Case 5:18-mj-70919-MAG Document 1 Filed 07/09/18 Page 1 of 15 A09i (Rev. 11/11) Criminal Complaint United States District Court ''ILko for the 0 9 2018 Northern District of California ^ SOOWG United States of America SANjose ^ORNIA V. Cfi 18.70919 XIAOLANG ZHANG MAG Defendant(s) CRIMINAL COMPLAINT I, the complainant in this case, state that the following is true to the best of my knowledge and belief. On or about the date(s) of Northern District of April 30, 2018 California in the county of in the , the defendant(s) violated: Offense Description Code Section 18 U.S.C.ยง 1832(a)(1) Santa Clara Theft of Trade Secrets This criminal complaint is based on these facts: See attached affidavit of S/A Eric Proudfoot PENALTIES: 10 years imprisonment. $250,000 fine, $100 special assessment, and 3 years' supervised release Sf Continued on the attached sheet. ''s signaliire Eric M. Proudfoot, Special Agent, FBI Printed name and title Sworn to before me and signed in my presence. Date: tXMK: acts Judge's signature City and state: San Jose, California Virginia K, DeMarchi, U.S. Magistrate Judge Printed name and title .Case Document 1 Filed 07/09/18 Page 2 of 15 AFFIDAVIT PRESENTED IN SUPPORT FOR A CRIMINAL COMPLAINT 1, Eric M. Proudfoot, Special Agent of the Federal Bureau of Investigation being duly sworn, hereby declare as follows: INTRODUCTION AND AGENT BACKGROUND 1. This af?davit is presented in support of a criminal complaint charging Xiaolang Zhang (?Zhang?) with the crime of theft of trade secrets, in violation of Title 18, United States Code, Section 1832, Theft of Trade Secrets. 2. I am an ?investigative or law enforcement of?cer of the United States? within the meaning of Section 2510(7) of Title 18, United States Code, that is, an of?cer of the United States who is empowered by law to conduct investigations of, and to make arrests for, offenses enumerated in Title 18, United States Code, Section 1832. 3. I have been employed as a Special Agent of the Federal Bureau of Investigation since March 2, 2008, and am currently assigned to the San Francisco Division. While employed by the Federal Bureau of Investigation, I have investigated federal criminal violations related to high technology/cybercrime, child exploitation, child pornography, foreign counterintelligence, and intellectual property crime. I have gained experience through training at the Federal Bureau of Investigation and everyday work relating to conducting these types of investigations. As a federal agent, I am authorized to investigate violations of United States laws and to execute warrants issued under the authority of the United States. 4. As an FBI agent, I am authorized to investigate violations of United States law and I am a law enforcement of?cer with the authority to execute warrants issued under the authority of the United States. During my career as a Special Agent of the FBI, I have received training and possess actual experience relating to Federal criminal procedures and Federal statutes. I have .Case Document 1 Filed 07/09/18 Page 3 of 15 also received specialized training and instruction in the ?eld of investigation in computer-related crimes. I have had the opportunity to conduct, coordinate, and participate in numerous investigations relating to computer?related crimes. I have participated in the execution of numerous search warrants conducted by the FBI and have participated in the seizure of email accounts and computer systems. 5. The facts in this af?davit are based on my personal participation in this investigation, my training and experience, and documents, records, emails, and other types of information obtained during the investigation from other sources and Witnesses. The FBI has, thus far conducted interviews and reviewed documentation provided by the victim company, Apple, (?Apple?), which included ?le listings, closed circuit television images, physical access badge history, and employee agreements. The FBI has also conducted a physical search of residence, authorized on June 22, 2018, by the Honorable Susan van Keulen, Magistrate Judge, United States District Court, Northern District of California, San Jose Disivison. Because this af?davit is being submitted for the limited purpose of securing a criminal complaint, I have not included every fact known to me concerning this investigation. I have set forth only the facts that I believe are necessary to establish probable cause to believe that evidence of violations of US. law occurred. Also, where I refer to conversations and events, I often refer to them in substance and in relevant part rather than in their entirety or verbatim, and ?gures and calculations set forth in this complaint are approximate, unless otherwise noted.A APPLICABLE STATUTES 6. The FBI is investigating alleged violations of Title 18, United States Code, Section 1832, which states in part: Whoever, with intent to convert a trade secret, that is related to a product or service used in or intended for use in interstate or foreign commerce, to the .Case Document 1 Filed 07/09/18 Page 4 of 15 economic bene?t of anyone other than the owner thereof, and intending or knowing that the offense will, injure