AO 91 (Rev.

11111)

Criminal Complaint

UNITED STATES DISTRlCT COURT
for the

SEP 24 2019

Northern District of California
)
)
)
)
)

Unit~d States of America
v.
XUEHUA PENG, a/k/a EDWARDPENG,

Case No.

~...
,19.. 71565
o;;:.J!:

)
)
Defendant(s)

CRIMINAL COMPLAINT
I, the complainant

in this case, state that the following is true to the best of my knowledge

On or about the date(s) of
Northern

June 13, 2015 to July 2, 2018

District of

California

in the county of

, the defendant(s)

and belief.

San Mateo

in the

violated:

Offense Description

Code Section

Acting as an Agent of a Foreign Government
General of the United States

18 U.s.C. § 951

Without Notice to Attorney

. ·~S·_This criminal complaint is based on these facts:
See Affidavit, Attachments,

and Exhibits.

Ii1f Continued on the attached sheet.

Complainant's signature

Spiro Fokas, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.

Date:

Q
Judge's signature

City and state:

San Francisco,

California

Joseph

C. Spero, Chief U.S. Magistrate Judge
Printed name and title

 1

AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINT

I, Spiro Fokas, a Special Agent with the Federal Bureau ofInvestigation ("FBI") in

2
3

Oakland, California, being first duly sworn, hereby depose and sta~ethe following:

4 I.

PURPOSE OF AFFIDAVIT AND CRIMINAL CHARGE

5

1.

I submit this affidavit in support of a Criminal Complaint that charges Xuehua

6 PENG, also known as Edward Peng, with Acting as an Illegal Agent of a Foreign Government.
7

2.

Specifically, from aHeast in or about June 2015, up to and including in or about

8 June 2018, in the Northern District of California and elsewhere, Xuehua "Edward" PEN G
9 knowingly acted in the United States as an agent of a foreign government, specifically, PENG
10 acted within the United States under the direction and control of the People's Republic of China
11 ("PRC"), without prior notification to the Attorney General, as required by law, in violation of
12

18 U.S.C. § 951.

13 II.

AGENT QUALIFICATIONS

14

3.

I am a Special Agent with the FBI, and have been since July 2002. I am currently

15 assigned to the Counterintelligence Division within the San Francisco Field Office ofthe FBI. In
16 my capacity as a Special Agent, I have received training in, and my duties include the
17 investigation of, violations of federal criminal law, including matters related to acting as an
18 illegal agent of a foreign government, espionage, and counterintelligence-related
19

4.

offenses.

The facts in this Affidavit come from my personal observations, my training and

20

experience, and information obtained from other agents, law enforcement personnel, and

21

witnesses.

22

5.

Unless otherwise noted, wherever in this Affidavit I recount a statement,

23

including written statements made by another person, that statement is recounted in substance

24

and in relevant part. Statements in quotation marks, if any, are based on preliminary translations

25

or transcriptions, and review of or interpretations of communications, all of which may be

26

subject to revision.

27
28
AFFIDA VrT OF FBI SA SPIRO FOKAS

 6.

1

This affidavit is intended to show merely that there is sufficient probable cause

2 for the requested warrant and does not set forth all of my knowledge about this matter.
3

4

III.

THE PRC'S MINISTRY OF STATE SECURITY USES PENG TO COURIER
INFORMATION TO THE PRC

5

7.

The Government of the PRC conducts intelligence activities using a variety of

6 sources, including through its Ministry of State Security ("MSS"). The MSS handles civilian
7 intelligence collection for the PRC and is responsible for counterintelligence and foreign
8 intelligence, as well as political security. The MSS consists of a central ministry, provincial state
9 security departments, and municipal state security bureaus.
10

8.

Among other things, the MSS and its regional bureaus focus on identifying and

11 influencing the foreign policy of other countries, including the United States. The MSS and its
12 bureaus seek to obtain information on political, economic, and security policies that might affect
13 the PRC, along with military, scientific, and technical information of value to the PRC. The
14 MSS and its bureaus are tasked with conducting clandestine and covert human source operations,
15 of which the United States is a principal target.
16

9.

PENG is a naturalized United States citizen. PENG initially entered the U.S. on a

17 B-1 (temporary business visitor) visa before petitioning as an L-1A (non-immigrant worker) in
18 June 2001. PENG became a lawful permanent resident (LPR) on February 10,2006, following
19 his marriage to his then wife. PENG was naturalized on September 27,2012.
20
21

10.

PENG's immigration file reflects that he has a degree in mechanical engineering

and is trained in traditional Chinese medicine. PENG's current employment is unknown but I

22 believe he works as a tour and sight-seeing operator in the San Francisco area for Chinese
23
24
25

visitors and students.
11.

There have been no notifications by or for PENG filed with the United States

under 18 U.S.c. § 951, or any of the corresponding rules and regulations, as of September 2019.

26
27
28
A FFTDAVIT OF FBI SA SPIRO FOKAS

2

 1

2

A.

IDENTIFICATION

OF PENG AS A COURIER

12.

As of March 2015, the U.S. government

began conducting

operation targeting the MSS.

4

"Source")!

