A 7 T7 Case Document 3 Filed 05 01 14 Page 1 of 56 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF Criminal No UNITED STATES OF AMERICA WANG DONG a k a Jack Wang a k a UglyGorilla SUN KAILIANG I8 U S C lO30 a 2 C a k a Sun Kai Liang lO30 a 5 A 1030 b a k a Jack Sun 18 U S C 1028A WEN XINYU 18 U S C l831 a 2 a k a Wen Xin Yu and a k a WinXYHappy 18 U S C 1832 a 2 a k a a k a Lao Wen HUANG ZHENYU a k a Huang Zhen Yu UNDER SEAL a k a hzy_lhx and GU CHUNHUI a k a Gu Chun Hui a k a KandyGoo MAY-12014 CLERK US DISTRICT RT WEST DIST OF COUNT ONE Conspiracy to Commit Computer Fraud and Abuse The Grand Jury Charges INTRODUCTION 1 From at least in or about 2006 up to and including at least in or about April 2014 members of the People's Liberation Army the military' of the People's Republic of China China conspired together and with each other to hack into the computers of commercial entities located in the Western District of and elsewhere in the United States to maintain unauthorized access to those computers and to steal Case Document 3 Filed 05 01 14 Page 2 of 56 information from those entities that woubd be useful to their competitors in China including state owned enterprises 2 In some cases the conspirators stole trade secrets that would have been particularly beneficial to Chinese companies at the time they were stolen For example as described in more detail below an Oregon producer of solar panel technology was rapidly losing its market share to Chinese competitors that were systematically pricing exports well below production costs at or around the same time members of the conspiracy stole cost and pricing information fronx the Oregon producer And while a nuclear power plant manufacturer was negotiating with a Chinese company over the construction and operation of four power plants in China the conspirators stole among other things proprietary and confidential technical and design specifications for pipes pipe supports and pipe routing for those nuclear power plants that would enable any competitor looking to build a similar plant to save on research and development costs in the development of such designs 3 In the case of both of those American victims and others the conspirators also stole sensitive internal communications that would provide a competitor or adversary in Case Document 3 Filed 05 01 14 Page 3 of 56 litigation with insight into the strategy and vulnerabilities of the American entity 4 Meanwhile during the period relevant to this Indictment Chinese firms hired the same PLA Unit where the defendants worked to provide information technology services For example one SOE involved in trade litigation against some of the American victims mentioned herein hired the Unit and one of the co-conspirators charged herein to build a secret database to hold corporate intelligence THE DEFENDANTS 5 At various times relevant to this Indictment Defendants WANG DONG a k a Jack Wang a k a UglyGorilla hereinafter Defendant SUN KAILIANG a k a Sun Kai Liang a k a Jack Sun hereinafter Defendant WEN XINYU a k a Wen Xin Yu a k a WinXYHappy a k a a k a Lao Wen hereinafter Defendant HUANG ZHENYU a k a Huang Zhen Yu a k a hzy_lhx hereinafter Defendant and GU CHUNHUI a k a Gu Chun Hui a k a KandyGoo hereinafter Defendant whose photographs are attached as Exhibits A through E respectively worked together and with others known and unknown to the Grand Jury for the General Staff Third Department a signals intelligence component of the PLA in a Unit known by the Military Unit Code Case Document 3 Filed 05 01 14 Page 4 of 56 Designator 61398 Unit 61398 and in the vicinity of 208 Datong Road Pudong District Shanghai China 6 The co conspirators hacking activities are described in more detail below but are summarized here as follows a In cu about 2007 Westinghouse Electric Company Westinghouse which is headquartered in the Western District of reached an agreement with a Chinese state-owned nuclear power company to construct and operate four nuclear power plants in China Negotiations regarding the details of that transaction such as limitations on which technology would be provided to and under what conditions continued up to and including 2013 In or about 2010 and 20ll while negotiations were ongoing Defendant SUN stole from Westinghouse s computers among other things proprietary and confidential technical and design specifications for pipes pipe supports and pipe routing within the nuclear power plants that Westinghouse was contracted to build as well as internal Westinghouse communications concerning the company's strategy for doing business with in China and the potential that may eventually become a competitor b In or about May and July 2012 Defendant WEN hacked into the computers of U S subsidiaries of SolarWorld AG a German solar products manufacturing company including a production facility located ill Hillsboro Oregon and 51 sales Case Document 3 Filed 05 01 14 Page 5 of 56 facility located in Camarillo California collectively SolarWorld From in or about May 2012 up to and including at least in or about September 2012 Defendant WEN and at least one unidentified co-conspirator stole thousands of e mails and related attachments that provided detailed information about So1arWorld s financial position production capabilities cost structure and business strategy Meanwhile contemporaneous with that hacking Solarworhj was an active litigant in trade cases against Chinese solar manufacturers several of which reported in filings with the U S Securities and Exchange Commission that their sales revenues had increased each year from 2009 through 2011 In or about May 2012 the Department of Commerce imposed significant duties on Chinese imports of solar products based on its finding that those manufacturers luui received unfair subsidies from CHUJm1 and had dumped large volumes of solar products into U S markets at prices below fair value severely undercutting competitors like Solarworld and in some cases helping to drive the most vulnerable American solar products manufacturers out of business Several Chinese solar manufacturers subsequently reported in SEC filings that in 2012 their sales revenues had decreased from 2011 and their net income and profit margins had dropped to five year lows Case Document 3 Filed 05 01 14 Page 6 of 56 c Between iJ1 or about 2009 and iJ1 or about 2012 United States Steel Corporation Steel which is headquartered in the Western District of litigated a number of trade cases against the Chinese steel industry including specifically one large Chinese state owned steel company About two weeks before the anticipated decision in one of