The Threat Was Already Badged In: Insider Lessons From Two Lab Poisoning Cases

A LinkedIn post landed in my feed last week with everything a viral security story needs: a university lab, a neurotoxin in a colleague's tea, cancer research, footage after midnight, and an arrest at LAX on the way to China. It was framed as research theft by a foreign state. I went and read what the court record and the university actually say. The real story is less cinematic, and far more useful for anyone who runs a facility.

Everything below about the accused is an allegation. Nobody has been convicted, and the accused is presumed innocent.

What is actually on the record in Wyoming

On October 13, 2026, the University of Wyoming announced that a graduate student "has been charged with aggravated assault in connection with allegations that she used a substance to harm a colleague in a UW laboratory." The charge was filed in Albany County Circuit Court after a UW Police Department investigation. The university added a line every reader should keep in mind: "These are only allegations, and individuals are presumed innocent pending trial or resulting conviction in any matter."

According to the police affidavit, as reported by Cowboy State Daily and CNN, the accused is Aili Wang, 32, a microbiology graduate student. She faces one felony count, reported as aggravated assault and battery. That is the whole charge. There is no theft, trade secret, or espionage charge.

The affidavit alleges that:

• A fellow doctoral student, identified only as "KT," developed tingling, numbness, and leg weakness starting around August 10, and kept seeing doctors without an answer.
• He noticed his hot water tasted off. Water from the coffee maker he used to make tea, tested by colleagues in a UW chemistry lab, showed high levels of acrylamide, a neurotoxin. Only his coffee maker tested positive among the samples taken.
• Cameras placed in the shared office by a professor, by campus police, and by the victim himself allegedly showed the accused going through his desk, inspecting his coffee tin, rinsing his mug with liquid from her own mug, photographing and "manipulating notebooks" on his desk, and looking into his coffee maker.
• Card-swipe records allegedly show her entering the area just after midnight on September 18 and on October 1.
• University IT data allegedly showed her university email account was used to order acrylamide on eBay twice, in June and August. On October 5, the day police interviewed her, the account allegedly asked eBay to delete its order history. She told the detective she had not used acrylamide in years.
• Prosecutors say she was arrested on October 6 at Los Angeles International Airport while trying to return to China, carrying laptops, storage devices, and documents.

The affidavit says the two "have not gotten along." The victim told police his research was patent pending, and police noted the accused had worked on similar research before coming to the US. Their supervising professor told investigators she had no reason to access his notes, because their current fields are unrelated. That is the full basis for the "stealing cancer research" framing. It is a question worth asking. It is not a charge, and nobody has alleged a foreign government was involved.

The Berkeley case is not "similar" in the way it was sold

The LinkedIn post also pointed to "a similar poisoning case at Berkeley." That one is real, but it was not at UC Berkeley and it had nothing to do with espionage. In 2019 an engineer at a private firm, Berkeley Engineering and Research, was charged by Alameda County prosecutors with attempted murder and two counts of poisoning a coworker's water with cadmium. A spy camera the victim set up in her own office allegedly captured him pouring something into her water bottle. He pleaded no contest to one poisoning count in 2023, the other charges were dropped, and he was sentenced to probation. In October 2026, after he completed probation, a judge dismissed the conviction under California law, over the victim's objection.

The common thread is not a country. It is a coworker with daily, trusted, unwatched access to someone's desk, drink, and work, and a victim who had to install their own camera before anyone believed something was wrong.

Geopolitics on someone's home turf, and how it gets spun

State-linked research theft is real. The US Justice Department still treats economic espionage and pressure on researchers by hostile governments as a national security priority. But the way we talk about it matters, and the US has already run the experiment of getting it wrong.

The DOJ's "China Initiative," launched in 2018, was ended on February 23, 2022. Assistant Attorney General Matthew Olsen said the department had heard concerns that it "fueled a narrative of intolerance and bias," and that its research grant prosecutions created "a chilling atmosphere for scientists and scholars." He concluded "this initiative is not the right approach" and replaced it with a strategy covering threats from several countries. An MIT Technology Review analysis of 77 known cases found that only 19 involved Economic Espionage Act charges, that only about a quarter of those charged had been convicted, and that 130 of 148 people charged, 88 percent, were of Chinese heritage.

