AO 91 (Rev. 11/11) Criminal Complaint

UNITED STATES DISTRICT COURT,
for the

2! 2011

Eastern District of Virginia
United States of America
V.
)

KEVIN PATRICK MALLORY

Case No. 1:17-MJ-

23,5

) FILED UNDERSEAL

Defendant(s)

CRIMINAL COMPLAINT
I, the complainant in this case, state that the following is true to the best of my knowledge and belief.
Loudoun
On or about the date(s) of April 1, 2017 through May 31, 2017 in the county of
Eastern

District of

Virginia

Code Section
18 U.S.C. § 1001
18 U.S.C. § 794

in the

, the defendant(s) violated:
Offense Description

Making materially false statements to the FBI
Gathering or delivering defense information to aid a foreign government

This criminal complaint is based on these facts:
SEE ATTACHED AFFIDAVIT

gi Continued on the attached sheet.

Complainant's signature

Reviewed by AUSAJSAUSA:
AUSA JOHN GIBBS

Stephen Green, Special Agent FBI
Printed name and title

Sworn to before me and signed in my presence.

sa
Date:

June 21, 2017

/s/
rroll Buchanan
tales Magistrate Judge
Judge's signature

City and state:

Theresa C. Buchanan, U.S. Magistrate Judge
Printed name and title

 IN THE UNITED STATES DISTRICT COURT FOR THE
EASTERN DISTRICT OF VIRGINIA
Alexandria Division
UNITED STATES OF AMERICA

2 1 2017

UNDER SEAL
Criminal No. 1:17-M- 2_6-.0
)c,i)

V.
KEVIN PATRICK MALLORY,
Defendant

AFFIDAVIT IN SUPPORT OF
AN APPLICATION FOR A CRIMINAL COMPLAINT AND ARREST WARRANT
I, Stephen Green, being first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1.

I am a Special Agent with the FBI, and have been since 2012. Since 2012, I have

been assigned to the Washington Field Office, Counterintelligence Division. Since October 2016,
I have investigated offenses involving espionage and the unlawful retention or disclosure of
classified information.
2.

I have training in the preparation, presentation, and service of criminal complaints,

and have been involved in the investigation of numerous types of offenses against the United
States. I have also been trained in the preparation, presentation, and service of arrest and search
warrants, and have executed both arrest warrants and search warrants in previous cases.
3.

The facts in this affidavit are based on my personal observations, my training and

experience, and information obtained from other witnesses and law enforcement agents. This
affidavit is intended to show merely that there is sufficient probable cause for the requested
criminal complaint and warrant and does not set forth all of my knowledge about this matter.

 PURPOSE OF AFFIDAVIT
4.

Based on my training and experience and the facts as set forth in this affidavit, there

is probable cause to believe that Mallory violated 18 U.S.C. § 1001 (Making Material False
Statements) and 18 U.S.C. § 794 (Gathering or Delivering Defense Information to Aid a Foreign
Government). I therefore make this affidavit in support of a criminal complaint charging Mallory
with these offenses.
STATUTORY AUTHORITY AND DEFINITIONS
5.

For the reasons set forth below, there is probable cause to believe that Mallory

committed violations of Title 18, United States Code, Section 1001, and Title 18, United States
Code, Section 794(a).
6.

Under 18 U.S.C. § 1001, "whoever, in any matter within the jurisdiction of the

executive, legislative or judicial branch of the Government of the United States, knowingly and
willfully makes any materially false, fictitious, or fraudulent statement or representation" shall be
fined or imprisoned for a term of not more than five years.
7.

Under 18 U.S.C. § 794(a), "whoever, with intent or reason to believe that it is to be

used to the injury of the United States or to the advantage of a foreign nation, communicates,
delivers or transmits, or attempts to communicate, deliver or transmit, to any foreign government
. . . or to any representative, officer, agent, employee, subject, or citizen thereof. . . any document,
writing,. . . or information relating to the national defense" shall be imprisoned "for any tem' of
years or for life[1"
8.

Under Executive Order 13526, information in any form may be classified if it: (1)

is owned by, produced by or for, or is under the control of the United States Government; (2) falls
within one or more of the categories set forth in the Executive Order [Top Secret, Secret, and
2

 Confidential]; and (3) is classified by an original classification authority who determines that its
unauthorized disclosure reasonably could be expected to result in damage to the national security.
9.