those disputes in 2010 Defendant SUN targeted one of the employees working in the relevant division of U S Steel with an e mail message known as a spearphishing message that was designed to trick the employee who received it into allowing SUN access to the employee's computer At or about that time Defendant WANG stole hostnames and descriptions for more than 1 700 servers including servers that controlled physical access to the company's facilities and Jnobile device access to the company's networks d Allegheny Technologies Incorporated a specialty metals manufacturer headquartered in the Western District of has since in or about 1995 been a partner in a joint venture with and was between 2009 and 2012 also an adversary of in litigation before the World Trade Organization In April 2012 the day after a board meeting for the joint venture in Shanghai China Defendant WEN stole network credentials for virtually every Case Document 3 Filed 05 01 14 Page 7 of 56 employee at the company which would have allowed wide ranging and persistent access to computers e The United Steel Paper and Forestry Rubber Manufacturing Energy Allied Industrial and Service Workers International Union headquartered in the Western District of has long been a vocal opponent of Chinese trade practices In 2012 on or about the day that the President issued a call to action against Chinese policies Defendant WEN stole e-mail messages containing strategic discussions from senior union employees And two days after the union publicly urged Congress to pass legislation that would have imposed duties on Chinese imports Defendant WEN stole more e mail messages containing internal strategic discussions f Ir or about 2008 Alcoa Incorporated Alcoa an aluminun1 manufacturer whose jprincipal office is located in the Western District of announcecl a partnership with a Chinese state owned aluminum company to acquire a stake in another foreign ndning company Approximately three weeks later Defendant SUN targeted senior Alcoa managers with spearphishing messages designed to trick the recipients into providing SUN with access to the company's computers 7 As described above Defendants WANG SUN and WEN among others known and unknown to the Grand Jury hacked or Case Document 3 Filed 05 01 14 Page 8 of 56 attempted to hack into at least the U S companies described above 8 Contemporaneously beginning at least in or about 2006 and continuing until at least in or about 2012 Defendant HUANG was ea computer programmer within the same ndlitary Unit He facilitated hacking activities by registering and managing domain accounts that his co conspirators including at least Defendants WANG SUN and WEN used to commit those crimes Meanwhile beginning at least iJ1 or about 2006 and continuing until at least in or about 2009 Unit 61398 assigned Defendant HUANG to perform programming work for SOE-2 including the creation of a secret database for designed to hold corporate intelligence about the iron and steel industries including information about American companies 9 Like Defendant HUANG beginning at least in or about 2006 and continuing until at least in or about 2010 Defendant GU managed domain accounts used to facilitate hacking activities against American companies Defendant GU also tested spearphishing messages in furtherance of the conspiracy MANNER AND MEANS OF THE CONSPIRACY 10 The members of the conspiracy who are both known and unknown to the Grand Jury used the following manner and means to accomplish their objectives which included gaining Case Document 3 Filed 05 01 14 Page 9 of 56 unauthorized access to computers and using that access to steal information 11 As described above the co conspirators used e mail messages known as spearphishing messages to trick unwitting recipients into giving the co conspirators access to their computers Spearphishing messages were typically designed to resemble e mails from trustworthy senders like colleagues and encouraged the recipients to open attached files or click on hyperlinks in the messages However the attached or linked files once opened installed malware malicious code that provided unauthorized access to the recipient's computer known as a backdoor thereby allowing the co conspirators to bypass normal authentication procedures in the future l2 After creating a backdoor the malware typically attempted to contact other computers controlled by the co- conspirators by sending them a short message known as a beacon These beacons typically 1 notified the co- conspirators of the successful penetration of a victim's computer 2 provided some information about the victim's computer useful for future intrusion activity and 3 solicited additional instructions from the co-conspirators 13 During the conspiracy the co conspirators controlled compromised computers in the United States besides those belonging to the six entities named above The co conspirators ii I Case Document 3 Filed 05 01 14 Page 10 of 56 I generally used those computers known as hop points to access other victims computers and in so doing the co-conspirators attempted to mask the true identity and location of the computers in China from which they were actually conducting their hacking activity Among other things the co conspirators used hop points to research victims send spearphishing e mails store and distribute additional malware manage malware and transfer exfiltrated data Some hop points were used as command and control servers which received communications from and returned instructions to malware on other compromised computers 14 The co conspirators commonly used domain names to hide malicious communications to and from hop points and other victim computers Domain names are labels used to indicate ownership or control of a resource on the Internet and they are governed by the rules and procedures of the Domain Name System Domain names resolve back to specific Internet Protocol or simply addresses which are unique numeric addresses assigned to computers to route traffic on the Internet l5 The function of the DNS is to translate an alphanumeric domain name into an IP address of the computer hosting that domain using the DNS is analogous to using a phone book to look up the phone number of a particular person Typically an Internet user attempts to navigate to ea website 10 Case Document 3 Filed 05 01 14 Page 11 of 56 using its domain name but computers navigate to a website using an IP address When a computer user types the domain websitename comV into 51 web Ibrowser for example the user's computer contacts a DNS server which then translates the domain name into an IP address like 58 247 