Stinker, emailer, trawler, spy: How an engineer stole top US chip designs, smuggled them to China to set up a rival fab

Chinese chap swiped communications blueprints from what-is-now-Broadcom on behalf of Beijing

An engineer-turned-spy stole confidential blueprints of American wireless electronics on behalf of the Chinese government to run a rival factory churning out the components in the Middle Kingdom.

Late last week, Hao Zhang, 41, was found guilty of economic espionage and theft of trade secrets, as well as conspiring to commit both crimes, after a four-day bench trial in the US. The verdict was handed down by Edward Davila, a federal district judge in northern California. Zhang faces up to 15 years in the cooler, and will be sentenced this year. He was released on a $500,000 secured bond.

Zhang took a job at high-end American semiconductor outfit Skyworks from 2005 until May 2009, according to his indictment [PDF]. During that time, he trawled his employer's computers for industry secrets, and used his friendship with former classmate Wei Pang, who worked at US chip giant Avago, to obtain intellectual property from that corporation. Avago is now known as Broadcom via a complicated takeover in 2015.

Specifically, Zhang stole from Skyworks and Avago trade secrets on Surface Acoustic Wave (SAW) and Bulk Acoustic Wave (BAW) filters, as well as Film Bulk Acoustic Resonators (FBAR), which are used in cellphones and other wireless gear, civilian and military, to reduce interference and boost performance, according to prosecutors. Both Zhang and Pang are Chinese nationals, and both studied electrical engineering together in college in southern Cali. They joined Avago and Skyworks in the United States shortly after earning their doctorates.

"Technological advances in FBARs have played a substantial role in creating smaller, more efficient wireless devices for both consumer and military applications," prosecutors noted. "Avago, one of the victims of Zhang’s theft, was the leading company in the United States manufacturing and selling FBARs. Zhang’s other victim, Skyworks, was developing its own BAW technology."

Sometime around 2006 and 2007, Zhang and Pang sought to create an FBAR factory in China, according to prosecutors, and got in contact with the Chinese government's Tianjin University. The duo met Tianjin officials in San Jose in 2008, and it was agreed they would set up an FBAR-manufacturing plant back in the Middle Kingdom.

The pair simultaneously quit the next year, flew back to their homeland, and were made full professors at the university. According to Uncle Sam, Zhang and Pang jetted off from the Land of the Free with "source code, specifications, presentations, design layouts and other documents marked as confidential and proprietary from the victim companies, and shared the information with one another and with individuals working for Tianjin University."

Zhang and Pang formed, with the uni's help, ROFS Microsystem to make FBARs in competition against Avago and Skyworks using the swiped secrets, Uncle Sam charged. The duo laundered the stolen trade secrets for the resonators through a shell company, Novana, Inc, founded in the Cayman Islands, at the request of their Tianjin handlers, it was claimed. When Pang was in China in 2009, Zhang emailed Powerpoint documents and screenshots of Avago and Skyworks' wireless electronics to Pang.

"The stolen trade secrets enabled Tianjin University to construct and equip a state-of-the-art FBAR fabrication facility, to open ROFS Microsystems, a joint venture located in PRC state-sponsored Tianjin Economic Development Area (TEDA), and to obtain contracts for providing FBARs to commercial and military entities," prosecutors alleged.

Zhang even applied for US and Chinese patents describing the stolen know-how in a bid to legitimize the operation. He was collared by the Feds in 2015 when he flew in Los Angeles, charged, and put on trial.

His indictment that year also fingered Pang, then 35, and four other Chinese citizens for their alleged involvement in the corporate espionage; Jinping Chen, then 41, a Tianjin professor and ROFS board director; Huisui Zhang, then 34, a former classmate of Zhang and Pang, who received a master’s degree in electrical engineering in 2006; Chong Zhou, then 26, who studied under Zhang and Pang and was a ROFS design engineer; and Zhao Gang, then 39, the general manager at ROFS.

As the Feds noted, this is nothing new for tech houses in Silicon Valley: spies are part and parcel of the industry.

"Economic espionage is a pervasive threat throughout the United States, particularly to the San Francisco Bay Area and Silicon Valley which is the center of innovation and technology,” said John Bennett, FBI agent-in-charge for the area.

"While this case exemplifies how easily a few motivated employees can conspire to misappropriate intellectual property for the benefit of the People’s Republic of China, Zhang’s conviction should serve as a warning to our adversaries that the FBI and our partners remain committed to aggressively investigating and prosecuting these crimes."

Sentencing was set for August 31, though given the pandemic, that may be delayed. ®