The Levandowski case: how Google's self-driving secrets walked out on a laptop

A federal judge called it the biggest trade secret crime he had ever seen, and it started with an engineer quietly copying thousands of files to his own laptop on the way out the door.^[1] This case file covers how a senior leader of Google's self-driving project walked off with its secrets, what it cost him and two of the biggest names in tech, and the one control that would have raised the alarm in time.

What happened

How it worked

There was no hacking here. Levandowski was a trusted insider with legitimate access to the project's shared files, which is exactly why the copying was easy. According to prosecutors, he pulled the files from Google's corporate storage to a personal machine in the months before he left.^[1]

The file he admitted taking in his plea was a set of internal weekly updates from late 2015 that tracked the status of the project, including its goals, technical progress and problems it was working through.^[1] For a competitor, that kind of document is a map of where a rival is ahead and where it is stuck.

The underlying weakness was timing and visibility. An employee who is about to leave has a strong motive to take work with them, and still has all the access of a current employee. Nothing in the way the files were stored stopped a large one-time pull to a personal device, and nothing flagged it quickly enough to keep the information from leaving.

What it cost

On August 4, 2020, U.S. District Judge William Alsup sentenced Levandowski to 18 months in prison, a $95,000 fine, $756,499.22 in restitution to Waymo, and 3 years of supervised release.^[1] The judge described the theft as massive in scale.^[1]

Separately, an arbitration over his Google pay ended with an order that he pay Google about $179 million, and he filed for bankruptcy in March 2020, owing millions more to his own lawyers.^[2] Because of COVID-19 the judge had delayed the start of his prison term, so he had not yet reported when, on January 20, 2021, the outgoing president pardoned him.^[2] The pardon erased the prison sentence, but not the civil fallout or the years of litigation.

For Uber, the price was about $245 million in equity to settle, on top of the $680 million it had paid for Otto.^[2][3] For Google, it was a long legal fight to protect work it had spent years building.

The missing control

The missing control: monitoring downloads by departing staff. The moment an employee gives notice, or is known to be heading out, their access should get a closer look, and large or unusual downloads to personal devices should trigger an alert that someone actually reviews.

That would not have made Levandowski honest, but it would have changed the timeline. A flagged bulk download of thousands of project files to a personal laptop, spotted as it happened, gives a company the chance to cut access, ask questions and recover the material before it ends up inside a competitor. Blocking company files from syncing to personal devices would have made the copy harder in the first place. Here, the evidence was pieced together later through a lawsuit and a criminal case.^[1]

What to do in your business

• Keep company files on company accounts. Turn off syncing and downloading of shared drives to personal devices wherever your cloud storage allows it.
• Turn on download alerts. Most business cloud suites can alert an administrator when one user downloads or shares an unusual number of files. Switch it on and name who reads the alerts.
• Review activity when someone gives notice. When an employee resigns, look back over the last 60 to 90 days of file activity and keep an eye on the rest of their notice period.
• Remove access the same day they leave. Keep a written offboarding checklist covering email, cloud storage, shared passwords and any customer or vendor portals.
• Put it in writing. Make sure employment agreements spell out what counts as confidential and that it must be returned on departure, so there is no confusion later.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.