27 223 and sends that IP address back to the user's computer The user's computer can then immediately communicate directly with websitename com because it has identified the corresponding IP address Dynamic DNS providers enable owners or operators of domain names to change the IP addresses to which the domain names resolve usually km logging ixnxn domain accounts at time providers over the Internet and configuring the settings for the domain names to include the destination IP addresses 16 The co conspirators either directly or through intermediaries purchased leased or otherwise registered domain names from domain registrars obtained accounts at dynamic DNS providers and assigned the domain names to those domain accounts if the domain names were not already assigned to the desired DNS providers as part of the original purchase lease or registration Using those domain accounts the co- conspirators managed the resolutions of those domain names that is the assignments of those domain names to particular IP addresses CH1 the Internet to which lookup requests for those domain names would be directed Often those domain names were Case Document 3 Filed 05 01 14 Page 12 of 56 designed to mimic the domain names of legitimate websites but with slight differences in spelling such as finaceanalysis com gmailboxes com and busketball com The co-conspirators then used the domain names with their malware After the malware was installed on victim computers the domain names served as the destination points for the malware to contact or beacon for further instructions The table below lists some of the other malicious domains used by the conspiracy during the period relevant to this Indictment Malicious Domain Names arrowservice net bigish net businessconsults net businessformars com marsbrother com purpledaily com newsonet net comrepair com oplaymagzine com hugesoft org 17 The co-conspirators used the domain accounts at dynamic DNS jproviders to assign 'their domain names to the IP addresses of different computers depending on their needs at the time For example when the co-conspirators wished to proceed with particular intrusions they used the applicable accounts at dynamic DNS providers to turn malicious domains associated with their nmlware that is to assign time domains 1x the IP addresses of computers under their control like hop points Then between intrusions the co-conspirators used the domain 12 Case Document 3 Filed 05 01 14 Page 13 of 56 accounts to reassign the malicious domain names to non routable or innocuous IP addresses IP addresses for popular webmail services like Gmail or Yahoo which would obscure any beacons their malware sent during that period At one dynamic DNS provider for example domains were typically turned on at the beginning of business hours in Shanghai Monday through Friday and turned off reassigned to noneroutable or innocuous IP addresses at lunchtime and the close of business and left off over the weekend as the charts attached as Exhibit to this Indictment show 18 After obtaining ea foothold in 51 victimfs computers the co conspirators performed a variety of functions designed to identify collect package and exfiltrate targeted data from the victim's computers to other computers under the co- conspirators control THE INTRUSIONS AT SIX VICTIMS Westinghouse 19 Westinghouse is one of the world's leading civilian nuclear power developers providing fuel services and plant design to customers in the commercial nuclear industry worldwide The company's designs are the basis for approximately half If the world's currently operating nuclear power plants Westinghouse s Nuclear Power Plant is a particularly well known power plant design with unique safety 13 Case Document 3 Filed 05 01 14 Page 14 of 56 features which took Westinghouse significant resources to develop over a 15-year period 20 After two years of negotiations on July 24 2007 Westinghouse and a Chinese state owned enterprise in the nuclear power industry signed contracts for the construction and operation of four AP1000 power plants in China subject to further negotiations on certain unresolved issues Those contracts provided for the transfer of some technology to but they limited what was permitted to do with it For example was not authorized to send materials and components outside China to use then1 in reactor plants that competed with Westinghouse s products outside China or to use them for Hulitary purposes Emrther the technology transfer contracts limited ability to provide such technologies to entities other than those listed in the contracts without notifying and receiving approval from Westinghouse Negotiations regarding the other details including additional technology transfer issues continued for years thereafter up to and including 2013 21 During the conspiracy while Westinghouse was building the AP1000 plants and negotiating other terms with hackers repeatedly targeted Westinghouse s computers including computers in the Western District of For example on or about May 6 2010 Defendant SUN gained unauthorized I4 Case Document 3 Filed 05 01 14 Page 15 of 56 access to Westinghouse s computers and stole proprietary and confidential technical and design specifications related to pipes pipe supports and pipe routing within the plant buildings Among other things such specifications would enable a competitor to build a jplant similar to the AP1000 without incurring significant research and development costs associated with designing similar pipes pipe supports and pipe routing systems During the same intrusion Defendant SUN also stole Westinghouse network credentials that would facilitate additional unauthorized access 22 In addition to constructing the plants and negotiating contractual details relating to those plants in late 2010 Westinghouse began to explore other business ventures with For example in or about September 20lO Westinghouse and began negotiating over the construction of additional power plants in China Westinghouse sought to conclude these negotiationsi before the arrival of an official in Washington D C as part of a January 20ll Chinese state visit so that the agreement could be signed during the visit Meanwhile Westinghouse management internally discussed what approach to take during upcoming negotiations and in future partnerships with as well as the potential that may eventually become a competitor 15 Case Document 3 Filed 05 01 14 Page 16 of 56 23 While these business initiatives and discussions were underway beginning at least in or about December 2010 and continuing at least 1J1 or about tknunugr 2011 Defendant SUN repeatedly targeted