Independent public-source research Read our evidence standard
ChinaSteals Search
Menu
← All case files CS-020 Jump to sources ↓

AI, semiconductors & telecommunications / 2010–2018

A software developer stripped identifiers from IBM code and offered the product to prospective buyers S1 S2 S3 S4

Jiaqiang Xu left a China-based software role with a complete copy of proprietary clustered-file-system source code. He modified it to conceal its origin, then demonstrated and offered the derivative software to undercover buyers. S1 S2 S3 S4

Evidence at a glance How labels work

Evidence status Adjudicated
Case-level nexus context Court-established or admitted
Public sources 4 Automated checks verify citation linkage; editorial review judges support
Evidence foundation Official summaries only The adjudicated outcome is currently linked through official government summaries; no dispositive court document is yet included. S1 S2
Publication record Published Aug 23, 2026 Reviewed Aug 25, 2026 · Next Aug 23, 2027

Evidence status and PRC-state nexus answer different questions and must not be joined across different actors. Actor-specific outcomes appear below.

Compare this file
Finding

Xu pleaded guilty to all six economic-espionage and trade-secret counts. He admitted intending to benefit the PRC National Health and Family Planning Commission and received five years in prison. S1 S2 S3 S4

01 / Executive brief

Executive summary

Jiaqiang Xu worked from 2010 to 2014 as a systems-software developer in China for a U.S. technology company identified by Reuters as IBM. His job gave him full access to proprietary source code for a clustered file system; after resigning, he retained a complete copy and used scripts to remove or change references that revealed its origin. S1 S2 S3 S4

Xu marketed and demonstrated software built from that source code, including during an FBI undercover operation. He pleaded guilty to all six charged counts and admitted acting for his own profit and intending to benefit the PRC National Health and Family Planning Commission. The court sentenced him to five years in prison. S1 S2

Rows of computer servers with illuminated status lights in a data center
technology

Clustered file systems coordinate data across storage infrastructure; source code reveals how that capability is implemented. This is contextual imagery, not equipment from Xu's case.

Federal Bureau of Investigation · Public domain ↗

02 / The vignette

What happened

Full source access came with an ordinary development job

The asset was not a finished executable that could be bought on the market. Source code exposed the design of a clustered file system used to increase data-storage performance, along with the engineering choices needed to modify and support it. Xu's developer role allowed him to download that material before his voluntary resignation in May 2014. S1 S2 S3

Concealment turned employer code into a competing product

Xu did more than retain a backup. He created scripts that removed or altered identifiers connecting the files to their owner, then used the modified code to build software for customers. That transformation is the bridge between acquisition and use: conceal provenance, preserve functionality, and present the result as something available for sale. S1 S2 S4

Undercover infrastructure made the provenance visible

During meetings with undercover officers posing as startup representatives, Xu offered the source code as a platform for a data-storage business and uploaded files to a test network. A company employee confirmed that the files appeared to contain protected code. Xu ultimately admitted both commercial use and the intended benefit to a PRC government commission. S1 S2

03 / Anatomy

How access became transfer

This six-part framework asks the same questions of every file. Each stage carries its own evidence state; a listed stage can be alleged, inferred, interrupted, disputed, or not established. The structure does not manufacture a completed transfer or harm.

  1. 01

    Relationship context Documented

    China-based developer

    Xu worked for the victim company's China operation and developed systems software. S1 S2 S3

  2. 02

    Access assessed Documented

    Complete source tree

    His role permitted full access to download the proprietary clustered-file-system code. S1 S2 S4

  3. 03

    Acquisition assessed Adjudicated or admitted

    Code retained after resignation

    Xu left employment with a complete copy of the source code. S1 S2 S4

  4. 04

    Movement assessed Documented

    Files uploaded to a test network

    He provided modified code to undercover infrastructure while discussing a prospective sale. S1 S2

  5. 05

    Downstream use assessed Adjudicated or admitted

    Origins removed and product demonstrated

    Scripts obscured the source while Xu marketed software derived from the protected code. S1 S2

  6. 06

    Consequences assessed Adjudicated or admitted

    Six pleas and five years

    Xu admitted every charged count, including intended PRC-government benefit, and received a five-year sentence. S1 S2

04 / Evidence boundary

What is established—and what is not

Established in the record

  • Xu admitted retaining, disguising, marketing, and distributing proprietary source code from his former employer. S1 S2
  • He admitted intending to benefit a PRC government commission and pleaded guilty to all six counts. S1 S2

Uncertain, limited, or unresolved

  • The court materials identify the victim as an unnamed U.S. company; IBM is the employer identified by Reuters through Xu's public employment profile. S2 S3

Subject response / procedural context

  • Xu resolved the case by pleading guilty to every count. Reuters reported that IBM did not immediately respond to its request for comment. S1 S3

05 / Sequence

Timeline

  1. Development role begins

    Xu began work in China with full access to the proprietary source code. S1 S3

  2. Resignation with code retained

    Xu voluntarily resigned after copying the complete source tree. S1 S2

  3. Guilty plea

    Xu pleaded guilty to all six economic-espionage and trade-secret counts. S1

  4. Five-year sentence

    The court imposed five years in federal prison. S2

06 / People and institutions

Who appears in the public record

Jiaqiang Xu

Former China-based software developer S1 S2 S3 S4

Outcome: Pleaded guilty to six counts; sentenced to five years S1 S2

Actor-specific PRC nexus Court-established or admitted

Jiaqiang Xu: Xu admitted that he intended the stolen code to benefit the PRC National Health and Family Planning Commission. S1 S2 S3

PRC National Health and Family Planning Commission

Government commission Xu admitted intending to benefit S1 S2 S3

Actor-specific PRC nexus Court-established or admitted

PRC National Health and Family Planning Commission: Xu admitted that he intended the stolen code to benefit the PRC National Health and Family Planning Commission. S1 S2 S3

Originator / affected institution

IBM

Employer identified by Reuters and developer of the proprietary source code S1 S2 S3

07 / Consequences

Documented, attributed, potential, and unknown consequences

Documented record

Xu put a functional derivative of the proprietary code into a sales channel, but the reviewed sources do not report a court-adopted dollar loss. S1 S2

08 / Hindsight analysis

Where leadership could have seen risk

These are our analytic judgments based on the public record, not court findings. They are framed to improve controls without treating nationality as a risk factor.

Source access enabled full replication

A developer could copy an entire product foundation, not merely a report or a limited technical excerpt.

Provenance was technically erasable

Identifiers embedded in code were not a durable ownership control once the source tree left company systems.

09 / Apply the lesson

Actions leaders can take

  1. companies

    Limit complete-tree access

    Segment repositories and require task-based approval for bulk export or cloning of crown-jewel source code.

  2. companies

    Detect provenance stripping

    Monitor scripts and mass edits that remove copyright, product, package, or repository identifiers.

  3. both

    Test post-exit exposure

    Use code-fingerprint and market monitoring to identify protected software reappearing in demonstrations, bids, or outside products.

10 / Source record

Sources

Links point to the public record reviewed for this file. Government releases can summarize court proceedings but remain government-authored sources; the source note identifies those limits.

  1. S1

    Chinese National Pleads Guilty to Economic Espionage and Theft of a Trade Secret ↗

    U.S. Attorney's Office, Southern District of New York · Published May 19, 2017 · Retrieved Aug 23, 2026

    official summary government release
  2. S2

    Chinese National Sentenced for Economic Espionage and Theft of a Trade Secret from U.S. Company ↗

    U.S. Department of Justice · Published Jan 18, 2018 · Retrieved Aug 23, 2026

    official summary government release
  3. S3

    Ex-IBM employee from China gets five years in prison for stealing code ↗

    Reuters via Business Standard · Published Jan 20, 2018 · Retrieved Aug 23, 2026

    Identifies the otherwise unnamed victim company as IBM from Xu's public employment record.

    independent reporting reputable reporting
  4. S4

    Superseding Indictment: United States v. Jiaqiang Xu ↗

    U.S. District Court for the Southern District of New York via U.S. Department of Justice · Published Jun 14, 2016 · Retrieved Aug 25, 2026

    Locator: United States v. Xu, No. 7:16-cr-00010, ECF No. 15

    Primary charging document for the six counts and alleged PRC-commission beneficiary; guilt and sentence are supported by the later official plea and sentencing summaries.

    procedural record court record

12 / Reference

Cite this dossier

Use the permanent URL and review date below so readers can identify the version of the public-source record you consulted.

ChinaSteals. “A software developer stripped identifiers from IBM code and offered the product to prospective buyers.” CS-020. Published Aug 23, 2026; last reviewed Aug 25, 2026. https://chinasteals.com/cases/jiaqiang-xu-ibm-source-code/

Permanent dossier URL →