The Context
Let us start with a number: 150 million Taiwan dollars. That is the fine levied against Tokyo Electron’s Taiwan branch by the Intellectual Property Court on April 27, 2026. The penalty is a direct financial cost for a systemic governance failure. The court convicted four former TSMC employees for theft and unauthorised disclosure of trade secrets over a period beginning mid-2023. Lead defendant Chen Li-ming received a 10-year prison sentence. Three other former employees received terms of six, three, and two years respectively. A Tokyo Electron manager was sentenced to 10 months, suspended. This is Taiwan’s first prosecution under the National Security Act for trade secrets classified as national core critical technologies. The court’s judgment explicitly noted that Tokyo Electron failed in its duty of care: internal performance evaluations documented Chen’s ability to ‘leverage existing client resources’ and obtain customer and competitor information, yet the company did not supervise him. The audit trail is damning.
The Risk
For a director sitting in a boardroom in New Zealand, the arithmetic is simple. The dollar value of the fine—US$4.8 million—is a tangible liability. But the real risk is not the fine; it is the erosion of trust. Under the Companies Act 1993, a director’s duty of care, diligence, and skill (section 137) requires a director to exercise the care that a reasonable person in their position would exercise. If a company’s internal controls fail to prevent the leakage of trade secrets that constitute ‘national core critical technologies’, a director may face personal liability for a failure of governance. The court’s reasoning here is instructive: it reduced Chen’s sentence from the prosecutors’ 14-year request to 10 years, citing his full confession and cooperation. This implies judicial recognition that organisational negligence enabled the breach. That is a gap in the governance framework. A director cannot delegate the duty to ensure adequate controls exist. They must verify the audit trail. They must ask the hard questions about who has access to what, and why. The silence of a board is not a defence; it is a liability.
The Control
The strategic solution is not to build a higher wall. It is to build a better gate. The board must demand a forensic review of all access controls, data classification systems, and third-party due diligence processes. Specifically, the board should require management to map every employee’s access to trade secrets against a risk-based tier system. If a former employee can solicit classified files from current colleagues with impunity, the control environment is leaking. The board must also ensure that performance evaluations for employees with access to critical technologies include a specific assessment of their adherence to confidentiality protocols. This is not a technical problem; it is a governance problem. The board must own it.
The Challenge
These are the critical questions you should be raising at the board table:
| What is the exact dollar value of the trade secrets we have classified as ‘core critical’—and how many employees have access to that data right now? | |
| When was the last time our third-party due diligence process identified a ‘leverage existing client resources’ risk in a performance evaluation—and what did we do about it? | |
| If a court were to examine our board minutes today, would they find evidence that we explicitly challenged management on the adequacy of controls over national core critical technologies—or would they find silence? |