Westinghouse's computers For example on or about December 30 2010 January 3 2011 and January 5 2011 Defendant SUN gained unauthorized access to Westinghouse s computers and stole sensitive non public and deliberative e- mails belonging to senior decision makers responsible for Westinghouse s business relationship with including Westinghouse s Chief Executive Officer Some stolen e mails described the status of the four AP1000 plants construction Many other stolen e mails however concerned Westinghouse s confidential business strategies relating to including Westinghouse's strategies for reaching an agreement with on future nuclear power plant construction in China and discussions regarding cooperation and potential future competition with in the development of nuclear power plants elsewhere around the world 24 In total between ima or about 2010 and iJ1 or about 2012 members of the conspiracy stole at least 1 4 gigabytes of data the equivalent of roughly 700 000 pages of e mail messages and attachments from Westinghouse s computers Case Document3 Filed 05 01 14 Page 17'of56 Solarworld 25 At times relevant to this Indictment Solarworld had significant business interests relating to China including as a direct competitor with various Chinese solar products manufacturers Beginning at least in or about October 2011 and continuing until in or about September 2012 Solarworld was particularly active in trade litigation involving Chinese manufacturers it was the lead petitioner in a case before the U S Department of Commerce and U S International Trade Commission That litigation ultimately resulted i11 a finding that Chinese solar Hanufacturers had received unfair subsidies from China and had dumped large volumes of solar products into U S markets at prices below fair value As a result the Department of Commerce imposed significant countervailing and antidumping duties on Chinese imports of solar products 26 On or about May 3 2012 following one preliminary determination by the Department of Commerce and about two weeks before a second determination was scheduled Defendant WEN hacked into SolarWorld s computers and stole e mails and files belonging to three senior executives Then from M1 or about May 9 2012 up to and including on or about September 26 2012 Defendant WEN and at least one other unidentified co- conspirator conducted at least twelve more intrusions into and exfiltrations from SolarWorld s computers Through those 17 Case Document 3 Filed 05 01 14 Page 18 of 56 intrusions they stole thousands of ee mail messages and other files from at least seven identified Solarworld employees who based on their positions would be expected to have comprehensive and highly detailed information about SolarWorld s financial position production capabilities cost structure business strategy or trade litigation strategy 27 Collectively the data stolen from Solarworld would have enabled a Chinese competitor to target SolarWorld s business operations aggressively from a variety of angles For example the stolen data included cash flow spreadsheets maintained km the Chief Financial Officer that would enable a Chinese competitor to identify the length of time that Solarworld might survive a financial or market shock 2 detailed Inanufacturing metrics technological innovations and production line information that would enable a Chinese competitor to mimic SolarWorld s proprietary production capabilities without the need to invest time or money in research and development 3 specific production costs for all manufacturing inputs that would enable a Chinese competitor to undermine Solarworld financially through targeted and sustained underpricing of solar products and 4 privileged attorney- client communications related to SolarWorld s ongoing trade litigation with China including confidential Question and 18 Case Document 3 Filed 05 01 14 Page 19 of 56 Answer documents submitted ix the Department of Commerce that were not discoverable by the Chinese respondents U S Steel 28 U S Steel is the largest steel company in the United States During the period relevant to this Indictment U S Steel had significant business interests relating to China including as a competitor of several Chinese steel manufacturers like For example beginning at least j11 or about 2009 and continuing until at least in or about 20l2 U S Steel participated in several international trade disputes with Chinese steel manufacturers including SOE-2 These disputes involved allegations that China subsidized the Chinese steel industry and that the Chinese steel industry dumped steel into U S markets at below market prices 29 In or about 2010 U S Steel was particularly active in that litigation That year U S Steel was one of several lead petitioners in protracted litigations before the U S Department of Commerce and U S International Trade Commission involving imports of oil country tubular goods which are steel piping used by oil and gas companies and seamless standard line pipes which are steel pipes specifically constructed without ea welded seam cknwi the length of the pipes In both cases the Department of Commerce found that the respondents various Chinese steel manufacturers Case Document 3 Filed 05 01 14 Page 20 of 56 including received unfair subsidies fronx China and dumped billions of dollars worth of steel into U S markets at prices below fair value As a result the Department of Commerce imposed significant countervailing and antidumping duties worth millions of dollars on Chinese imports of OCTG and SSLP Thereafter the amount of OCTG and SSLP steel imported by Chinese manufacturers fell dramatically 30 In or about February 2010 while U S Steel was participating in at least the two international trade disputes described above Defendants SUN and WANG hacked into U S Steel's computers a On cu about February 8 2010 approximately two weeks before the Empartment of Commerce was scheduled to release its preliminary determination in the SSLP trade dispute Defendant SUN sent a spearphishing e-mail purporting to be from U S Steel's Chief Executive 3fficer to approximatel5r 20 U S Steel employees affiliated with the U S Steel division responsible for OCTG and SSLP The e-mail contained a link to malware which some of the recipients clicked on installing malware on computers located in the Western District of and providing Defendant SUN and his co conspirators with backdoor access to U S Steel's computers b On or about February 23 2010 Defendant SUN sent spearphishing e mails purporting ix be from tum U S Steel e- 20 Case Document 3 Filed 05 01 14 Page 21 of 56 mail accounts to approximately eight U S Steel