Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 1 of 25 Page ID #:79 mm UNITED STATES DISTRICT COURT FOR THE CENTRAL DISTRICT OF CALIFORNIA June 2014 Grand Jury UNITED STATES OF-AMERICA, SA CR NO. manna iaergzmar: v. [18 U.S.C. 1030(a)(2)(C), 1030(a)(4), SU BIN, 1030(b), aka ?Stephen Su,? aka ?Stephen subin;? Unauthorized Computer Access; 18' aka ?Steven Subin,? U.S.C. 371: Conspiracy; 18 U.S.C. 1832(a)(5): Conspiracy to Defendant. Commit Theft of Trade Secrets; 18 U.S.C. Aiding and Abetting] The.Grand Jury charges: INTRODUCTORY ALLEGATIONS At all times relevant to this Indictment: 1. Defendant SU BIN, also known as ?Stephen Su,? aka ?Stephen Subin,? aka ?Steven Subin? (?defendant was a citizen of the People?s Republic of China (hereinafter ?China?). 2. Unindicted Co?conspirator 1 was a_citizen of China and resided in China. Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 2. of 25 Page ID #:80 3. Unindicted Couconspirator 2 was a citizen of China and resided in China. 4. Defendant SU, Unindicted Co?conspirator 1, and Unindicted Coeconspirator 2 e-mailed each other both in Chinese and English. 5. Between in or about October 2008 and in or about May 2014, defendant SU traveled to the United States multiple times, including specifically: a. between on or about January 13, 2010, and on or about January 24, 2010; b. between on or about February 11, 2010, and on or about February 21, 2010; 1 c. between on or about May 26, 2010, and on or about June 8, 2010; d. between on or about June 20, 2010, and on or about June 27, 2010; e. I between on or about September 8, 2010, and on or about September 11, 2010; f. between on or about December 18, 2010, and on or about December 28, 2010; g. between on or about June 30, 2011, and on or about June 22, 2011; h. between on or about September 28, 2012, and on or about October 3, 2012; i. between in or about October 2012 and on or about November 3, 2012; and, j. between on or about December 31, 2012, and on or about January 2, 2013. Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 3 of 25 Page ID #:81 6. The Boeing Company (hereinafter ?Boeing7), headquartered in Chicago, Illinois, was a company with offices throughout the United States that developed and sold military and commercial aircraft, among other goods; technologies; and related support services. Boeing had facilities in many locations, including Seal Beach and Long Beach, California. The goods and teChnologies Boeing sold to its customers were sold and shipped, and were intended to be sold and shipped, in interstate and foreign commerce. 7. One of the aircraft models that Boeing manufactured was the military transport aircraft (?the including variants of the which was manufactured in Les Angeles County, California, located in the Central District of California. The C?l7 was developed over multiple years and produced by Boeing and its predecessor and subcontraCtors pursuant to contracts with the United. States Air Force at a cost of billions of dollars. Developing and. producing the Cwl7 required the use of trade secrets and the use of export?controlled technical data. Boeing maintained multiple computer servers containing files relating to the C?l7, including servers in Orange County, California, containing detailed files necessary to make the component parts of the C?l7. 8. The ?Lightning? was a fifth?generation fighter jet aircraft capable of supersonic speed and equipped with ?stealth? capabilities that allowed it to evade radar (?the The was developed over multiple years by multiple companies performing (?defense contracts with the United States Department of Defense contractors?) in the United States and other countries at a cost of billions of dollars. Developing and producing the required the use of those defense contractors? trade secrets and the use of 3 Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 4 of 25 Page #:82 export?controlled technical data.' Variants of the aircraft were made for different services of different countries? armed forces. 