Hacker News Reader

Comment by feverzsj | Hacker News Reader

So he was already CEO/CTO of 2 China companies while still working in google. And these information are publicly available right after he registering them. Seems a management disaster of google.

View on HN

You expect Google to scan the database of companies in every country continuously to see if employees are executives of them? How would this handle different people who have the same name?

Disclosure: I work at Google.

Presumably for such a high profile position a simple um, Google of the person, checking LinkedIn, or a standard background check would reveal this.

> Within weeks of the theft starting, prosecutors say, Ding was offered the position of chief technology officer at an early-stage technology company in China that touted its use of AI technology and that offered him a monthly salary of about $14,800, plus an annual bonus and company stock. The indictment says Ding traveled to China and participated in investor meetings at the company and sought to raise capital for it.

> He also separately founded and served as chief executive of a China-based startup company that aspired to train “large AI models powered by supercomputing chips,” the indictment said.

These events happened after the person was hired.

This would suggest performing background checks with some frequency - presumably at least once a month - in order to catch the events promptly.

> Prosecutors say Ding did not disclose either affiliation to Google, which described him Wednesday as a junior employee.

... and not just of high profile or senior developers, but all of the junior developers too.

> You expect Google to scan the database of companies in every country continuously to see if employees are executives of them?

Um, yes? That’s among the least invasive and cheapest due diligence they could do.

Perhaps just perhaps the task is a bit harder than what you make it sound like

Instances of people sharing the same name are far more common in china than elsewhere. For example there are more than 30 thousand people called "Wang Wei".

The fact is complicated by the fact that the writing systems are different and transliteration errors are commonplace.

How many people named Wang Wei in any given year become the officers of companies?

Google could even automate this with an email, opting into which would be a requirement for any senior employee handling the kind of information the US government cares about.

"A person sharing your name has registered a company in China, as of 2024-03-07. To affirm that you are not related to this person, please click this link. If you were this person, please reply to this email for next steps."

Edit: obviously, criminals don't mark the "yes I'm a criminal box" on forms. That's not the purpose it's there to serve.

If you are guilty of a much more serious crime, saying you're not related to this person or ignoring the email won't add much to your guilt.

"Yes, I am not this person"

phew

I think it is quite difficult to find out the officers of Chinese companies. There was the big wall street stock scandal a few years ago with respect to Chinese listings on US exchanges.

>opting into which would be a requirement for any senior employee

According to the article, he was a junior employee.

>Edit: obviously, criminals don't mark the "yes I'm a criminal box" on forms. That's not the purpose it's there to serve.

What purpose would it serve? Would it have prevented this case?

To add to that, I don't think Google (or any American company) would ask for foreign ID numbers. Your SSN can be used for a background check in the USA, but not in China.

Every problem is easy and cheap until you think about how to do it.

Not for nothing but plenty of other companies do pretty much just this, for example in defense. Surely Google of all companies should be able to do a simple search like that on a regular basis.

In highly regulated national security impacting industries like defense, that makes sense. Google has not developed that rigor yet, although it's becoming obvious that their business has high national security implications now.

I don't think Google has ever had rigor, in anything except possible things which directly affect uptime. It seems to be a systematic problem - look at their history with chat apps for example. Great for hackers - both ones working for Google and ones working for other governments, apparently.

Not sure why this was downvoted but there is a lot of evidence to support this statement, despite the way Google is perceived

> You expect Google to scan the database of companies in every country continuously to see if employees are executives of them? How would this handle different people who have the same name?

> Disclosure: I work at Google.

It's Google. Not a mom and pop shop, not a startup, not even a large bank. It's a massive conglomerate who's entire business model revolves around data.

So yes. And same-name conflicts can be handled case by case.

>And same-name conflicts can be handled case by case.

How? Several times I've had to contact someone within Google whose name I know, but when I go to look up the person's email, there are multiple employees with that name. This is just within Google. Think of within an entire country.

I'm not aware of any corp doing this and why should they? There are as many valid reasons registering a company without affecting your employment.

Big 4 do this routinely to check for conflict of interest as a result of audit regs.

When you apply to Google, they ask what other employment you have, IP you own, etc. Many companies do some variation of this, but I believe Google is one of the most restrictive on its employees.

Sure, if it's an employment that's standard procedure in every company i ever applied to ask/rule out if you would be employed by another company after start date. I was rather operating under the assumption when you're not employed / the owner but the ex-googler seems to have been an employee in a rivaling business in both cases which would have clearly violated his contract with google.

But this person would just lie and say no. The application isn't a lie detector.

And how are they going to access Chinese databases that they are not allowed to access? It's Google, not the CIA. I wouldn't be surprised if all of that information was covered under China's broad state secrets law.

> And same-name conflicts can be handled case by case.

...unless they're Chinese.

They could try Googling it

So I've worked at a few places, none nearly as fancy as Google. Not a single one would have had files being uploaded to personal cloud storage from a work device go unnoticed. That was the red flag, at that point they should've been monitoring actively.

