Coordinated Arrests And Charges Dismantle Hamas Terror Finance Network Raising Funds From the United States

The U.S. Justice Department released the information below:

The Justice Department announced the unsealing of an indictment charging Saleem Alzaq, as well as the arrests of Omar Adhami, Abdel Adhami, and Raed Yousef, for their involvement in paying, soliciting and collecting funds for Hamas. In a coordinated law enforcement operation in France, three of Alzaq’s associates, Faouzi Barika, Amel Oualid, and Nordine Barika were arrested by the French General Directorate for Internal Security. 

“Anyone who finances or assists terrorist organizations responsible for the deaths of American citizens should expect to be prosecuted by the Department of Justice,” said Attorney General Todd Blanche. “For decades, members of Hamas have raised funding to carry out brutal terrorist attacks. Under the leadership of President Trump, the Department of Justice will continue pursuing terrorists who kill Americans, dismantling terrorist finance networks, and delivering justice for the families of victims.”

"The FBI will never forget the horrific attack on Israel by Hamas on October 7, 2023 – and we will never stop our efforts to cut off funding to Hamas terrorists," said FBI Director Kash Patel. "These subjects allegedly engaged in a conspiracy that extended beyond national borders to funnel money to Hamas and fuel violent attacks, using cryptocurrency, to try to hide their criminal activity. Today's announcement shows the abilities of this FBI and our interagency partners to follow the money and shut down resources going to terrorists under the guise of charitable giving – with 4,000 Foreign Terrorist organization related disruptions and stopping 1,100 alleged terrorist actors here at home and around the world since last year. Special thanks to our FBI New York, New Orleans, and Tampa Field Offices, our Counterterrorism Division, as well as the Paris Legal Attaché's Office and French authorities for their outstanding work with us in this case.”

“Money is the lifeblood of terrorist organizations, and the arrests announced today disrupted a global financing network that was supplying Hamas with the funds needed to continue its campaign of destroying innocent lives,” said Assistant Attorney General for National Security John A. Eisenberg, “These coordinated investigations and arrests spanned multiple jurisdictions in the United States and across international borders, and demonstrate that we will use all of our capabilities to eradicate terrorism. I want to thank the FBI agents and federal prosecutors who worked together to dismantle this network, and I also want to thank Joint Task Force 10-7 for its leadership in seeking justice for the victims of the Hamas-led attack in Israel on October 7, 2023, that killed more than 1,200 men, women, and children. My thoughts are with all who are still suffering from the losses of that terrible day, and the National Security Division will never stop working to hold the perpetrators, and those who enabled them, accountable for their atrocities.”

“This Office and our law enforcement partners will root out and prosecute those who finance Hamas, no matter where they are located,” said U.S. Attorney Jamie McDonald for the Southern District of New York. “As alleged, Saleem Alzaq was the center of a Hamas financing network that operated around the globe, soliciting more than a million dollars from individual donors including here in the United States. The close cooperation of law enforcement and prosecutors’ offices to dismantle Alzaq’s alleged Hamas financing network demonstrates our commitment to depriving Hamas of the funding it relies on in Gaza and to commit terror attacks like the brutal October 7, 2023, massacre of more than a thousand innocent victims, including dozens of Americans.” 

“According to the indictment and complaint filed in the Eastern District of Louisiana, Saleem Alzaq solicited financial donations on behalf of Hamas, a terrorist organization responsible for the commission of heinous attacks worldwide,” said U.S. Attorney David I. Courcelle for the Eastern District of Louisiana. “Omar Adhami and Abdel Adhami are accused of providing Alzaq with resources intended to fund Hamas’ relentless reign of terror. The Department of Justice and the U.S. Attorney’s Office for the Eastern District of Louisiana are laser focused on the identification, prosecution, and eradication of terrorist networks, and the individuals who financially support these networks.” 

“Providing financial assistance and support to terrorist organizations like Hamas place the safety and security of everyone, anywhere in the world, at risk,” said U.S. Attorney Gregory W. Kehoe for the Middle District of Florida. “The diligence and cooperation exhibited by our domestic and international law enforcement partners during this investigation demonstrates our collective resolve to relentlessly pursue, disrupt, and prosecute those who engage in these illegal activities.”

“The NYPD’s counterterrorism work knows no borders,” said NYPD Commissioner Jessica S. Tisch.  “Our intelligence analysts uncovered this international finance network and built the case that exposed more than $2 million being funneled to Hamas. Saleem Alzaq, a leader in Hamas’ military arm responsible for planning and carrying out terrorist attacks, and the other defendants allegedly solicited donations under the guise of humanitarian aid and then directed that money to Hamas. This is the kind of extraordinary counterterrorism work the NYPD does every day to disrupt threats before they reach New Yorkers, and I thank our law enforcement partners for helping us dismantle this network.” 

According to the Alzaq indictment unsealed in the Southern District of New York, the Adhami complaints filed in the Eastern District of Louisiana, and the Yousef indictment filed in the Middle District of Florida:

Alzaq, 45, of Gaza, is a Hamas member in the Gaza Strip and a battalion deputy in the Izz al-Din al-Qassam Brigades (the Al-Qassam Brigades), Hamas’s armed wing responsible for planning and executing terrorist attacks. Alzaq serves in the Photography Department of the Al-Qassam Brigades’ Shujaiyya Brigade Media Office, a Hamas propaganda office. In this role, he has photographed Hamas events, including events led by senior Hamas leaders such as Ismail Haniyeh and Yahya Sinwar. He distributes these photographs and descriptions of Hamas events to others involved in the Hamas propaganda apparatus. He has also posted Hamas propaganda across multiple social media platforms, including posts glorifying deceased leaders of Hamas (such as Sheikh Ahmed Yassin, Haniyeh, and Sinwar); supporting Al-Qassam Brigades terrorists and glorifying Al-Qassam Brigades “martyrs;” and promoting and celebrating Hamas’s October 7, 2023, terrorist attacks against Southern Israel, in which more than 1,200 victims were murdered and more than 250 were taken hostage, including 46 American citizens. 

Since at least about January 2020, Alzaq has operated an international Hamas fundraising network that collects donations from individuals around the world, including from individuals in the United States. Alzaq promotes this fundraising through social media campaigns purportedly providing humanitarian aid to people in Gaza, while the money is funneled to Hamas. Since January 2020, Alzaq has collected more than $1.7 million through purported charitable campaigns. Alzaq’s associates in France, Barika, Amel Oualid, and others assisted Alzaq in collecting and transferring money raised for Hamas. 

