An IP Leak Is a Decision Before It Is an Incident

Key Takeaways In recent cases, insiders deliberately switched to photographing their screens with a phone, specifically because a photo leaves none of the traces a file transfer does. Insider risk now costs the average organization $19.5M a year, up 123% since 2018, and data exfiltration spikes 720% in the 24 hours before a layoff. Fasoo Smart Screen changes the decision itself. A screen that visibly carries the viewer’s name, IP, and time tells a would-be leaker “this traces to me,” and makes the camera trick pointless. This week: look at what an engineer actually sees when they open your crown-jewel designs. Does anything signal that they are accountable?

In early 2026, federal prosecutors unsealed a case that should change how every manufacturer thinks about the screen. A group of engineers at major technology and chip firms, trusted with processor and cryptography secrets, had been feeding that information to a foreign adversary. The detail that matters is how.

After an employer’s monitoring system flagged one of them, the group deliberately switched to photographing their computer screens with a phone. They took dozens of pictures of confidential designs — precisely because a photograph leaves none of the traces a file transfer does. They were not defeating the technology. They were stepping around it, into the one gap it cannot watch. They did so because in that moment, photographing a screen felt safe.

It was not an isolated trick. In a separate case, a departing engineer at a leading foundry arranged for a former colleague to open the company’s most advanced process designs on a laptop. He then photograph them with his phone to help a competitor close the gap.

Different companies, different countries, the same move. When people decide to steal what is on a screen, the camera is the tool they reach for. Crucially, they make that decision long before any alarm can fire.

 

Why Is Insider Risk the Most Expensive Problem Nobody Calls an Attack?

Insider risk has quietly become a top-line cost center. The 2026 Ponemon Institute and DTEX Cost of Insider Risks report puts the average loss at $19.5 million per organization, up 123% since 2018, and closer to $24 million in APAC. Most of those incidents are not malicious; roughly three quarters trace to negligence.

But the deliberate, targeted theft, the kind aimed at a company’s crown-jewel designs, is the costly tail: IBM finds malicious-insider incidents the single most expensive vector at $4.92 million each. And the danger is not evenly spread across a career. This is clearly a “behavior” problem with a price tag, and it peaks at the exit.

 

Who Decides to Leak? The Four Insider Risk Profiles

There is no single profile. That matters, because the deterrent that works for one type does nothing for another.

1. The aggrieved leaver feels wronged and takes data as a form of payback.
2. The rationalizer tells himself the work is partly his, that everyone keeps something, that no real harm is done.
3. The recruited or coerced insider is offered money or leverage by a competitor or a state, which is the pattern in most of the high-profile chip cases.
4. And the careless one acts with no malice at all, moving a file or snapping a photo out of pure convenience.

The rationalizer and the careless one respond strongly to a simple signal that someone is watching. The recruited insider is harder, but even he runs a calculation. That is exactly why the engineers in the cases above switched to photographing screens — they were trying to lower their perceived risk of detection. Change that perception and you change the calculation for three of the four.

 

Why Does Stealing from a Screen Feel Consequence-Free?

Three things make screen capture feel consequence-free.

The act produces no obvious trace, so it does not feel like theft in the way carrying out a box of files would.

The person can rationalize it, because intangible knowledge feels less like property than a physical object does.

And the screen itself gives no feedback that anyone is paying attention. It looks anonymous, so the choice feels anonymous.

The result is that an otherwise careful, law-abiding engineer can talk himself into a decision he would never make if he believed it would be traced to him by name.

 

What Actually Changes the Decision to Leak?

What changes a decision in the moment is the perceived certainty of being identified. For decades, criminologists have shown that certainty of detection deters far more reliably than severity.

Ordinary life runs on the same principle: a visible camera, a name badge, a signed acknowledgment. None of them physically stops anyone. They work by making accountability impossible to forget.

The reason screen capture feels safe is that the screen offers no such reminder. The mechanism is worth naming — it is what makes the intervention work.

An on-screen identity mark converts a consequence that is abstract and deferred — the vague possibility of getting caught someday — into one that is concrete, immediate, and personal. Your own name looks back at you at the exact instant you are deciding whether to raise the phone.

Behavior bends to immediate and certain consequences far more than to severe but distant ones. Therefore, the moment of decision is the only place a deterrent truly has to land.

 

How Does Fasoo Smart Screen Change the Decision Before It Happens?

This is where Fasoo Smart Screen acts less like a lock and more like a behavioral intervention.

When an engineer opens a sensitive design, the screen carries her own name, IP address, and the time, in plain view. The message is unmistakable: whatever I do with these points back to me.

It also blocks the easy digital captures, the Print Screen key, snipping tools, recorders, and remote-control software, on the applications you designate.

And it directly answers the camera trick from those court cases: the same identity mark can be applied invisibly, so a photograph of the screen still decodes to the person who took it. The move that was supposed to evade monitoring instead signs the evidence.

The deepest effect, though, is upstream of all of this. It shifts the defense from catching a leak after it happens to changing the decision before it does.

 

What Does a Protected Manufacturing Environment Look Like?

Picture the same organization a year into treating the screen as an accountable surface.

• The careless captures stop, because convenience is no longer frictionless.
• The rationalizations weaken, because “no one will ever know” is plainly false when your name is on the glass.
• Capture attempts on sensitive applications fall and then stay low, not because people are policed harder, but because the norm has shifted from “don’t get caught” to “everyone here is accountable for what they view.”

That is not a fortress. It is a culture, and cultures are what actually hold when the technology is one phone-photo away from being bypassed. It is also measurable, which matters for a control sold on behavior rather than blocking.

The leading indicators are concrete: blocked digital-capture attempts on sensitive applications, and how that volume trends over the months after rollout — including spikes around departures and layoffs.

A program that is working shows attempts falling toward a low baseline and staying there. The sharpest drop comes among the population that used to feel the most anonymous. You are not just hoping the deterrent landed; you can watch it land.

 

What Doesn’t Fasoo Smart Screen Address?

Honesty matters more than a clean claim. No software can physically stop a person from pointing a phone at a monitor, and Fasoo Smart Screen does not pretend to. It cannot read intent, and it cannot stop someone from memorizing a figure or re-keying it later.

What it does is change the odds and the attribution: it removes the easy digital routes and ensures that the hard route, the camera, no longer offers anonymity. It is most powerful paired with the rest of an offboarding discipline, access reviews, and clear classification of what truly matters. It changes the decision and signs the image. It does not repeal the laws of physics.

 

What Should You Do This Week?

1. Open a crown-jewel design as an engineer would. Is there any signal of accountability on that screen, or does it look anonymous?
2. Identify the highest-temptation population: staff serving notice and contractors nearing the end of an engagement, the group the 720% spike is built from.
3. Make accountability visible there first with on-screen identity watermarks, and watch whether capture attempts fall.

The direction of travel is clear. Governments now treat advanced manufacturing know-how as a national-security asset, prosecuting screen-photo theft under economic-espionage and national-security laws.

Talent moves between rivals faster than ever. Distributed and virtual-desktop work scatters sensitive screens across homes and contractors. As digital controls tighten, moreover, the camera becomes the path of least resistance.

You will never write a policy that overrides a human decision. However, you can change the arithmetic the decision rests on. An engineer who sees her own name on the screen is no longer making an anonymous choice.