sb-nz logo
Story image

Tesla's suit against ex-employee a strong case for IP security

16 Jul 2019

A former Tesla employee has reportedly admitted that he stole trade secrets belonging to the company and uploaded them to his own account.

Former engineering employee Guangzhi Cao admitted to uploading .zip files containing the source code to Tesla’s Autopilot software to his personal iCloud account.

What’s more, he is accused of then sharing that code and 300,000 files with his current employer, Alibaba-backed China competitor Xiaopeng Motors (also known as Xmotors and XPeng).

Xiaopeng Motors is reportedly developing technologies similar to Tesla’s Autopilot, Tesla claims.

A court document states:

“Mr. Cao admits that at the time of his separation from employment with Tesla he did not disclose that he had previously made copies of Tesla files during his employment, but Mr. Cao alleges that Tesla never inquired about these materials, or any other confidential or trade secret information, during his separation from employment with the Company, and further alleges that he made extensive efforts to delete and/or remove any such Tesla files prior to his separation from Tesla.”

This isn’t the first time Tesla has been put in a difficult situation following a dispute with an ex-employee. In 2018, Tesla took former US employee Martin Tripp to court for sharing the company’s confidential information.

The entire saga could have been prevented if Tesla had used data loss prevention (DLP) products, according to Digital Guardian cloud services security architect, Naaman Hart.  

“There was no need for this employee to be using their own iCloud for data storage even if the original intent was non-malicious,” says Hart.  

“This should've been detected and blocked, either by identifying the important files and selectively blocking them or by a blanket ban on iCloud.  Simply allowing this to happen has exposed Tesla to potential data loss.  Closing the doors to private cloud hosted services is a proactive approach to preventing data loss.”

“Yes, it's great that Tesla can get information from Apple to help their case, but the data is gone and now it's in the wild for Tesla's competitors to use.  Implementing DLP visibility solutions are also a great reactive measure to retrospectively identify and confirm a specific employee's malicious intent.  This information can enhance any court proceedings and get a positive outcome for the victim.”

“Prevention is better than reaction however, so focusing on forcing employees to use approved and secure channels is the preferred approach.  You don't have to make yourself ineffective, just provide a sufficient set of tools that you can control, rather than allowing people to use services completely outside of your control.”

Story image
BackupAssist partners with Wasabi for greater cyber-resilience
This partnership provides customers with an up to 80% less expensive solution that is faster than the competition for achieving enterprise-grade cyber-resilience, the company states. More
Story image
Entrust acquires HyTrust, with aim to improve data encryption solutions
Entrust says the acquisition will bolster its effort to deliver data protection and compliance solutions to its customers, while accelerating their digital transformations.More
Story image
Online gaming a 'hotbed' for DDoS attacks — report
The latency and availability issues present in online gaming, in particular, presented an attractive target to attackers, in addition to the enduring popularity of gaming in the era of COVID-19.More
Story image
A brief history of cyber-threats — from 2000 to 2020
Many significant cybersecurity events have occurred since the year 2000 — not every one of them ‘firsts’, but all of them correlating with a change in security behaviour or protection.More
Story image
As digital transformation grows in A/NZ companies, misconceptions about their role in cloud security abound
While an 81% majority of A/NZ organisations are accelerating their digital transformation, a giant 99% of surveyed respondents say they believe their cloud security provider provides enough protection, according to a Trend Micro study. More
Story image
Quantea and Attivo Networks launch joint network security solution
"Attivo and Quantea together provide advanced, real-time, in-network threat detection and improved incident response."More