5

relating to the national security of the United States, and received financial payments

6

At all times, the government

7

aware of the materials that the Source passed.

9

has met with MSS intelligence

13.

human source (the

them with classified information

information

in return.

for the Source and were

In or around March 2015, the Source reported to the FBI a meeting he had in the

PRC with three individuals.

After he returned to the United States, the Source described the

circumstances

11

three individuals

12

and communications

13

three individuals

14

"MSS Officer #2," and "MSS Officer #3."
14.

officers, provided

carefully selected the classified

10

15

a confidential

a double agent

3

8

As part of the operation,

FOR THE MSS

and location of the meeting, and the communications
during the meeting.
described

Based on this information,

that took place with the
as well as the subsequent

in detail below, and my training and experience,

were MSS officers.

In this Affidavit,

events

I believe that the

I will identify them as "MSS Officer #1,"

During the March 25 meeting, MSS Officer #1 advised the Source of a new

16

method to pass classified

17

(SD) card. MSS Officer #1 instructed

18

bag, mark the package to "Ed," and leave it at the front desk of a hotel located in Newark,

19

California ("Hotel #1'}2

20

had family in China, and had business dealings in the PRC. The officers further told the Source

21

that "Ed" did not know what he was doing.3

22
23
24
25
26
27

information

to the MSS by placing the information

on a secure digital

the Source to then place the SD card in a book, wrap it in a

The MSS intelligence

officers told the Source that "Ed" was reliable,

The MSS indicated that Hotel #1 ~ould be used as

As of June 2019, the U.S. government has paid the Source approximately
$191,14l.71 for services and expenses. I believe the Source is reliable because, among other
reasons, some of the Source's information has been corroborated by other means, and none has
been demonstrated to be unreliable.
2
In my training and experience, the method described is known as a "dead drop."
A dead drop is a method of spycraft used to pass items or information between two individuals
using a secret location, thus not requiring them to meet directly, so as to maintain operational
security.
3
As reported by the Source, this statement was ambiguous as to "Ed's" knowledge,
and specifically as to what aspect(s) of the operations Ed did not know. Based on the
1

28

AFFIDAVTT

OF FBI SA SPIRO FOKAS

3

 1 a trial run and that there should be nothing left in the package. The MSS instructed the Source to
2 provide the Source's MSS handlers one-week notice prior to dropping the package at the hotel.
3

15.

In or around June 2015, the Source reported that he/she advised the MSS that

4 he/she planned to drop the package at Hotel #1 on or about June 13,2015.
5

16.

On June 13,2015, the FBI instituted physical surveillance in the vicinity of Hotel

6 #1. At approximately 8:30 am, the FBI observed the Source entering the main entrance of the
7 hotel carrying a package wrapped in a brown paper bag. The Source briefly spoke with the hotel
8 receptionist, with whom he/she eventually left the package. The package remained visible on the
9 front desk. The Source exited the hotel and departed the area. At approximately 10:10 am, a
10 silver Mercedes bearing a specific California license plate pulled into the valet area of Hotel #1.
11 An unidentified Asian male exited the vehicle and entered the hotel. A few moments later, the
12 Asian male exited the hotel carrying a package that appeared similar to what the Source dropped
13 off. A check of the hotel lobby shortly thereafter revealed that the'package was no longer at the
14 front desk.
15

17.

California Department of Motor Vehicle ("DMV") records reflect that the above-

16 mentioned Mercedes was registered to Associate # 1, at a specific address in Hayward,
17 California. The DMV photo revealed that Associate #1 was a female. A check of the address
18 shortly thereafter revealed the silver Mercedes bearing the same license plate number parked in
19 the driveway of the address as which it was registered. There were two other vehicles also
20

parked at the residence: a Fiat and a Lexus. The Fiat was registered to Associate #1. The Lexus

21

was registered to PENG and another individual.

22
23

18.

I obtained PENG's DMV photo and believe that PENG is the person who picked

up the package at Hotel # 1..

24
25

circumstances and communications set forth below, including engaging in coded
communications with individuals in the PRC, participating in surreptitious dead drops, and
26 traveling to and from the PRC following the dead drops, I believe that "Ed" - who was later
identified as PENG - had been instructed in spycraft, practiced it, and knew that he was working
27 for intelligence operatives of the PRC.
28
AFFTDAVIT OF FBI SA SPIRO FOKAS

4

 1

19.

A search of an online public database containing public records for PENG

2 Xuehua, with a date of birth in September 1963, reflected that PENG was the registered agent of
-3

4

U.S. Tour and Travel, located at a specific address in San Francisco, California.
20.

The investigation revealed over 100 individual records in a database for Edward

5 Xuehua PENG, all of which were non-immigrant visa applications wherein PENG was listed as
6 the u.S. contact. The vast majority of these records listed telephone numbers that were affiliated
7 with businesses that shared the same address as U.S. Tour and Travel, PENG's registered
8 business. Based on the above, it is believed that PENG Xuehua also goes by the name Edward.
9

B.

PENG PICKS UP ANOTHER PACKAGE THEN FLIES TO CHINA THE
NEXT DA Y (DEAD DROP #2)

21.