9. The ?Raptor? was a fighter jet? aircraft capable of supersonic speed and equipped with ?stealth? capabilities that allowed it to evade radar (?the Fm22?). The was developed over multiple years by defense contractors in the Developing and United States at a cost of billions of dollars. producing the required the use of those defense contractors? trade secrets-and the use of expert-centrolled technical data. 10. In developing, testing, producing, and maintaining the 17, and other military technology, defense contractors generated documents, files, and information, including Computer ?files, that contained trade secrets that were the produCt of research and development and that were proprietary information belonging to those defense contractors. Those trade secrets related to various facets of the aircraft, its development, design, testing, production, components, and ongoing maintenance. Those trade secrets also related to the ways in which those defense contractors competed to win government contracts to build and serviCe military aircraft and other military technology.- Those trade secrets existed in a single document and record at times, and at other times as compilations and collections of documents and files that related to the entire aircraft and to portions or components of the aircraft. 11. The Arms Export Control Act, Title 22, United States Code, Section 2778 authorized the President of the United States to control the export of ?defense articles? and ?technical data? related to such defense articles by designating those items and that Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 5 of 25 Page ID #:83 data as defense articles and by promulgating regulations for the import and export of such articles and data. 12. Defense articles and technical data subject to such licensing requirements were designated on the United States Munitions List Those designations were made by the United States Department of State (?Department of State?) with the concurrence of the United States Department of Defense (?Department of Defense?). (22 U.S.C. 2778(a)(1); 22 C.F.R. 120.2.) 13. Category of the USML, among others, included aircraft and aircraft?related equipment. (22 C.F.R. 121.1.) 14. The AECA and its attendant regulations, the International Traffic in Arms Regulations, Title 22, Code_of Federal Regulations, Parts 120?130 required a person to apply for and obtain an export license from the Directorate of Defense Trade Controls, of the Department of State before exporting from the United States defense articles or related technical data by any means, including by disclosing technical data on the USML to a foreign person. (22 U.S.C. 2778(b)(2); 22 C.F.R. 120.1, 120.10, 120.17.) 15. At no time did defendant SU apply for, receive, or possess a license to export defense articles or technical data from the United States. 16. The factual allegations in paragraphs 1 through 15 are incorporated in all counts of this Indictment by reference and are resalleged as though fully set forth therein. 17. In the course of their conduct, defendant SU, Unindicted? Co?conspirator l, and Unindicted Co?conspirator 2 committed the following acts on or about the following dates: 5 Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 6 of 25 Page ID #:84 18. On October 23, 2008, Unindicted Co?conspirator 1 wrote an e?mail to another person asking: ?Hey there, Do you sell the Poisonivy Program? How much do you sell it for? i wish to buy one which can not be detect [sic] and killed by the Anti?Virus software.? 19. On July 22, 2009, defendant SU forwarded an e-mail that he had received from-Unindicted Co?conspirator 1. Attached to that e?mail was a draft contract for the purchase of a ?System for Unidirectional Secure Delivery of Files Over the Internet,? from an 'identified company located in China that advertised its expertise in the fields of computer network attack and defense and communication security. 20. On July 23, 2009, defendant SU caused one of his company?s employees to e?mail defendant SU and Unindicted Co?conspirator 1 a signed version of the contract described in paragraph 19 that defendant 8U had executed on behalf of his company. 21. On December 14, 2009, defendant SU sent an e?mail to Unindicted Co?conspirator 1 with a subject line of ?Target.? Attached to the e?mail was a file containing the names and positions of U.S. executives as well as a website and telephone number. 22. On December 17, 2009, defendant SU sent an e~mail to Unindicted Cc?conspirator 1 and copied Unindicted Co-conspirator 2 with a subject line of Target.? In that e-mail defendant 8U identified e-mail addresses, a website, and four individuals associated with a European company. 