Forget James Bond's super-gadgets, this chap spied for China using SD card dead drops. Now he's behind bars
- Reference: 1584580325
- News link: https://www.theregister.co.uk/2020/03/19/sd_card_spy_china/
- Source link:
A federal district judge this week sentenced Xuehua Edward Peng, 56, of Hayward, California, after he admitted handing over the trade secrets to Beijing. Peng earlier confessed that SD cards loaded with information stolen from an unspecified US company were left for him to collect at hotels by a contact only known as Ed. Peng would also hide tens of thousands of dollars in hotel rooms for Ed to collect as payment. Lawyers said Peng spent years trafficking confidential info.
"Today Xuehua Peng suffers the consequences of acting in the United States at the direction of a foreign government,” [1]said US attorney David Anderson.
"This day of reckoning comes from Peng’s decision to execute dead drops, deliver payments, and personally carry to Beijing, China, secure digital cards containing classified information related to the national security of the United States. Peng will now spend years in prison for compromising the security of the United States."
Months-long trial of alleged CIA Vault 7 exploit leaker ends with hung jury: Ex-sysadmin guilty of contempt, lying to FBI [2]READ MORE
Prosecution [3]paperwork [PDF] stated that, from 2015 through 2019, Peng agreed to, under orders from the Chinese Ministry of State Security, collect SD cards filled with stolen corporate information, and fly to China to drop them off to government snoops. The nature of the data was seemingly too sensitive for the US government to disclose in court.
Uncle Sam's investigators said Peng moved to the Land of the Free under a B-1 business visa at the turn of the millennium, armed with a degree in mechanical engineering and "training in traditional Chinese medicine." We're told "he became a permanent resident via marriage in 2006, and was working as a San Francisco tour guide during his nefarious activities."
According to prosecutors, three years after his US naturalization in 2012, Peng began moving information from the US to China via hotel pickups after he was tapped up by a Beijing official. Here's how it went down, we're told:
On October 24, 2015, Peng goes to the hotel [in Newark, California] and retrieves a package that was left for him there. The package contains a secure digital (SD) memory card. The next day, Peng drives to San Francisco International Airport and flies directly to Beijing, China. In Beijing, Peng meets with agents of the Ministry of State Security (MSS), including the People's Republic of China (PRC) official with whom Peng had been communicating, and delivers the SD card to MSS.
A PRC official uses coded language to tell Peng that another dead drop will occur on April 23, 2016. The official directs Peng to book a hotel room where he will conduct the exchange. The PRC official directed Peng to leave $20,000 cash in the hotel room and that Peng be will be reimbursed for the payment. The PRC official instructs Peng to return to the PRC on April 24, and to fly directly to Beijing, Shanghai, or Guangdong. Peng is informed that the PRC official with whom he is communicating would meet Peng when he landed.
Peng complied with the instructions. On April 23, 2016, Peng drives to an Oakland hotel, reserves a room, and leaves a key to the room at the front desk. Peng leaves $20,000 concealed on the underside of a dresser in the room. Hours later, Peng returns, observes that the money had been retrieved and determines that a cigarette pack with an SD card inside of it has been left for him in place of the money. Peng travels on a direct flight from San Francisco to Beijing the next day where he meets with agents of the MSS, including the PRC official.
Rinse and repeat a few more times. At one point, we're told, Peng taped $20,000 to the underside of a dresser in a hotel room and left a key to his room at the front desk for someone to collect. Returning to the hotel about 90 minutes later, Peng saw the money was taken, checked out of the hotel, and returned home.
Peng was cuffed at his home on September 27, 2019 before his seventh dead drop could be completed. We're told the US government found out about the espionage after a contact informed on Peng for around $200,000 in reward money, and he was put under FBI surveillance.
"This case exposed one of the ways that Chinese intelligence officers work to collect classified information from the United States without having to step foot in this country," said Assistant Attorney General Demers. "Peng acted as an agent of the Chinese Ministry of State Security in the United States, conducting numerous dead drops here on their behalf and delivering classified information to them in China." ®
[1] https://www.justice.gov/usao-ndca/pr/hayward-resident-sentenced-four-years-acting-agent-people-s-republic-china
[2] https://www.theregister.co.uk/2020/03/09/cia_hacking_trial_verdict/
[3] https://www.courtlistener.com/recap/gov.uscourts.cand.348673/gov.uscourts.cand.348673.1.0.pdf
Re: What?
His fortune cookie said "You won't be travelling for the foreseeable future"
Money-laundering?
That's a lot of cash to take out, and get back, surely his bank's money-laundering detection system should have flagged such large paired transactions immediately?