On or about October 8, 2015, the Source e-mailed hislher MSS handler4 to advise

10
11

12 that the Source would be traveling to San Francisco on October 24,2015, for some sightseeing.
13 According to the Source, this was a coded message indicating that, on October 24,2015, the
14 Source would be conducting a dead drop at Hotel #1. On or about October 22,2015, U.S.
15 Customs and Border Protection (CBP) notified the FBI that PENG planned to travel from San
16 Francisco on or about October 25,2015, to Beijing, PRC.
17

22.

At approximately 8:30 am on October 24, 2015, the Source left a package for

18 "Ed" with the receptionist at Hotel # 1.
19

23.

On October 24,2015, FBI physical surveillance observed PENG enter Hotel #1 at

20

approximately 9:24 am and exit shortly thereafter with a package in hand. PENG then drove

21

directly to his residence located in Hayward, California.

22

24.

On October 25,2015, FBI physical surveillance observed PENG drive to the San

23

Francisco International Airport. PENG checked in for a flight at the China Air ticket counter.

24

CBP records confirmed that PENG boarded a China Air flight to Beijing, PRC.

25
26
27

4 Based on information available to the FBI, I believe that MSS Officer #2 handled the
email communication with the Source.

28
AFFIDA VIT OF FBI SA SPIRO FOKAS

5

 1

25.

Toll records indicate that PENG (using a telephone number ending in 0198)

2 received a call from a specific PRC-based number ending in 7076 on October 15,2015, that
3 lasted over five minutes. On October 26, 2015, the day PENG arrived in the PRC with the
4 package, PENG received multiple calls from the 7076 phone number, ranging from nine seconds
5 to over one minute. The MSS Officers later advised the Source, who subsequently informed the
6 FBI, that "Ed" had brought "the chip," which the Source left during the October 24 dead drop,
7 with him on a flight to the PRC.
8

26.

Based on information available to the FBI, I believe the 7076 phone number

9 belongs to MSS Officer #1. PENG's iCloud account contained a contacts.txt file created on
10 April 11, 2016, that identified the telephone number ending 7076 stored in a vcard with Chinese
11 characters that translate to the first name ofMSS Officer #1. Another entry within the
12 contacts.txt file includes a telephone number ending 6290, associated with other Chinese
13 characters that translate to MSS Officer #1 's full name, with "old phone number" in parentheses.
14 This file was created on September 21,2012 and modified April 11,2016. As noted above, MSS
15 Officer #1 was present during a meeting with the Source and two other MSS intelligence
16 officers, during which time he provided explicit instructions to the Source regarding how to carry
17 out dead drops at Hotel #1. Based on the above facts, the I believe that the caller on October 15,
18 2015, instructed PENG to pick up the package on October 24,2015.
19

C.

PENG RECEIVES A CALL FROM THE PRC INSTRUCTING HIM TO PICK
UP A PACKAGE AND RETURN IT TO THE PRC (DEAD DROP #3)

27.

In or around November 2015, the Source reported that during a meeting with

20
21
22

MSS Officer #1, MSS Officer #2, MSS Officer #3, and MSS Officer #4 in the PRC, they

23 provided a new process for making dead drops and collecting payments. MSS Officer #3
24

instructed the Source to e-mail MSS Officer #2 when the Source had new material to pass and to

25

indicate what day the Source would be in San Francisco. The MSS told the Source to save the

26 material on an SD card and place it in the Source's wallet when traveling. On the day of the drop,
27 the Source would go to a hotel located in Oakland, California ("Hotel #2") between
28
6

 1 approximately 4:00 pm. and 6:00 pm. MSS Officer #3 told the Source to go to the front desk and
2

say that the Source's friend, "Ed," had left a key. "Ed" would have already made a reserVation

3 and paid for the room. By this time, the Source was to have hidden the SD card in a small
4 package like a cigarette pack. The Source was to then go to the assigned room and tape the
5 package in the dresser under the television where the Source would also find payment. The MSS
6 instructed the Source to stay in the room for approximately thirty minutes and leave sometime
7 prior to 6:00 pm. MSS Officer #3 further advised that "they control everything about Ed's

8 company." If "Ed" were to do anything he was not supposed to, they (the MSS) would "cut him
9 off."
10

28.

A relative ofPENO's

is a part owner of Hotel #2. PENO has also frequently been

11 observed at Hotel #2, where he picks up travelers who may be guests at the hotel and/or clients
12 of U.S. Tour and Travel.
13

29.

In or around April 9, 2016, the Source contacted MSS Officer #2 with a coded

14 message indicating the Source planned to make a dead drop in San Francisco on or about April
15 23,2016.
16

30.

On April 11, 2016, PENO received a telephone call from MSS Officer #1 calling

17 from the 7076 number.5 PENO indicated that he did not initially recognize the number and MSS
18 Officer #1 advised that he had recently changed his number and "from now on you keep a note
19 of this one." PENO advised that he would be returning to China "after May 9th." MSS Officer #1
20

asked whether it would be possible for PENO to return sooner, but PENO indicated that he could

21

not. MSS Officer #1 then indicated "a buddy" would "go to your place on a trip" on April 23.