Abdel Adhami, 35, and Omar Adhami, 33, both of Covington, Louisiana, donated funds to Alzaq’s Hamas financing network. Beginning in approximately February 2021, and continuing through approximately September 2026, Abdel Adhami allegedly contributed approximately $94,000 and Omar Adhami allegedly contributed approximately $11,000 to Hamas, a designated terrorist organization, knowing that the organization engaged in terrorist activities, and attempted to conceal their contributions to Hamas through wire transfers, and the use of intermediaries. Yousef, a resident of Lutz, Florida, provided almost $50,000 to Alzaq’s Hamas financing network. 

Alzaq is charged with conspiring to provide material support to Hamas, a designated foreign terrorist organization, which carries a maximum penalty of 20 years in prison; conspiring to violate the International Emergency Economic Powers Act, which carries a maximum penalty of 20 years in prison; conspiring to commit money laundering, which carries a maximum penalty of 20 years in prison; and conspiring to defraud the United States, which carries a maximum penalty of five years in prison.

Omar Adhami is charged with providing material support to a Foreign Terrorist Organization, which carries a maximum penalty of 20 years in prison; conspiracy to provide material support to a Foreign Terrorist Organization, which carries a maximum penalty of 20 years in prison; conspiracy to commit wire fraud, which carries a maximum penalty of 20 years in prison; and conspiring to commit money laundering, which carries a maximum penalty of 20 years in prison. 

Abdel Adhami is charged with providing material support to a Foreign Terrorist Organization, which carries a maximum penalty of 20 years in prison; conspiracy to provide material support to a Foreign Terrorist Organization, which carries a maximum penalty of 20 years in prison; conspiracy to commit wire fraud, which carries a maximum penalty of 20 years in prison; and conspiring to commit money laundering, which carries a maximum penalty of 20 years in prison. 

Raed Yousef, 56, of Lutz, Florida, is charged with one count of conspiring to provide material support to a foreign terrorist organization, which carries a maximum penalty of 20 years in prison; five counts of attempting to provide material support to a foreign terrorist organization, which carries a maximum penalty of 20 years in prison on each count; one count of providing funds, goods, and services to a specially designated terrorist, which carries a maximum penalty of 20 years in federal prison; five counts of attempting to provide funds, goods, and services to a specially designated terrorist, which carries a maximum penalty of 20 years in person on each count; one count of conspiracy to commit money laundering, which carries a maximum penalty of 20 years in federal prison; five counts of money laundering, which carries a maximum penalty of 20 years in federal prison on each count; and one count of passport fraud, which carries a maximum penalty of 5 years in federal prison.       

The Alzaq case is being investigated by the FBI with the assistance of the New York Police Department (NYPD). Assistant U.S. Attorneys David A. Markewitz, Ben Arad, Sarah L. Kushner, Juliana N. Murray, and Keith Savino for the Southern District of New York are prosecuting the case, with assistance from Trial Attorneys Rob MacDonald and A.J. Dixon of the National Security Division’s Counterterrorism Section. The Justice Department’s Office of International Affairs provided significant assistance.

The Adhami case is being investigated by the FBI New Orleans Field Office. Assistant U.S. Attorney Greg Kennedy for the Eastern District of Louisiana is prosecuting the case. 

The Yousef case is being investigated by the FBI. Assistant U.S. Attorneys Lindsey Schmidt and Michael Buchanan for the Middle District of Florida are prosecuting the case.

Afghan National Pleads Guilty To Obtaining Firearms In Connection With Plot To Conduct ISIS-Inspired Election Day Terrorist Attack

The U.S. Justice Department released the information below:

Abdullah Haji Zada, 18, a native and citizen of Afghanistan and U.S. lawful permanent resident, pleaded guilty today to a criminal information charging him with knowingly receiving, attempting to receive, and conspiring to receive a firearm and ammunition to be used to commit a federal crime of terrorism.

According to court documents, Zada and a co-conspirator received two AK-47-style rifles and 500 rounds of ammunition, knowing that the firearms and ammunition would be used in connection with a terrorist attack on Election Day in November 2024 on behalf the Islamic State of Iraq and al-Sham (ISIS), a designated foreign terrorist organization. Zada was arrested with co-conspirator Nasir Ahmad Tawhedi, 27, also a citizen of Afghanistan, in October 2024.

Zada, who was 17 at the time of his arrest, entered his guilty plea as an adult and will be sentenced as an adult. At sentencing, Zada faces a maximum penalty of 15 years in federal prison and a $250,000 fine.

As part of the plea agreement, Zada stipulated to the entry of a judicial order of removal from the United States to Afghanistan following his term of incarceration. Zada acknowledged that the order of removal would terminate his lawful permanent resident status. Zada also waived his right to appeal the conviction except in limited circumstances or seek any form of appeal or relief from his removal and deportation, including but not limited to, seeking asylum.

Tawhedi is currently awaiting trial for conspiring and attempting to provide material support to ISIS, which carries a maximum penalty of 20 years in prison, and receiving, attempting to receive, or conspiring to receive a firearm to be used to commit a felony or a federal crime of terrorism, which carries a maximum penalty of 15 years in prison, if convicted. An indictment is merely an allegation and Tawhedi is presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Sue J. Bai, head of the Justice Department’s National Security Division, U.S. Attorney Robert J. Troester for the Western District of Oklahoma, and Assistant Director David J. Scott of the FBI’s Counterterrorism Division made the announcement.

The FBI Oklahoma City Field Office’s Joint Terrorism Task Force, which includes Homeland Security Investigations, U.S. Immigration and Customs Enforcement, U.S. Citizenship and Immigration Services, U.S. Marshals Service, Oklahoma State Bureau of Investigation, the Edmond Police Department, the Moore Police Department, the Oklahoma City Police Department, the Oklahoma City Community College Police Department, and the Oklahoma City University Police Department, is investigating the case.

Assistant U.S. Attorneys Jessica L. Perry and Matt Dillon for the Western District of Oklahoma, and Assistant U.S. Attorney Everett McMillian and Trial Attorney Jennifer Levy of the National Security Division’s Counterterrorism Section are prosecuting the case.

Chinese National Sentenced For Economic Espionage Conspiracy

The U.S. Justice Department released the below information:

A Chinese national formerly residing in Chesterfield, Missouri, was today sentenced to 29 months in prison followed by three years of supervised release and a $150,000 fine for conspiring to commit economic espionage.

Xiang Haitao, 44, pleaded guilty to the charge in January 2022.  According to court documents, Xiang conspired to steal a trade secret from The Climate Corporation, a subsidiary of Monsanto, an internationally based company doing business in St. Louis, Missouri, for the purpose of benefitting a foreign government, namely the People’s Republic of China (PRC).

