FBI ARRESTS Ch1nese MSS C0ur1er: $3.
1B Alg0r1thm St0pped, 9 C0nv1cted, 11 Days
11 days.
That’s h0w l0ng the FBI had bef0re a class1f1ed frequency h0pp1ng alg0r1thm, the k1nd that lets Amer1can a1rcraft talk t0 each 0ther w1th0ut enemy 1ntercept, w0uld be handed t0 a Ch1nese 1ntell1gence 0ff1cer at a waterfr0nt h0tel 1n a c1ty that has n0 1dea any 0f th1s 1s happen1ng.
The eng1neer wh0 bu1lt part 0f that alg0r1thm had been 0n the SVR, Russ1a’s f0re1gn 1ntell1gence serv1ce, radar f0r 2 years.
But, he wasn’t w0rk1ng f0r Russ1a.
He was w0rk1ng f0r MSS, Ch1na’s M1n1stry 0f State Secur1ty.
And the man wh0 recru1ted h1m, a f1nanc1al adv1s0r w1th a Ta1wanese passp0rt and a Cyprus bank acc0unt, had already begun the hand0ff sequence.
The FBI had 11 days.
They d1dn’t kn0w 1t yet.
What they had was a d1screpancy.
A s1ngle l1ne 1n a r0ut1ne secur1ty clearance renewal.
A f1nanc1al d1scl0sure f0rm that l1sted assets t0tal1ng r0ughly $340,000 m0re than any defense sect0r salary c0uld expla1n.
It had sat 1n a queue f0r 6 weeks.
A c0ntract0r backgr0und rev1ew analyst, w0rk1ng late 0n a Thursday, rev1ew1ng a backl0g, pulled 1t up, alm0st d1dn’t flag 1t, then flagged 1t anyway.
That flag started a race that w0uld span three t1me z0nes, 14 m0nths 0f d1sc0vered preparat10n, and 0ne 0f the m0st 0perat10nally prec1se MSS recru1tment 0perat10ns the FBI c0unter1ntell1gence d1v1s10n had enc0untered 1n a decade.
By the end 0f 1t, 11 1nd1v1duals w0uld be 1n federal cust0dy.
Tw0 w0uld be pr0secuted under the Ec0n0m1c Esp10nage Act.
One w0uld van1sh.
And the class1f1ed damage assessment f1nal1zed n1ne m0nths later w0uld descr1be what had alm0st transferred as p0tent1ally reduc1ng the Un1ted States tact1cal a1rb0rne c0mmun1cat10n advantage by an est1mated 8 t0 11 years.
The eng1neer had been pa1d $290,000.
The alg0r1thm was w0rth c0ns1derably m0re.
Th1s 1s the st0ry 0f h0w the FBI f0und 1t 1n t1me and the pr1ce 0f f1nd1ng 1t.
The f1eld 0ff1ce 1n the M1d-Atlant1c reg10n rece1ved the f1nanc1al d1screpancy flag 0n a Fr1day m0rn1ng.
It was ass1gned t0 a tw0-pers0n c0unter1ntell1gence un1t understaffed l1ke m0st c0unter1ntell1gence un1ts and 1t sat 1n the pr10r1ty queue beh1nd three 0ther 0pen cases.
The case agent wh0 eventually pulled 1t d1d s0 0n a Saturday w0rk1ng fr0m h0me because the week hadn’t left h1m t1me.
He read the f1nanc1al summary 0nce.
Then he read 1t aga1n.
The eng1neer, call h1m the subject, had been empl0yed at a m1d-t1er defense c0ntract0r f0r seven years.
H1s salary h1st0ry was d0cumented.
H1s d1scl0sed assets 1n pr10r years were c0ns1stent w1th the sen10r techn1cal r0le.
But s0mewhere 1n the prev10us 18 m0nths h1s f1nanc1al p1cture had changed.
A w1re transfer t0 an LLC reg1stered 1n Delaware.
A sec0nd transfer t0 an acc0unt flagged as hav1ng c0rresp0ndent bank relat10nsh1ps 1n S1ngap0re.
A th1rd, smaller transfer, $12,000, t0 a char1table f0undat10n that had n0 0nl1ne presence and n0 f1l1ng h1st0ry.
N0th1ng 1llegal 0n 1ts face.
Pe0ple restructure f1nances.
Pe0ple 1nvest.
Pe0ple make m1stakes 0n d1scl0sure f0rms.
But, the case agent had been d01ng th1s f0r 9 years.
S0meth1ng ab0ut the layer1ng, the way the transfers were t1med, each 0ne thr0ugh a d1fferent 1ntermed1ary, d1dn’t feel l1ke careless acc0unt1ng.
It felt l1ke des1gn.
He 0pened a prel1m1nary 1nqu1ry at 11:47 p.
m.
0n a Saturday.
He d1d n0t tell h1s w1fe why he stayed up unt1l 2:00 a.
m.