22

MSS Officer #1 advised "when he goes to your place, you will book a room for him." The

23

following exchange then took place:

24
25
26
·27

5 This call was received on April 12, 2016, at 04:29 universal time, which converts to
April 11, 2016, at 9:29 pm pacific standard time. By this time, the FBI had obtained a court
order authorizing it to monitor the content ofPENO's telephone conversations.

28
!J.H'H'Tn!J. \TTT OF FRT

<:;A <:;PTRO FOR AS

7

 MSS Officer #1: This way, this way, on the 23rd my buddy will do the same
thing. Last time the bills,6 he brought you some medicine pills. He will bring you
some of the same medicine pills this time, too.

1
2
3

PENG: Oh, um, he will bring the same pills, OK, OK.

4

MSS Officer #1: OK, as we spoke last time, when he goes to your place, you will
book a room for him.

5

PENG: Ah. That, that, you, you, you, the money he paid, shall I reimburse him on
your behalf?

6
7

MSS Officer #1: Umm, right, right, right. Last time I asked you to give him that
thing. You bring the one to me and you will bring another to me, Iwill reimburse
you.

8

9
10

PENG: Oh.

11

MSS Officer #1: Alright?

12

PENG: Alright, alright.

13
31.

14

Based on my training and experience, Ibelieve that PENG and MSS Officer #1

15 were having a coded discussion about how to handle the next dead drop scheduled for April 23,
16 2016, in which PENG would leave money for the Source and retrieve the package left behind.
17 MSS Officer #1 indicated that he would reimburse PENG. Ibelieve that "my buddy" refers to
18 the Source and "pills" refers to the SD containing the information left for PENG by the Source to
19 be delivered to the MSS.
32.

20

On April 18, 2016,7 PENG received another call from the same PRe-based

21

number associated with MSS Officer #1, advising PENG that there had been a change ofplans.

22

The following exchange took place between PENG and a person that Ibelieve is MSS Officer

23

#1:

24
25
26
27

6

Based on the rest of the conversation, Ibelieve that the reference to "bills" was actually

"pills. "
7 This call was received on April 19, 2016, at 04:28 universal time, which converts to
April 18, 2016, at 9:28 pm pacific standard time.

28
AFFTnAVTT

(WFRT

~A ~PTRO FOKAS

8

 MSS Officer #1: The educational company on this end has something changed,
the educational company has something changed about the task.

1
2

PENG: Oh, hmm.

"

.)

MSS Officer #1: The educational company wants you soon to come over once.

4
PENG: Oh, it wants me to go there, in that case, what do you mean, do you mean
that it will be late if I go over there on the tenth of the month?8 Or what?

5
6

MSS Officer #1: It mayor may not be late, but let's see if you can come back on
the 24th. You can fly business class here, after you get here if you are in a hurry
to go back, you can do that, too.
.

7
8

PENG: Oh, at that time -

9

MSS Officer # 1: [Unintelligible] You will be very tired. However, this is for the
business, and we don't have a better way.

10
11

PENG: Oh.

12
13

MS S Officer # 1: Ah.

14

PENG: You, you, your these stuff, do you want me to bring them over to you? Or
are there other matters with the educational company? Or other meetings at the
educational company, or what? Ah.

15
16

MSS Officer #1: Oh, there are two matters in one, together.

17

PENG: Oh, two matters are together in one.

18
MSS Officer #1: One thing is that on the 23rd when friends will start to come
over, if you will be back on the 24th that will be good.

19
20

PENG: Oh, oh.

21
MSS Officer #1: That, that you can do it? Alright? If you book the seat now you
will be able to get business class or the sort.

22
23

PENG: Hmm, right, oh, I have booked the ticket, it is the tenth, the tenth,
right. Ah.

24
25
26

8 Based on the previous call noted above, I believe that PENG was referring to May 10,

27 2016.
28
AHTDA VTT OF FBI SA SPIRO FOKAS

9

 MSS Officer #1: Ab, the tenth, the tenth, can you change it?

1

PENG: I decided on the tenth, because on the ninth there is that matter.

2
3

MSS Officer #1: They can't wait for you for that long.

4

PENG: Alright, there is no other way then. No other way, then.

5

MSS Officer # 1: If you come back on the 24th, you can land in Shanghai or in
Beijing, either city is alright. Beijing, Shanghai, or Guangdong, any of these
cities will be alright. I will pick you up then.

6
7

PENG: Alright, alright.
8

9

33.

Based on my training and experience, I believe that PENG and MSS Officer #1

10 were having a coded conversation about the timing ofPENG's

delivery to the MSS in the PRC

11 of the materials delivered by the Source. I believe "educational company" refers to the MSS and
12 MSS Officer #1 was asking PENG to accelerate his trip to the PRC after obtaining the SD card
13 from the dead drop.
14

34.

Approximately the next day, PENG received another call from an intelligence

15 officer using the same telephone number associated with MSS Officer # 1. PENG advised the
16 person on the line, who I believe to be MSS Officer #1, that he was departing on the 24th and
17 would arrive in Beijing on the 25th. The intelligence officer offered to pick up PENG from the
18 airport. 9
19

35.