“Xiang conspired to steal an important trade secret to gain an unfair advantage for himself and the PRC,” said Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division. “The victim companies invested significant time and resources to develop this intellectual property.  Economic espionage is a serious offense that can threaten U.S. companies’ competitive advantage, and the National Security Division is committed to holding accountable anyone who steals trade secrets to benefit a foreign government.”

“The defendant took advantage of living and working in the United States to steal a valuable trade secret for the benefit of PRC entities,” said Assistant Attorney General Kenneth A. Polite, Jr. of the Justice Department’s Criminal Division. “This type of theft threatens employers large and small in every state, and it imperils our economic competitiveness as a nation. Individuals entrusted with valuable trade secrets should be on notice that if they abuse that trust – especially for the benefit of foreign nations – we will hold them accountable.”

“Those who conspire to steal technology from U.S. businesses and transfer it to China cause tremendous economic damage to our country," said Assistant Director Alan E. Kohler Jr. of the FBI’s Counterintelligence Division. "The government of China does not hesitate to go after the ingenuity that drives our economy. Stealing our highly prized technology can lead to the loss of good-paying jobs here in the United States, affecting families, and sometimes entire communities. Our economic security is essential to our national security.  That’s why at the FBI protecting our nation’s innovation is both a law enforcement and a top national security priority.”

“This is the first economic espionage conviction ever in the history of the Eastern District of Missouri,” said Acting Special Agent in Charge Akil Davis of FBI’s St. Louis Field Office. There are less than two dozen such convictions nationwide. Economic espionage convictions are rare because the elements required to prove state-sponsored theft is extremely difficult,” “Today’s sentencing is a culmination of more than five years of tenacity and dedication by our agents and federal prosecutors. I commend their success in protecting the victim company and ultimately our U.S. economy.”

According to court documents, Xiang was employed by Monsanto and its subsidiary, The Climate Corporation, from 2008 to 2017, where he worked as an imaging scientist. Monsanto and The Climate Corporation developed a digital, online farming software platform that was used by farmers to collect, store and visualize critical agricultural field data and increase and improve agricultural productivity for farmers. A critical component to the platform was a proprietary predictive algorithm referred to as the Nutrient Optimizer. Monsanto and The Climate Corporation considered the Nutrient Optimizer a valuable trade secret and their intellectual property.

In June 2017, the day after leaving employment with Monsanto and The Climate Corporation, Xiang attempted to travel to China on a one-way airplane ticket. While he was waiting to board his flight, federal officials conducted a search of Xiang’s person and baggage. Investigators later determined that one of Xiang’s electronic devices contained copies of the Nutrient Optimizer. Xiang continued on to China where he worked for the Chinese Academy of Science’s Institute of Soil Science. Xiang was arrested when he returned to the United States in November 2019.

The FBI and the Department of Homeland Security, Customs and Border Protection investigated the case.

Assistant U.S. Attorneys Matthew Drake and Gwendolyn Carroll for the Eastern District of Missouri, Senior Trial Attorney Heather Schmidt and Trial Attorney Adam Small of the National Security Division’s Counterintelligence and Export Control Section, and Senior Counsel Jeff Pearlman and Assistant Deputy Chief Matthew Walczewski of the Criminal Division’s Computer Crime and Intellectual Property Section prosecuted the case.

Four Russian Government Employees Charged In Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide

The U. S. Justice Department released the below information:

The Department of Justice unsealed two indictments today charging four defendants, all Russian nationals who worked for the Russian government, with attempting, supporting and conducting computer intrusions that together, in two separate conspiracies, targeted the global energy sector between 2012 and 2018. In total, these hacking campaigns targeted thousands of computers, at hundreds of companies and organizations, in approximately 135 countries.

A June 2021 indictment returned in the District of Columbia, United States v. Evgeny Viktorovich Gladkikh, concerns the alleged efforts of an employee of a Russian Ministry of Defense research institute and his co-conspirators to damage critical infrastructure outside the United States, thereby causing two separate emergency shutdowns at a foreign targeted facility. The conspiracy subsequently attempted to hack the computers of a U.S. company that managed similar critical infrastructure entities in the United States.

An August 2021 indictment returned in the District of Kansas, United States v. Pavel Aleksandrovich Akulov, et al., details allegations about a separate, two-phased campaign undertaken by three officers of Russia’s Federal Security Service (FSB) and their co-conspirators to target and compromise the computers of hundreds of entities related to the energy sector worldwide. Access to such systems would have provided the Russian government the ability to, among other things, disrupt and damage such computer systems at a future time of its choosing.

“Russian state-sponsored hackers pose a serious and persistent threat to critical infrastructure both in the United States and around the world,” said Deputy Attorney General Lisa O. Monaco. “Although the criminal charges unsealed today reflect past activity, they make crystal clear the urgent ongoing need for American businesses to harden their defenses and remain vigilant. Alongside our partners here at home and abroad, the Department of Justice is committed to exposing and holding accountable state-sponsored hackers who threaten our critical infrastructure with cyber-attacks.” 

“The FBI, along with our federal and international partners, is laser-focused on countering the significant cyber threat Russia poses to our critical infrastructure,” said FBI Deputy Director Paul Abbate. “We will continue to identify and quickly direct response assets to victims of Russian cyber activity; to arm our partners with the information that they need to deploy their own tools against the adversary; and to attribute the misconduct and impose consequences both seen and unseen.”

“We face no greater cyber threat than actors seeking to compromise critical infrastructure, offenses which could harm those working at affected plants as well as the citizens who depend on them,” said U.S. Attorney Matthew M. Graves for the District of Columbia. “The department and my office will ensure that those attacking operational technology will be identified and prosecuted.”

“The potential of cyberattacks to disrupt, if not paralyze, the delivery of critical energy services to hospitals, homes, businesses and other locations essential to sustaining our communities is a reality in today’s world,” said U.S. Attorney Duston Slinkard for the District of Kansas. “We must acknowledge there are individuals actively seeking to wreak havoc on our nation’s vital infrastructure system, and we must remain vigilant in our effort to thwart such attacks. The Department of Justice is committed to the pursuit and prosecution of accused hackers as part of its mission to protect the safety and security of our nation.”

In addition to unsealing these charges, the U.S. government is taking action to enhance private sector network defense efforts and disrupt similar malicious activity.

The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has already released numerous Technical Alerts, ICS Alerts and Malware Analysis Reports regarding Russia’s malign cyber activities, including the campaigns discussed in the indictments. These are located at: https://www.cisa.gov/shields-up

1. United States v. Evgeny Viktorovich Gladkikh – defendant installed backdoors and launched malware designed to compromise the safety of energy facilities

In June 2021, a federal grand jury in the District of Columbia returned an indictment charging Evgeny Viktorovich Gladkikh (Евгений Викторович Гладких), 36, a computer programmer employed by an institute affiliated with the Russian Ministry of Defense, for his role in a campaign to hack industrial control systems (ICS) and operational technology (OT) of global energy facilities using techniques designed to enable future physical damage with potentially catastrophic effects.