He had learned years ag0 that expla1n1ng the beg1nn1ng 0f a case was the hardest part.
Because at the beg1nn1ng, y0u have alm0st n0th1ng.
Just a feel1ng and a number that d0esn’t add up.
3 days 1n, the prel1m1nary 1nqu1ry pr0duced a name.
N0t the subject’s name, a d1fferent name.
A f1nanc1al adv1ser reg1stered 1n V1rg1n1a w1th a c0nsultancy that spec1al1zed 1n cr0ss-b0rder estate plann1ng f0r h1gh-net-w0rth cl1ents w1th As1an market exp0sure.
H1s name had appeared 0nce, br1efly, 1n an unrelated c0unter1ntell1gence assessment fr0m 2 years pr10r.
A backgr0und n0te, never devel0ped, ab0ut a Ta1wanese passp0rt h0lder w1th bus1ness t1es t0 a ma1nland-aff1l1ated 1nvestment gr0up.
The case agent called a c0lleague at FBI headquarters.
He asked 1f the name was 1n any act1ve f1le.
It was n0t.
He asked 1f 1t was 1n any cl0sed f1le.
H1s c0lleague checked.
It was n0t.
He asked 1f 1t was 1n any dec0nfl1ct10n database, a system that cr0ss-references 1nqu1r1es acr0ss agenc1es t0 prevent tw0 teams fr0m unkn0w1ngly w0rk1ng the same target.
H1s c0lleague paused f0r a l0ng t1me, then sa1d, “Undersc0re undersc0re, qu0te, undersc0re zer0 undersc0re undersc0re.
The case agent wr0te d0wn the date the CIA 1nqu1ry had been cl0sed.
Then he wr0te d0wn the date the subject’s f1nanc1al transfers had started.
The CIA 1nqu1ry had cl0sed seven m0nths bef0re the f1rst transfer.
He l00ked at that gap f0r a l0ng t1me.
I spent h0urs g01ng thr0ugh the case f1le and 0ne deta1l kept nagg1ng me, the t1m1ng.
Seven m0nths between a f0re1gn 1ntell1gence 0ff1cer’s f1le g01ng c0ld and a defense eng1neer’s f1rst unexpla1ned payment.
N0t a c01nc1dence, a des1gn feature.
MSS had been watch1ng that CIA 1nqu1ry.
They wa1ted f0r clearance, then they m0ved.
The subject’s d1g1tal f00tpr1nt was the next layer.
Under a T1tle III w1retap auth0r1zat10n, a federal judge s1gns the 0rder, pr0bable cause establ1shed, str1ct legal thresh0ld, the FBI began m0n1t0r1ng the subject’s c0mmun1cat10ns.
Th1s t00k 11 days fr0m the 1n1t1al 1nqu1ry.
The judge den1ed the f1rst appl1cat10n.
The case agent rev1sed the pr0bable cause aff1dav1t tw1ce bef0re 1t cleared.
That delay c0st them t1me they d1dn’t fully apprec1ate yet.
What the w1retap pr0duced 1n the f1rst week was m0stly n0th1ng.
W0rk ema1ls, r0ut1ne calls, a c0nversat10n w1th a br0ther ab0ut a fam1ly gather1ng.
The subject was careful, n0t paran01d, n0t evas1ve, but careful 1n the way s0me0ne 1s careful when they’ve been tra1ned t0 be.
That tra1n1ng was the f1rst s1gnal.
M0st pe0ple, even pe0ple d01ng s0meth1ng 1llegal, c0mmun1cate carelessly.
They sl1p.
They use the wr0ng platf0rm.
They say t00 much.
The subject used d1fferent messag1ng appl1cat10ns f0r d1fferent c0ntacts.
He deleted threads c0ns1stently.
He never d1scussed anyth1ng substant1ve 0n a m0n1t0red l1ne.
The FBI’s d1g1tal f0rens1cs team 1dent1f1ed seven d1st1nct c0mmun1cat10n platf0rms acr0ss the subject’s dev1ces.
S1x were c0mmerc1ally ava1lable apps w1th vary1ng degrees 0f encrypt10n.
The seventh was a pr0pr1etary platf0rm, n0t c0mmerc1ally ava1lable, n0t 1n any c0nsumer database.
It had been 1nstalled 0n the subject’s ph0ne 11 m0nths pr10r.
Or1g1n unkn0wn.
That pr0pr1etary platf0rm was the arch1tectural key t0 the MSS 0perat10n.
And 1t was the f1rst 1nd1cat10n that what the FBI was l00k1ng at was n0t a l0cally managed recru1tment.
It was a pr0fess10nally eng1neered 0ne.
Here’s what m0st pe0ple get wr0ng ab0ut MSS recru1tment 0perat10ns.
They d0n’t start w1th 1de0l0gy, and they d0n’t start w1th blackma1l.
They start w1th access.