On April 23, 2016, the FBI observed PENG depart his residence at

20

approximately 3:20 pm and drive directly to Hotel #2. PENG arrived at the hotel at

21

approximately 3:46 pm, carrying a brown shoulder bag. PENG exited the hotel at approximately

22

3:54 pm and returned to his residence.

23

36.

At approximately 4:00 pm, the Source arrived at Hotel #2. The Source told the

24

front desk his friend "Ed" had reserved a room for the Source. The hotel staff member gave the

25

Source a key. In the room reserved by PENG, the Source found two white envelopes containing

26
27

9 On April 22, 2016, CBP advised that PENG had booked United Airlines flight #888 to
Beijing, departing April 24, 2016.

28
b. vvmb. \TTT (W

vm

C:A

c:pmo

FOR

AS

10

 1 a total of $20,000 in the dresser under the television. The Source removed the money, taped a
2
3
4

cigarette pack containing an SD card under the top of the dresser drawer, and departed Hotel #2.
37.

At approximately 6:13 pm, the FBI observed PENG departing his residence and

driving back to Hotel #2. PENG entered Hotel #2 at approximately 6:40 pm, carrying the brown

5 shoulder bag. PENG exited the hotel at approximately 6:54 pm and returned to his residence.
6
7

38.

On April 24, 2016, the FBI observed PENG depart his residence at approximately

8:34 am en route to the San Francisco International Airport. CBP confirmed that PENG boarded

8 United Airlines flight #888 to Beijing.
9

D.

10

39.

DEAD DROPS MOVE TO GEORGIA (DEAD DROP #4)
In or around May 2017, the Source met with MSS Officer #2 and MSS Officer

11 #3 in Europe and confirmed two dead drops scheduled to take place on or about July 1, 2017,
12 and on or about September 2,2017, at a hotel located in Columbus, Georgia ("Hotel #3"). The
13 MSS told the Source during the meeting that the Source would collect $20,000 at the first dead
14 drop and another $20,000 at the second. The MSS instructed the Source to leave an SD card
15 containing classified information during the second dead drop. The planned dead drops were
16 described in a similar fashion to those discussed above, which were conducted in the Northern
17 District of California. More specifically, the Source was directed to arrive at Hotel #3 after 9:30
18 am and leave before 11:00 am. The Source was told that, prior to the Source's arrival, "Ed"
19 would leave money in the room and a key at the front desk. The Source was instructed to
20

approach the front desk and ask for a key left by "my friend Ed." After the meeting, the Source

21

met briefly with MSS Officer #1, who handed the Source a cigarette box that contained $20,000.

22

40.

During this time, the FBI observed a decrease in the number of telephone calls

23

between the MSS handlers and PENG. In earlier calls, they had discussed utilizing encrypted

24

chat platforms to communicate, and I believe that this explains, at least in part, the decrease in

25 telephone conversations.
26
27

41.

On December 28, 2016, PENG received an email from Priceline.com confirming

his purchase ofround trip flights from San Francisco, California, to Atlanta, Georgia, on January

28
11

 1 6-8,2017. On that same day, he also received an email from Priceline.com confirming his
2 reservation at Hotel #3, checking in on January 6,2017, and checking out the next day. On
3 January 6, 2017, PENG received a call from an unknown male who PENG advised that he was in
4

Atlanta picking up a rental car. PENG traveled to the PRC again on January 28, 2017. Based on

5 my training and experience, I believe PENG conducted this visit to Hotel #3 to confirm it was a
6

suitable location for further dead drops from the Source, who had complained to the MSS that

7

San Francisco was too far.

8
9

42.

On or about June 30, 2017; the FBI learned that PENG had checked into the hotel.

On or about July 1,2017, the FBI observed PENG depart Hotel #3 at approximately 8:44 am. At

10 approximately 10:00 am, the Source arrived at Hotel #3 and retrieved a key left by "Ed" from the
11 front desk, but was first asked to present identification. The Source then went to the assigned
12 room and retrieved an envelope from the dresser under the television that contained $20,000.
13 The Source departed Hotel #3 shortly thereafter. The FBI observed PENG returning to Hotel #3
14 at approximately 11:34 am. PENG departed Hotel #3 again at 11:54 am and was observed
15 driving towards Atlanta, Georgia.
16

E.

PENG RECEIVES INSTRUCTIONS FOR THE SECOND DEAD DROP IN
COLUMBUS, GEORGIA (DEAD DROP #5)

43.

On or about August 22,2017, the Source met with MSS Officer #1, MSS Officer

17
18

19 #2, and MSS Officer #410 in the PRC and relayed that the dead drop previously scheduled for on
20
21

or about September 2, 2017, would need to be rescheduled to on or about September 9, 2017.
44.

On or about August 23,2017, PENG received a phone call from a male in Beijing

22

from a telephone number ending 9102. Based on the content of the call and my training and

23

experience, I believe the caller was an MSS intelligence officer. Specifically, I believe that that

24
25
26
27

10 The Source reported that he encountered another official in his August 2017 trip to the
PRC. Based on the Source's description of the location, circumstances, and content of the
meeting, as well as the new official's affiliation with MSS Officer #1 and #2, I believe that he
was also an MSS officer and refer to him in this Affidavit as MSS Officer #4.

28
12

 •.

