[비즈한국] Technology often crosses borders quietly, tucked inside someone’s bag on their way home from work. Research achievements built up over decades and strategic national technologies disappear, confined to a few pages of printouts or a USB memory stick. While dozens of technology theft cases are uncovered every year, the full picture remains only partially revealed. Through this four-part series, 'Tech Espionage,' Biz Hankook reconstructs the moments of theft based on actual cases.
1.
In March 2022, Ji Soo-hwan, a manager, was reviewing a project proposal in an office in Gwangju, Gyeonggi Province.
The plan was to develop furnace equipment with investment from a Chinese firm. Furnace equipment is a core facility in the ALD (Atomic Layer Deposition) process, which builds up atomic layers one by one in semiconductor manufacturing. It is a high-priced piece of equipment supplied to major domestic semiconductor companies, with each unit costing billions of won.
Ji’s connection to China began six years prior. After working for major domestic semiconductor companies for 21 years, he headed to Hefei in 2016, one year after his resignation. Hefei, the capital of Anhui Province, was designated by the Chinese government as a hub for its "semiconductor rise." There, Ji secured a position as the head of DRAM development at CXMT (ChangXin Memory Technologies). CXMT was the symbol of China’s semiconductor ambitions, launched with massive state capital under the guise of being a memory chip manufacturer.
China was desperate for the capability to develop its own furnace equipment. CXMT’s goal was to develop a 17-18 nanometer DRAM process. They lacked the time to tread the path from the beginning, a path that Korean companies had paved by pouring in trillions of won.
It was a project worth tens of billions of won, at the very least. Ji knew a shortcut. He picked up the phone.
2.
One of the people he called was team leader Yang Dae-won, who was overseeing mechanical design for ALD equipment at a domestic firm, 'Company A.' "Let's do this together," the proposal was direct. A massive salary offer followed. He and his team member, Nam Jung-gook, joined. Shin Dong-sik from 'Company B' and Joo Jin-il from 'Company C' were also brought in. Although they were from different companies, they held all the puzzle pieces needed to complete the equipment.
Mechanics, electronics, and process.
They gathered at Xincai, a newly established semiconductor equipment company in Shanghai. It was a developer formed through discussions between Ji and the Chinese investor, Fusheng. The final destination for the developed technology was CXMT—the very same company Ji had served as DRAM development head six years earlier.
The 'Shin Project' took shape. The plan was for Ji Soo-hwan to become Vice President, Yang Dae-won to lead the mechanical team, Nam Jung-gook and Joo Jin-il to serve as mechanical team members, and Oh Sung-hoon to lead the electronics team.
3.
At first, they seemed to draw a line. "No Korean data."
But the request changed. "Let's just use it as a reference."
One evening in May 2022, at the office of Company A in Icheon, Gyeonggi Province, Team Leader Yang called his subordinate, Nam Jung-gook, and gave instructions to print the blueprints. The printers started rolling. These were the module manufacturing and assembly blueprints for 'Falcon,' the ALD equipment for which Company A had spent over 10 billion won in development costs since 2016. It contained design information on which chemicals to use, at what temperatures and pressures, and in what order to stack atomic layers. It was the culmination of nearly a decade of Company A's know-how and technology designated as a national core technology.
The two men split the 1,120 pages of printouts, walked out of the office, and closed the trunk of Yang’s car.
4.
The leak did not end there.
Before resigning, Yang gathered additional data separately: 130 blueprints for FIMS units and a Bill of Materials (BOM) for over 3,200 parts, including costs, materials, and supplier information.
Oh Sung-hoon also compiled the electronics designs. This process was quietly repeated at every company where the project participants were employed. The data was broken into fragments, but when combined, they formed a single piece of equipment.
5.
It was right after the Xincai contract was finalized. In September 2022, Ji Soo-hwan opened a NAS server at his home. It was a shared storage device accessible from anywhere with an internet connection, built within Korea. This server was intended to serve as a data warehouse shared by the entire Xincai development team in China.
The folder name was simple: 'Korean Data Archive.' It contained not only Xincai equipment development data but also the DRAM process data from his previous company that he had been hoarding since his time in Hefei six years prior. There were files copied by hand into notebooks from domestic semiconductor process flowcharts, and files created by taking photos of monitor screens with a smartphone. These were process details designated as national core technologies. The blueprints stolen from Company A followed suit. Two streams of data merged into one server. The technology needed by the Chinese firm was destined to cross over via this path.
6.
January 2023, Xincai office in Shanghai.
Team Leader Yang sent an email to an external partner: "This is data based on Company A. Please maintain confidentiality."