23. On January 13, 2010, Unindicted Co?conspirator sent defendant SU an e-mail with a subject line of attached a file titled ?Desktop 22.rar,? and wrote that he would send defendant SU the password for the file. Case 8:14-or-00131-UA Document 10 Filed 08/14/14 Page 7 of 25 Page ID #:85 24; On January 14, 2010, defendant SU sent an e?mail to Unindicted Co~conspirator 1 with a subject line of C~l7,? attached a file titled ?Desktop 22.rar,? and asked Unindicted Con conspirator 1 to give defendant SU the password for the file. 25. On January 21, 2010, Unindicted Co?conspirator 1 sent defendant SU a file titled ?C?17?2.rar? and asked defendant 80 to write Unindicted Co?conspirator 1 a document about which files were important, which ones were not important, and what they were. 26. On January 22, 2010, Unindicted Co?conspirator 1 sent an em mail to defendant SU with a subject line of ?Re: C?l7 and wrote that 3.txt was the subdirectory and document of 3?jianua.txt, added that some directory trees contained random codes, and reminded defendant SU to read 3.txt. defendant SU sent an e?mail to 27" On January 23, 2010, Unindicted Co?conspirator 1 with a subject line of attached a document titled ?Appendix 3.rar,? and wrote that, judging from its name, the document looked fine. 28.1 On January 23, 2010, Unindicted Conconspirator 1 sent an e~ mail to defendant Sinith a subject line of ?Re: C~l7 and wrote that 3.txt was the liSt of documents, added that defendant SU should pay attention to it, and noted that there was some gibberish due to incorrect encoding. defendant SU sent an e?mail to 29. On January 25, 2010, Unindicted Cohconspirator 1 with a subject line of ?Re: C?l7 2? and attached a document titled which was a list approximately 1,467 pages long of files and folders related to the 17, with some files and folders highlighted in yellow. In the e?mail defendant.SU wrote that the useful ones were marked in yellow and 7 ?Case 8:14-cr-00131-UA Decument 10 Filed 08/14/14 Page 8 of 25 Page ID #:86 that they should be the computer documents of a person who used an airplane as opposed to a designer. 30. On February 2, 2010, defendant SU sent an e-mail to Unindicted Co?conspirator 1 with a subject line of ?Document No. 17,? and defendant SU attached to this e~mail a compressed file, the contents of which included a file with the characters in the filename. 31. On February 4, 2010, defendant SU sent Unindicted Co? conspirator 1 an e?mail attaching a file titled ?System 20100206.rar.? Compressed within the .rar file was a file with the characters?C?l7? in the filename. 32. On February 7, 2010, defendant SU sent Unindicted Cow conspirator 1 an e?mail attaching a file titled ?20100207.rar.? Compressed within the .rar file was a document with the characters in the filename. 33. On February 28, 2010, defendant SU sent Unindicted Co? conspirator 1 an e?mail in which defendant SU wrote that the value was decent for a document related to a specific military aircraft, and that it was information needed by an identified state?owned aircraft company in China, but that the company was too stingy. 34. On March 1, 2010, Unindicted Co?conspirator 1 sent defendant SU an e?mail and wrote only ?17 keywords? in the body of the e?mail. - 35. On March 1, 2010, Unindicted Co-conspirator 1 sent defendant SU an e?mail and wrote ?17?s LIST. Read Carefully.? Unindicted Co?conspirator 1 attached a file to that e?mail titled ?17.rar.? ?Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 9 of 25 Page ID #:87 36. On March 3, 2010, defendant SU sent Unindicted Co? conspirator 1 an e-mail and attached a file titled ?17.rar.? Compressed within the .rar file were 11 .txt files, whose file names were l7/1.txt through l7/lO.txt and an additional file titled l7/tools.txt. 37. _On March 4, 2010, defendant 80 sent Unindicted Co? conspirator 1 an emmail attaching a file titled ?blueprint.rar.? 38. On March 7, 2010, Unindicted Co?conspirator 1 sent an e? mail to another co-conspirator attaching several reports about the expenses and activities of certain Chinese entities. One report described how one of the entities identified targets and sought foreign technologies to advance research and development cost? effectively. I 39. -On March 19, 2010, Unindicted Co-conspirator sent defendant SU an e?mail with a subject line of ?View picture? and wrote in the body of the e?mail ?Haha.? Unindicted Cowconspirator 1 attached to that e?mail an image of a list of seven filenames that had English characters followed by Chinese characters describing their contents, six of which files contained ?c?l7? or ?cl7? in the name of the file. 40. On April 4, 2010, Unindicted Coeconspirator sent defendant SU an eemail with a subject line of,?22? and wrote ?22? in the body of the e?mail. Attached to the e?mail was a document titled ?22.rar.? 41. On April 4, 2010, defendant SU sent Unindicted Co? conspirator 1 an ewmail with a subject line of 22.? 