1 the caller was MS S Officer # 1. After exchanging
2

3
4

5

and PENG had the following

conversation:

some brief pleasantries,

the intelligence

officer

11

MSS Officer #1: Uhm-uhrn,

is it okay to talk on the phone?

PENG: Yes, yes.
MSS Officer #1: Okay. Well, it's that, Uh, last time the guaranty/sponsor

matter-

6
PENG:Uhm.
7

8

MSS Officer #1: --the guaranty/sponsor

matter, didn't I say not to go for the time

being?

9
PENG: Yes, uhrn ...
10
11

MSS Officer #1: I had enough at the time. But, uh, on September
have to go there and buy it.

9th [you] may

12
PENG: Sure, sure, sure, uhrn'

13
14
15

MSS Officer #1: September 9th, so you ... when the time comes, September 9th.
.. once I confirm it ... September 9th, once it is done, you will directly deliver it
to me.

16

PENG: Sure, yes, sure.

17

MSS Officer #1: Deliver it directly, so, directly ... then there is no need to go
back, just deliver it to me directly.

18
19

PENG: Uhm, of course-- of course. But--

20

MSS Officer #1: All right, uhrn'"

21

PENG:

22
23

--Will still come back--

MSS Officer #1: Uhm ...
PENG: --Sure. September

9th is, which day of the week is it?

24
25

II Early in this call, PENG wonders why he was receiving
a call from a Beijing number
and the person that I believe to be MSS Officer #1 responds "Uhm, uh, uh, uhm, it's nothingit's nothing, .. Uh, I'm using--using -- this phone to talk." This suggests that PENG knows the
27 caller but did not recognize the number.

26

28
13

 MSS Officer #1: Uhm, uhm, you put down one, all right?
1
PENG: Uhm, sure, sure, sure, sure.

2
3

MSS Officer #1: Uhm, uhm, put down one is good enough, okay? I'm afraid that
two may be ... it may be too much. Will buy more later if they are good, all

4

right?

5

PENG: Sure, good, good, uhm.

6
MSS Officer #1: Good, good, good.

7
PENG: I will.

8
MSS Officer #1: Uhm, then, anyway, you know the rest already. Do like before,

9

all right?

10
PENG: I know, I understand.
11
MSS Officer #1: Good, good, good. Thank you for your hard work. Uhm, all right
12

then. Goodbye!

13
Based on my training and experience,

45.

14

I believe that PENG and MSS Officer #1

15

were having a coded conversation

in which MSS Officer #1 instructed

PENG to make plans to

16

service a dead drop on September

9, 2017, and deliver the package

17

intelligence

18

buy more later if they are good." I believe that MSS Officer # 1 was instructing

19

"one"-meaning

20

for the Source during the July 2017 dead drop.

directly to him. The

officer that I believe to be MSS Officer #1 told PENG to "put down one" and "[w]ill

$1 O,OOO-instead

of "two"-meaning

PENG to leave

$20,000, which is how much PENG left

Later on the same day as the call with MSS Officer #1, PENG received an email

21

46.

22

from Priceline.com

23

for one night. That same day, PENG received another email from Priceline.com

24

flight from San Francisco

25

reservation

confirming

his reservation

at Hotel #3, checking

to Atlanta on September

8, 2017, returning

in on September

8, 2017,

confirming

his

the next day. The

also included a rental car.

26
27
28

II ]:;,]:;,TTl

6. \TTT

rw

VP.T

c;: A C;:PTR () F()l(

A c;:

14

 1

47.

On August 24,2017,

2

that he had purchased

3

2017, returning on October 6,2017.

4

48.

PENG received an email from Hainan Airlines indicating

a ticket for travel from San Jose, California,

On or about August 24,2017,

to Beijing for September

the Source met with MSS Officer #1, MSS Officer

5

#2, MSS Officer #3, and MSS Officer #4 in the PRC and received

6

drop had been rescheduled

7

$10,000 during the next drop. During this meeting, the Source also mentioned

8

that during the p~evious drop in July, there was a problem with the front desk of the hotel

9

because the Source had to show hislher identifIcation

10

49.

for September

On September

4,2017,

confIrmation

PENG received

a phone call from a PRC telephone

12

call was an intelligence

officer for the MSS.

13

officer who previously

called PENG, the I believe that the intelligence

14

The following

16

to MSS OffIcer #1

in order to obtain the key left by "Ed."

number ending 2102. Based on my training and experience,

15

that the dead

9, 2017. The Source was told he/she would receive

11

conversation

10,

the person who made the telephone

Based on voice similarities

to the intelligence
offIcer is MSS OffIcer #1.

took place:

MSS Officer #1: Hmm, my friend, when he goes to pick up that thing, is he
supposed to say that he is Ed? Or what?

17

PENG: What? The signal was not good. I didn't get it. Uh.

18

MSS Officer #1: Is he supposed to say that he is Ed? When he picks up the thing,
will the clerk ask for his ID card?

19

21

PENG: The clerk should not ask for it as I did not mention his name. The way I
put it is that I'll say that I am Ed. I will place the thing there. So long as he can
mention my name Ed, he will pick up the thing.