any owner of that trade secret, knowingly? (1) Steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, arti?ce, or deception obtains such information; (2) Without authorization copies, duplicates, . . . downloads, uploads, . . . replicates, transmits, delivers, sends, mails, communicates, or conveys such information; (3) Receives, buys, or possesses such information, knowing the same to have been stolen or appropriated, obtained, or converted without authorization; (4) Attempts to commit any offense described in paragraphs (1) through (3) . . . (5) Conspires with one or more other persons to commit any offense described in paragraphs (1) through (3), and one or more of such persons do any act to effect the object of the conspiracy, shall . . . be ?ned under this title or imprisoned not more than 10 years, or both. ENTITIES 7. Apple, Inc. ?Apple? is a technology company headquartered in Cupertino, California with an annual revenue (in 2017) of $229 billion. 8. Xiaopeng Motors, aka Xpeng Motors, (?XMotors?) is an intelligent electric vehicle company with headquarters in Guangzhou, China, and North American of?ces located in Palo Alto, California. INDIVIDUALS 9. Xiaolang Zhang is a former Apple employee, working as a hardware engineer on their autonomous vehicle development team. ZHANG BACKGROUND 10. ZHANG was hired at Apple starting on December 7, 2015, to work on a project to develop software and hardware for use in autonomous vehicles (the Project). Although Apple has made general statements to the press about being interested in autonomous vehicle development, the details of Apple?s research and development for the Project is a closely 3 Case Document 1 Filed 07/09/18 Page 5 of 15 guarded secret that has never been publicly revealed. Most recently, ZHANG worked on the Compute Team, Where he designed and tested circuit boards to analyze sensor data within the Project. Because of his role on the team, ZHAN was granted broad access to secure and con?dential internal databases containing trade secrets and intellectual property for the Project. Among these are multiple con?dential databases whose names and categories are known to the government (the ?Databases?). 11. ZHAN took paternity (new parent) leave following the birth of his child from April 1 to April 28, 2018, pursuant to Apple?s employee leave policy. While on paternity leave, ZHAN traveled with his family to China. On April 30, 2018, shortly after returning from China, ZHANG met with his immediate supervisor at Apple, and explained that ZHANG would be resigning to move back to China in order to be closer to his mother who he stated was in poor health. As the meeting progressed, ZHANG disclosed that he intended to work for XMOTORS a Chinese start-up company focused on electric automobiles and autonomous vehicle technology. 12. After hearing ZHAN G?s intentions and feeling that he had been evasive during their meeting, ZHAN G?s supervisor asked a representative from Apple?s New Product Security Division to join the meeting with ZHANG. At the conclusion of their meeting, ZHANG was asked to turn in all Apple-owned devices, and ZHAN was advised he would then be walked off the campus. ZHAN turned over to Apple two (2) Apple iPhones and one (1) MacBook laptop computer. Apple security then immediately disabled remote network access, badge privileges, network access, and other employee accesses. ZHANG was also reminded about Apple?s intellectual property policy, and ZHANG acknowledged that he understood and would comply. Case Document 1 Filed 07/09/18 Page 2018, Apple New Product Security asked that the internal Apple team overseeing the con?dential Databases where Apple?s materials, including proprietary and con?dential materials, are stored began reviewing ZHANG's historical network user activity. At the same time, an Apple Global Security attorney began a physical security review of ZHANG's building access and activities on the Apple campus. The Apple security attorney also requested forensic analysis of ZHANG's Apple-owned devices from Apple Information Security. 14. Apple?s database security team found that in the days just prior to April 30, 2018, ZHAN G?s Apple network activity increased exponentially compared to the prior two years of his employment. The majority of his activity consisted of both bulk searches and targeted downloading copious pages of information from the various con?dential database applications. The information contained within the downloading contained trade secret intellectual property, based on the level of access within Apple's autonomous vehicle team. 15. Historical analysis of network activity by Apple Information Security (AIS) show that with the con?dential database A (the name of which is known to the af?ant), ZHANG generated 5 81 rows of user activity on April 28, 2018 alone. On April 30, 2018, ZHAN generated 28 rows of user activity. By comparison, ZHANG generated 610 rows of user activity during the entire previous month. The amount of activity is unusual for ZHANG given that he announced his resignation on April 30, 2018. 