The audacious ruse that exposed China’s campaign to steal American secrets

During a two-week trial in Cincinnati that began in October 2021 — more than three years after Xu was extradited to the United States — federal prosecutors laid out their case. Xu was represented by a team that included five attorneys from Taft, Stettinius and Hollister, a top Midwestern law firm, suggesting that the hundreds of thousands of dollars required in legal fees were paid for by the Chinese government. (The company declined to comment for this article.) The defense argued that Xu was deceived; the intention behind his correspondence with Hua was not to steal trade secrets but simply to facilitate an academic exchange between Hua and Chinese scientists. Ralph Kohnen, one of the defense lawyers, said in his closing argument: “What happened here is that Mr. Xu, my client, has become a pawn, a pawn in the place tense between American industries trying to exploit China and trying to get along with China.

The prosecution claimed that Xu systematically attacked the intellectual property of aerospace companies in the United States and Europe through cyber espionage and the use of human sources. It’s not often that prosecutors find a one-stop shop for much of their evidence, but that’s what Xu’s iCloud account was – a repository of the spy’s personal and professional life. Indeed, Xu often used his iPhone calendar as a diary, documenting not only the events of the day, but also his thoughts and feelings. Several entries from 2017, for example, point to rising tensions with her boss, a man named Zha Rong. “Zha rejected a meal receipt today,” he wrote on March 27. Then, on April 28: “The relationship with Zha plummeted to freezing point. Other entries from this period—when he began corresponding with Hua—reflect misfortune in Xu’s personal life. Like the one on August 17, in which he lamented the breakup of what appears to have been an extramarital romance. She “saw me in the rain yesterday morning, didn’t stop and left with her umbrella”. Things weren’t going well financially either, as evidenced by an excerpt from a May 19 entry: “I lost so much on the stock market. I found myself in this money pit.

‘If you ask me, are there days when I have trouble falling asleep? Yes there is. I regret what I did.

Messages Xu had exchanged with several other US aerospace employees, which prosecutors exposed during the trial, were also saved in the cloud. One of them was Arthur Gau of a Honeywell division in Phoenix, who testified at trial that Rong and Xu paid him $5,000 and covered his plane ticket to China for a visit to Nanjing in 2017 for make a technical presentation. (In May 2021, Gau pleaded guilty in Arizona to a charge of exporting controlled information without a license. Bloomberg Businessweek extensively covered Xu’s case in an article published last September.) Another was a company engineer aviation company Fokker, who accepted Xu’s invitation to visit China to share information with a Chinese research institute after Xu arranged to help the engineer’s parents, who had lost their home in China when their building was to be demolished as part of a development project. A Boeing computer scientist, who testified at trial under the pseudonym Sun Li, described how Xu tried to cultivate a relationship with him, first contacting him by email in which he mentioned contacting the witness’s father. , a scholar in China. The witness then met Xu, who repeatedly offered to reimburse his round-trip tickets to China in exchange for sharing his knowledge and experience with computers. The witness eventually stopped communicating with Xu after realizing that Xu wasn’t really interested in his expertise, which was project management, but in “something else that I couldn’t provide.”

“What they call exchanges is not just a nice invitation,” Timothy Mangan, who led the prosecution, told me, summarizing a point he made to the jury. “It’s part of a recruitment cycle. Some succeed, some don’t, but they are the ones who throw the fishing lines, trying to control people.

During Xu’s trial, Mangan backed up the argument that the alleged exchanges were anything but benign by citing an audio recording of a four-hour meeting between Xu and several Chinese engineers. Why Xu should have recorded this conversation is inexplicable – and surprisingly reckless in hindsight, given that it ended up in an iCloud account – but in it he explains the approach to soliciting information from Chinese expats. “As overseas experts, it would be very difficult for them to directly take large batches of materials due to the fact that their companies’ security is very strict,” Xu told the engineers, stressing the need to take into account the risks incurred for the targeted sources. . Elsewhere in the conversation, he explains how to spot potential recruits while targeting specific technologies. “For example, if I’m an aviation enthusiast, I would search for Boeing or Lockheed, right? Find it at Lockheed Martin,” Xu said. “After finding the person, I would find out if that person does something?As responsible for overall design or avionics.

Messages from Xu’s iCloud account led investigators to another damning discovery. Xu had helped coordinate a cyber espionage campaign targeting several aviation technology companies. These attacks – described in a report by CrowdStrike, a cybersecurity company – began in 2010, shortly after the state-owned Commercial Aircraft Corporation of China (COMAC) announced that it had chosen a joint venture between GE Aviation and Safran to provide a custom aircraft. engine manufactured for China’s first commercial airliner, the C919. The plan behind the campaign, which was directed against Honeywell, Capstone Turbine and Safran, among others, only became clear later when security researchers made the connection. “When I started rounding up all these victims – I was like, OK, these are all component manufacturers for different parts of the C919,” Adam Kozy, a cybersecurity expert who runs security firm SinaCyber ​​and was lead author of the CrowdStrike report. , said. Although COMAC was willing to source the components needed to build the plane from these companies, the Chinese government was also working to steal the intellectual property of these suppliers in order to make domestic manufacturing possible in China, according to The report.