employees including U S Steel s Chief Executive Officer The e mails had the subject line Steel Industry Outlook and contained a link to malware that once clicked would surreptitiously install malware on the recipients computers allowing the co- conspirators backdoor access to the company's computers Further beginning on or about February 24 2010 and continuing until on or about March 2 2010 an unidentified co conspirator sent approximately 49 spearphishing e mails to U S Steel employees with the same subject Steel Industry Outlook c On or about February 26 2010 Defendant WANG gained unauthorized access to at least one U S Steel computer located in the Western District of Defendant WANG used that unauthorized access to steal hostnames and descriptions for more than 1 700 U S Steel computers including servers used for emergency response network monitoring network security applications for U S Steel employees mobile devices and physical access ix U S Steel's facilities 1J1 the Western District of WANG then took steps to identify and exploit vulnerable servers on that list El 31 AT1 is a large specialty metals company It operates primarily in three business segments high performance metals 21 Case Document 3 Filed 05 01 14 Page 22 of 56 nickel and cobalt flat rolled products stainless steel and engineered products tungsten 32 At times relevant to this Indictment ATI had significant business interests relating to China including as a partner with and competitor of various Chinese producers of flat rolled products For example since approximately 1995 ATI through a wholly owned subsidiary has partnered in a joint venture with for the manufacture of precision rolled stainless steel strips which are among other things used in the automotive medical equipment and semiconductor industries The board of c rectors of this joint venture met periodically including for example on or about April 12 2012 in Shanghai China That same ATI subsidiary competed with in the production of grain oriented flat rolled electrical steel which is used in power distribution and power generation transformers In addition beginning at least in or about June 2009 and continuing until at least in or about June 2012 ATI participated in an international trade dispute against regarding importation of GOES into China which the WTO ultimately resolved in ATI's favor 33 On or about April 13 2012 the day after the joint venture board meeting Defendant WEN gained unauthorized access into ATI computers located in the Western District of Defendant WEN then stole the usernames and Case Document 3 Filed 05 01 14 Page 23 of 56 passwords for at least 7 000 ATI employees These network credentials would have facilitated additional unauthorized access to computers by Defendant WEN and his co- conspirators allowing them to monitor activity on those systems and to steal information in the future 34 Thereafter H1 at least three occasions iJ1 or about May 2012 several of the same compromised ATI computers beaconed to the same hop point used to steal those network credentials reflecting persistent access by the hackers 35 USW has approximately one ndllion active and retired members nationwide from a variety of industries including metals energy and rubber and plastics One of core missions is to oppose Chinese trade practices that it perceives as unfair trade strategy includes representing its members in international trade disputes media campaigns and lobbying On at least four occasions between in or about 2010 and 20l2 while USW was particularly vocal about China's trade practices Defendant WEN and an unidentified co- conspirator gained unauthorized access to computers and stole e mail messages and attachments from the accounts of six to eight USW employees who would be expected to have sensitive non public and deliberative information about trade 23 ase Document 3 Filed 05 01 14 Page 24 of 56 strategy concerning China Each theft targeted messages from a narrow window of time before the intrusion 36 For example i11 or about late January 2012 USW was involved in public disputes over Chinese trade practices in at least two industries raw materials and auto parts First on or about January 30 2012 the Appellate Body of the WTO issued a report concluding that Chinese trade practices relating to the export of various industrial raw materials were inconsistent with China's obligations as a member of the WTO In response and on the same day USW issued a press release stating that the decision was ki huge victory for American workers And the next day on or about January 31 2012 USW issued a statement from its International President calling on the U S Government to take action to protect the U S auto parts sector from China's predatory protectionist and illegal trade practices USW also releasecl a report M1 Chinese trade jpractices in the auto parts industry 37 That same day on or about January 31 2012 Defendant WEN gained unauthorized access to computers and stole e- mails dated between in or about January 24 and January 31 2012 that were located in certain folders of the accounts of six senior USW employees including USW's International President most of whom were personally and publicly involved in either the raw materials or auto parts disputes The stolen e mails 24 Case Document 3 Filed 05 01 14 Page 25 of 56 included sensitive non public and deliberative information about strategy including for example preparations for the January 31 2012 news conference where it issued its call to action against Chinese trade practices in the auto parts sector discussion of the merits of the January 31 2012 WTO report on raw materials and drafts of press releases announcing that report 38 Then on or about March 5 2012 the International President of USW issued an open letter urging Congress to pass a bill that would grant the U S Department of Commerce authority to impose countervailing duties on Chinese exports stating would kxe a travesty for tiongress ix stand idle while ea country like China can provide lavish subsidies for exports without the United States being able to defend American workers euxi producers km offsetting time harm Approximately two days later on or about March 7 2012 Defendant WEN again gained unauthorized access to computers and stole e mails received between March 1 and March 7 2012 from the inboxes of six senior USW employees including International President Those e mails included sensitive non public and deliberative information about trade strategy such as internal discussions of how would change its strategy in pending international trade disputes if the bill were enacted and the union's