We are watching the same pattern again in Laramie. Within days, the university's graduate dean wrote to students that the case "has led to hateful and racist remarks, particularly on social media," and invited international students to a support meeting. A colleague is allegedly harmed, and thousands of uninvolved students and researchers pay for it.

Here is my position. Origin is not a risk indicator. Behavior and access are. Profiling by nationality sends your investigators after the wrong people, poisons the trust that makes people report real concerns, and drives away exactly the talent you are trying to protect. In both cases above, what gave the game away was behavior: after-hours entry, touching someone else's things, buying a toxin through an institutional account, and trying to erase the trail.

Vetting: continuous, behavioral, and fair

• Vet the role, not the passport. Apply the same screening to everyone with access to the same assets. Document it.
• Treat vetting as ongoing. Most insiders pass the background check. Changes in behavior, conflicts with coworkers, and access that no longer matches the job matter more than the file from hiring day.
• Take conflict seriously. In Wyoming, the supervisor said the accused showed animosity mostly by avoiding people. Persistent interpersonal conflict in a lab with hazardous materials deserves a documented conversation, not a shrug.

Physical security: the boring controls that catch people

• Log after-hours access and actually review it. The card-swipe data existed in Wyoming. Flag entries outside a person's normal pattern, especially into spaces they share with someone they are in conflict with.
• Two-person rules for sensitive labs, chemical stores, and high-value research spaces outside business hours.
• CCTV on entrances and shared spaces, with clear policy and retention, so victims do not have to buy their own spy cameras.
• Control hazardous materials end to end. Inventory and sign-out for toxic chemicals, and screen purchases made through institutional accounts and email, including consumer marketplaces. A toxin delivered to a lab through a university account should never be invisible.
• Lockable personal storage for notebooks and work, and a culture where unattended food and drink in shared labs is not the norm.

Logical security: protect the work, not just the door

• Least privilege. If someone has "no reason to access" a colleague's research, the systems should agree. Segment shared drives, ELNs, and repositories by project.
• Data-loss controls on removable media, bulk downloads, personal cloud sync, and phone photos of paper notebooks in sensitive areas.
• Watch for evidence deletion. Sudden account or history deletion right after an interview or incident is a signal worth an automatic alert.
• Offboarding and travel triggers. Abrupt departures, unannounced international travel during an open inquiry, or resignation with large data pulls should prompt an immediate access review. Do this for everyone, or do not do it at all.

Reporting: make it easy to speak up early

The victim in Wyoming told professors his water tasted off weeks before anyone acted. That is not a criticism of them. Nobody expects poison. It is a reason to build a simple, trusted path for "something feels wrong" reports, health or security, that someone is required to follow up on. Link occupational health, campus or site security, and IT, so a strange illness, a strange purchase, and a strange badge swipe can meet in one place.

A quick checklist

1. After-hours badge entries reviewed weekly, with alerts on pattern breaks.
2. Two-person rule for sensitive labs and chemical stores after hours.
3. CCTV on lab entrances and shared offices, with written policy.
4. Hazardous chemical inventory, sign-out, and purchase screening, including institutional email on marketplaces.
5. Least-privilege access to research data, reviewed each term or quarter.
6. Data-loss controls on USB, cloud sync, and bulk downloads.
7. Alerts on account deletion or log wiping after incidents.
8. Access review triggered by abrupt departure, unusual travel during an inquiry, or role change.
9. A no-blame reporting channel shared by health, security, and IT.
10. Identical rules for everyone, regardless of nationality or origin.

The threat in both of these cases was already badged in. Your controls should assume that, and your culture should never assume it based on where someone was born.

Sources: University of Wyoming statement (Oct 13, 2026), Cowboy State Daily on the police affidavit and bond petition, CNN (Oct 17, 2026), AP, WyoFile via Wyoming Tribune Eagle, Alameda County criminal complaint, 19-CR-004967 (PDF), The Berkeley Scanner, The Daily Californian, DOJ, AAG Olsen remarks (Feb 23, 2022), MIT Technology Review China Initiative database.