Re: Money-laundering?
Who says he was depositing the money back into the bank after he took it out the first time? If you knew you were going to need $20,000 cash again and again and the bank was paying little or no interest, would you bother?
Re: Money-laundering?
Yes. Any transaction of $10k+ is sent to the Federal Gov't.
4 years in a Federal pound-me-in-the-ass prison is insufficient; At least ten.
If the FBI had him under surveillance then the people loading up the SD cards for $20k may also be known, and these people are more than just couriers.
Gosh, this can't be right
Any time someone mentions here that China engages massively in corporate espionage, a gang of commentards ridicules and abuses them for believing such lies. How, then, can this story be true?
I trust our loyal commentards will promptly rally round and sort out this ElReg journo, set him to rights.
Re: Gosh, this can't be right
What people ridicule is that only China is doing that (I'm pretty sure most countries do that, actually), and they also like to point out that e.g. Cisco had actually backdoors for the US TLAs in their products to exfiltrate (i.e. steal) secrets, whereas in the case of other Chinese companies there is no proof so far (apparently not even any shared secretly with allied countries, otherwise they would be banning that stuff as well).
Yeah, dftt, I know...
Re: Gosh, this can't be right
We don't ridicule the idea that China is engaging in industrial espionage. We ridicule the idea that they're the only ones. Do you somehow think that the western countries aren't also spying on China?
You're mistaking our cynicism about governments across the board (yes, especially including our own) for support for China.
Stupid
If the data on the SD cards was decently encrypted then just sending it by post to China would have been easier and far less likely to be detected.
An alternative method (also assuming decent encryption) post the data on a Usenet newsgroup - there is no easy method to determine who has received the data.
Re: Stupid
He was also the conduit for cash in the opposite direction.
Re: Stupid
Your ideas do not improve the situation. Posting to a news group leave a permanent trail pointing to the sender. Same applies for a letter sent. Using dead drops sounds like a reasonable thing to do.
Also surveillance requires much less effort if you get on the radar. Tapping your comms is a no brainer. Giving your letter some extra care is also not so difficult. Getting caught in the act is really only the last step. We need this for a fair trial. The perp already knows he is guilty but for us citizens it is important to know that he is really guilty.
"Peng will now spend years in prison for compromising the security of the United States"
Peng is not the guy compromising the security of the USA, he's just the courier.
The guy doing the compromising is, apparently, Ed. He's the guy the FBI should find.
Of course, Peng is part of an espionage ring and guilty, no doubt there, but I think the wording is wrong. Peng participated in compromising US security, but he did not do so directly himself.
Re: "Peng will now spend years in prison for compromising the security of the United States"
So which link in the chain was responsible for hanging the meat?
All of them were...
https://upload.wikimedia.org/wikipedia/en/2/2e/Pengo_arcade_flyer.jpg
He seems to be very trusting
According to the article, he apparently left $20k in cash in a hotel room on the promise that he'd be reimbursed.
Being a tour guide in San Francisco must be more lucrative than I imagine, if he's got $20k he can afford to leave lying around.
Of course his handlers may have given him the money in advance, but then it wouldn't be "reimbursement".
This is the story, but was was the Plot?
Nobody in the movie business would buy this story, it's only the tip of the iceberg - send it back to the writers for a rework to develop the back story.
What was happening behind the scenes? Clearly a lot more than this little dribble of information "reveals" - I think there's probably enough happening behind locked doors to make the story into a 30 episode series.
Hotel staff are now regularly inspecting the underside of furniture.
Having stayed at various hotels in the Bay Area, including months at a time at one in Newark. I can tell you that the cleaning staff definitely weren't bothering to look under, behind or even around furniture in the rooms. Pretty much a horror story even at even the big name hotel chains.
So if this story means they actually bother to clean rooms properly, that's great news for the guests. Of course they might look under furniture etc and still not bother to clean the years of dust, hair and worse hiding there ...
"This case exposed one of the ways that Chinese intelligence officers work to collect classified information from the United States without having to step foot in this country,"
Or, in plain English, a paid agent nicks it from WITHIN THE COUNTRY, passes it to a paid courier WITHIN THE USA who manually transports it to China ... the only bit that's 'without having to step foot in this country' being the final delivery. Isn't that chain similar to the way every case of espionage works?
Obviously the CIA don't do that as they always set foot in a foreign country and directly send their spying results to HQ (probably after opening channel d) and would never employ local agents and dead drops to do naughty stuff for them ...
What?
So Chinese take-away is illegal in the US now?!?