42. On April 4, 2010, defendant SU sent Unindicted Co? conspirator 1 an e?mail with a subject line of 22? and 9 28' Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 10 of 25 Page ID #:88 instructed Unindicted Co?conspirator llto take a look at the file ?avel\Training\AVEL Familiarization Course 7?28?08 .ppt.? 43. On April 4, 2010, Unindicted Co?conspirator 1 sent defendant SU an e~mail with a subject line of ?Re: Reply: 22? and attached an image file named That image showed a computer monitor displaying a presentation related to training on an component used in launching missiles, which was marked, proprietary and with the warning, ?Proprietary Information Source Selection Sensitive. This Data is Covered by IATR [sic] 22 CFR 120? 130.? 44. On April 4, 2010, Unindicted Co?conspirator 1 sent defendant SU an e-mail and asked defendant SU about providing a sample of the data they had acquired relating to the C?l7. 45. On April 5, 2010, defendant SU sent Unindicted Co?' censpirator l?an e?mail concerning the sale of data and expenses. 46. On April 5, 2010, Unindicted Co?conSpirator 1 sent defendant SU an e-mail'and wrote that the sample of C-17 data was not intended for sale, but rather for use as a bargaining chip. 47. On August 27, 2010, defendant SU sent Unindicted Co? conspirator 1 an e?mail attaching a .rar file. 48. On October 24, 2010, defendant SU sent Unindicted Co? conspirator 1 an e?mail. Attached to that e?mail was a .rar file, and compressed within the .rar were five documents containing filenames that corresponded to military and civilian aircraft. These doCuments listed some files and folders that were highlighted in yellow. 49. .On December 27, 2010, Unindicted Co?conspirator e-mailed to Unindicted Co-conspirator 2 a report that described meeting the 10 .military project that was subject to Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 11 of 25 Page ID #:89 objective of an identified Chinese company to acquire U.S. military technology but sought additional funds to complete the Special Project.? 2 50. On August 11, 2011, Unindicted Comconspirator sent an e? mail to defendant SU that included a screenshot image of a document and asked defendant 30 what the document was. 51. On November 10, 2011, defendant SU drafted and modified a report that discussed how an identified Chinese entity had acquired research and development information that related to a specific export restrictions and was Defense, explained why that restricted by the U.S. Department of information was valuable, and sought support to complete its work in acquiring more information.- 52,- On November 10, 2011, defendant SU sent an e?mail to Unindicted Co?conspirator 1 and Unindicted Comconspirator 2. Attached to that e?mail was the report described in paragraph 51. 53. On December 8, 2011, Unindicted Co?conspirator 2 sent an e? mail to Unindicted Co?conspirator 1 with a list of emmail addresses, names, and affiliations or roles in 0.8. and other governments as well as how the e?mail addresses were compromised.- 54. On February 26, 2012, Unindicted Co?conspirator 1 sent Unindicted Co?conspirator 2 an e?mail attaching a list of thirty?two U.S. military projects and corresponding amounts of data. 55. On March 23, 2012, defendant SU modified a document related to a flight test plan for the aircraft with different portions written in English and in Chinese that bore notations that it was proprietary information and subject to export restrictions. 11 Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 12 of 25 Page ID #:90 56. On May 3, 2012, defendant SU sent an e?mail to Unindicted Co?conspirator with a subject line of ?Plan,? Attached to that ea mail was the document described in paragraph 55. 57. On August 6, 2012, Unindicted Co?conspirator 1 drafted and edited a document that described the acquisition of 65 gigabytes of data in 630,000 files and 85,000 file folders that included scans, drawings, and technical details related to the obtained by gaining access to the Boeing network in January 2010, and nOted that the had been developed at a cost of $3.4 billion in research and development expenses. 