Where such unauthorized disclosure could reasonably result in damage to the

national security, the information may be classified as "Confidential" and must be properly
safeguarded. Where such unauthorized disclosure could reasonably result in serious damage to the
national security, the information may be classified as "Secret" and must be properly safeguarded.
Where such unauthorized disclosure could reasonably result in exceptionally grave damage to the
national security, the information may be classified as "Top Secret" and must be properly
safeguarded.
10.

Classified information of any designation may be shared only with persons

determined by an appropriate United States Government official to be eligible for access, and who
possess a "need to know." Among other requirements, in order for a person to obtain a security
clearance allowing that person access to classified United States Government information, that
person is required to and must agree to properly protect classified infonnation by not disclosing
such information to persons not entitled to receive it, by not unlawfully removing classified
information from authorized storage facilities, and by not storing classified information in
unauthorized locations. If a person is not eligible to receive classified information, classified
information may not be disclosed to that person. In order for a foreign government to receive
access to classified information, the originating United States agency must determine that such
release is appropriate.

3

 PROBABLE CAUSE
Relevant Parties:

11.

Kevin Patrick Mallory is a 60-year-old self-employed consultant with GlobalEx,

LLC. He is a United States citizen who resides and works at 16621 Elk Run Court, Leesburg,
Virginia 20176. Mallory graduated from Brigham Young University in 1981 with a B.A. degree
in Political Science. After graduation, Mallory worked full time in an active duty military position
until 1986. After he left active duty, Mallory continued his military service as an Army reservist.
From 1987 through 1990, Mallory worked as a Special Agent for the State Department Diplomatic
Security Service. From 1990 to 2013, Mallory worked at various government agencies, for U.S.
cleared defense contractors, and on U.S. Army active duty deployments. Mallory was stationed in
locations including Iraq, the People's Republic of China ("PRC"), Taiwan, and the greater
Washington D.C. area. During much of that time, Mallory held a TOP SECRET security clearance.
Mallory has language fluency in Mandarin Chinese.
12.

In March and April 2017, while visiting Shanghai, China, Mallory met with an

individual (hereinafter "PRC1") who represented himself to Mallory as working for a PRC think
tank, the Shanghai Academy of Social Sciences ("SASS").
Chinese Institutions, Intelligence Services and Associated Terms:

13.

According to its public website, SASS was "founded in 1958 and administered by

the Municipal Government of Shanghai," and "receives most of its funds from the municipal
government of Shanghai." According to a 2007 report on Chinese think tanks by the Center for
Naval Analysis, a federally funded research and development center, SASS is one of the two
largest and most established Shanghai think tanks. That report also noted "all provincial- and

4

 municipal-level think tanks are affiliated with the provincial or municipal government they serve.
That government is their primary client."
14.

The FBI has described SASS as a leading think tank and distinguished academic

institution that specializes in humanities and social sciences to include economics, history,
philosophy, journalism, international relations, and sociology. PRC policy-makers utilize SASS
publications. Since at least 2014, the FBI has assessed that the Shanghai State Security Bureau
("SSSB"), a sub-component of the Ministry of State Security ("MSS"), has a close relationship
with SASS and uses SASS employees as spotters and assessors. FBI has further assessed that SSSB
intelligence officers have also used SASS affiliation as cover identities.
15.

The PRC intelligence services ("PRCIS") encompass both the civilian and military

components of Chinese intelligence programs. Civilian intelligence collection is handled by the
MSS. The MSS can be described as an institution similar to the FBI and the Central Intelligence
Agency ("CIA") combined under one intelligence directorate responsible for counter-intelligence,
foreign intelligence, and political security. The MSS consists of a central ministry, provincial state
security departments, and municipal state security bureaus, such as the Beijing State Security
Bureau ("BSSB") and the SSSB.
16.

Among other things, the MSS and its regional bureaus are focused on identifying

and influencing the foreign policy of other countries, including the United States. The MSS and
its bureaus seek to obtain information on political, economic, and security policies that might affect
the PRC, foreign intelligence operations directed at the PRC, and biographical profiles of foreign
politicians and intelligence officers.
17.