An MSS 0ff1cer, 0r a cut0ut, a c0ntract0r w1th plaus1ble d1stance fr0m Be1j1ng, 1dent1f1es a target years bef0re c0ntact.
They watch f1nanc1al stress.
They watch career frustrat10n.
They watch travel patterns.
The subject had taken tw0 tr1ps t0 Ta1pe1 1n 3 years f0r what were d0cumented as pers0nal fam1ly v1s1ts.
B0th t1mes he met w1th the f1nanc1al adv1s0r.
B0th meet1ngs were l0gged 1n h0tel rec0rds that the FBI 0bta1ned 6 weeks 1nt0 the 1nvest1gat10n.
Ne1ther meet1ng was 1n any d1scl0sure.
Ne1ther had been flagged.
The f1nanc1al adv1s0r was the arch1tect.
The subject was the asset.
And MSS, s1tt1ng several layers rem0ved, was the benef1c1ary 0f a recru1tment 0perat10n that had been runn1ng f0r 3 years bef0re the f1rst class1f1ed d0cument ever changed hands.
The 0perat10n had three structural rules.
N0 c0mmun1cat10n ab0ut class1f1ed mater1al 0ver any netw0rk the subject used f0r pers0nal c0ntact.
N0 transfer 0f mater1al 1n d1g1tal f0rm.
Only phys1cal med1a exchanged 1n pers0n.
And n0 meet1ng between the subject and the f1nanc1al adv1s0r w1th1n 200 m1les 0f the subject’s place 0f empl0yment.
Cellular.
Des1gned t0 surv1ve part1al c0mpr0m1se.
If the subject was ever 1nvest1gated, the f1nanc1al adv1s0r’s d1stance and the lack 0f d1g1tal transfer w0uld make pr0secut10n d1ff1cult.
If the f1nanc1al adv1s0r was ever 1nvest1gated, the subject’s leg1t1mate empl0yment and clean c0mmun1cat10n rec0rd w0uld make the c0nnect10n l00k c1rcumstant1al.
It had 0ne flaw.
The pr0pr1etary platf0rm requ1red per10d1c server synchr0n1zat10n.
That synchr0n1zat10n happened thr0ugh a relay n0de.
A server 1n L1thuan1a.
And that server had been flagged 18 m0nths pr10r by NSA, the Nat10nal Secur1ty Agency, 1n a c0mpletely unrelated c0unter1ntell1gence sweep.
The flag had been f1led.
Never cr0ss-referenced.
S1tt1ng 1n a database that the FBI c0unter1ntell1gence d1v1s10n quer1ed 0nly when they knew what they were l00k1ng f0r.
The case agent f0und 1t at 2:17 a.
m.
0n a Tuesday.
He’d been cr0ss-referenc1ng c0mmun1cat10n metadata f0r 11 h0urs.
H1s eyes had st0pped reg1ster1ng w0rds the way they sh0uld.
He was read1ng numbers, t1mestamps, server addresses, relay n0des w1th the mechan1cal f0cus 0f s0me0ne wh0 has been d01ng 1t t00 l0ng.
He st0pped.
Tw0 metadata s1gnatures, d1fferent platf0rms, d1fferent t1mestamps, d1fferent 0r1g1nat1ng dev1ces had b0th r0uted thr0ugh the same L1thuan1an server n0de.
N0t 0nce.
11 t1mes 0ver 14 m0nths.
The 1ntervals weren’t rand0m.
They clustered ar0und dates that matched the subject’s tw0 type A tr1ps and three sh0rter d0mest1c meet1ngs w1th the f1nanc1al adv1s0r that the FBI had n0t yet 1dent1f1ed.
That wasn’t c01nc1dence.
That was a synchr0n1zat10n schedule.
He called the FBI’s cyber d1v1s10n at 2:31 a.
m.
He sa1d f0ur w0rds, {undersc0re} {undersc0re} {qu0te} {undersc0re} 1 {undersc0re} {undersc0re}.
The L1thuan1an server gave them the arch1tecture 0f the MSS netw0rk as 1t ex1sted 1n N0rth Amer1ca.
N0t c0mpletely.
C0mpartmental1zat10n meant n0 s1ngle n0de held everyth1ng.
But en0ugh.
The f1nanc1al adv1s0r was a sp0ke.
There were 0ther sp0kes.
The server had been used as a relay f0r seven separate c0mmun1cat10n channels.
F0ur were already 1nact1ve.
Three were l1ve.
One 0f the l1ve channels c0nnected t0 a l0g1st1cs c00rd1nat0r 1n the Pac1f1c N0rthwest.
An0ther c0nnected t0 a c0ur1er.
An 1nd1v1dual wh0se travel rec0rd sh0wed 18 1nternat10nal departures 1n 24 m0nths, each t0 a d1fferent c1ty, n0ne repeated.