1 58. On August 13, 2012, Unindicted Co?conspirator 1 sent Unindicted Co?conspirator 2 an emmail with a subject line of ?cl7.? Attached to that e?mail was the document described in paragraph 57. 59. 'On February 21, 2013, Unindicted Co-conspirator 1 sent an emmail to Unindicted Co?conspirator 2 that attached a report. The attached report described how the entity with which they Were affiliated in China used servers in multiple countries, transferred data to Hong Kong or Macau, and then carried the data to China by hand. The report described how the entity focused in the United States on military technologies, among other topics, and had acquired data related to the F-35 and 4 60. On May 21,-2014, Unindicted Co?conspirator forwarded an emmail to a co?conspirator attaching a report describing how a company had been targeted, how its network had been infiltrated, how the computer data stored at the company had been downloaded and transmitted to Macau after going through jumps overseas and before being physically delivered, and how future computer intrusions of the company in a second phase were being deSigned to address security 12 Case Document 10 Filed 08/14/14 Page 13 of 25 Page ID #:91 measures that had prevented acquisition of the information they sought. 13 .18Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 14 of 25 Page ID #:92 COUNT ONE [18 U.S.C. 1030(b), A. OBJECTS OF THE CONSPIRACY 61. Beginning in or about October 2008, and continuing up to and including at least in or about May 2014, in Orange County, within the Central District of California, and elsewhere, including outside the United States, defendant SU BIN, also known as ?Stephen su,? aka ?Stephen Subin,? aka ?Steven Subin? (?defendant Unindicted Cowconspirator 1, Unindicted Coeconspirator 2, and others known and unknown to the Grand Jury, knowingly combined, conspired, and agreed with each other knowingly and intentionally to commit offenses against the United States, namely: To intentionally access a computer without authorization, and exceed authorized access, and thereby obtain information from a protected computer, as that term is defined at Title 18, United States Code, Section 1030(e)(2), (1) where the offense was committed for purposes of commercial advantage and private financial gain; (2) where the offense was committed in furtherance of a criminal and tortious act in violation of the United States, Constitution and the laws of the specifically, conSpiring to export defense articles, in violation of Title 18, United States Code, Section 371, and Title 22, United States Code, and Title 22, Code of Federal Sections 2778(b)(2) and Sections 121.1, 123.1, Regulations, and as alleged in Count Four of this Indictment; and conspiring to commit theft of trade secrets, in violation of Title 18, United States Code, Section 1832(a)(5), as alleged in Count Five of this Indictment; and (3) where the value of 14 Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 15 of 25 Page ID #:93 the information obtained and sought exceeded $5,000, all in violation of Title 18, United States Code, Sections 1030(a)(2)(knowingly, and with intent to defraud, access a protected computer, as that term is defined at Title 18, United States Code,'Section 1030(e)(2), without authorization, and exceed authorized aCcess, and by means of such conduct further the intended information related fraud and obtain a thing of value, specifically, to military and aviation technology, in violation of Title 18, United States Code, Sections 1030(a)(4) and B. MEANS BY WHICH THE OBJECTS OF THE CONSPIRACY WERE TO BE 62. The objects of the conspiracy were to be accomplished in substance as follows: 1 63. Defendant SU would e?mail Unindicted Co~Conspirators and 2 with guidance on what persons, companies, and technologies to target for unlawful computer intrusions. 64. Unindicted Co?Conspirator 1 would e?mail defendant SU information and files showing defendant SU the information and files gained access through to which Unindicted Co?conspirator 1 had Defendant SU would then provide unlawful computer intrusions. direction to Unindicted Co?conspirator 1 as to which information and files Unindicted Co?conspirator 1 should steal and obtain via unlawful computer intrusions. After gaining unauthorized access into various protected computers, Unindicted Co?conspirator 1 would then steal, copy, download, transmit, possess, and send the information and files that defendant SU had directed him to obtain. 