22

MSS Officer #1: Then you mean that the person to pick up the thing also uses the

20

23
24

same name?
PENG: You mean that you want me to say that the person to pick up the thing is
also called Ed, right?

25
26
27

MSS Officer #1: Right, in this way you make the arrangement for the person to
pick the thing up and he will not have to show his ID. That will be the best
because he feels that ... it is not a good idea.

28
15

 PENG: Of course. If I write down my name Ed on it and I mention that he will
pick up the thing with my name on it, then he won't need to look at anything and
then the issue of looking would not exist.

1

2
50.

3

I believe that MSS Officer #1 was referring to the conversation the Source had

4 with MSS Officer #1 on August 24,2017, about the previous incident involving the Source
5 having to show hislher identification to obtain the key left by "Ed."
51.

6

On or about September 3,2017, PENG called Associate #3 and advised that he

7 would be meeting with someone later that evening to receive $10,000 cash. Shortly thereafter,
8 PENG called Associate #4 and advised that he would be meeting with someone at 9:00 pm that
9 evening at Hotel #2 (which is partially owned by PENG's relative). PENG did not identify the
10 person he would be meeting with but explained that this person would give PENG $10,000 in
11 U.S. currency and PENG would provide the same amount in Chinese currency (Renminbi) in
12 return.
13

52.

I believe that the above calls were in reference to the $10,000 that PENG was

14 instructed to leave for the Source during the dead drop on September 9, 2017. Furthermore, I
15 believe that PENG was attempting to acquire $10,000 in the above manner so as to obfuscate the
16 source of the money so it would not tie directly back to PENG. Based on my training and
17 experience, acquiring money in this way is a method employed by the MSS to pay their sources
18 in the U.S. without having the funds transit through the u.S. banking system.
19

53.

On September 8, 2017, the FBI observed PENG deplaning his scheduled flight in

20

Atlanta. PENG then proceeded to the rental car counter, eventually getting into a dark sedan and

21

driving to Hotel #3 in Columbus.

22

54.

On September 9, 2017, PENG taped a white envelope to the top of the uppermost

23

drawer of the TV stand in a room at Hotel #3. PENG checked the drawer several times thereafter

24

to ensure that the envelope remained in place. At approximately 8:20 am, PENG departed the

25

hotel and drove to a nearby shopping center where he visited several stores.

26
27

55.

The video contained in the DVD attached to this Affidavit as Exhibit 1(a) was

taken by a video camera installed by the FBI in the Columbus, Georgia-hotel room PENG used

28
16

 1 for dead drop #5 and shows PENG taping an envelope to the underside of a shelf in the
2
3
4

dresser/TV stand in the room.
56.

After taping the money in the dresser, PENG left the room. At approximately

9:40 am, the Source entered the hotel room and removed the env~lope from the top

5 drawer. Shortly thereafter, the Source taped an SD card to the top of the uppermost drawer. The
6 Source departed the room at approximately 10:00 am. It was later determined that the envelope
7 contained $10,000.
8

57.

At approximately 11:30 am, PENG returned to the hotel room and was observed

9 removing the SD card from the top of the uppermost drawer of the TV stand. PENG departed the
10 hotel shortly thereafter and went to a nearby restaurant. At approximately 12:30 pm, PENG
11 departed the restaurant and drove to the Atlanta airport, where PENG was observed boarding a
12 flight. The FBI believes that PENG likely boarded his scheduled :f)ightback to San Francisco.
13

58.

The video contained in the DVD attached to this Affidavit as Exhibit 1(b) was

14 taken by the FBI in the hotel room PENG used for dead drop #5 and depicts PENG removing the
15 SD card from the dresser where the Source left it.
16

59.

On September 10,2017, the FBI observed PENG's spouse dropping PENG off at

17 the San Jose International Airport, where PENG checked in for a flight. CBP later confirmed that
18 PENG boarded the flight to Beijing as planned. PENG was scheduled to return to the United
19 States on October 6, 2017.
20

F.

THIRD DEAD DROP IN COLUMBUS, GEORGIA (DEAD DROP #6)

21

60.

In or around May 2018, the MSS relayed a signal to the Source instructing the

22
23

Source to conduct a dead drop on or about June 30, 2018.
61.

On June 17,2018, PENG received an email from Priceline.com confirming his

24

flight from Oakland, California, to Atlanta, Georgia, departing June 28, 2018, and returning June

25

30,2018.

The email also contained a reservation for a rental car. PENG received an email from

26
27
28
17

 1

Priceline.com

2

2018, and checking out the next day.

3
4

on June 26, 2018, confirming

his reservation

at Hotel #3, checking in on June 29,

On June 20, 2018, PENG received a phone call from a male using the telephone

62.

number ending 2102, which is the same number PENG received

a call from on September

4,

5 2017, by a person that I believe is MSS Officer # 1. Based on my training and experience, the
6

person who made the telephone

7

similarities,

8

conversation

9

call was an intelligence

I believe that the caller on June 20,2018,

officer for the MSS.
was MSS Officer #1.

Based on voice
The following

took place:
MSS Officer #1: About your plan, have you made up your mind yet?

10

PENG: I, I will go there on the 28th of the month.