16. AIS historical network activity of ZHANG from con?dential database (database containing technical documents for the Project) re?ect 3,390 rows of user activity generated on April 28 and April 29, 2018. By comparison, ZHANG generated 1,484 rows of user activity over the time period of July 2017 through March 2018. Some of the technical .pdf documents .Case Document 1 Filed 07/09/18 Page 7 of 15 downloaded on April 28 and April 29, 2018 include con?dential topics such as Prototypes and Prototype Requirements (power requirements, low voltage requirements, battery system, drivetrain suspension mounts, etc.) As noted above, this amount of downloading activity is unusual for ZHANG given his resignation on April 30, 2018. 17. Apple Security?s review of swipe badge access and close circuit television footage revealed that ZHANG had been on Apple's campus at or around 9:14 pm. on the evening of Saturday, April 28, 2018. CCTV footage showed that ZHANG entered both the autonomous vehicle software and hardware labs, and left the building less than an hour later carrying a computer keyboard, some cables, and a large box. network activity, physical presence on campus, and removal of Apple property all occurred during ZHANG's paternity leave - contrary to Apple corporate policy. activity was particularly alarming to several groups within Apple?s hierarchy: the New Product Security Division, Apple?s Research and Development team overseeing the Autonomy Project, and Apple?s Global Security Investigations Group since it occurred in the few days prior to resignation from Apple. 18. The Apple security attorney then contacted Apple Employee Relations on May 1, 2018, to discuss bringing ZHANG back to Apple for a follow-up interview. ZHAN was contacted and replied later in the evening of May 1, agreeing to be re-interviewed by Apple. 19. On May 2, 2018, ZHANG was interviewed a second time by the Apple security attorney and an Apple employee relations representative whose identity is known. During the interview, ZHANG admitted to pursuing employment with X-Motors while still employed at Apple. ZHANG initially denied coming onto the Apple campus during his paternity leave and denied removing items that were Apple property. As the interview progressed, Apple security .Case Document 1 Filed 07/09/18 Page 8 of 15 personnel confronted ZHANG verbally, stating that Apple was aware that ZHANG was, in fact, on the Apple campus during the evening of April 28, 2018. A?er being confronted with this information, ZHANG recanted his earlier denials and admitted to being present on the Apple campus while still on paternity leave. ZHANG ?irther admitted to taking the online data from ?the Databases? while on paternity leave. ZHANG also admitted removing items from the laboratories prior to his paternity leave (including two circuit boards and a Linux server from the hardware lab). reason for these actions were that he took the hardware because he thought the hardware might bene?t him in a new position within Apple. (Prior to taking paternity leave, ZHAN had begun negotiations to transfer to a separate proprietary research program at Apple, but the transfer had never taken place.) ZHANG further explained that he had compiled and downloaded the data because ZHANG has an interest in platforms and wanted to study the data on his own. 20. ZHAN admitted to being shown a proprietary chip by colleagues while on campus during the evening of Saturday, April 28, 2018. Further, ZHAN admitted ?air-dropping? the data he had taken from Apple?s system onto a personally-owned device (a device not owned by Apple), which ZHAN identi?ed as his wife?s laptop computer. ZHANG provided the Apple interviewers consent to search wife?s laptop for any Apple intellectual property. ZHANG also offered to return the Linux server and circuit boards he had taken from the hardware lab. 21. ZHANG departed the Apple campus during the May 1 interview and returned in less than an hour with the computer ZHANG identi?ed as his wife?s laptop computer (Subject Computer), along with a Linux server and the two circuit boards ZHANG had admitted to taking from Apple. The Apple security attorney and the employee relations representative performed a~ .Case Document 1 Filed 07/09/18 Page 9 of 15 cursory review of the Subject Computer in presence for any intellectual property and noted several folders of concern, particularly a folder entitled that contained approximately 40GB worth of data. Additionally, the laptop's system event logs re?ected ?Air Drop? activity on both April 29, 2018 and April 30, 2018. 22. Apple security personnel asked ZHAN if he further ex-?ltrated or forwarded any of the data on his wife?s laptop, which ZHAN denied. ZHANG was advised that the Apple team would need to keep the Subject Computer in order to perform a more in-depth search for Apple intellectual property, to which ZHANG consented. 23. Apple security personnel has advised the FBI that at the present time, the Apple Digital Forensic Investigations team has discovered that approximately 60 percent of the data on the Subject Computer was ?highly problematic;? the complete evaluation remains ongoing. 