15 Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 16 of 25 Page ID #:94 65. Defendant SU, Unindicted Co?conspirator 1, and Unindicted Co?conspirator 2 would then write, revise, and circulate reports that described the information they and others had obtained by engaging in such computer hacking, the value of that information, the. Significance of the information in developing similar technologies, their progress, and their need to continue their computer intrusions. 66. Defendant SU and Unindicted Co~conspirator 1 would communicate about selling some of the information that they had obtained as a result of their unlawful computer intrusions. C. OVERT ACTS I 67. On or about the relevant dates listed herein, in furtherance of the conspiracy and to accomplish the objects of the conspiracy, defendant SU, Unindicted Co?conspirator l, Unindicted Co? conspirator 2, and others known and unknown to the Grand Jury, committed various overt acts within the Central District of California and elsewhere. These overt acts included sending e?mails, drafting and revising reports and other documents, and other overt acts, including but not limited to the allegations contained in paragraphs 18 through 60 of the Introductory Allegations, which are incorporated herein by reference. 16 ?Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 17 of 25 Page ID #:95 COUNT TWO [18 U.S.C. 1030(a)(2)(C), 18 U.S.C. Between on or about January 1, 2010 and on Or about April 30, 2010, in Orange County, within the Central District of California, and elsewhere, including outside the United States, defendant SU BIN, also known as ?Stephen Su,? aka ?Stephen Subin,? aka ?Steven Subin? (?defendant intentionally accessed and attempted to access a computer without authorization, and exceeded authorized access, and aided and abetted Unindicted Co?conspirator 1 and other persons known and unknown to the Grand Jury in doing so, and thereby obtained information and attempted to obtain information, inCluding information related to the from a protected computer, as that term is defined at Title 18, United states Code, Section 1030(e)(2). The offense was committed by defendant SU (1) for purposes of commercial advantage and private financial gain; (2) in furtherance of a criminal and tortious act in violation of the Constitution and the laws of the United States, specifically, conspiring to export defense articles, in violation of Title 18, United States Code, Section 371, and Title 22, United States Code, Sections 2778(b)(2) and (c1, and Title 22, Code of Federal Regulations, Sections 121.1, 123.1, and as alleged in Count Four of this Indictment; and conspiring-to commit theft of trade secrets, in violation of Title 18,_United Section 1832(a)(5), States Code, as alleged in Count Five of this Indictment; and (3) the value of the information obtained and that defendant SU attempted to obtain exceeded $5,000. 17 'also known as Case 8:14-cr-00131-UA Document 10 Filed~O8/14/14 Page 18 of 25 Page ID #:96 COUNT THREE [18 U.S.C. 1030(a)(4), 18 U.S.C. Between on or about January 1, 2010 and on or about April 30, 2010, in Orange County, within the Central District of California, and elsewhere, including outside the United States, defendant SU BIN, ?Stephen Su,? aka ?Stephen Subin,? aka ?Steven Subin? knowingly and with intent to defraud accessed (?defendant and attempted to access a protected computer, as that term is defined at Title 18, United States Code, Section 1030(e)(2), without authorization, and exceeded authorized access, and aided and abetted Unindicted Co?conspirator 1 and other persons known and unknoWn to the Grand Jury in doing so, and by means of such conduct furthered defendant intended fraud and obtained a thing of value, including specifically information related to military and other technology and including specifically information related to the 17?. 