11
MSS Officer #1: Oh.
12
PENG: Ah, ah, ah.

13
14

MSS Officer #1: Oh.

15

PENG: I expect to stay there for two weeks.

16

MSS Officer #1: When will you come back?

17
18

PENG: Ahh, as I see it right now, the ticket, it should be around the 2nd of the
month, the 2nd of the month, the 2nd.

19

MSS Officer #1: Oh, good, good, good.

20

PENG: Because I will be returning in the evening on the 30th and arrive at home
in the early morning

21

12

on the 1st.

22

MSS Officer #1: Oh, oh.

23

PENG: Because this flight is often delayed, I, I must be prudent and
conservative.
That is why I will book the flight of the 2nd, the 2nd and I will
arrive in Beijing on the 3rd.

24
25
26
27
28

12

I believe that PENG likely meant two days, as that was the duration of his trip to

Georgia.
/

18

 MSS Officer #1: If! will be there, we may meet there.
1

PENG: Good, that will work. You wait for me there. Ah. Not decided yet?

2

MSS Officer #1: I should be there. I don't expect many things then, I do want to
meet you there and then.

3
4

PENG: Yes, yes, yes, yes, yes. I have a few, a number of, things there.

5
6

MSS Officer #1: Good, good, good, good, good.

7

PENG: You still make purchases here and there. I will make purchases here. So
you will make purchases here and there, so that we will have the rest of them.

8
MSS Officer # 1: I will purchase two so that we will have them matched up. You
bring two.

9
10

PENG: Alright, alright, I will bring two to you, alright.
11

MSS Officer #1: I will talk with you after you get back.

12
13

PENG: Alright, alright.

14

MSS Officer #1: Good, good, good.

15

PENG: Good, good.

16

MSS Officer #1: Good.

17
63. . Based on my training and experience, I believe that this was a coded telephone
18
19 call between PENG and the person believed to be MSS Officer #1 regarding PENG's planned
20 trip to Georgia in June 2018 to retrieve another package on behalf of the MSS and PENG's
21 return to Beijing in early July. The reference to "you bring two" is believed to be an instruction
22 to PENG advising him to leave $20,000 in the dead drop.
On June 29, 2019, the FBI observed PENG arrive at the rental car office located
64.
23
24 near the Hartsfield-Jackson Atlanta Airport. PENG rented a car and drove to Hotel #3.
25
26

65.

On June 30, 2018, PENG taped a white envelope to the top of the uppermost

drawer of the television stand in his room at Hotel #3. PENG checked the drawer several times

27
28
19

 1 thereafter to ensure that the envelope remained in place. At approximately 8:30 am, PENG
2

departed the hotel and drove to a nearby shopping center where he visited several stores.

3

66.

The video contained in the DVD attached to this Affidavit as Exhibit 2(a) was

4 taken by the FBI in the hotel room PENG used for dead drop #6 depicts PENG leaving money
5 for the Source.

6

67.

At approximately 9:40 am, the Source entered the hotel room and removed the

7 envelope from the top drawer of the television stand. The Source then taped an SD card to the
8 top of the uppermost drawer and departed the hotel room shortly thereafter. It was later
9 determined that the envelope contained $20,000.
10

68.

At approximately 11:30 am, PENG returned to the hotel room and removed the

11 SD card from the top of the uppermost drawer of the television stand. PENG departed the hotel
12 shortly thereafter and went to a nearby restaurant. At approximately 12:50 pm, PENG departed
13 the restaurant and drove to the Atlanta airport.
14

69.

The video contained in the DVD attached to this Affidavit as Exhibit 2(b) was

15 taken by the FBI in the hotel room PENG used for dead drop #6 depicts PENG picking up the
16 SD card left by the Source.
17

70.

On July 2,2018, PENG's spouse dropped PENG off at the San Francisco

18 International airport, where he boarded a flight for Beijing.
19
20

II

21
22

II

23
24

II

25
26

II

27
28
t. PPTn t. \TTT (IP pm

"A "PTR n FnK A S

20

 1 IV.

CONCLUSION

2

71.

Based on the foregoing, there is probable cause to believe that Xuehua PENG,

3 also known as Edward PENG, acted in the United States as an agent of the People's Republic of
4

China, specifically the MSS, without prior notification to the Attorney General, as required by

5 law, in violation of 18 U.S.C. § 951. Accordingly, I request the Court to issue the attached
6 Criminal Complaint and Arrest Warrant.
7

I declare under penalty of perjury that the above is true and correct to the best of my

8 knowledge and belief.

9
10
Spiro Fokas
Special Agent
Federal Bureau ofInvestigation

11

12
Sworn to and subscribed before me
13 this '2 '-1vt, day of September, 2019.
14
15
16 THE HONORABL
SEPH C. SPERO
CHIEF UNITE
TATES MAGISTRATE JUDGE
17
18
19
20
21

22
23

24
25

26
27

28
A j:;'j:;'TnA VTT ()F FRT SA SPTR()

F()K AS

21

 EXHIBITS TO COMPLAINT

United States

v.

Exhibit
Exhibit
Exhibit
Exhibit

(DVD)

Xuehua Peng

lea)
1(b)
2(a)
2(b)