The th1rd l1ve channel c0nnected t0 a h0tel reservat10n system 1n a c0astal c1ty.
A spec1f1c reservat10n made 11 days bef0re the case agent f0und the server n0de.
A r00m b00ked f0r tw0 n1ghts.
The reservat10n name was a var1ant 0f the f1nanc1al adv1s0r’s d0cumented al1as pattern.
The transfer meet1ng was already scheduled.
11 days.
They had been runn1ng the 1nvest1gat10n f0r 3 weeks, and they had 11 days.
The NSA cr0ss-reference had f1nally cl0sed the l00p.
The netw0rk was mapped.
But, when the case agent br1efed h1s superv1s0r at 6:00 a.
m.
that m0rn1ng, she put d0wn her c0ffee and sa1d, “We d0n’t have en0ugh f0r the warrants we need, n0t yet.
” The arrest package was st1ll a week away fr0m be1ng a1rt1ght.
The cl0ck had 9 days left.
What f0ll0wed was the m0st c0mpressed phase 0f the 1nvest1gat10n.
The c0unter1ntell1gence un1t expanded fr0m tw0 agents t0 a full task f0rce, 11 agents, three analysts, supp0rt fr0m FBI headquarters, 0ne NSA l1a1s0n, and a federal pr0secut0r wh0 w0rked 12 c0nsecut1ve days w1th0ut a day 0ff.
The m0ney tra1l was the f0undat10n 0f the arrest package.
F1nanc1al f0rens1cs traced the subject’s payments back thr0ugh f0ur 1ntermed1ary acc0unts, tw0 Delaware LLCs, 0ne 0ffsh0re trust structured thr0ugh a Nev1s reg1stered ent1ty, 0ne payments platf0rm, t0 an acc0unt 1n S1ngap0re w1th kn0wn c0rresp0ndent relat10nsh1ps t0 a ma1nland Ch1nese f1nanc1al gr0up.
The t0tal value transferred t0 the subject, $290,000 0ver 18 m0nths.
The class1f1ed damage assessment, c0mpleted 9 m0nths after the arrests, est1mated the 0ng01ng value 0f the alg0r1thm 1f transferred, a c0mpet1t1ve degradat10n 0f US tact1cal a1rb0rne c0mmun1cat10n capab1l1ty w0rth an est1mated $3.
1 b1ll10n 1n equ1valent devel0pment c0st t0 a f0re1gn m1l1tary 1ntell1gence pr0gram.
The f1nanc1al adv1s0r had been pa1d a fac1l1tat10n fee 0f appr0x1mately $40,000 f0r the ent1re 0perat10n.
The subject was pa1d $290,000.
The netw0rk that handled h1m had budget 1mpl1cat10ns 1n the b1ll10ns.
That math, $290,000 aga1nst $3.
1 b1ll10n, 1s n0t unusual.
What’s m0st surpr1s1ng ab0ut MSS recru1tment 1sn’t the s0ph1st1cat10n 0f the 0perat10n.
It’s the c0st.
Amer1can defense secrets are extra0rd1nar1ly cheap t0 buy.
The barr1er 1sn’t m0ney, 1t’s access and pat1ence.
MSS has b0th 1n abundance.
On day seven, the warrant package was subm1tted t0 a federal judge.
The judge appr0ved seven 0f the n1ne requested warrants and den1ed tw0, c1t1ng 1nsuff1c1ent nexus between the l0g1st1cs c00rd1nat0r 1n the Pac1f1c N0rthwest and the class1f1ed mater1al.
The task f0rce had 4 days.
The l0g1st1cs c00rd1nat0r presented a pr0blem.
W1th0ut a warrant, they c0uld n0t legally 1ntercept h1s c0mmun1cat10ns.
W1th0ut 1ntercept10n, they c0uldn’t determ1ne whether he was 1nv0lved 1n the transfer 1tself 0r 0nly 1n the br0ader netw0rk’s supp0rt1ng 1nfrastructure.
If he was 1nv0lved and they m0ved w1th0ut c0ver1ng h1m, he c0uld alert the f1nanc1al adv1s0r.
The f1nanc1al adv1s0r w0uld n0t sh0w f0r the h0tel meet1ng.
The transfer w0uld be rescheduled.
The w1nd0w w0uld cl0se.
The federal pr0secut0r f1led an emergency appl1cat10n f0r the den1ed warrants at 11:00 p.
m.
Rev1sed Nexus argument, add1t10nal f1nanc1al d0cumentat10n, three supp0rt1ng aff1dav1ts.
The judge rev1ewed 1t the f0ll0w1ng m0
rn1ng at 9:47 a.
m.
3 days and 14 h0urs bef0re the scheduled h0tel transfer, the warrants were appr0ved.
The task f0rce had an arrest package and a c0untd0wn.
The subject d1d n0t kn0w he was under surve1llance.
That was partly by des1gn.
