most first world nations are generally quite good - AAA+ or so, which means they're low risk, and thus low interest. But it's a great place to park money you're not using - a safe investment and it also gets money flowing and economy humming. But do something like fail to pay a debt, or threaten to do so and you lose the nice credit rating and creditors will demand more money to cover the risk.

Yes, even personal loans work this way - that's why there are companies like Equifax making lots of money storing your credit history - the repayment rate is what determines if the bank will let you have the loan.

Compatible with the Harvard Business School method

[Ungrounded Lightning]

The CEOs who got paid well to sell out the company are almost as guilty as the Chinese.

It's right in line with a career building move for denizens of the C-suite (CEO, COO, CFO, CTO, ...) that is often attributed to the teachings of the Harvard Business School (though graduates of other business schools have also been seen to execute it). It works like this:

1. Join the company as the new, or turnaround, CEO (or whatever). Get a big package of stock options (a "free" leveraged investment that pays off drastically if, and only if, the stock price rises.)
2. Dump the R&D and other preparation for future products (and any personnel working on them). Perhaps also make some cuts in customer support for current products, cheapen the product, cut infrastructure maintenance, etc.. This drastically cuts expenses while not (initially) affecting revenue, boosting the "bottom line" of the financial statements.
3. Announce the big boost in profits at a few quarterly reports and the investor/financial media phone conferences. The stock price soars, as does the executives' reputation as a corporate administration wizard.
4. Select a successor (sucker), leave the company, and cash out the stock options. (PROFIT!) Of course cashing out when leaving is viewed as prudent, since the company will now be run by somebody else the way THEY feel like running it.
5. Rinse and repeat at your next company. Meanwhile, your successor is in charge, and catches the blame, when the house of cards collapses.

The scam depends on the benefits being immediate and the damages, though bigger, being delayed.

Moving production to China (or some other offshore sites), with its far lower costs but track record of expropriation of trade secrets (which takes a while to spin up into a competing product) has exactly the same structure.

Of course it's a breach of fiduciary duty for officers of a corporation to do this. But they can make it LOOK like they're being responsible by taking advantage of the drastically lower production prices to "maximize investor value".

Until enough investors catch on to this, and both the markets and stockholder meetings shift to make this a losing strategy for executives (or regulators pick up on it ditto), expect it to continue.