Based on that data, Nam Jung-gook redrew the Xincai equipment blueprints—same structure, similar layout. Only the name was changed. Now, the equipment was officially "newly developed."
Internally, they were aware of the risks. Ji Soo-hwan asked an acquaintance, "Will this cause trouble?"
He already knew the answer before waiting for a reply.
In another message, he wrote: "Be careful, as this could violate the Industrial Technology Protection Act."
7.
Signs of trouble remained in the records: printing history, file movement logs, and email transmission history.
Individually, they were fragments, but connected, they formed a pattern.
The National Intelligence Service (NIS) captured signs of irregular activity based on intelligence in the spring of 2023. Upon receiving a request for investigation from the NIS, the prosecution followed the trail. The secured materials all shared commonalities.
The structures were identical, the arrangements similar. It was not a 'newly created design.'
The Xincai project came to a halt.
The full story of the semiconductor process and equipment technology leak to China
This factional narrative reconstructs the technology leak incidents that occurred at semiconductor equipment partners, including Samsung Electronics005930 and Eugene Technology084370, from 2016 to 2023. Defendant A, a former department head at Samsung Electronics, stole DRAM semiconductor process information while moving to CXMT in 2016. After returning to Korea in 2021, he conspired with former team leaders from companies like Eugene Technology the following year to steal ALD equipment design technology from semiconductor partners and provide it to CXMT.
Centered around A, who organized a semiconductor furnace equipment development project with a Chinese investor, the defendants from companies like Eugene Technology printed and leaked blueprints from their respective employers. They then set up a NAS (Network Attached Storage) server in Korea, uploaded the materials, and shared them with the development team at the Chinese firm, Xincai. The NAS server was a method devised to avoid detection by airport security. An insider at Xincai who purchased and built the server later voluntarily submitted the data to the prosecution, providing the initial lead for the investigation.
During the investigation, it was revealed that the former Samsung employee had leaked materials by manually transcribing process flowcharts (PRP) into a notebook or photographing monitor screens with a smartphone. The design, process, and device technology for DRAM under 30nm, as well as 3D stacking technology, were designated as national core technologies by the Ministry of Trade, Industry and Energy in 2016.
At Eugene Technology, 1,120 module manufacturing and assembly blueprints for ALD equipment were unauthorizedly printed and leaked, along with 130 FIMS unit blueprints and BOM data containing cost, material, and supplier information for 3,200 parts. Subsequent investigations revealed that the Xincai development team used the Eugene Technology blueprints directly to redraw their own equipment designs.
During the trial, the first and second courts ruled that the act of uploading trade secrets to a NAS server for co-conspirators to access constituted 'use' of trade secrets, thus acquitting them of separate 'leakage' charges. However, early this year, the Supreme Court overturned and remanded the case to the Seoul High Court, stating that the leakage of trade secrets should be viewed as a separate and independent crime from its use. This judgment is considered significant as it clearly expands the scope of punishment for sharing technology through digital channels like NAS servers or clouds.
On the 23rd of last month, the Criminal Division 10-1 of the Seoul High Court sentenced Defendant A to 6 years and 4 months in prison and a fine of 200 million won, further recognizing the leakage charge. This sentence was 4 months longer than the appellate sentence. Defendant B, a former Eugene Technology employee indicted alongside him, was also given an additional 3-month sentence. Defendant B had already been sentenced to 2 years and 6 months in prison for violating the Industrial Technology Protection Act.
The remand court pointed out, "The defendant's actions render the enormous time and cost invested in DRAM semiconductor development futile, seriously undermine market trade order, and can have a negative impact on national competitiveness." It further ruled, "The crime of illicitly acquiring and using Samsung Electronics' trade secrets in China is very grave, and treating trade secret infringement lightly would strip the technology—which took a long time and significant cost to develop—of its meaning."
Samsung Electronics explained that it recognizes semiconductor core technology as an asset that must be managed not just at a company level, but also from the perspectives of the nation and its customers. Key technologies are protected under the Industrial Technology Protection Act and the Act on Prevention of Divulgence and Protection of Industrial Technology, and the effectiveness of security systems is audited annually. Furthermore, the company has established separate guidelines for the security management of national core technologies and operates a system where executive-level personnel are designated to give final approval for technology protection measures. Emails containing customer-related information are automatically blocked from being sent externally through mail filtering services. Regarding customer information security, NDAs are signed, and access is restricted to authorized personnel only.
An official from Eugene Technology stated, "For semiconductor equipment companies, technology security is a matter directly linked to survival. We have significantly strengthened access management for design blueprints and monitoring of printing history. Technology theft is not just a simple data breach; it is an act that undermines years of research achievements and the entire competitiveness of the company."