The FBI had kept 1ts phys1cal presence m1n1mal, rely1ng 0n electr0n1c m0n1t0r1ng rather than v1s1ble surve1llance teams, and partly by the subject’s 0wn hab1ts.
He l1ved qu1etly.
He dr0ve the same r0ute t0 w0rk.
He d1d n0t s0c1al1ze extens1vely.
He had 1n 3 years 0f an MSS 1ntell1gence relat10nsh1p behaved 1n every 0bservable way l1ke a pers0n wh0 was n0t d01ng what he was d01ng.
The f1nanc1al adv1s0r was 3 h0urs away by car.
He had checked 1nt0 the h0tel 48 h0urs early.
The r00m was 0n the 14th fl00r fac1ng the waterfr0nt.
He had 0rdered r00m serv1ce tw1ce.
He had made f0ur ph0ne calls, all 0n a pers0nal dev1ce, all t0 numbers that traced t0 leg1t1mate bus1ness c0ntacts w1th n0 c0nnect10n t0 the 1nvest1gat10n.
He was calm.
That was the tell.
A pers0n stay1ng 1n a h0tel tw0 days early f0r a leg1t1mate meet1ng gets restless.
He hadn’t left the r00m except 0nce, br1efly, t0 walk the waterfr0nt.
He had sat at the w1nd0w f0r l0ng stretches.
He was wa1t1ng.
He knew exactly what was c0m1ng and exactly when.
Put y0urself 1n the case agent’s p0s1t10n f0r a sec0nd.
Watch1ng a man thr0ugh a surve1llance feed, kn0w1ng what he was ab0ut t0 rece1ve.
Kn0w1ng that the alg0r1thm he was wa1t1ng f0r c0uld reshape the electr0n1c battlef1eld f0r a decade.
The w1nd0w 1s cl0s1ng and the paperw0rk st1ll 1sn’t f1n1shed.
That’s n0t a m0v1e.
That’s n1ne years 0f tra1n1ng and a 2:00 a.
m.
server l00kup h0ld1ng the wh0le th1ng t0gether.
The 1ntercept team c0nf1rmed the subject had left h1s h0me
at 7:14 a.
m.
0n the m0rn1ng 0f the transfer.
H1s veh1cle was head1ng t0ward the 1nterstate.
Intercept c0nf1rmed.
Arrest teams were staged.
Then the l0g1st1cs c00rd1nat0r’s ph0ne went act1ve.
He was call1ng a number the FBI had n0t seen bef0re.
A clean number, unreg1stered, that had n0t appeared 1n any pr10r 1ntercept 0r metadata analys1s.
The call lasted 40 sec0nds.
The task f0rce had n0 rec0rd1ng.
They had a t0wer p1ng and a durat10n.
40 sec0nds.
The c00rd1nat0r had been 1nf0rmed.
Whether he was call1ng ahead t0 the f1nanc1al adv1s0r, g1v1ng h1m a warn1ng w1nd0w, was unkn0wn.
The transfer meet1ng was 1n 4:00 a.
m.
The superv1s0r made the call at 8:22 a.
m.
D0n’t wa1t.
M0ve 0n all three s1multane0usly.
S1multane0us arrests are 0perat10nally d1ff1cult.
Stag1ng teams acr0ss three l0cat10ns, the subject’s r0ute, the h0tel, the l0g1st1cs c00rd1nat0r’s h0me 1n the Pac1f1c N0rthwest, requ1res synchr0n1zed t1m1ng, clean c0mmun1cat10n channels, and the understand1ng that 1f any 0ne element m0ves early, the 0thers are at r1sk.
One alert text, 0ne 1nst1nct1ve ph0ne call, 0ne m1ssed stag1ng w1nd0w, the wh0le 0perat10n unravels.
The subject was arrested at a h1ghway rest st0p at 9:04 a.
m.
He had st0pped f0r c0ffee.
The arrest team was already p0s1t10ned.
He d1d n0t res1st.
He st00d very st1ll when the agents appr0ached, and the case agent w0uld later say that the subject l00ked n0t surpr1sed, but res1gned, l1ke a man wh0 had underst00d f0r s0me t1me that th1s m0ment was c0m1ng and had s1mply n0t kn0wn 1ts shape.
At 9:07 a.
m.
, the Pac1f1c N0rthwest arrest team breached the l0g1st1cs c00rd1nat0r’s res1dence.
He was h0me.
He d1d n0t answer when they kn0cked.
They entered under warrant.
He was 1n the k1tchen.
He had destr0yed 0ne dev1ce, a ph0ne, phys1cally br0ken 1n the s1nk, 1n what the f0rens1c team est1mated was the prev10us 20 m1nutes.
He had n0t destr0yed a sec0nd dev1ce, a tablet, that was st1ll 0n the c0unter.
That tablet held 3 m0nths 0f encrypted c0mmun1cat10ns that the FBI w0uld spend 4 weeks extract1ng and decrypt1ng.
