Tesla IP Theft: Engineer Emails 26,000 Confidential Files Before Joining Competitor
A Tesla engineer transferred 26,000 confidential files including autopilot source code, trade secrets, and manufacturing data to personal devices before resigning to join a Chinese electric vehicle startup.
Background
Tesla's Autopilot and manufacturing processes represent billions of dollars in research and development. In 2018, as Chinese EV startups began aggressively recruiting Tesla engineers, the company investigated suspicious data transfers by departing employees.
The Attack
Engineer Guangzhi Cao exfiltrated approximately 26,000 files and 300,000 source code files related to Tesla's Autopilot neural network before resigning to join Xpeng Motors, a Chinese EV company directly competing with Tesla. Cao transferred files using a personal iCloud account and USB drives. Investigation also revealed that another engineer, Chunzeng "Charles" Lv, had taken code and joined Xpeng. Tesla also sued Zoox (autonomous vehicle startup) for IP theft by a former employee.
Response
Tesla filed trade secret lawsuits against both engineers and Xpeng. The US Attorney's office filed criminal charges. Xpeng ultimately settled for an undisclosed amount. The cases prompted Tesla to significantly tighten data loss prevention (DLP) controls and monitoring of employee data transfers.
Outcome
The cases were among the highest-profile automotive IP theft cases. They reflected a broader pattern of Chinese EV companies recruiting from Tesla to accelerate development. Several engineers faced criminal prosecution. Tesla's cases established legal precedent for trade secret protection in autonomous vehicle technology.
Key Takeaways
- Monitor and log all file transfers to personal cloud accounts and USB devices for employees in sensitive roles
- DLP tools should alert on large-volume exfiltration from engineering data stores
- Exit interviews and access revocation processes must include immediate termination of data transfer capabilities
- Trade secret lawsuits against both the employee and the receiving company are an effective deterrent