According to the indictment, between May and September 2017, the defendant and co-conspirators hacked the systems of a foreign refinery and installed malware, which cyber security researchers have referred to as “Triton” or “Trisis,” on a safety system produced by Schneider Electric, a multinational corporation. The conspirators designed the Triton malware to prevent the refinery’s safety systems from functioning (i.e., by causing the ICS to operate in an unsafe manner while appearing to be operating normally), granting the defendant and his co-conspirators the ability to cause damage to the refinery, injury to anyone nearby, and economic harm. However, when the defendant deployed the Triton malware, it caused a fault that led the refinery’s Schneider Electric safety systems to initiate two automatic emergency shutdowns of the refinery’s operations. Between February and July 2018, the conspirators researched similar refineries in the United States, which were owned by a U.S. company, and unsuccessfully attempted to hack the U.S. company’s computer systems.

The three-count indictment alleges that Gladkikh was an employee of the State Research Center of the Russian Federation FGUP Central Scientific Research Institute of Chemistry and Mechanics’ (Государственный научный центр Российской Федерации федеральное государственное унитарное предприятие Центральный научно-исследовательский институт химии и механики, hereinafter “TsNIIKhM”) Applied Developments Center (“Центр прикладных разработок,” hereinafter “ADC”). On its website, which was modified after the Triton attack became public, TsNIIKhM described itself as the Russian Ministry of Defense’s leading research organization. The ADC, in turn, publicly asserted that it engaged in research concerning information technology-related threats to critical infrastructure (i.e., that its research was defensive in nature).

The defendant is charged with one count of conspiracy to cause damage to an energy facility, which carries a maximum sentence of 20 years in prison, one count of attempt to cause damage to an energy facility, which carries a maximum sentence of 20 years in prison, and one count of conspiracy to commit computer fraud, which carries a maximum sentence of five years in prison.

Assistant U.S. Attorneys Christopher B. Brown and Luke Jones for the District of Columbia, in partnership with the National Security Division’s Counterintelligence and Export Control Section, are prosecuting this case. The FBI’s Washington Field Office conducted the investigation.

The U.S.-based targets of the conspiracy cooperated and provided valuable assistance in the investigation. The Department of Justice and the FBI also expressed appreciation to Schneider Electric for its assistance in the investigation, particularly noting the company’s public outreach and education efforts following the overseas Triton attack.

2. United States v. Pavel Aleksandrovich Akulov, Mikhail Mikhailovich Gavrilov, and Marat Valeryevich Tyukov – defendants undertook years-long effort to target and compromise computer systems of energy sector companies

On Aug. 26, 2021, a federal grand jury in Kansas City, Kansas, returned an indictment charging three computer hackers, all of whom were residents and nationals of the Russian Federation (Russia) and officers in Military Unit 71330 or “Center 16” of the FSB, with violating U.S. laws related to computer fraud and abuse, wire fraud, aggravated identity theft and causing damage to the property of an energy facility.

The FSB hackers, Pavel Aleksandrovich Akulov (Павел Александрович Акулов), 36, Mikhail Mikhailovich Gavrilov (Михаил Михайлович Гаврилов), 42, and Marat Valeryevich Tyukov (Марат Валерьевич Тюков), 39, were members of a Center 16 operational unit known among cybersecurity researchers as “Dragonfly,” “Berzerk Bear,” “Energetic Bear,” and “Crouching Yeti.” The indictment alleges that, between 2012 and 2017, Akulov, Gavrilov, Tyukov and their co-conspirators, engaged in computer intrusions, including supply chain attacks, in furtherance of the Russian government’s efforts to maintain surreptitious, unauthorized and persistent access to the computer networks of companies and organizations in the international energy sector, including oil and gas firms, nuclear power plants, and utility and power transmission companies. Specifically, the conspirators targeted the software and hardware that controls equipment in power generation facilities, known as ICS or Supervisory Control and Data Acquisition (SCADA) systems. Access to such systems would have provided the Russian government the ability to, among other things, disrupt and damage such computer systems at a future time of its choosing.

According to the indictment, the energy sector campaign involved two phases. In the first phase, which took place between 2012 and 2014 and is commonly referred to by cyber security researchers as “Dragonfly” or “Havex,” the conspirators engaged in a supply chain attack, compromising the computer networks of ICS/SCADA system manufacturers and software providers and then hiding malware – known publicly as “Havex” – inside legitimate software updates for such systems. After unsuspecting customers downloaded Havex-infected updates, the conspirators would use the malware to, among other things, create backdoors into infected systems and scan victims’ networks for additional ICS/SCADA devices. Through these and other efforts, including spearphishing and “watering hole” attacks, the conspirators installed malware on more than 17,000 unique devices in the United States and abroad, including ICS/SCADA controllers used by power and energy companies.

In the second phase, which took place between 2014 and 2017 and is commonly referred to as “Dragonfly 2.0,” the conspirators transitioned to more targeted compromises that focused on specific energy sector entities and individuals and engineers who worked with ICS/SCADA systems. As alleged in the indictment, the conspirators’ tactics included spearphishing attacks targeting more than 3,300 users at more than 500 U.S. and international companies and entities, in addition to U.S. government agencies such as the Nuclear Regulatory Commission. In some cases, the spearphishing attacks were successful, including in the compromise of the business network (i.e., involving computers not directly connected to ICS/SCADA equipment) of the Wolf Creek Nuclear Operating Corporation (Wolf Creek) in Burlington, Kansas, which operates a nuclear power plant. Moreover, after establishing an illegal foothold in a particular network, the conspirators typically used that foothold to penetrate further into the network by obtaining access to other computers and networks at the victim entity.

During the Dragonfly 2.0 phase, the conspirators also undertook a watering hole attack by compromising servers that hosted websites commonly visited by ICS/SCADA system and other energy sector engineers through publicly known vulnerabilities in content management software. When the engineers browsed to a compromised website, the conspirators’ hidden scripts deployed malware designed to capture login credentials onto their computers.

The conspiracy’s hacking campaign targeted victims in the United States and in more than 135 other countries.

Akulov, Gavrilov and Tyukov are charged with conspiracy to cause damage to the property of an energy facility and commit computer fraud and abuse, which carries a maximum sentence of five years in prison, and conspiracy to commit wire fraud, which carries a maximum sentence of 20 years in prison. Akulov and Gavrilov are also charged with substantive counts of wire fraud and computer fraud related to unlawfully obtaining information from computers and causing damage to computers. These offenses carry maximum sentences ranging from five to 20 years in prison. Finally, Akulov and Gavrilov are also charged with three counts of aggravated identity theft, each of which carry a minimum sentence of two years consecutive to any other sentence imposed.