Additionally, the MSS and its bureaus are tasked with conducting clandestine and

overt human source operations, of which the United States is a principal target. These operations
5

 use trained intelligence officers, as well as non-professional collectors called "cut-outs" or "cooptees." A cut-out or co-optee is a person trusted by both the source and the intelligence officer
who helps to provide a layer of insulation between an intelligence officer and a source, and thereby
increases operational security. Cut-outs or co-optees can operate under a variety of covers, posing
as diplomats, journalists, academics, or business people both at home and abroad. These
individuals are tasked with spotting, assessing, targeting, collecting, and handling sources or assets
with access to classified, open-source, proprietary, or sensitive information that the government of
the PRC can utilize for economic, political, or military decision-making or advantage. Sources or
assets are people who agree to help a foreign intelligence service by providing information to that
service in response to taskings from foreign intelligence officers or agents.
18.

PRCIS source operations tend to originate inside the PRC, where the PRCIS prefers

to meet with its sources or assets. To facilitate continued meetings inside the PRC, the PRCIS will
arrange and/or pay for travel and expenses. The PRCIS is known to pay their sources not only in
cash, but also through other means, including business considerations or other types of assistance
within the PRC.
Mallory's U.S. Government Security Clearances:

19.

As required for his various government positions, Mallory obtained a TOP

SECRET security clearance, which was active during various assignments during his career.
Mallory's security clearance was terminated in October 2012 when he left government service.
20.

Because Mallory held a security clearance and was assigned to various government

agencies, both as an employee and as a private contractor, the U.S. Government entrusted Mallory
with access to sensitive government materials, including information relating to the national

6

 defense that was closely held by the government ("National Defense Information") and classified
documents and materials.

Timeline of Mallory's Contacts with Individuals He Believed To Be PRCIS Agents
21.

On or about April 21, 2017, after a return flight to the United States from Shanghai,

Mallory was subjected to a U.S. Customs and Border Protection ("CBP") secondary search and
interview by CBP at Chicago O'Hare Airport. Mallory was informed that CBP policy and
procedure dictated that anyone crossing the border was subject to inspection, including an
inspection of all of their belongings and electronic devices.
22.

During the CBP interview, Mallory stated that he was outside the United States for

one week, and he was returning from Shanghai. Mallory stated that it was a business trip as well
as a father/son vacation. Mallory stated that he was currently a consultant for "GlobalEx," which
was a company he founded in 2010. While in the PRC on this trip, Mallory said he met with an
individual whom he knew through Mallory's church, and stated that he was consulting with this
individual on anti-bullying/family safety development. Mallory also stated that he did not receive
anything from this individual during his trip.
23.

Mallory checked "no" in response to question no. 13 on the CBP Customs

Declaration Form 6059b, which asked whether he was carrying over $10,000 in U.S. or foreign
currency. CBP, however, found $16,500 U.S. Dollars ("USD") in Mallory's two carry-on bags.
Mallory was allowed to amend his customs declaration to reflect the correct amount of money he
was bringing into the United States.
24.

On May 24, 2017, Mallory submitted to a voluntary interview with the FBI in

Ashburn, Virginia. Mallory told the FBI agents he had been contacted on a social media site by a
Chinese recruiter (hereinafter "PRC2") in or around February 2017. Mallory recounted that, over
7

 the next several days, he had phone interviews with PRC2 and was introduced by PRC2 to a
potential client (PRC1, discussed above). Mallory told the agents that he travelled to Shanghai
separately in March 2017 and April 2017 to meet with PRC1 and PRC1's boss (hereinafter
"PRC3").
25.

Mallory told the agents that he had reached out in or around March 2017 to one or

more former co-workers (to include two individuals, hereinafter "Employee 1" and "Employee2")
from a U.S. government agency (hereinafter "USGA1") requesting they help him get in contact
with a specific department in USGA1. Mallory told agents that Employeel and Employee2 did not
facilitate any contact with the specific department, or anyone at USGA1, as he had requested.
Mallory described to the agents how he again contacted Employeel in April 2017 requesting help
arranging a meeting with USGA1 to discuss people Mallory had recently met with in the PRC.
Based on its investigation, the FBI knows this contact to have occurred after Mallory was subjected
to a secondary search and interview by CBP.
26.

Mallory told the agents that Employed l facilitated a meeting for him at USGA1,

which the FBI knows to have been on May 12, 2017, where he met with an employee of USGA1
(hereinafter "Employee3"). Recounting that meeting to the agents, Mallory said that he had
informed Employee3 that he now believed that individuals he had met with in Shanghai
(previously identified as PRC1 and PRC3) were affiliated with the PRCIS. Mallory stated that he
had told Employee3 about receiving a communication device from PRC1, and that he had been
trained in how to use it. According to Mallory, he had agreed with Employee3 to meet again with
U.S. government employees to allow the device to be technically examined.
27.

Mallory told the FBI Agents that he had come to the May 24, 2017 meeting

voluntarily, expecting to meet with Employee3. Upon arrival, he was introduced to the FBI agents.
8

 During the May 24 meeting with the FBI agents, Mallory signed a voluntary consent form
permitting the FBI to search the device provided to Mallory by PRC1, which he had brought to the
meeting. At that time, the FBI extracted an image of the device, and returned the device to Mallory.
The FBI conducted further technical examination of the imaged copy of the device after the
interview.
28.

During the May 24, 2017 interview with the FBI, Mallory told the agents that

during his most recent trip to the PRC in April 2017, he had been given the device by PRC1 and
was trained to use it specifically for private communications with PRC1, an individual he believes
works for the PRCIS. Mallory based this assessment on the multiple examples of PRCIS tradecraft
and taskings which would be consistent with PRC government officials or intelligence officers
(hereinafter "I0s"), and would be inconsistent with the practices of a legitimate commercial
company. Mallory told the FBI agents that he was a fonner U.S. government employee who had
training and overseas operational experience, which made it easy for him to spot tradecraft.
29.

Mallory told agents that he was encouraged by the PRC IOs to pursue employment

with the U.S. Government, which he was already in the process of doing prior to meeting these
individuals. When asked where he thought the PRC IOs would like this relationship to go, Mallory
told the FBI that he believes they would like to see him obtain a position of access in the U.S.
Government.
30.

Mallory also told the agents that he received taskings from the individuals he

believed were PRC IOs to write papers about U.S. policy matters, and that he responded by writing
and delivering two short, unclassified white papers, using information in his head as well as open
source info illation. He stated that he did not retain copies of those documents. Mallory told agents

9

 multiple times that he did not provide the PRC IOs with any other documents in any format,
whether in paper or electronic form, beyond these two white papers.
31.

Mallory told the FBI agents that he had received cash payments of $10,000USD in

March 2017 and $15,000USD in April 2017 from the individuals he believed to be PRC I0s. These
payments were based on his daily billable rate plus some expenses, and no other payments were
due or expected to be paid prior to his anticipated travel in June 2017. In an upcoming trip to the
PRC in June, Mallory said that he expected to receive his daily billable rate again. According to
Mallory, no payments were due to him from the PRC IOs for work done while Mallory was in the
United States.
32.

While demonstrating the capabilities of the device at the meeting on May 24, 2017,

Mallory voluntarily showed agents how to move from normal message mode to secure message
mode. When doing this, Mallory expressed surprise at seeing some secure message history. Prior
to the demonstration, he had told the agents that he believed the communication system was
designed to delete all previous history. When questioned on the secure messages which were
visible on the device, Mallory pointed out to the agents which messages he had sent and which
messages PRC1 had sent. One message he had sent stated, "I can also come In the middle of June
I can, bring the remainder of the documents I have at that time."
33.

Upon questioning, Mallory said that comment was a reference to the two white

papers he had already told agents about regarding open source U.S. policy information. Mallory
stated that the reference to the "remainder of the documents" was just stringing PRC1 along, and
that he did not actually have anything to give PRC1.

10

 Passage of Classified Documents Via Device

34.

In or around June 2, 2017, upon subsequent technical review of the device that

Mallory voluntarily allowed the FBI to search, additional secure message history was recovered.
The message history was part of the same string of messages Mallory had shown the FBI agents
on May 24, 2017, between himself and PRC1.
35.

In a recovered secure message sent from the device on or about May 1, 2017,

Mallory wrote, "Also, we may need to go again step by step in my getting the document to become
part of the image. Then sending it to you."
36.

In messages sent on or about May 3, 2017, PRC1 and Mallory discussed two

documents, "nol and no2," which Mallory had provided to PRC1.
37.