24. ZHAN was voluntarily terminated from Apple effective May 5, 2018 (though his accesses and permissions had been de-activated since April 30, 2018), and now claims to be working for XMotors out of their Mountain View, California location. ZHANG also advised the Apple investigators that he is planning to move his family to Guangzhou, China in the near future. FILES RECOVERED FROM SUBJECT COMPUTER 25. Apple Information Security provided the FBI with a sample set of ?les Apple identi?ed as belonging to Apple and recovered from the Subject Computer along with technical descriptions of each ?le. The information contained in each ?le is largely technical in nature, including engineering schematics, technical reference manuals, and technical reports. 26. One of these ?les was identi?ed as by its speci?c ?le name (known to the af?ant), and it is a 25-page document containing electrical schematics for one of the circuit boards that Case Document 1 Filed 07/09/18 Page 10 of 15 form Apple?s proprietary infrastructure technology for the Project. An excerpt of the schematic showing the Intellectual Property caveat is included below: TABLE OF CONTENTS A DRAWING TITLE SCH, DR SIZE Apple Inc. 0.2.1 NOTICE OF PROPRIETARY PROPERTY: BRANCH THE INFORMATION CONTAINED HEREIN IS THE PROPRIETARY PROPERTY OF APPLE INC. THE POSESSOR AGREES To THE FOLLOWING: PAGE I TO MAINTAIN THIs DOCUMENT IN CONFIDENCE REPRODUCE OR COPY IT NOT To REVEAL OR PUBLISH IT IN WHOLE OR PART SHEET Iv ALL RIGHTS RESERVED 1 OF 2 5 7 ?l 27. The ?le was only accessible to certain Apple employees that were disclosed on the Project as described below. This single file serves as the basis for the instant criminal charge. The Subject Computer is currently in the possession of the FBI, having been seized from Apple pursuant to a search warrant issued by U.S. Magistrate Judge Susan van Keulen on June 22, 2018. STEPS TO PROTECT ITS INTELLECTUAL PROPERTY 28. Apple goes to great to protect data and intellectual property for the Project. The Databases are protected by several layers of access control. First, an employee must be logged into Apple's virtual private network (VPN). Accounts for VPN are provisioned during the onboarding process for new hires and controlled via an internal tool. The employee must then download an internal application and install the VPN. Next, the employee must be granted ?disclosure? for the Project. Disclosure status allows an employee to receive information for the Project. Case Document 1 Filed 07/09/18 Page 11 of 15 29. Apple uses an internal software tool to manage requests for project disclosure and maintains a record of all disclosures. An employee has to be ?sponsored? for disclosure on the Project by someone who is already disclosed. The sponsor will submit a disclosure request on behalf of the employee through the disclosure tool. The request must include a business justi?cation for the employee to be granted access. An administrator reviews the request and approves or denies it. Approximately 5,000 of Apple?s over 135,000 full time employees are disclosed on the Project. 30. Not all employees disclosed on the Project are granted access to the Databases. After receiving disclosure, an employee must also separately request database access, unless they are designated as a ?core employee? for the Project. 31. ZHANG had core employee status and access to the Databases because he was working full time on the Project under the Research and Development organization. Approximately 2,700 employees have access to one or more of the Databases. 32. Apple also goes to great to communicate the importance of secrecy to its employees. Before starting at Apple, corporate employees must sign an Intellectual Property Agreement (IPA). The IPA speci?es that an employee may not use Apple?s intellectual property except as authorized by Apple, including a prohibition against transfer and transmission of intellectual property Without Apple?s consent. 33. ZHANG signed an IPA on October 28, 2015. In addition, ZHANG took an annual Business Conduct course which discussed appropriate handling of con?dential material. The training explained that con?dential material includes unannounced product designs and features, project or product timelines and staf?ng, project code names and marketing and ?nancial information, among other things. 10 Case Document 1 Filed 07/09/18 Page 12 of 15 34. The annual Business Conduct training also explained that once an employee is formally disclosed on a project, an employee has authorized awareness of a con?dential project, can discuss project details with people disclosed on the project, and may be given access to speci?c con?dential information or documents. The training stated that being disclosed does not mean an employee can disclose other people at will. 35. Employees disclosed on the Project must also attend an in-person secrecy training for the Project. ZHANG attended the secrecy training on December 9, 2015. The training covered the importance of keeping the nature and the details of the Project secret and avoiding intentional or unintentional information leaks. The training reviewed methods for ensuring information about the project is only provided to individuals disclosed on the project, the fact that