At 9:11 a.
m.
, the h0tel team kn0cked 0n the d00r 0f r00m 1407.
The f1nanc1al adv1s0r 0pened 1t.
He was dressed.
He had h1s jacket 0n.
H1s br1efcase was 0pen 0n the desk.
He l00ked at the agents f0r a l0ng m0ment.
F0ur 0f them, credent1als 0ut, arrest warrant v1s1ble, and then he sa1d, 1n Engl1sh w1th alm0st n0 accent, “Undersc0re undersc0re, qu0te, undersc0re three undersc0re undersc0re.
” That was the extent 0f h1s res1stance.
Ins1de the br1efcase, a clean lapt0p, tw0 encrypted dr1ves, $14,000 1n cash, and a handwr1tten d0cument, 0ne page 1n Mandar1n that the FBI l1ngu1st w0uld later descr1be as a techn1cal ver1f1cat10n checkl1st f0r c0nf1rm1ng
the c0mpleteness 0f a data hand0ff.
The transfer had n0t happened.
The alg0r1thm was st1ll 1n Amer1can hands.
The subject’s att0rney f1led an emergency m0t10n t0 suppress the w1retap ev1dence w1th1n 72 h0urs 0f arrest, argu1ng the 1n1t1al pr0bable cause aff1dav1t had been 1nsuff1c1ent.
The m0t10n was heard 14 days later.
The judge den1ed 1t.
The 0r1g1nal flag, the f1nanc1al d1screpancy, the T1tle III appl1cat10n, the case agent had bu1lt the pr0bable cause carefully en0ugh that even the rev1sed challenge c0uldn’t d1smantle 1t.
What the defense att0rney d1d succeed 1n d01ng was establ1sh1ng that the subject had n0t, 1n the end, transferred any class1f1ed mater1al.
He had accessed class1f1ed systems.
He had prepared mater1als.
He had traveled t0 meet1ngs.
But, the transfer, the hand0ff, had n0t 0ccurred.
That d1st1nct10n shaped the pr0secut10n.
The subject pled gu1lty t0 c0nsp1racy t0 c0mm1t ec0n0m1c esp10nage and unauth0r1zed access t0 pr0tected c0mputer systems.
He rece1ved a sentence 0f 14 years.
H1s att0rney argued f0r e1ght.
The pr0secut0r argued f0r 22.
The judge f0und 14.
Here’s the take that’ll pr0bably get us s0me pushback.
14 years f0r nearly del1ver1ng a class1f1ed alg0r1thm t0 a f0re1gn m1l1tary 1ntell1gence serv1ce, 0ne that c0uld have degraded Amer1can a1rb0rne c0mmun1cat10n capab1l1ty f0r a decade, 1s n0t en0ugh.
The sentence reflects what he d1d n0t d0, n0t what he 1ntended t0 d0, and what he came w1th1n 4 h0urs 0f acc0mpl1sh1ng.
The system rewards the absence 0f the f1nal act.
It sh0uld we1gh heav1er the pr0x1m1ty t0 catastr0phe.
The f1nanc1al adv1s0r was a m0re c0mplex case.
Extrad1t10n was unava1lable.
He’d been 0perat1ng 0n a Ta1wanese passp0rt, had res1dency 1n a jur1sd1ct10n w1th n0 extrad1t10n treaty, and had fam1ly legal res0urces that c0mpl1cated the federal case.
He was charged.
He was 1nd1cted.
The 1nd1ctment rema1ns act1ve.
He has n0t been extrad1ted.
He 1s, at the t1me 0f th1s acc0unt, 1n a c1ty that the FBI kn0ws and cann0t reach.
The l0g1st1cs c00rd1nat0r c00perated 1n exchange f0r a reduced sentence.
He had been recru1ted separately fr0m the subject thr0ugh a bus1ness c0ntact w1th n0 d1rect c0nnect10n t0 the f1nanc1al adv1s0r.
And had 0perated as a supp0rt n0de w1th0ut full kn0wledge 0f the 0perat10n sc0pe.
He rece1ved 5 years, served three and a half, and pr0v1ded the FBI w1th en0ugh 1nf0rmat10n t0 1dent1fy tw0 add1t10nal MSS fac1l1tat10n netw0rks 0perat1ng 1n the c0nt1nental Un1ted States.
Th0se netw0rks are separate 1nvest1gat10ns.
B0th are 0ng01ng.
What d0 th1nk? D1d the system fa1l here 1n the m0ment? Or was th1s 0utc0me the best 1t c0uld del1ver g1ven the legal arch1tecture? Because that quest10n d0esn’t have a c0mf0rtable answer.
The man wh0 alm0st handed 0ver the alg0r1thm 1s 1n a federal fac1l1ty.
The man wh0 eng1neered the 0perat10n 1s n0t.
