That’s a problem, said Frank Figliuzzi, formerly the FBI’s assistant director for counterintelligence and now an NBC News contributor. He said tech companies need to step up their security against so-called insider threats.

“No question there was a ball dropped here,” he said. “But this is something I see commonly in security failures across the board. Number one, companies have to get much better at identifying what is truly a crown jewel in their company. Number two, identify the employees in your company who have access to those crown jewels. Number three, monitor those employees and the crown jewel data to ensure that bad things aren’t happening. So when that crown jewel employee who has access is traveling abroad, you need to know it.”

While the indictment does not allege any links between Ding and the Chinese government, Figliuzzi said that doesn’t really matter, given Chinese government policies.

“There is indeed an actual strategy, a five-year plan that China publishes, putting its citizens on alert that we need the following items this year, and for the next five years, and we’ll do everything we can to get our hands on it,” he said. It’s a challenge for an American company to secure against that threat, Figliuzzi added, saying “it’s against the law for a Chinese national to refuse to cooperate with their intelligence services.”And if a Chinese national were to take protected information of their own accord, patent it in China and open their own business with it, “good luck challenging that in court in China,” he said. “It rarely if ever succeeds.”