LOLz, Law, Lettuce

LOLz, Law, Lettuce

We totally get it. Your newsfeed of late has been busier than a Michigan rest stop. The economy. Foreign affairs. AI models escaping and hacking other models (real talk: why do they call it a “sandbox”? Seems unnerving that the birth of Skynet will be associated with a child’s backyard toy, no? I digress . . .). Tornadoes in New Jersey. And of course, lettuce . . . so we figured you could use a palate cleanser.
 
Fortunately, there’s a recent story involving good, clean, old-fashioned corporate espionage – with practical HR and employment law takeaways included. In this edition, we’re talking about Apple’s recent lawsuit against OpenAI and what it potentially means for you and your business. Enjoy!

When the Exit Interview Is Optional (For Them, Not For You)

“LOL, I found out I can access the [network storage], so funny.”
 
Allegedly that’s an actual line from an actual text message, sent by a former Apple engineer, now working at OpenAI, to a then-current Apple employee he was recruiting.
 
Let’s back up.
 
On July 10th, Apple filed a complaint in the Northern District of California accusing OpenAI and two former Apple executives of essentially running an extraction operation. The facts, if true (and for so many reasons, we stress if), are almost comically brazen.
 
Chang Liu, a Senior System Electrical Engineer who left Apple for OpenAI in January, allegedly discovered – after he’d already left – that he could still access Apple’s internal network storage. His reaction, preserved forever in a message to a still-employed Apple colleague he was recruiting, was the aforementioned “LOL” text. Allegedly he then spent weeks downloading Apple’s confidential files, coached his colleague on how to copy files “to avoid trouble with the security team.”
 
Meanwhile, Tang Tan – a 24-year Apple veteran who became OpenAI’s Chief Hardware Officer – allegedly used Apple’s internal project codenames during job interviews to fish for information about unreleased products, directed candidates to bring actual Apple hardware components to “show and tell” sessions (one candidate reportedly said he “didn’t even know we could take those from the office” . . . correct instinct, sir, correct instinct), and circulated an internal Apple document titled “Need to Know” describing Apple’s own security procedures for departing employees – shared with new hires before they gave notice, so they’d allegedly know exactly what to dodge. Fun fact: there are apparently over 400 former Apple employees now at OpenAI.
 
OpenAI’s response was “I know this looks bad . . . but we can explain!”
 
(ok fine, they actually said they have “no interest in other companies’ trade secrets”)

The Offboarding Choreography

While this case is certainly very entertaining, let’s talk about the less entertaining (but certain very important) reality of locking down company data.
 
We talk to clients constantly about protecting their systems when they’re the ones doing the firing – cutting system access, collecting devices, monitoring activity, the whole choreography (and if you just read that and said something to the effect of, “what do you mean, ‘choreography?’ then we need to talk).
 
For various reasons, this process is easier and more manageable because you control the timing. You know the termination is happening at 2:00 p.m. on Thursday, IT is ready at 1:55 to revoke access, and you’ve been monitoring the activity of someone who presumably had no prior warning or motivation to abscond with company data.
 
Resignations , on the other hand, don’t give you that same luxury. The employee sets the clock, and by the time they’ve given you notice (if they even give notice), they may have had a running start you knew nothing about. So the real question isn’t “do we have an offboarding policy”, it’s whether you have systems and policies in place to protect against rogue actors within your organization before they announce they’re leaving.
 
A few things to look out for:

• Watch the Digital Telltales: Nobody expects you to run a forensic intelligence unit, but corporate exfiltration leaves footprints. A sudden spike in cloud downloads, unusual printing volumes after hours, and our personal favorite: forwarding internal emails to a personal Gmail account. Periodically auditing for anomalous behavior is essential. Where possible, deploy software that restricts or alerts on the use of unapproved external storage drives (USBs).
• Pay Extra Attention During the Notice Period: The moment an employee gives notice, immediately evaluate whether they actually need continued access to sensitive systems. If they are staying on briefly to facilitate a transition, drill down to the exact scope of access required. They rarely need full admin rights to hand off their duties.
• Treat the Exit Interview as a Security Event: Treat the exit interview seriously – and while we of course mean going through the questions as to why the person is leaving to ascertain any issues, we also mean making sure you collect and confirm all devices are back and confidentiality agreements are all signed.

Whether Apple proves any of this remains to be seen, and is also largely irrelevant to your operations. But, the underlying lessons are also largely irrelevant to any jury verdict – pay attention to what’s going on in your organization and take steps to protect against abuse.

That’s all for this one. Enjoy the rest of your summer (feel free to go for that chocolate over the lettuce). As always, if you’ve got questions, you know we’ve got answers (except that whole “sandbox” thing …).

~ The W + K Team