family members should not have access to information about the Project, as well as possible consequences for providing information or con?rmation of information to non-disclosed individuals, including employment termination. The training also covered Apple?s policy prohibiting employees from storing IP on devices over which they do not have personal control, and requirements for storing and transmitting Project documents using secure mechanisms. INTERVIEW 0F ZHANG BY FBI AGENTS 36. ZHANG was interviewed by Agents from the FBI on June 27, 2018, at the time of an execution of a Federal search warrant at his residence. ZHAN admitted to taking ?les from the Project, and further admitted to transferring these ?les to a non-Apple digital device, described by ZHANG as his wife?s laptop computer (Subject Computer). ZHAN told the Agents that because he needed to tum-in his Apple-owned laptop upon resignation, he transferred the ?les to Subject Computer for access in the ?xture. 11 ,Case Document 1 Filed 07/09/18 Page 13 of 15 INTERNATIONAL TRAVEL PLANS 37. On July 7, 2018, FBI Agents learned that ZHANG purchased a last-minute round-trip airline ticket with no co-travelers, departing San Jose, California on July 7, 2018 traveling to Beijing, China with a ?nal destination of Hangzhou, China aboard Hainan Airlines. Agents intercepted ZHANG at the San Jose International Airport after he had passed through the security checkpoint of Terminal B, where he was arrested by federal agents without incident based on probable cause to believe that he had committed theft of trade secrets in violation of 18 U.S.C. 1832. 38. Through my training and experience as an FBI Agent, I believe that ZHANG used his employment as an Apple employee, working on a secretive program, to obtain intellectual property and trade secrets from Apple prior to resigning from Apple. ZHANG admitted both to Apple and to the FBI to taking Apple?s data and admitted ?air-dropping? this information onto Subject Computer. Subject had received initial Intellectual Property training and annual training thereafter which would have prohibited such behavior. Further, ZHAN signed an Intellectual Property Agreement on October 28, 2015, indicating that ZHAN understood his responsibilities and would abide by Apple?s policies. 39. Based upon the foregoing, my training and experience, and the training and experience of agents and investigators involved in this investigation, I believe that there is probable cause to believe that ZHANG has committed the crime of theft of trade secrets in violation of Title 18, United States Code Section 1832. 12 . ,Case Documentl Filed 07/09/18 Page 14 of 15 44ng i. ERIC M. PROLTDFOOT Special Agent Federal Bureau of Investigation Sworn to before me this May of July, 2018 HONO BLE VIRGINTA K. United States Magistrate Judge 13 Case Document 1 Filed 07/09/18 Page 15 of 15 A0 257 (Rev. ens) DEFENDANT INFORMATION RELATIVE TO A CRIMINAL ACTION IN U.S. DISTRICT COURT BY: COMPLAINT El INFORMATION INDICTMENT SUPERSEDING w? OFFENSE CHARGED Count One: 18 U.S.C. 1832Iain I Theft ofTrade Secrets Petty Minor Misde- meanor Felony PENALTY: IOyears imprisonment, $250,000 fine, $100 special assessment, 3 years' supervised release PROCEEDING Name of Complaintant Agency, or Person Title, if any) Eric M. Proudfoot, FBI person is awaiting trial in another Federal or State Court, give name of court this personiproceeding is transferred from another district El per (circle one) 20, 21, or 40. Show District this is a reprosecution of charges previously dismissed which were dismissed on motion SHOW of DOCKET NO [3 us. ATTORNEY [j DEFENSE this prosecution relates to a pending case involving this same defendant MAGISTRATE prior proceedings or appearance(s) before U.S. Magistrate regarding this defendant were recorded under I3, CASE NO. Name and Of?ce of Person Furnishing Information on this form ALEX 6- TSE, Acting U.S. Attorney Other U.S. Agency Name of Assistant U.S. Attorney (if assigned) Amie D. Rooney PROCESS: SUMMONS NO WARRANT lf Summons, complete following: Arraignment El Initial Appearance Defendant Address: Comments: Name of District Court. andior JudgeiMagistrate Location NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION DEFENDANT - U.S . XIAOLANG ZHANG DISTRICT COURT NUMBER MAG 4" DEFENDANT IS NOTIN CUSTODY Has not been arrested, pending outcome this proceeding. I If not detained give date any prior summons was served on above charges Is on Bail or Release from (show District) JUL 09 2018 F'svsiin v. 500 we IS IN CUSTODY NORTHERN oIssArNgIgt??mc COURT CALIFORNIA I On this charge JOSEP- 2) Is a Fugitive 5) On another conviction Federal State 6) Awaiting trial on othercharges If answer to (6) is "Yes", show name of institution Has detainer El Yes giv??ejsate been ?led? No ?led DATE OF MonthiDay/Year ARREST July 7' 2018 it Arresting Agency Warrant were not DATE TRANSFERRED Montthay/Year TO U.S. CUSTODY ADDITIONAL INFORMATION OR COMMENTS DateiTime: This report amends A0 25? previously submitted Bail Amount: Where defendant pre viousty apprehended on compiaint. no new summons or warrant needed, since Magistrate has scheduted arraignment Before Judge: