What happened?
According to The Register on 27/8/2025, Taiwanese prosecutors indicted three people. One is a former TSMC employee who moved to the Taiwan subsidiary of Tokyo Electron, the Japanese chip-equipment maker. Two of the defendants are accused of taking TSMC's 2 nm manufacturing-process secrets, the kind of information TSMC describes as trade secrets belonging to "national core technology".
TSMC said it discovered the matter in July 2025, ran an internal investigation, notified the authorities and filed a complaint in early August. According to the article, these are the first indictments under provisions of Taiwan's National Security Act, amended two years earlier to increase penalties for stealing secrets related to core technology. The sentence prosecutors sought for the former TSMC employee was reported as 14 years in prison. Tokyo Electron said it had taken strict disciplinary action, dismissed the staff concerned at its Taiwan subsidiary and pledged to cooperate with the authorities.
Note: these are allegations by the prosecution; the final outcome depends on the court's ruling.
Lessons for enterprises
- Knowledge lives in files and in people. When staff move to a competitor or a supplier, the risk lies in the documents they once had access to.
- High-tech supply chains share data with many parties. Each party adds one more point to control.
- Early detection determines the ability to respond. TSMC's discovery and report to the authorities within about a month shows the value of internal monitoring.
A data-centric approach
For drawings, process parameters or R&D documents, enterprises can set fine-grained permissions by engineering team, log opens and copies of files, restrict screen capture, printing and copying to external devices, and revoke rights when staff leave. Dynamic watermarks showing the viewer's identity help deter and trace. These measures reduce risk but must go together with confidentiality agreements and a culture of compliance. See also the product.
Three questions for a self-check
- Can R&D staff take process documents out by USB, email or screen capture?
- When employees change jobs, do you know which documents they accessed in their final period?
- Do documents shared with suppliers have permissions and can they be revoked?