Assistant U.S. Attorneys Scott Rask, Christopher Oakley and Ryan Huschka forthe District of Kansas, and Counsel for Cyber Investigations Ali Ahmad and Trial Attorney Christine Bonomo of the National Security Division’s Counterintelligence and Export Control Section are prosecuting this case. The FBI’s Portland and Richmond field offices conducted the investigation, with the assistance of the FBI’s Cyber Division.

Numerous victims, including Wolf Creek and its owners Evergy and the Kansas Electric Power Cooperative, cooperated and provided invaluable assistance in the investigation.

An indictment is merely an allegation and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

---

Note: View the concurrent announcement by the Department of State of a $10 million reward for information leading to the arrest of a defendant or identification of other conspirators as part of its Rewards for Justice program.

View the concurrent announcement by the FBI, Department of Energy and Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) of a  Joint Cybersecurity Advisory containing technical details, indicators of compromise and mitigation measures. 

United States Prevails In Actions To Seize And Forfeit Iranian Terror Group’s Missiles and Petroleum: Missiles And Petroleum Products Were Property Of Islamic Revolutionary Guard Corps Or A Source Of Influence Over Terror Organization

The Justice Department released the below information and photos:

The Justice Department announced the successful forfeiture of two large caches of Iranian arms, including 171 surface-to-air missiles and eight anti-tank missiles, as well as approximately 1.1 million barrels of Iranian petroleum products. The U.S. Navy seized the weapons from two vessels in the Arabian Sea while conducting routine maritime security operations. Iran’s Islamic Revolutionary Guard Corps (IRGC), a designated foreign terrorist organization, orchestrated the arms shipments, which were destined for Houthi militants in Yemen. The U.S. government similarly seized the Iranian petroleum products from four foreign-flagged tankers in or around the Arabian Sea while en route to Venezuela. These actions represent the government’s largest-ever forfeitures of fuel and weapons shipments from Iran.

The U.S. government sold the seized petroleum products pursuant to a court order. The net proceeds of that sale, $26,681,397.67 before interest, may be directed, in whole or in part, to the U.S. Victims of State Sponsored Terrorism Fund now that the case has concluded.

“The actions of the United States in these two cases strike a resounding blow to the Government of Iran and to the criminal networks supporting Iran’s Islamic Revolutionary Guard Corps,” said Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division. “The Department of Justice will continue to use all available tools to combat the threats posed by terrorist organizations and all those who seek to harm the United States and its allies.”

“These two cases demonstrate that not only can we disrupt the Islamic Revolutionary Guard Corps’ ability to finance its operations through petroleum sales, but we can also thwart its ability to use the proceeds of such sales to arm its terrorist proxies and export terrorism abroad,” said U.S. Attorney Matthew M. Graves for the District of Columbia. “Given our expertise and special statutory authority, the U.S. Attorney’s Office for the District of Columbia is uniquely positioned to support its law enforcement partners in such terrorism cases. We are deeply committed to this mission.”

“The combined efforts of the FBI and our partners to seize missiles and over a million barrels of petroleum demonstrate our commitment to defend against foreign terrorist organizations and enforce U.S. sanctions,” said Assistant Director Alan E. Kohler Jr. of the FBI’s Counterintelligence Division. “The Government of Iran’s sponsorship of terrorism has left innocent victims in its wake and its attempts to support regimes dangerous to the United States and our allies will be met with the full force of the law. The FBI has a continued resolve to hold the Government of Iran accountable for its illegal actions, and we urge anyone with information about violations of sanctions on Iran to contact the FBI.”

“This case is a success because of the hard work and dedication of a joint agency team including agents, analysts and prosecutors who, by securing illegal petroleum, have helped curtail Iran’s campaign of violence and unrest throughout the Middle East,” said Special Agent in Charge Michael Paul of the FBI’s Minneapolis Field Office.

“The results announced today by the Department of Justice represent another significant victory for HSI in its ongoing efforts to thwart the nefarious criminal activities of the Iranian regime and Iran’s Islamic Revolutionary Guard Corps,” said Special Agent in Charge Ray Villanueva of Homeland Security Investigations (HSI) Washington. “Protecting our homeland from transnational threats of any kind remains a top priority for HSI. The actions conducted by HSI and our partner organizations, both at home and abroad, demonstrate that no matter where in the world Iran attempts to violate sanctions and arm dangerous entities, HSI stands ready to disrupt their activities and defend the national security of the United States.”

“The illegal transfer of Iranian-made weapons poses a significant and immediate threat to our national security,” said Director Kelly P. Mayo of the Department of Defense, Office of the Inspector General’s criminal investigative arm, the Defense Criminal Investigative Service (DCIS). “The judgement announced today is an important step in our efforts to identify, disrupt, and bring to justice those who imperil resources vital to our safety.”

U.S. Navy Central Command (NAVCENT) seized the weapons from two flagless vessels in the Arabian Sea on Nov. 25, 2019, and Feb. 9, 2020, respectively. The weapons included 171 guided anti-tank missiles, eight surface-to-air missiles, land attack cruise missile components, anti-ship cruise missile components, thermal weapons optics and other components for missiles and unmanned aerial vehicles.

On Aug. 20, 2020, the Justice Department filed a complaint seeking to forfeit the seized weapons in U.S. District Court for the District of Columbia. The complaint alleged that the arms shipments were part of an IRGC trafficking network designed to distribute illicit weapons to the Houthi movement in Yemen. The court granted the government’s motion for default judgment and entered a final order of forfeiture on Nov. 15. In its opinion, the court found that the government had adequately alleged that the weapons belonged to the IRGC and that the IRGC constitutes an entity engaged in planning or perpetrating a federal crime of terrorism against the United States.  

On July 2, 2020, the United States also filed a complaint in the District of Columbia seeking to forfeit all petroleum-product cargo aboard four foreign-flagged oil tankers. The complaint alleged that the petroleum originated in Iran, and the sale of that petroleum benefitted the IRGC, a sanctioned Iranian entity. On Oct. 1, 2021, the court granted the government’s motion for default judgment and entered an order of forfeiture. In its opinion, the court found that the United States had sufficiently alleged that the petroleum products provided a source of influence over the IRGC because those properties were critical to furthering the affairs of the terrorist group’s enterprise.

These successful forfeiture actions are a product of the U.S. government’s coordinated efforts to enforce U.S. sanctions against the IRGC and the Iranian regime.