18 Case Document 10 Filed 08/14/14 Page 19 of 25 Page ID #:97 COUNT FOUR [18 U.S.C. 371] A. OBJECT OF THE CONSPIRACY 68. Beginning in or about October 2008, and continuing up to and including at least in or about May 2014, in Orange County, within the Central District of California, and elsewhere, including outside the United States, defendant SU BIN, also known as ?Stephen Su,? aka ?Stephen Subin,? aka ?Steven Subin? (?defendant Unindicted Co?conspirator 1, Unindicted Co-conspirator 2, and others known and unknown to the Grand Jury, knowingly combined, conspired, and agreed with each other knowingly and intentionally to commit an offense against the United States, namely: a. To willfully export and cause to be exported from the United States items designated as defense articles on the USML, namely technical data, including by means of disclosing such technical data to foreign nationals, without having first obtained from the DDTC the required export license or authorization for such export, in violation of Title 22, United States Code, Sections 2778(b) and and Title 22, Code of Federal Regulations, Sections 121.1, 123.1, and B. MEANS BY WHICH THE OBJECT OF THE CONSPIRACY WAS TO BE ACCOMPLISHED 69. The object of the conspiracy was to be accomplished in substance as follows: 70. Defendant SU would e?mail Unindicted Co?Conspirators 1 and 2 with guidance on what persons, companies, and technologies to 19 Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 20 of 25 Page ID #:98 target in order to obtain export?controlled technical data and other information through unlawful computer intrusions. 71. Unindicted Co-Conspirator 1 would e?mail defendant SU information and files showing defendant SU the export-controlled technical data and other information and files to which Unindicted Co?conspirator 1 had gained access through unlawful computer intrusions. 'Defendant SU wOuld then provide direction to Unindicted Conconspirator as to which information and files Unindicted Co? conspirator 1 should steal and obtain via unlawful computer intrusions. After gaining unauthorized access into various protected computers, Unindicted Co?conspirator 1 would then steal, copy, download, transmit, possess, and send the information and files that defendant SU had directed him to obtain, without having obtained permission or authorization to export technical data out of the United States or to disclose it to foreign persons. 72. Defendant SU, Unindicted Co?conspirator l, and Unindicted Cowconspirator 2 would then write, revise, and circulate reports that described the exportncontrolled techniCal data and other information they and others had obtained by engaging in such computer hacking, the value of that information, the significance of the information in developing similar technologies, their progress, and their need to continue their computer intrusions. The reports would also explain that the information was protected by U.S. export restrictions. C. i OVERT ACTS 73. On or about the relevant dates listed herein, in furtherance of the conspiracy and to accomplish the object of the conspiracy, defendant SU, Unindicted Co-conspirator l, Unindicted Co? conspirator 2, and others known and unknoWn to the Grand Jury, 2O Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 21 of 25 Page ID #:99 committed various overt aCts within the Central District of California and elsewhere. Those overt acts included sending emmails, drafting and revising reports and other documents, and other overt acts, and include, but are not limited to, the allegations contained in paragraphs 29the. Introductory Allegations, which are incorporated herein by reference. 21 Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 22 of 25 Page ID #:100 COUNT FIVE [18 U.S.C. 1832(a)(5)] A. OBJECTS OF THE CONSPIRACY '74. Beginning in or about October 2008, and continuing up to and including at least in or about May 2014, in Orange County, within the Central District of California, and elsewhere, including outside the United States, defendant SU BIN, also known as ?Stephen Su,? aka ?Stephen Subin,? aka ?Steven Subin? (?defendant Unindicted Co?conspiratOr l, Unindicted Co-conspirator 2, and others known and unknown to the Grand Jury, knowingly combined, conspired, and agreed with each other knowingly and intentionally to commit offenses against the United States, namely: a. To knowingly steal and without authorization appropriate, take, and conceal, and by fraud, artifice, and deception obtain a trade secret that is related to and included in a product that is produced for, used in, and placed in and intended for use in interstate and foreign commerce, with the intent to convert the trade ?secret to the economic benefit of someone other than the owner of the_ trade secret, and intending and knowing that doing so would injure any owner of that trade secret, in violation of Title l8, United States Code, Section 1832(a)(l); b. To knowingly and without authorization copy, duplicate, photograph, download, upload, replicate, transmit, deliver, send, communicate, and