Tesla's suit against ex-employee a strong case for IP security
A former Tesla employee has reportedly admitted that he stole trade secrets belonging to the company and uploaded them to his own account.
Former engineering employee Guangzhi Cao admitted to uploading .zip files containing the source code to Tesla's Autopilot software to his personal iCloud account.
What's more, he is accused of then sharing that code and 300,000 files with his current employer, Alibaba-backed China competitor Xiaopeng Motors (also known as Xmotors and XPeng).
Xiaopeng Motors is reportedly developing technologies similar to Tesla's Autopilot, Tesla claims.
A court document states:
"Mr. Cao admits that at the time of his separation from employment with Tesla he did not disclose that he had previously made copies of Tesla files during his employment, but Mr. Cao alleges that Tesla never inquired about these materials, or any other confidential or trade secret information, during his separation from employment with the Company, and further alleges that he made extensive efforts to delete and/or remove any such Tesla files prior to his separation from Tesla.
This isn't the first time Tesla has been put in a difficult situation following a dispute with an ex-employee. In 2018, Tesla took former US employee Martin Tripp to court for sharing the company's confidential information.
The entire saga could have been prevented if Tesla had used data loss prevention (DLP) products, according to Digital Guardian cloud services security architect, Naaman Hart.
"There was no need for this employee to be using their own iCloud for data storage even if the original intent was non-malicious," says Hart.
"This should've been detected and blocked, either by identifying the important files and selectively blocking them or by a blanket ban on iCloud. Simply allowing this to happen has exposed Tesla to potential data loss. Closing the doors to private cloud hosted services is a proactive approach to preventing data loss.
"Yes, it's great that Tesla can get information from Apple to help their case, but the data is gone and now it's in the wild for Tesla's competitors to use. Implementing DLP visibility solutions are also a great reactive measure to retrospectively identify and confirm a specific employee's malicious intent. This information can enhance any court proceedings and get a positive outcome for the victim.
"Prevention is better than reaction however, so focusing on forcing employees to use approved and secure channels is the preferred approach. You don't have to make yourself ineffective, just provide a sufficient set of tools that you can control, rather than allowing people to use services completely outside of your control.