decision not to seek an extension of certain 25 Case Document 3 Filed 05 01 14 Page 26 of 56 tariffs against Chinese companies which USW had not yet announced 39 Thereafter until at least in or about January 2013 USW computers continued to beacon to malicious domains used by the conspiracy on a near daily basis reflecting persistent access by the co conspirators to computers Alcoa 40 Alcoa is the largest aluminum company in the United States At times relevant to this Indictment Alcoa had significant business interests relating to China For example in or about 2001 Alcoa entered into an agreement with a Chinese SOE in the aluminum industry to purchase shares in a Chinese aluminum company that partially owned Alcoa sold those shares on or about September 12 2007 Then on or about February q 2008 Alcoa announced 51 partnership mdi i to acquire a substantial stake in a foreign mining company 41 Spearphishing activity targeted Alcoa including near in time to significant events in its business relationship with For example on or about February 20 2008 about three weeks after Alcoa announced the partnership with Defendant SUN targeted Alcoa with a spearphishing campaign Specifically Defendant SUN sent e mails to approximately 19 senior Alcoa employees at least some of whom were located in the Western District of using an account designed 26 Tjj Case Document 3 Filed 05 01 14 Page 27 of 56 to impersonate a member of Alcoa s Board of Directors In all but one of the e-mails Defendant SUN attached a file disguised as an agenda for Alcoa's annual shareholders meeting which once opened would install malware on the recipients computers 42 Thereafter in or about June 2008 unidentified individuals stole at least 2 907 e mail messages along with approximately 863 attachments from Alcoa's computers including internal messages among Alcoa senior managers discussing the foregoing acquisition STATUTORY ALLEGATIONS 43 Beginning at least in or about 2006 and continuing until at least ijl or about April 2014 the exact dates being unknown to the Grand Jury in the Western District of and elsewhere Defendants WANG DONG a k a Jack Wang a k a UglyGorilla SUN KAILIANG a k a Sun Kai Liang a k a Jack Sun WEN XINYU a k a Wen Xin Yu a k a WinXYHappy a k a a k a Lao Wen HUANG ZHENYU a k a Huang Zhen Yu a k a hzy_lhx and GU CHUNHUI a k a Gu Chun Hui a k a KandyGoo 27 Case Document 3 Filed 05 01 14 Page 28 of 56 did knowingly and intentionally combine conspire confederate and agree together with each other and with others known and unknown to the Grand Jury to commit offenses against the United States namely a to access a computer without authorization and exceed authorized access ix a computer and 113 obtain thereby information from a protected computer for the purpose of commercial advantage and private financial gain and in furtherance of a criminal and tortious act in violation of the laws of the Commonwealth of namely the common law tort of Invasion of Privacy and where the value of the information did and would if completed exceed $5 000 in violation of Title l8 United States Code Sections l030 a 2 C and l030 c 2 B and b to cause the transmission of a program information code and command and as a result of such conduct to cause damage without authorization to a pmotected computer and where time offense chxi cause and if completed have caused loss aggregating $5 000 in value to at least one person during a one year period from a related course of conduct affecting a protected computer and damage affecting at least 10 protected computers during ea one year period violation of Title 18 United States Code Sections l030 a 5 A and 28 Case Document3 Filed 05 01 14 Page 29_of56 OVERT ACTS 44 In furtherance Hf the conspiracy and 1x3 achieve the objects thereof the conspirators committed the following overt acts among others in the Western District of and elsewhere a On or about April 18 2006 Defendant SUN created e mail account b On or about July 17 2006 Defendant SUN created domain account at a domain provider in the United States c On or about December l2 2006 Defendant WEN sent Defendant WANG two executable files containing tools that would be useful for intrusions d On or about July 12 2007 Defendant GU designed and tested a spearphishing message e On or about February 20 2008 Defendant SUN created an e mail account using the misspelled name of a person with the initials C G who was then a member of Alcoa's Board of Directors the Spearphishing Account f On or about February 20 2008 Defendant SUN using the C G Spearphishing Account transmitted e mail messages with a file named agenda zip which contained malware to approximately 19 Alcoa employees 29 Case Document 3 Filed 05 01 14 Page 30 of 56 g On or about October 26 2008 Defendant GU designed and tested a spearphishing message h On or about February 8 20l0 Defendant SUN sent a spearphishing e mail purporting to be from U S Steel's Chief Executive Officer to approximately 20 U S Steel employees i On or about February 23 2010 Defendant SUN sent spearphishing e mails purporting to kxa two U S Steel e- mail accounts to approximately eight U S Steel employees j On or about February 26 2010 Defendant WANG accessed without authorization at least one U S Steel computer located in the Western District of k On or about February 26 20l0 Defendant WANG stole server names and descriptions from a U S Steel computer located in the Western District of l On or about February 26 2010 Defendant WANG transmitted at least one file that he stole a U S Steel computer to a computer located in China m On or about February 26 20l0 Defendant WANG transmitted a file named ccapp exe to a U S Steel computer n On or about May 6 20l0 Defendant SUN accessed without authorization a Westinghouse computer located in the Western District of with hostname o On or about May 6 2010 Defendant SUN transmitted a file named ccapp exe to a Westinghouse computer 30 Case Document 3 Filed 05 01 14 Page 31 of 56 located j11 the Western District of with hostname p On or about May 6 2010 Defendant SUN transmitted a file named ccapp exe to a Westinghouse computer with the hostname q On or about May 6 2010 Defendant SUN stole at least one file from a Westinghouse computer with hostname r On or about August 24 2010 Defendant WEN sent a test spearphishing e mail to Defendant SUN s On or about December 30 2010 Defendant SUN accessed the malicious domain account purpledaily com and changed the IP address of sub domain klwest purp1edaily com to a hop point located in Kansas t On or about December 30 2010 Defendant SUN accessed without authorization a Westinghouse computer with