During the May 3, 2017 communication, PRC1 wrote, "I suggest you send all and

retype the handwriting. And NO1 is obvious the first page of a complete article, where the else is
and why it is black on top and bottom....We will try our best to apply for another sum of amount,
as you required. However, I'm not sure it will be the Same amount for now and I will try, and for
safety, we cannot send u in one time or in a short period altogether, need to figure out a better
way."
38.

In messages sent on or about May 3, 2017, Mallory responded, "The black was to

cross out the security classification (TOP SECRET//ORCON//...I had to get it out without the
chance of discovery. Unless read in detail, it appeared like a simple note...I have arranged for a
USD account in another name. You can send the funds broken into 4 equal payments over 4
consecutive days.. .When you agree I will send you the bank E.g. instructions."
39.

Later in this same conversation, Mallory stated, "It was dicey (look it up) when

they asked for me by name. If they we looking for me in terms of State Secrets, and found the SD
11

 card..., we would not be talking today. I am taking the real risk as you, [PRC3], and higher up
bosses know... "When you get the OK to replace the prior payment, then I will send more does. I
will also type my notes. NOTE: In the future, I will destroy all electronic records after you confirm
receipt.. .1 already destroyed the paper records. I cannot keep these around, too dangerous."
40.

In messages sent on or about May 5, 2017, Mallory wrote, "your object is to gain

information, and my object is to be paid for." PRC1 responded, "My current object is to make sure
your security and try to reimburse you."
41.

In messages sent on or about May 5, 2017, Mallory wrote, "I can also come In the

middle of June. I can bring the remainder of the documents I have at that time."
42.

Analysis of the device revealed a handwritten index describing eight different

documents. Four of the eight documents on this list were found stored on the device.
43.

USGA1 analyzed the four documents found on the device and confirmed that three

of the documents are USGA1 documents, containing classified information. USGA1 further
confirmed that one of the three documents was classified at the TOP SECRET level at the time it
was transmitted to PRC1 in early May 2017 and continues to be classified at that level. USGA1
further confirmed that the remaining two documents were classified at the SECRET level at the
time they were transmitted to PRC1 in early May 2017 and continue to be classified at that level.
CHARGES
False Statements — 18 U.S.C. 4 1001

44.

Mallory made materially false statements during the FBI interview on May 24,

2017 in Ashburn, Virginia. After being informed of the identities of federal agents, Mallory
knowingly and willfully made numerous materially false statements about sending documents to
presumed PRC I0s, including by:
12

 •

Claiming to FBI agents that he had not provided additional documents, beyond two
unclassified white papers, to individuals he identified as PRC I0s.

•

Claiming to FBI agents that he had never transmitted documents, other than a test
message, using the device.

Delivering Defense Information To Aid Foreign Government — 18 U.S.C. 794
45.

With reason to believe it would be used to the injury of the United States or to the

advantage of the PRC, Mallory transmitted national defense information in the form of documents
classified at the SECRET and TOP SECRET level to an agent of the PRC.
CONCLUSION AND SEALING REQUEST
46.

For all the reasons stated above, there is probable cause to believe that from in or

about April 2017 through in or about May 2017, Mallory made materially false statements to
federal law enforcement officers, in violation of 18 U. S .C. § 1001, and transmitted national defense
information to an agent of the PRC in violation of 18 U.S.C. § 794. These criminal violations were
either begun or committed in the Eastern District of Virginia, or were begun or committed
overseas, out of the jurisdiction of any particular state or district, and your affiant expects that
Mallory will be arrested in the Eastern District of Virginia.
47.

I ask that this affidavit be sealed, until further order of the court, to protect this

investigation. I am aware from my training and experience that evidence is destroyed, individuals
flee, and witnesses may be tampered with or become uncooperative when the details known to law
enforcement become prematurely available to the targets of a criminal investigation.

13

 48.

I declare under the penalty of perjury that the information provided above is true

and correct.

Respectfully submitted,

tephen reen
Special Agent
Federal Bureau of Investigation
Washington, D.C.
Subscribed and sworn to before me
on June TA, 2017.
/s/
Theresa Carroll Buchanan
--tJnited States Magistrate Judge
THE HONORABLE THERESA C. BUCHANAN
UNITED STATES MAGISTRATE JUDGE

14