And s0mewhere 1n the space between th0se tw0 facts, there’s a gap 1n Amer1can c0unter1ntell1gence that th1s case exp0sed but d1d n0t cl0se.
The 1nvest1gat10n pr0duced system1c changes that deserve rec0rd1ng.
The secur1ty clearance f1nanc1al d1scl0sure rev1ew pr0cess, the same pr0cess that pr0duced the 0r1g1nal flag, had a d0cumented backl0g 0f m0re than 2,200 pend1ng 1tems at the t1me the subject’s f0rm was rev1ewed.
The analyst wh0 flagged 1t had been w0rk1ng thr0ugh that backl0g f0r 6 weeks, rev1ew1ng an average 0f 41 f0rms per day.
The flag alm0st d1dn’t happen.
N0t because 0f negl1gence, but because 0f v0lume.
After th1s 1nvest1gat10n cl0sed, the 0ff1ce resp0ns1ble f0r that rev1ew rece1ved add1t10nal res0urces.
The backl0g pr0cess1ng t1mel1ne was reduced.
Aut0mated cr0ss-referenc1ng 0f f1nanc1al an0mal1es w1th ex1st1ng c0unter1ntell1gence databases was 1mplemented.
The spec1f1c gap, the fa1lure t0 c0nnect the CIA 1nqu1ry cl0sure w1th the subsequent f1nanc1al transfers, was addressed thr0ugh a new 1nteragency dec0nfl1ct10n pr0t0c0l.
The case agent wh0 1n1t1ated the 1nqu1ry was asked, at a class1f1ed after-act10n rev1ew, what w0uld have happened 1f the d1scl0sure f0rm had rema1ned 1n the backl0g f0r an0ther 3 weeks.
He sa1d he d1d n0t kn0w.
What he knew was that the f1nanc1al adv1s0r’s h0tel reservat10n had a check0ut date.
After that date, the alg0r1thm’s mater1als and the f1nanc1al adv1s0r w0uld have been 1n trans1t t0 a jur1sd1ct10n 0uts1de Amer1can reach w1th1n 22 h0urs.
The transfer w0uld have been c0mpleted s0mewhere else.
By the t1me any0ne l00ked f0r the f1nanc1al adv1s0r aga1n, he w0uld have been unt0uchable.
3 weeks.
A d1scl0sure f0rm 1n a queue.
41 f0rms rev1ewed per day.
The marg1n was exactly that.
And here’s the layer 0f th1s case that the publ1c rec0rd d0esn’t capture.
The subject wasn’t the 0nly eng1neer w1th unexpla1ned f1nanc1al d1scl0sures 1n that c0ntract0r’s empl0y.
When the 1nvest1gat10n expanded, as these 1nvest1gat10ns always d0, the FBI rev1ewed f1nanc1al d1scl0sures f0r all pers0nnel at the subject’s clearance level w1th1n the same 0rgan1zat10n.
They f0und three add1t10nal an0mal1es.
All three were referred f0r f0ll0w-up 1nqu1ry.
One was expla1ned by leg1t1mate 1nher1tance.
One was attr1buted t0 und1scl0sed crypt0currency h0ld1ngs.
A c0mpl1ance 1ssue, n0t an esp10nage 1ssue.
The th1rd has n0t been publ1cly res0lved.
Three add1t10nal an0mal1es 1n a s1ngle c0ntract0r.
One case already act1ve.
The quest10n the FBI d0esn’t answer publ1cly, can’t answer publ1cly, 1s h0w many m0re d1scl0sure f0rms and h0w many m0re backl0gs c0nta1n a l1ne that, rev1ewed carefully at 2:00 a.
m.
by s0me0ne wh0 d0esn’t g0 h0me unt1l 1t’s underst00d, leads s0mewhere that n0b0dy wants 1t t0 lead.
We’ll say what m0st w0n’t.
The real fa1lure 1n th1s case 1sn’t the subject and 1t 1sn’t the f1nanc1al adv1s0r.
It’s the seven weeks a cr1t1cal flag sat 1n a queue.
It’s the CIA 1nqu1ry that cl0sed and was never c0nnected t0 what f0ll0wed.
It’s a c0unter1ntell1gence system that w0rks when 1t w0rks because 1nd1v1dual analysts w0rk late 0n Saturdays and feel s0meth1ng 1s wr0ng ab0ut a number and d0n’t let 1t g0.
That’s n0t a system.
That’s a pers0n.
And the system sh0uld n0t be dependent 0n the pers0n’s stubb0rnness at 11:00 p.
m.
What w0uld have happened 1f the f1nanc1al adv1s0r had checked 0ut 0f r00m 1407 0n schedule? By n00n 0n the transfer day, the f1nanc1al adv1s0r w0uld have been 1n a veh1cle head1ng t0 an a1rp0rt 140 m1les fr0m the h0tel.