convey a-trade secret that is related to and included in a product that is produced for, used in, and placed-in and intended for use in interstate and foreign commerce, with the intent to convert the trade secret to the economic benefit of someone other than the owner of the trade secret, and intending 22 Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 23 of 25 Page ID #:101 and knowing that doing so would injure any owner of that trade secret, in violation of Title 18, United States Code, Section 1832(a)(2); and c. To knowingly receive, buy, and possess a-trade secret that is related to and included in a product that is produced for, used in, and placed in and intended for use in interstate and foreign commerce, knowing the same to have been stolen and appropriated, obtained, and converted without authorization, with the intent to convert the trade secret, to the economic benefit of someone other than the owner of the trade secret, and intending and knowing that doing so would injure any owner of that trade secret, in violation of Title 18, United States Code, section 1832(a)(3). B. MEANS BY WHICH THE OBJECTS OF THE CONSPIRACY WERE TO BE ACCOMPLISHED 75. The objects of the conspiracy were to be accomplished in substance as follows: I 76. Defendant SU would e~mail Unindicted Co~Conspirators 1 and 2 with guidance on what persons, companies, and technologies to target for unlawful computer intrusions in order to obtain trade secrets and other information, intending to convert such trade secrets and other information to the economic benefit of persons and entities other than their owners and intending and knowing that doing so would injure the owners of the trade secrets and other information. 77. Unindicted Co?Conspirator 1 would e?mail defendant SU information and files showing defendant SU the trade secrets and other information and files to which Unindicted Co?conspirator 1 had Defendant SU gained access through unlawful computer intrusions. 23 Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 24 of 25 Page ID #:102 would then provide direction to Unindicted Co?conspirator as to which information and files, including which trade secrets, Unindicted Co?conspirator 1 should steal and obtain via unlawful computer intrusions. After gaining unauthorized access to various protected computers, Unindicted Co?conspirator 1 would then steal, copy, download, transmit, possess, and send the information and files, including the trade secrets, that defendant SU had directed him to obtain. Defendant SU would then receive and possess the information and files, including the unlawfully obtained trade secrets, knowing they had been stolen and obtained without authorization. 78. Defendant SU, Unindicted Co?conspirator 1, and Unindicted Co?conspiratcr 2 would then write, revise, and circulate reports that described the trade secrets and other information they and others had obtained by engaging in such computer hacking, the value of that information, the significance of the information in developing similar technologies, their progress, and their need to continue their computer intrusions. 79. Defendant SU and Unindicted Co-conspirator 1 would communicate about selling some of the trade secrets and other information that they had obtained as a result cf their unlawful computer intrusions. C. OVERT ACTS 80. On or about the relevant dates listed herein, in furtherance of the conspiracy and to-accomplish the object of the conspiracy, defendant SU, Unindicted Co?conspirator l, Unindicted Coe conspirator 2, and others known and unknown to the Grand Jury, committed various overt acts within the Central District of 24 'Case 8:14-cr-00131-UA Document 10 Filed 08/14/14 Page 25 of 25 Page ID #:103 California and elsewhere. Those overt acts included sending e?mails, drafting and revising reports and other documents, and other overt acts, and include, but are not limited to, the allegations contained in paragraphs 19the Introductory Allegations, which are incorporated herein by reference. A TRUE BILL Foreperson STEPHANIE YONEKURA Acting United States Attorne ROBERT E. DUGDALE Assistant United States Attorney Chief, Criminal Division PATRICK R. FITZGERALD Assistant United States Attorney Chief, National Security Section ANTHONY J. LEWIS Assistant United States Attorney National Security Section AARON LEWIS Assistant United States Attorney. National Security section 25