HSI’s Washington Field Office and DCIS’s Mid-Atlantic Field Office led the investigation of the IRGC weapons smuggling network, with substantial assistance from NAVCENT in conducting the seizures. HSI Denver and FBI’s Minneapolis Field Office led the investigation of the Iranian petroleum sales, again with substantial assistance from NAVCENT during the seizures.

Both cases were prosecuted by the U.S. Attorney’s Office for the District of Columbia and the Justice Department’s National Security Division. Assistant U.S. Attorneys Brian P. Hudak, Stuart D. Allen, and Michael P. Grady for the District of Columbia and Trial Attorney David Lim of the National Security Division’s Counterintelligence and Export Control Section prosecuted the cases, with support from Paralegal Specialist Brian Rickers and Legal Assistant Jessica McCormick. The Money Laundering and Asset Recovery Section of the Justice Department’s Criminal Division provided extensive assistance in the forfeiture and sale of the seized petroleum.

The cases are United States v. All Petroleum-Product Cargo Aboard the Bella, et al., 1:20-cv-1791-JEB, and United States v. 171 “Dehlavieh” Anti-Tank Guided Missiles, et al., 20-cv-2299-JEB.

Note: On Feb. 9, 2020, U.S. authorities seized three type “358” surface-to-air missiles (seen in the above photo) and 150 “Dehlavieh” anti-tank guided missiles (seen in the below photo):

Chinese National Pleads Guilty To Illegal Exports To Northwestern Polytechnical University

WASHINGTON – A Chinese national pleaded guilty today in federal court in Boston in connection with illegally procuring and causing the illegal export of $100,000 worth of U.S. origin goods to Northwestern Polytechnical University (NWPU), a Chinese military university that is heavily involved in military research and works closely with the People’s Liberation Army on the advancement of its military capabilities. 

According to court documents, Shuren Qin, 44, a Chinese national residing in Wellesley, Mass., gained admittance into the United States through the EB-5 Immigrant Investor Visa Program in 2014 and established LinkOcean Technologies, LTD., which he used to import goods and technology with underwater and marine applications into the PRC from the United States, Canada and Europe. Today, he pleaded guilty to one count of conspiracy to unlawfully export items from the United States to NWPU without first obtaining the required export licenses; one count of visa fraud; two counts of making false statements to law enforcement agents regarding his customers and the types of parts he caused to be exported from the United States to the People’s Republic of China (PRC); four counts of money laundering; and two counts of smuggling hydrophones from the U.S. to the PRC. 

“Qin took advantage of the open marketplace in the United States to purchase sensitive technologies for a Chinese military university,” said Assistant Attorney General John C. Demers for the Justice Department's National Security Division. “In addition, he lied on his visa application and to U.S. customs officers. When individuals illegally pursue personal profit at the expense of U.S. national security, DOJ will disrupt such conduct and punish those involved.” 

"The People’s Republic of China has an insatiable appetite for our country’s most sensitive products and technologies – particularly those with military applications,” said Acting U.S. Attorney Nathaniel R. Mendell for the District of Massachusetts. “By exporting key anti-submarine warfare products to a Chinese military university, Mr. Qin created a threat to our national security and broke the law. That warrants federal prosecution, without a doubt.”

NWPU has been involved in the development of unmanned aerial vehicles, autonomous underwater vehicles and missile proliferation projects. Since 2001, the U.S. Department of Commerce (DOC) has designated NWPU on its Entity List for national security reasons. Qin communicated with and received purchase orders from NWPU to obtain items used for anti-submarine warfare. Between approximately July 2015 and December 2016, Qin caused at least 60 hydrophones (devices used to detect and monitor sound underwater) to be exported from the United States to NWPU without obtaining the required export licenses from the DOC. Qin and his company, LinkOcean, did so by concealing from the U.S. manufacturer of the hydrophones that NWPU was the true end-user and by causing false end-user information to be filed with the U.S. government. In addition, on four occasions in connection with the export of hydrophones to NWPU, Qin engaged in money laundering by transferring or causing the transfer of more than $100,000 from Chinese bank accounts to bank accounts located in the United States with the intent to promote and facilitate his unlawful export scheme. 

Additionally, in July 2016, Qin engaged in visa fraud in connection with his application to remove conditions on his U.S. Permanent Resident Status (Form I-829) by falsely certifying that he had not committed any crime for which he was not arrested since becoming a conditional permanent resident when, in fact, he had caused the illegal export of hydrophones in 2015. In addition, Qin made false statements to federal agents on two occasions regarding LinkOcean’s customers and its export activities. Specifically, during a November 2017 interview with Customs and Border Protection (CBP) Officers, Qin falsely stated that he only exported instruments that attach to a buoy. However, Qin had exported and caused the export of remotely operated side scan sonar systems, unmanned underwater vehicles, unmanned surface vehicles, robotic boats and hydrophones. The items that Qin concealed from CBP during this interview have military applications and several of these items were delivered to military end-users in China. On or about July 21, 2018, Qin lied to investigators when he stated that he did not have any customers on the DOC’s Entity List when he had at least two such customers – NWPU and the National University of Defense Technology (NUDT). NUDT has been designated on DOC’s Entity List and is involved modernizing the PRC’s armed forces. 

Prior to entering his guilty plea, Qin moved to suppress evidence seized from his laptop and iPhone during a border search and statements he made to CBP officers during a secondary in November 2017. Judge Casper found that the “Chinese Navy” was one of Qin’s customer’s according to LinkOcean’s website and when the border search occurred, agents testified that they were “concerned that Qin was involved [in] working on behalf of the Chinese Navy to procure items from the United States, export them to China so that they could be used or incorporated in systems the Chinese Navy or research institutes were developing to be used in electronic warfare, anti-submarine warfare.” 

By the end of the summer of 2017, investigators had learned that Qin was interested in procuring both AUVs and sonobuoys, which raised concerns for the agents as they learned that Ultra Electronics was at that same time developing “an AUV that worked in conjunction with [a] sonobuoy … strictly for military use by the U.S. Navy.” Qin also lied when questioned during the secondary inspection at the border regarding the types of parts he exported, concealing his “interest in procuring side scan sonar systems, AUVs, and sonobuoys.”       

The charge of conspiring to violate U.S. export laws provides for a sentence of up to 20 years in prison, three years of supervised release and a fine of $1 million. The charges of visa fraud and smuggling both provide for a sentence of up to 10 years in prison, three years of supervised release and a fine of $250,000. The charge of making false statements provides for a sentence of up to five years in prison, three years of supervised release and a fine of $250,000.  The charge or money laundering provides for a sentence of up to 20 years in prison, five years of supervised release and a fine of $500,000 fine. Sentences are imposed by a federal district court judge based upon the U.S. Sentencing Guidelines and other statutory factors. 

Assistant U.S. Attorney B. Stephanie Siegmann, Chief of Mendell’s National Security Unit, and Assistant U.S. Attorney Jason Casey, also of National Security Unit, are prosecuting the case. Valuable assistance was provided by the Justice Department's National Security Division.

China-Based Executive At U.S. Telecommunications Company Charged with Disrupting Video Meetings Commemorating Tiananmen Square Massacre: Defendant Coordinated With The People’s Republic Of China To Target Dissidents And Disrupt Meetings

 The U.S. Justice Department released the below information: 

A complaint and arrest warrant were unsealed today in federal court in Brooklyn charging Xinjiang Jin, also known as “Julien Jin,” with conspiracy to commit interstate harassment and unlawful conspiracy to transfer a means of identification.  

Jin, an employee of a U.S.-based telecommunications company (Company-1) who was based in the People’s Republic of China (PRC), allegedly participated in a scheme to disrupt a series of meetings in May and June 2020 held to commemorate the June 4, 1989 Tiananmen Square massacre in the PRC.  The meetings were conducted using a videoconferencing program provided by Company-1, and were organized and hosted by U.S-based individuals, including individuals residing in the Eastern District of New York.  Jin is not in U.S. custody. 

“No company with significant business interests in China is immune from the coercive power of the Chinese Communist Party,” said Assistant Attorney General for National Security John C. Demers.  “The Chinese Communist Party will use those within its reach to sap the tree of liberty, stifling free speech in China, the United States and elsewhere about the Party’s repression of the Chinese people.  For companies with operations in China, like that here, this reality may mean executives being coopted to further repressive activity at odds with the values that have allowed that company to flourish here.” 

“The FBI remains committed to protecting the exercise of free speech for all Americans.  As this complaint alleges, that freedom was directly infringed upon by the pernicious activities of Communist China’s Intelligence Services, in support of a regime that neither reflects nor upholds our democratic values,” said FBI Director Christopher Wray. “Americans should understand that the Chinese Government will not hesitate to exploit companies operating in China to further their international agenda, including repression of free speech.”  

“The allegations in the complaint lay bare the Faustian bargain that the PRC government demands of U.S. technology companies doing business within the PRC’s borders, and the insider threat that those companies face from their own employees in the PRC,” said Acting United States Attorney Seth D. DuCharme.  “As alleged, Jin worked closely with the PRC government and members of PRC intelligence services to help the PRC government silence the political and religious speech of users of the platform of a U.S. technology company.  Jin willingly committed crimes, and sought to mislead others at the company, to help PRC authorities censor and punish U.S. users’ core political speech merely for exercising their rights to free expression.  The charges announced today make clear that employees working in the PRC for U.S. technology companies make those companies—and their users—vulnerable to the malign influence of the PRC government.  This Office will continue working tirelessly to protect against threats to the free expression of political views and religious beliefs, regardless whether those threats come from inside or outside the United States.” 

Mr. DuCharme and Mr. Demers also extended their thanks and appreciation to Company-1 for its cooperation in the government’s ongoing investigation. 

According to the complaint, Jin served as Company-1’s primary liaison with PRC law enforcement and intelligence services.  In that capacity, he regularly responded to requests from the PRC government for information and to terminate video meetings hosted on Company-1’s video communications platform.  Part of Jin’s duties included providing information to the PRC government about Company-1’s users and meetings, and in some cases he provided information – such as Internet Protocol addresses, names and email addresses – of users located outside of the PRC.  Jin was also responsible for proactively monitoring Company-1’s video communications platform for what the PRC government considers to be “illegal” meetings to discuss political and religious subjects unacceptable to the Chinese Communist Party (CCP) and the PRC government. 

As alleged in the complaint, between January 2019 to the present, Jin and others conspired to use Company-1’s systems in the United States to censor the political and religious speech of individuals located in the United States and around the world at the direction and under the control of officials of the PRC government.  Among other actions taken at the direction of the PRC government, Jin and others terminated at least four video meetings hosted on Company-1’s networks commemorating the thirty-first anniversary of the Tiananmen Square massacre, most of which were organized and attended by U.S.-based participants, such as dissidents who had participated in and survived the 1989 protests.  Some of the participants who were unable to attend these meetings were Company-1 customers in Queens and Long Island, New York who had purchased subscriptions to Company-1’s services, and therefore entered into service agreements with Company-1 governed by its Terms of Service (TOS).  

Jin, officials from the PRC government and others allegedly collaborated to identify meeting participants and to disrupt meetings hosted on Company-1’s U.S. servers, at times creating pretextual reasons to justify their actions to other employees and executives of Company-1, as well as Company-1’s users themselves.  In particular, in May and June 2020, Jin and others acted to disrupt meetings held on the Company-1 platform to discuss politically sensitive topics unacceptable to the PRC government by infiltrating the meetings to gather evidence about purported misconduct occurring in those meetings.  In fact, there was no misconduct; Jin and his co-conspirators fabricated evidence of TOS violations to provide justification for terminating the meetings, as well as certain participants’ accounts.  Jin then tasked a high-ranking employee of Company-1 in the United States to effect the termination of meetings and the suspension and cancellation of user accounts. 

As detailed in the complaint, Jin’s co-conspirators created fake email accounts and Company-1 accounts in the names of others, including PRC political dissidents, to fabricate evidence that the hosts of and participants in the meetings to commemorate the Tiananmen Square massacre were supporting terrorist organizations, inciting violence or distributing child pornography.  The fabricated evidence falsely asserted that the meetings included discussions of child abuse or exploitation, terrorism, racism or incitements to violence, and sometimes included screenshots of the purported participants’ user profiles featuring, for example, a masked person holding a flag resembling that of the Islamic State terrorist group.  Jin used the complaints as evidence to persuade Company-1 executives based in the United States to terminate meetings and suspend or terminate the user accounts of the meeting hosts.  

PRC authorities took advantage of information provided by Jin to retaliate against and intimidate participants residing in the PRC, or PRC-based family members of meeting participants.  PRC authorities temporarily detained at least one person who planned to speak during a commemoration meeting.  In another case, PRC authorities visited family members of a participant in the meetings and directed them to tell the participant to cease speaking out against the PRC government and rather to support socialism and the CCP. 

The charges in the complaint are allegations, and the defendant is presumed innocent unless and until proven guilty.  If convicted of both charged conspiracies, Jin faces a maximum sentence of ten years in prison.  

The investigation into this matter was conducted by the FBI’s Washington Field Office.  The government’s case is being handled by the Office’s National Security and Cybercrime Section.  Assistant U.S. Attorneys Alexander A. Solomon, Richard M. Tucker, David K. Kessler and Ian C. Richardson are in charge of the prosecution, with assistance from Trial Attorney Scott A. Claffee of the National Security Division’s Counterintelligence and Export Control Section.

Chinese Telecommunications Conglomerate Huawei And Subsidiaries Charged In Racketeering Conspiracy And Conspiracy To Steal Trade Secrets: Charges Also Reveal Huawei’s Business In North Korea And Assistance To The Government Of Iran In Performing Domestic Surveillance

The U.S. Justice Department released the below information:

A superseding indictment was returned yesterday in federal court in Brooklyn, New York, charging Huawei Technologies Co. Ltd. (Huawei), the world’s largest telecommunications equipment manufacturer, and two U.S. subsidiaries with conspiracy to violate the Racketeer Influenced and Corrupt Organizations Act (RICO).

Brian A. Benczkowski, Assistant Attorney General of the Justice Department’s Criminal Division; John C. Demers, Assistant Attorney General of the Justice Department’s National Security Division; Richard P. Donoghue, U.S. Attorney for the Eastern District of New York and Christopher A. Wray, Director, FBI, announced the charges.

The 16-count superseding indictment also adds a charge of conspiracy to steal trade secrets stemming from the China-based company’s alleged long-running practice of using fraud and deception to misappropriate sophisticated technology from U.S. counterparts.

The indicted defendants include Huawei and four official and unofficial subsidiaries — Huawei Device Co. Ltd. (Huawei Device), Huawei Device USA Inc. (Huawei USA), Futurewei Technologies Inc. (Futurewei) and Skycom Tech Co. Ltd. (Skycom) — as well as Huawei’s Chief Financial Officer (CFO) Wanzhou Meng (Meng).  The new superseding indictment also contains the charges from the prior superseding indictment, which was unsealed in January 2019.

As revealed by the government’s independent investigation and review of court filings, the new charges in this case relate to the alleged decades-long efforts by Huawei, and several of its subsidiaries, both in the U.S. and in the People’s Republic of China, to misappropriate intellectual property, including from six U.S. technology companies, in an effort to grow and operate Huawei’s business.  The misappropriated intellectual property included trade secret information and copyrighted works, such as source code and user manuals for internet routers, antenna technology and robot testing technology.  Huawei, Huawei USA and Futurewei agreed to reinvest the proceeds of this alleged racketeering activity in Huawei’s worldwide business, including in the United States.

The means and methods of the alleged misappropriation included entering into confidentiality agreements with the owners of the intellectual property and then violating the terms of the agreements by misappropriating the intellectual property for the defendants’ own commercial use, recruiting employees of other companies and directing them to misappropriate their former employers’ intellectual property, and using proxies such as professors working at research institutions to obtain and provide the technology to the defendants.  As part of the scheme, Huawei allegedly launched a policy instituting a bonus program to reward employees who obtained confidential information from competitors.  The policy made clear that employees who provided valuable information were to be financially rewarded.

Huawei’s efforts to steal trade secrets and other sophisticated U.S. technology were successful.  Through the methods of deception described above, the defendants obtained nonpublic intellectual property relating to internet router source code, cellular antenna technology and robotics.  As a consequence of its campaign to steal this technology and intellectual property, Huawei was able to drastically cut its research and development costs and associated delays, giving the company a significant and unfair competitive advantage.  

When confronted with evidence of wrongdoing, the defendants allegedly made repeated misstatements to U.S. officials, including FBI agents and representatives from the U.S. House Permanent Select Committee on Intelligence, regarding their efforts to misappropriate trade secrets.  Similarly, the defendants engaged in obstructive conduct to minimize litigation risk and the potential for criminal investigations, including the very investigation that led to this prosecution.

The superseding indictment also includes new allegations about Huawei and its subsidiaries’ involvement in business and technology projects in countries subject to U.S., E.U. and/or U.N. sanctions, such as Iran and North Korea – as well as the company’s efforts to conceal the full scope of that involvement.  The defendants’ activities, which included arranging for shipment of Huawei goods and services to end users in sanctioned countries, were typically conducted through local affiliates in the sanctioned countries.  Reflecting the inherent sensitivity of conducting business in jurisdictions subject to sanctions, internal Huawei documents allegedly referred to such jurisdictions with code names.  For example, the code “A2” referred to Iran, and “A9” referred to North Korea. 

Huawei employees also allegedly lied about Huawei’s relationship to Skycom, falsely asserting it was not a subsidiary of Huawei.  The company further claimed that Huawei had only limited operations in Iran and that Huawei did not violate U.S. or other laws or regulations related to Iran.  In fact, the indictment alleges Skycom was Huawei’s unofficial subsidiary that, among other services, assisted the Government of Iran in performing domestic surveillance, including during the demonstrations in Tehran in 2009.

The charges in the superseding indictment are allegations, and the defendants are presumed innocent unless and until proven guilty beyond a reasonable doubt in a court of law.

The government’s investigation is ongoing.  Individuals with knowledge of misconduct by Huawei, its subsidiaries, employees or agents should contact the FBI’s New York Field Office at 1-800-CALL-FBI.

The FBI’s New York Field Office, U.S. Immigration and Customs Enforcement’s Homeland Security Investigations’ (HSI) New York Field Office, U.S. Department of Commerce Office of Export Enforcement’s (OEE) New York Field Office and the Defense Criminal Investigative Service’s (DCIS) Southwest and Northeast Field Offices are jointly conducting the investigation.  Agents from the FBI, HSI and OEE offices in Dallas provided significant support and assistance.  The government’s case is being handled by the U.S. Attorney’s Office for the Eastern District of New York, the Criminal Division’s Money Laundering and Asset Recovery Section (MLARS) and the National Security Division’s Counterintelligence and Export Control Section (CES). 

Assistant U.S. Attorneys Alexander A. Solomon, Julia Nestor, David K. Kessler and Sarah Evans, MLARS Trial Attorneys Laura Billings and Christian Nauvel and CES Trial Attorneys Thea D. R. Kendler and David Lim are in charge of the prosecution, with assistance provided by Assistant U.S. Attorney Brendan G. King of the Civil Division of the U.S. Attorney’s Office for the Eastern District of New York and Trial Attorneys Margaret O’Malley and John Riesenberg of the Criminal Division’s Office of International Affairs.  Additional Criminal Division and National Security Division Trial Attorneys and Assistant U.S. Attorneys within U.S. Attorney’s Offices for the Northern District of Texas, the Northern District of Illinois, the Eastern District of Texas, the Western District of Washington and the Northern District of California have provided valuable assistance with various aspects of this investigation.