“showing that another employee had scanned Ding’s access badge at the Google building in the U.S. where he worked to make it look like Ding was there during times when he was actually in China”

Google can’t secure itself. That’s been true for years. It’s an enterprise held together by monopoly power, lobbying and low interest rates.

The Google hiring process can take months. They have time to haze people with Leetcode but no time to do a good vet of a person who may be a high risk security threat.

How would Google have detected this before hiring him? It doesn't sound like he started working at the other companies until after he started at Google.

Google already apparently logs every network packet on the internal network (including DPI), so I imagine scanning corporate registrations can't be that much worse.

I used to work at a Chinese tech company. I hear that it's pretty common to use aliases, instead of your real name, due to anti-compete clauses when you switch between companies. Even if a company had the ability to do background checks, like you mentioned, it'd be pretty hard to automate if the practice is commonplace.

Not agreeing or disagreeing, but what’s the remedy? To regularly scour sources for information on tens of thousands of employees and parse actionable meaning from the data?

Maybe someone can make a horrible start-up that does this as a service.

making vast amounts of scraped data accessible, almost like search.

you’re right, the big names probably can’t handle that on their own.

> Not agreeing or disagreeing, but what’s the remedy? To regularly scour sources for information on tens of thousands of employees and parse actionable meaning from the data? Maybe someone can make a horrible start-up that does this as a service.

If a colleague new about it and reported it then that should lead to action 100% of the time. The question is if that happened or not.

Are you prohibited from owning a company or acting as the CEO of a company while employed by Google?

You're supposed to declare anything that's a potential conflict of interest, and Google is large enough to have a lot of interests. So if you're moonlighting as an Uber driver, Google's probably cool with it (at least if Waymo is not in your hood); if you're moonlighting trying to build the next Uber for X, Google probably would not be.

> What is Article 7 of the Chinese Intelligence law?

> Article seven says in part that “All organizations and citizens shall support, assist, and cooperate with national intelligence efforts in accordance with law, and shall protect national intelligence work secrets they are aware of.

And that's just a nice wording to make it official, russians don't have anything similar yet they keep bribing small and big people all around the world to often perform literal treason of their home country, and quite a few do so for petty sums. Your Chinese relatives can also be just sentenced ie for made up drug trafficking to execution and subsequent organ harvest if say sending them to 're-education' camp won't convince you.

Anybody having Chinese citizenship and any position of power or access to secret stuff should be treated as potential threat and evaluated continuously. Or just not hired. If they are actually serious about such a work they should give up their nationality, if they can't then they are risky. Its a serious stuff by no means, but this is how China plays so literally everybody around the globe has to adjust or suffer subsequent consequences.

They can't "give up their nationality". Chinese government's position is that once Chinese always Chinese, and emmigrating doesn't affect that. They will still come after your family on mainland. Or use their "local police" forces stationed in most western countries to harass you in your new location.

“ use their "local police" forces stationed in most western countries to harass”

Totally under appreciated point. It’s not “over there” anymore, the CCP have a strong and growing presence in the Bay Area now. Penetration into the FBI will take longer than google or local law enforcement but it is inevitable.

> They can't "give up their nationality"

You can, but it's a fucking pain in the ass, and when Zero COVID kicked in, the Chinese Embassies and Consulates stopped processing anything.

Its a formality they can ignore though. At least they have recent precedence with that Swedish bookseller who was abducted in Thailand a decade or so back.

I mean, you historically could ignore it, but it's changed since the anti-corruption purge began in 2016.

Imo there's no reason to poke that bear anymore - a lot of bad practices that were common 10 years ago are not tolerated anymore (though sadly, a lot of good practices have also started getting cracked down, like domestic criticism)

Edit: you're talking about Gui Minhai. Ok yea that's fair.

I would place money on China in 2024 being worse at rule of law, not better, than in 2016. They granted defacto citizenship to that snowboarder, for example, even though there is no way she qualified under the text of its own law (China doesn't allow for dual citizenship...unless convenient). That was 2022.

It has been downhill since Xi took charge, but yet, he was able to use accusations of corruption to purge his competition. The things that have improved are mostly public order (like prostitution being much less visible than it was).

I agree with ya!

A lot of the crackdown was performative, but silver lining is that at least some bastards got punished as they deserve (albeit by equally reprehensible bastards).

Sort of a broken clock is right twice kinda situation.

Do you not know any first generation Chinese Americans to say such inaccurate statements? This is incredibly inaccurate, naturalized citizens are treated as foreigners by the PRC.

Only when it's convenient to the PRC to do so. When it isn't, they're Chinese:

https://en.wikipedia.org/wiki/Gui_Minhai

Who, after being kidnapped, conveniently and totes voluntarily applied to have his Chinese citizenship reinstated.

Giving up citizenship doesn't solve the problem of retaliation against family

Reply on news.ycombinator.com