H1s b0ard1ng d0cumentat10n prepared under a sec0nd 1dent1ty c0ns1stent w1th h1s establ1shed al1as pattern w0uld have cleared standard screen1ng.
H1s dest1nat10n was a c0nnect1ng hub 1n As1a.
Fr0m there, a sec0nd fl1ght t0 a jur1sd1ct10n 0uts1de Amer1can extrad1t10n reach.
The encrypted dr1ves 1n h1s br1efcase w0uld have c0nta1ned the frequency h0pp1ng alg0r1thm parameters transferred c0ded t0 appear as arch1tectural des1gn f1les.
N0th1ng that aut0mated b0rder screen1ng t00ls w0uld flag.
N0th1ng that requ1red phys1cal c0ncealment.
By the t1me the subject fa1led t0 appear f0r w0rk the f0ll0w1ng m0rn1ng, the f1rst 0bservable an0maly, the f1nanc1al adv1s0r w0uld have been 22 h0urs 1nt0 a 40-h0ur trans1t that ended 0uts1de Amer1can legal reach.
The alg0r1thm w0uld have been del1vered w1th1n 72 h0urs 0f h1s arr1val.
The class1f1ed damage assessments est1mated 8 t0 11 year reduct10n 1n Amer1can tact1cal a1rb0rne c0mmun1cat10n advantage w0uld have begun 1ts cl0ck.
The subject’s absence w0uld have tr1ggered a secur1ty rev1ew.
The rev1ew w0uld have eventually 1dent1f1ed the f1nanc1al d1screpanc1es.
By then, the 1nvest1gat10n w0uld have had a cr1me w1th n0 rec0verable ev1dence and n0 reachable perpetrat0r.
The FBI agents staged at the h1ghway rest st0p arr1ved at 8:58 a.
m.
The subject st0pped f0r c0ffee at 9:03 a.
m.
5 m1nutes, n0t h0urs, m1nutes.
One deta1l that stuck w1th me g01ng thr0ugh the t1mel1ne 0f th1s case, the f1nanc1al adv1s0r and h1s h0tel r00m 0rdered breakfast at 8:45 a.
m.
R00m serv1ce del1vered 1t at 9:02 a.
m.
He was eat1ng when the FBI kn0cked 9 m1nutes later.
The breakfast was st1ll warm.
He had planned t0 be at a meet1ng 1n 40 m1nutes that w0uld have taken 3 years 0f preparat10n t0 1ts c0nclus10n.
He had n0 reas0n t0 bel1eve anyth1ng had changed.
He had n0 1dea that s0mewhere 0n a h1ghway rest st0p 23 m1les away, the subject had just stepped 0ut 0f a veh1cle and 1nt0 a set 0f handcuffs.
The f1nanc1al adv1s0r f1n1shed h1s c0ffee bef0re the arrest team secured the r00m.
There was n0 reas0n n0t t0.
The m0rn1ng was, f0r th0se 9 m1nutes, st1ll c0mpletely 0rd1nary.
W1ll th1s k1nd 0f 0perat10n happen aga1n? C0mment yes 0r n0.
Because the answer tells y0u s0meth1ng ab0ut whether y0u bel1eve the system learns 0r just rec0vers.
Case f1le recap.
11 days fr0m the scheduled transfer t0 the arrest.
14 m0nths 0f preparat10n by the MSS netw0rk d1smantled 1n 11 days 0f c00rd1nated 1nvest1gat10n.
Three s1multane0us arrests acr0ss three ge0graph1c l0cat10ns executed w1th1n a 7-m1nute w1nd0w.
11 1nd1v1duals ult1mately c0nnected t0 the br0ader netw0rk.
N1ne charged, seven c0nv1cted.
Tw0 add1t10nal MSS fac1l1tat10n netw0rks 1dent1f1ed thr0ugh c00perat1ve test1m0ny, b0th under act1ve federal 1nqu1ry.
Zer0 class1f1ed mater1als transferred.
An est1mated $3.
1 b1ll10n 1n equ1valent defense capab1l1ty pr0tected.
One f1nanc1al adv1s0r 1nd1cted and n0t extrad1ted.
The system w0rked.
Narr0wly and perfectly because an analyst w0rk1ng thr0ugh a backl0g 0n a Thursday even1ng d1dn’t let a number she alm0st m1ssed stay m1ssed.
The lead analyst wh0 flagged the 0r1g1nal d1screpancy never test1f1ed 1n c0urt.
Her r0le 1n the 1nvest1gat10n was n0t publ1cly d1scl0sed.
She was n0t present at the arrests.
She never saw the h0tel r00m 0r the br1efcase 0r the encrypted dr1ves that never reached the1r dest1nat10n.
S0mewhere 1n a g0vernment 0ff1ce, her name 1s 1n a case f1le that m0st pe0ple cleared t0 read, 1t w1ll sk1m past.
The alg0r1thm 1s st1ll 1n Amer1can hands.
That’s the math.
