TSMC Reports Compromise of 2-Nanometer Chip Production Technology: Lessons Abound

Jon Welch

Plenty of eyebrows were raised on August 5 when Taiwan Semiconductor Manufacturing Corporation (TSMC), the world’s largest chipmaker, announced that proprietary information related to its most advanced 2-nanometer chips may have been compromised. In U.S. markets, the company’s stock dipped 2.5 percent. And plenty of people wondered what might happen if the advanced technology found its way into the hands of China, which is currently unable to produce chips on that scale.

According to multiple press reports, TSMC discovered that one of its engineers, surnamed Wu, had repeatedly logged into the company’s intranet from a company issued laptop while working from home. Although Wu reportedly tried to conceal his activities and kept his login time within three minutes each time, the abnormally high frequency of logins alerted TSMC's information security system, which then activated internal monitoring.

TSMC then promptly filed a complaint with Taiwan’s High Prosecutors’ Office, which subsequently directed the Ministry of Justice’s Investigation Bureau to carry out multiple searches and interviews between July 25 and 28. Prosecutors searched the residences and workplaces of multiple people as well as the Taiwan premises of Japanese semiconductor equipment maker Tokyo Electron.

The investigation revealed that a former TSMC engineer surnamed Chen and as many as 10 TSMC engineers involved in advanced process trial production and R&D were implicated. Chen had previously worked in TSMC’s system integration department and later joined Tokyo Electron, a long-term Japanese equipment partner of TSMC, as an equipment engineer. Because Chen had close ties with current R&D personnel at TSMC, he was responsible for communicating directly with its R&D division.

Leveraging his relationships with TSMC engineers, Chen allegedly obtained confidential data by having TSMC engineers display process diagrams on their computer screens, which he then photographed using his mobile phone. It is believed that Chen took more than 700 photos from the TSMC engineer surnamed Wu and another nearly 300 photos from an unnamed TSMC engineer.

Prosecutors arrested the three individuals and charged them with violating Taiwan’s National Security Act. Just three years ago, the National Security Act was amended to protect “national core technologies” including manufacturing technology for chips smaller than 14 nanometers, following several attempts by Chinese competitors to poach engineering talent from Taiwan’s semiconductor companies.

Other TSMC engineers reportedly provided Chen with a small number of less sensitive process diagrams. The level of their involvement was considered minor, so they were not detained.

One of Taiwan’s largest daily newspapers, the Liberty Times, reported that Chen and Wu were caught red-handed at a local Starbucks.

Taiwan media reported that Chen’s supervisor at Tokyo Electron is also a former TSMC employee. Many of TSMC's suppliers are said to recruit TSMC employees in order to provide more effective services to the semiconductor manufacturer.

Lessons Learned

Taiwan deserves kudos for revising its National Security Law, and TSMC should be congratulated for not only detecting the potential compromise early on but also for notifying the proper authorities rather than sitting on the information to avoid embarrassment. These are welcome signs that the security culture in Taiwan’s private sector is maturing.

That said, the investigation is still ongoing. While there is no indication that the three suspects were acting on behalf of China or any other nation-state actor, the fact remains that anytime sensitive, proprietary, or classified information is moved from a protected environment to an unprotected one, it immediately becomes susceptible to targeting by third parties.

Acquisition of 2-nanometer chip technology would enable China to circumvent U.S. sanctions and greatly boost Chinese capabilities in AI, quantum, and other high-tech fields.

If TSMC and the Taiwan authorities detected the compromise in time, they may have narrowly averted a catastrophe with major geopolitical implications. Taiwan is the world’s largest producer of advanced chips used in all manner of high-tech applications. Chip fabrication thus underpins Taiwan economy and adds to the island’s strategic value.

For TSMC, the loss of its crown-jewel 2-nanometer technology to a competitor would also negatively impact revenues and market share.

The decision by TSMC to press charges against the three current and former engineers will likely destroy their career prospects. According to Taiwan media, the three were all elite talents. They had earned master’s degrees from prestigious national universities and had over 10 years of experience working for and with the world’s leading chip fab. Their futures were bright until they made a disastrous decision to circumvent security procedures. Years of personal investment and sacrifice, not to mention TSMC’s own significant investment in attracting and developing elite talent, have apparently been squandered.

A key lesson from this case is that while device monitoring is a critical component of a strong security program, it is also important for businesses to think of their workforce as valuable assets that must be protected, not only from targeting by malicious external actors, but also from poor personal decision-making.

Therefore, a comprehensive human capital protection program should include training, employee assistance programs, and other elements that reduce the risk that an insider makes a bad decision and wittingly or unwittingly jeopardizes the company’s future, as well as his or her career.

Jon Welch is Senior Vice President and Practice Lead at Pamir Consulting.