Chinese National Pleads Guilty To Conspiring To Hack Into U.S. Defense Contractors’ Systems To Steal Sensitive Military Information

The U.S. Justice Department released the below information:

A Chinese national pleaded guilty today to participating in a years-long conspiracy to hack into the computer networks of major U.S. defense contractors, steal sensitive military and export-controlled data and send the stolen data to China.

Su Bin, also known as Stephen Su and Stephen Subin, 50, a citizen and resident of the People’s Republic of China, pleaded guilty before U.S. District Judge Christina A. Snyder of the Central District of California.

The guilty plea was announced by Assistant Attorney General for National Security John P. Carlin, U.S. Attorney Eileen M. Decker of the Central District of California, Assistant Director Jim Trainor of the FBI’s Cyber Division and Assistant Director in Charge David Bowdich of the FBI’s Los Angeles Division.

A criminal complaint filed in 2014 and subsequent indictments filed in Los Angeles charged Su, a China-based businessman in the aviation and aerospace fields, for his role in the criminal conspiracy to steal military technical data, including data relating to the C-17 strategic transport aircraft and certain fighter jets produced for the U.S. military.  Su was initially arrested in Canada in July 2014 on a warrant issued in relation to this case.  Su ultimately waived extradition and consented to be conveyed to the United States in February 2016.

“Su Bin admitted to playing an important role in a conspiracy, originating in China, to illegally access sensitive military data, including data relating to military aircraft that are indispensable in keeping our military personnel safe,” said Assistant Attorney General Carlin.  “This plea sends a strong message that stealing from the United States and our companies has a significant cost; we can and will find these criminals and bring them to justice.  The National Security Division remains sharply focused on disrupting cyber threats to the national security, and we will continue to be relentless in our pursuit of those who seek to undermine our security.”

“Protecting our national security is the highest priority of the U.S. Attorney’s Office, and cybercrime represents one of the most serious threats to our national security,” said U.S. Attorney Decker.  “The innovative and tireless work of the prosecutors and investigators in this case is a testament to our collective commitment to protecting our nation’s security from all threats. Today’s guilty plea and conviction demonstrate that these criminals can be held accountable no matter where they are located in the world and that we are deeply committed to protecting our sensitive data in order to keep our nation safe.”

“Cyber security is a top priority not only for the FBI but the entire U.S. government,” said Assistant Director Trainor.  “Our greatest strength is when we harness our capabilities to work together, and today’s guilty plea demonstrates this.  Our adversaries’ capabilities are constantly evolving, and we will remain vigilant in combating the cyber threat.”

“This investigation demonstrates the FBI’s resolve in holding foreign cyber actors accountable regardless of where they reside,” said Assistant Director in Charge Bowdich.  “Cybercrime investigators in Los Angeles are among the finest and their efforts toward preserving America's national security in this case should be commended.”

In the plea agreement filed yesterday in the U.S. District Court of the Central District of California, Su admitted to conspiring with two persons in China from October 2008 to March 2014 to gain unauthorized access to protected computer networks in the United States, including computers belonging to the Boeing Company in Orange County, California, to obtain sensitive military information and to export that information illegally from the United States to China.

As part of the conspiracy, Su would e-mail the co-conspirators with guidance regarding what persons, companies and technologies to target during their computer intrusions.  One of Su’s co-conspirators would then gain access to information residing on computers of U.S. companies and email Su directory file listings and folders showing the data that the co-conspirator had been able to access.  Su then directed his co-conspirator as to which files and folders his co-conspirator should steal.  Once the co-conspirator stole the data, including by using techniques to avoid detection when hacking the victim computers, Su translated the contents of certain stolen data from English into Chinese.  In addition, Su and his co-conspirators each wrote, revised and emailed reports about the information and technology they had acquired by their hacking activities, including its value, to the final beneficiaries of their hacking activities.

Su’s plea agreement makes clear that the information he and his co-conspirators intentionally stole included data listed on the U.S. Munitions List contained in the International Traffic in Arms Regulations.  Su also admitted that he engaged in the crime for the purpose of financial gain and specifically sought to profit from selling the data the he and his co-conspirators illegally acquired. 

Su faces a maximum sentence of five years in prison and a fine of $250,000 or twice the gross gain or gross loss resulting from the offense, whichever is greatest.  Judge Snyder is scheduled to sentence Su on July 13, 2016.

The case is being investigated by the FBI Los Angeles Field Office’s Cyber Division with assistance from the U.S. Air Force’s Office of Special Investigations.

This case is being prosecuted by Assistant U.S. Attorney Anthony J. Lewis of the Central District of California and Trial Attorney Casey Arrowood and Senior Trial Attorney Robert E. Wallace of the National Security Division’s Counterintelligence and Export Control Section, with support from Lisa Roberts of the Justice Department’s Office of International Affairs. 

Retired Air Force Master Sergeant Sentenced To Prison For Disclosing Confidential Bid Information For Government Contracts And Tax Fraud

The U.S. Justice Department released the below information:

A retired U.S. Air Force Master Sergeant was sentenced today in the U.S. District Court for the Southern District of Florida to 18 months in prison following his guilty plea to unlawfully disclosing confidential procurement information and filing a false tax return, announced Acting Assistant Attorney General Caroline D. Ciraolo of the Justice Department’s Tax Division.

According to court documents, Trevor Smith retired from the U.S. Air Force in December 2012 at the rank of Master Sergeant.  From February 2009 through February 2010, Smith was deployed to Afghanistan, where he served as Supply Non-Commissioned Officer-In-Charge for the Operation Enduring Freedom/Combined Security Transition Command-Afghanistan NATO Training Mission.  In that capacity, Smith met a Fort Lauderdale-based government contractor.  As part of his plea, Smith admitted that he agreed to disclose confidential bid information on government contracts to the contractor in exchange for bribe payments.  Smith and the contractor agreed that Smith would receive two percent of all revenues on contracts that the contractor received as a result of Smith’s assistance.

In January 2010, the contractor wired $42,853.29 to Smith.  The two agreed to wait until Smith returned to the United States for more payments.  After returning to the United States, Smith set up a shell corporation called T Star Air Inc. to receive 23 additional payments totaling $220,600.  Smith also created and submitted phony invoices to conceal the scheme.  For tax years 2010 through 2012, Smith filed corporate tax returns for T Star Air that falsely claimed inflated expenses and deductions.

In addition to the prison term, U.S. District Judge Beth Bloom for the Southern District of Florida ordered Smith to pay restitution to the Internal Revenue Service (IRS) in the amount of $6,501.

Acting Assistant Attorney General Ciraolo commended special agents of IRS-Criminal Investigation, the U.S. Air Force’s Office of Special Investigations and the U.S. Department of Defense’s Office of the Inspector General, who investigated this case and Trial Attorneys Charles M. Edgar Jr. and Jason H. Poole of the Tax Division, who are prosecuting this case.

Acting Assistant Attorney General Ciraolo also thanked the U.S. Attorney’s Office of the Southern District of Florida for their substantial assistance. 

Former Connecticut Resident Pleads Guilty To Attempting To Send Sensitive Military Documents To Iran

The U.S. Justice Department released the below information:

Assistant Attorney General for National Security John P. Carlin and U.S. Attorney Deirdre M. Daly for the District of Connecticut announced that Mozaffar Khazaee, 60, formerly of Manchester, Connecticut, pleaded guilty today before U.S. District Judge Vanessa L. Bryant in Hartford to violating the Arms Export Control Act, in connection with his efforts to send to Iran sensitive, proprietary, trade secret and export controlled material relating to military jet engines for the U.S. Air Force’s F35 Joint Strike Fighter program and the F-22 Raptor program, which he had stolen from defense contractors where he had previously been employed.

“While employed with U.S. defense contractors, Mozaffar Khazaee stole sensitive, proprietary and controlled technology to send it to Iran,” said U.S. Attorney Daly.  “The illegal export of our military technology compromises U.S. national security and reduces the advantages our armed forces currently possess.  As today’s case demonstrates, we will aggressively investigate and hold accountable those who attempt to steal trade secrets and sensitive military technology from U.S. industries, whether for their own personal gain or for the benefit of foreign actors.”

“Today’s guilty plea demonstrates the ongoing cooperation with our federal law enforcement partners to prevent U.S. technology from falling into the wrong hands,” said Special Agent in Charge Bruce Foucart of HSI Boston.  “Across the globe, the magnitude and scope of threats facing the United States has never been greater, and that's why one of Homeland Security Investigations highest priorities is to prevent illicit procurement networks, terrorist groups and hostile nations from illegally obtaining U.S. military products and sensitive dual-use technologies.  Homeland Security Investigations takes pride in protecting our country, and today’s guilty plea is the latest example of our effective investigative efforts.”

“This joint investigation has emphasized the need for American companies to remain vigilant against the theft of valuable and sensitive technologies,” said Special Agent in Charge Patricia M. Ferrick of the FBI’s New Haven Division.  “As our nation continues to lead the way in research and development, we are constantly reminded that there are those who seek to advance their own causes by stealing the hard work of others, and we owe it to ourselves and to the American public to guard against it. The FBI vigorously investigates these matters in cooperation with our law enforcement partners, both domestic and abroad.”

“This investigation demonstrates the dedication of the Department of Defense, Office of the Inspector General, Defense Criminal Investigative Service and our federal and military partners to ensure that critical technology is not exploited by criminals acting on behalf of governments hostile to the U.S.,” said Special Agent in Charge Craig W. Rupert of the Defense Criminal Investigative Service’s Northeast Field Office.  “Foreign governments continue to actively seek U.S. military technology in an effort to advance their own military development.  Today’s plea represents our continuing efforts to safeguard sensitive technology and to shield America’s investment in national defense by thwarting those who try to illegally acquire our national security assets.”

According to court documents and statements made in court, at different times between 2001 and 2013, Khazaee was employed by three separate defense contractors.  From at least 2009 through and including late 2013, Khazaee attempted to use trade secret, proprietary and export controlled material that he had obtained from his employers to gain employment in Iran.

In November and December 2009, Khazaee corresponded by email with an individual in Iran to whom he attempted to send, and in some cases did send, documents containing trade secret, proprietary and export controlled material relating to the Joint Strike Fighter Program.  In one email Khazaee wrote “some of these are very controlled . . . and I am taking [a] big risk.  Again please after downloading these two Power Point files delete everything immediately.”

Analysis of Khazaee’s computer media revealed not only additional documents containing proprietary, trade secret and export controlled material belonging to the U.S. defense contractors at which he had been employed, but also cover letters and application documents, dating from in or about 2009 through in or about 2013, in which Khazaee sought employment with multiple state-controlled technical universities in Iran.  In multiple letters Khazaee described the knowledge and skills he had obtained while working for the U.S. defense contractors and wrote:  “[a]s lead engineer in these projects I have learned some of the key technique[s] that could be transferred to our own industry and universities.”  Khazaee stated that he was “looking for an opportunity to work in Iran, and . . . transferring my skill and knowledge to my nation.”

In or about November 2013, while residing in Connecticut, Khazaee caused a shipment to be sent by truck from Connecticut to a freight forwarder located in Long Beach, California, which was intended for shipment to Iran.  The shipment included numerous boxes and digital media containing thousands of documents consisting of sensitive technical manuals, specification sheets, technical drawings and data, and other proprietary material relating to military jet engines and the United States Air Force’s F35 Joint Strike Fighter (JSF) program and the F-22 Raptor.  Many documents were labeled as “Export-Controlled,” as well as stamped with “ITAR-controlled” warnings.  Khazaee did not apply for nor did he obtain any export license or written authorization to export any of the documents, and the export or attempted export of such material to Iran is illegal.

On Jan. 9, 2014, Khazaee was arrested at the Newark Liberty International Airport before boarding a flight with a final destination of Iran.  Search warrants executed on Khazaee’s checked and carry-on luggage revealed additional sensitive, proprietary, trade secret and export controlled documents relating to military jet engines, in both hard copy and in electronic form on Khazaee’s computer media.  Khazaee has been detained since that time.

Judge Bryan scheduled sentencing proceedings for May 20, 2015, at which time Khazaee faces up to 20 years in prison and a $1,000,000 fine.

This investigation is being led by the United States Department of Homeland Security’s Homeland Security Investigations in New Haven, in coordination with the New Haven Division of the Federal Bureau of Investigation, the Defense Criminal Investigative Service in New Haven and the Department of Commerce’s Boston Office of Export Enforcement.

Assistant Attorney General Carlin joins U.S. Attorney Daly in commending the efforts of the many other agencies and offices that were involved in this investigation, including U.S. Attorney’s Offices for the Central District of California, the Southern District of Indiana and the District of New Jersey, Homeland Security Investigations in Los Angeles, the U.S. Customs and Border Protection Service in Los Angeles, the U.S. Air Force’s Office of Special Investigations in Los Angeles and Boston,  as well as HSI, CBP, and FBI in New Jersey, and HSI, FBI and DCIS in Indianapolis.

This case is being prosecuted by Assistant U.S. Attorneys Stephen Reynolds and Krishna Patel of the National Security and Major Crimes Unit of the District of Connecticut, and Trial Attorney Brian Fleming of the Justice Department’s National Security Division.