hostname u On or about December 30 2010 Defendant SUN transmitted a file named ccapp exe to a Westinghouse computer with hostname V On or about December 30 2010 Defendant SUN transmitted at least two files named wiam exe and ccapp exe tx a Westinghouse computer located ill the Western District of with hostname 31 Case Document 3 Filed 05 01 14 Page 32 of 56 w On or about December 30 2010 Defendant SUN stole e-mails from the accounts of six Westinghouse employees x On or about January 3 2011 Defendant SUN accessed without authorization a Westinghouse computer with hostname y On or about January 3 2011 Defendant SUN transmitted a file named ccapp exe to a Westinghouse computer with hostname z On or about January 3 2011 Defendant SUN transmitted a file named ccapp exe to a Westinghouse computer located in time Western District of with hostname aa On or about January 3 2011 Defendant SUN stole e mails from the accounts of six Westinghouse employees bb On or about January 5 2011 Defendant SUN accessed the malicious domain account bigish net and changed the IP address assigned to two bigish net sub domains including finekl bigish net to a hop point located in Kansas cc On or about January 5 2011 Defendant SUN accessed without authorization ea Westinghouse computer located in the Western District of with hostname dd On or about January 5 2011 Defendant SUN transmitted files named wiam exe and ccapp exe to a Case Document 3 Filed 05 01 14 Page 33 of 56 Westinghouse computer located in the Western District of with hostname ee On or about January 5 2011 Defendant SUN transmitted files named wiam exe and ccapp exe to a Westinghouse computer with hostname ff On or about January 5 2011 Defendant SUN stole e-mails from the accounts of six Westinghouse employees gg On or about January 31 2012 Defendant WEN accessed without authorization a USW computer located in the Western District of with hostname hh On or about January 31 2012 Defendant WEN transmitted a file named ccapp exe to a USW computer located in the Western District of with hostname ii On or about January 31 2012 Defendant WEN stole hundreds of e-mails from the accounts of six USW employees jj On or about March 7 2012 Defendant WEN accessed without authorization a USW computer located in the Western District of with hostname kk On or about March 7 2012 Defendant WEN transmitted a file named gu exe to a USW computer 11 Ck1 or about March 7 2012 Defendant stole hundreds of e-mails from the accounts of six USW employees 33 transmitted a file named Case Document 3 Filed 05 01 14 Page 34 of 56 mm On or about April 12 2012 Defendant WEN accessed without authorization EH1 ATI computer located jil the Western District of with hostname nn On or about April 12 2012 Defendant WEN executed the program named ugls exe to monitor the status of compromised ATI computers located in the Western District of and elsewhere oo On or about April 13 2012 Defendant WEN accessed wmithout authorization EH1 AT1 computer located 1J1 the Western District of with hostname pp On or about April 13 2012 Defendant WEN ccapp exe to an ATI computer located in the Western District of with hostname qq On or about April 13 2012 Defendant WEN transmitted a file named i eXe to an ATI computer located in the Western District of with hostname rr On or about April 13 2012 Defendant WEN stole ATI network usernames and passwords for more than 7 000 ATI employees ss On or about May 3 2012 Defendant WEN accessed without authorization a SolarWorld computer using malware named ugls exe and stole e mails and files belonging to three employees tt On or about May 9 2012 Defendant WEN accessed 34 Case Document 3 Filed 05 01 14 Page 35 of 56 without authorization a Solarworld computer using malware named ugls exe and stole e-mails and files belonging to four employees uu On or about July 27 2012 Defendant WEN accessed without authorization a Solarworld computer using malware named ugls exe and stole e mails and files belonging to five employees vv On cm about February 20 2013 UHDJ changed the registration information for malicious domain accounts arrowservice net businessconsults net newsonet net and I purpledaily com and marsbrother com ww In or about April 2014 an unidentified co- conspirator created a malicious domain and configured it to resolve to an IP address in Germany All in violation of Title 18 United States Code Section lO30 b Case Document 3 Filed 05 01 14 Page 36 of 56 COUNTS TWO THROUGH NINE Computer Fraud and Abuse The Grand Jury further charges 45 The allegations set forth in paragraphs 1-42 and 44 of this Indictment are incorporated herein as if set forth in full 46 Beginning at least on or about February 26 2010 and continuing LnujJ_ at least H1 or about ZunjJ_ 13 2012 in the Western District of and elsewhere Defendants WANG DONG a k a Jack Wang a k a UglyGorilla SUN KAILIANG a k a Sun Kai Liang a k a Jack Sun WEN XINYU a k a Wen Xin Yu a k a WinXYHappy a k a a k a Lao Wen HUANG ZI-IENYU a k a Huang Zhen Yu a k a hzy_lhx and GU CHUNHUI a k a Gu Chun Hui a k a KandyGoo aided and abetted by others known and unknown to the Grand Jury did intentionally access a computer without authorization and exceed authorized access to a computer and did thereby obtain and attempt to obtain information from a protected computer for the purpose of commercial advantage and private financial gain in furtherance of a cmiminal and tortious act in violation of the laws of namely Invasion of Privacy and where 36 Case Document 3 Filed 05 01 14 Page 37 of 56 the value of the information obtained completed would have exceeded $5 000 47 On or about the dates chart set forth below as set forth in Column A GU accessed without access to victim listed District of the Commonwealth of unauthorized access and exceeding authorized access WANG SUN WEN HUANG Column D 2 2 26 2010 in Column C each date constituting a separate count authorization at least one protected Victim U S Steel Defendants WANG which was SUN and located As a exceeded exceeded result and identified i11 Column E3 of the WEN HUANG computer belonging to in using 21 computer located outside of of and GU obtained the information listed in Stolen Information Information U S Steel computers about 1 753 3 5 6 2010 Westinghouse Proprietary confidential files related to the nuclear power plant and 4 12 30 2010 Westinghouse Information accounts of employees A X L R P W from e mail Westinghouse C D C P and C P 5 1 3 2011 Westinghouse Information accounts of employees A R P W X L from e mail Westinghouse C D C P and C P 6 1 5 2011 Westinghouse Information accounts of employees A X L F S M F from e mail Westinghouse C D C R and authorized the Western such Defendants Case Document 3 Filed 05 01 14 Page 38 of 56 Stolen Information All in violation of Title 18 1030 a 2 C and 1030 C 2 B 38 United States Code and 2 Information from e mail accounts of USW 7 1 31 2012 USW employees L G C L H H W D J G and G P Information from e mai1 accounts of USW 8 3 7 2012 USW employees L G C L H H W D G H L A L B and C K ATI network credentials 9 4 13 2012 ATI for thousands of ATI employees Sections i 7 7' 7 Case Document 3 Filed 05 01 14 Page 39 of 56 COUNTS TEN THROUGH TWENTY-THREE Damaging a Computer The Grand Jury further charges 48 The allegations set forth in paragraphs 1-42 and 44 of this Indictment are incorporated herein as if set forth in full 49 Beginning at least H1 or about February 8 2010 and continuing at least CH1 or about Zgn j 13 2012 in the Western District of and elsewhere Defendants WANG DONG a k a Jack Wang a k a UglyGorilla SUN KAILIANG a k a Sun Kai Liang a k a Jack Sun WEN XINYU a k a Wen Xin Yu a k a WinXYHappy a k a a k a Lao Wen HUANG ZHENYU a k a Huang Zhen Yu a k a hzy_lhx and GU CHUNHUI a k a Gu Chun Hui a k a KandyGoo aided and abetted by others known and unknown to the Grand Jury did knowingly cause and attempt to cause the transmission of a program information code and command and as a result of such conduct did intentionally cause damage and attempt to cause damage without authorization to a protected computer and which offense caused and would if completed have caused loss aggregating at least $5 000 in value to at least one person 39 Case Document 3 Filed 05 01 14 Page 40 of 56 during a one year period from a related course of conduct and damage affecting at least ten protected computers during a one- year period 50 On or about the dates identified in Column of the chart set forth below each date constituting a separate count as set forth in Column A Defendants WANG SUN WEN HUANG and GU did knowingly cause the transmission of a program information code and command and as a result of such conduct did intentionally cause damage and attempt to cause damage without authorization 1x a protected computer belonging to the victim listed in Column C Each offense caused and would if completed have caused loss aggregating at least $5 000 in value to at least one person during a one year period from a related course of conduct and damage affecting at least ten protected computers during a one year period A summary of the method of transmission of the malicious program information code and command is listed in Column D Date Victim Description of Transmission On or About Spearphishing e mail to U S Steel employee R G with subject Meeting Invitation which contained the malicious file agenda zip 10 2 8 2010 U S Steel Transfer of at least one malicious program 11 5 6 2010 Westinghouse information code and command to a Westinghouse computer with hostname 40 Case Document 3 Filed 05 01 14 Page 41 of 56 Date Victim Description of Transmission On or About Transfer of at least one malicious program information code and command to a Westinghouse computer with hostname 12 5 6 2010 Westinghouse Transfer of at least one malicious program information code and command to a Westinghouse computer with hostname 13 12 30 2010 Westinghouse Transfer of at least one malicious program information code and command to a Westinghouse computer with hostname 14 12 30 2010 Westinghouse Transfer of at least one malicious program information code and command to a Westinghouse computer with hostname l5 l 3 2011 Westinghouse Transfer of at least one malicious program information code and command to a Westinghouse computer with hostname l6 l 3 2011 Westinghouse Transfer of at least one malicious program information code and command to a Westinghouse computer with hostname l7 l 5 20ll Westinghouse Transfer of at least one malicious program information code and command to a Westinghouse computer with hostname to l8 l 5 2011 Westinghouse Transfer of at least one malicious program 19 1 31 2012 USW information code and command to a USW computer with hostname 41 Case Document 3 Filed 05 01 14 Page 42 of 56 20 3 7 2012 USW Transfer of at least one malicious program information code and command to a USW computer 2l 4 13 2012 ATI Transfer of at least one malicious program information code and command to an ATI computer with hostname 22 4 13 2012 ATI Transfer of at least one malicious program information code and command to an ATI computer with hostname 23 4 13 2012 ATI Transfer of at least one malicious program information code and command to an ATI computer with hostname lO30 a 5 A All in violation of Title l8 and lO30 c 4 B and 2 42 United States Code Section Case Document 3 Filed 05 01 14 Page 43 of 56 COUNTS TWENTY-FOUR THROUGH TWENTY-NINE Aggravated Identity Theft The Grand Jury further charges 51 The allegations set forth in paragraphs 1-42 and 44 of this Indictment are incorporated herein as if set forth in full 52 Beginning at least on or about December 30 2010 and continuing until at least M1 or about April 12 2012 in the Western District of and elsewhere Defendants WANG DONG a k a Jack Wang a k a UglyGorilla SUN KAILIANG a k a Sun Kai Liang a k a Jack Sun WEN XINYU a k a Wen Xin Yu a k a WinXYHappy a k a a k a Lao Wen HUANG ZHENYU a k a Huang Zhen Yu a k a hzy_lhx and GU CHUNHUI a k a Gu Chun Hui a k a KandyGoo aided and abetted by others known and unknown to the Grand Jury during and in relation to the crime of conspiracy to commit computer fraud in violation of Title 18 United States Code Section 1030 b as more fully set forth in Count One above did knowingly transfer possess and use without lawful authority a means of identification of another person 43 Case Document 3 Filed 05 01 14 Page 44 of 56 53 On or about the dates identified in Column E3 of the chart set forth below each date constituting a separate count as set forth in Column A Defendants did knowingly transfer possess and use without lawful authority a Heans of identification Hf another person listed tut initials 1J1 Column C who was associated with a victim listed in Column D Westin house Westinghouse 26 1 5 2011 Westinghouse 27 1 31 2012 USW 28 3 7 2012 USW 29 4 13 2012 ATI 24 12 30 2010 25 1 3 2011 All in violation of Title 18 United States Code Sections lO28A a l lO28A b lO28A c 4 and 2 44 Case Document 3 Filed 05 01 14 Page 45 of 56 COUNT Economic Espionage The Grand Jury further charges 54 The allegations set forth in paragraphs 1-42 and 44 of this Indictment are incorporated herein as if set forth in full 55 On or about May 6 2010 in the Western District of and elsewhere Defendants WANG DONG a k a Jack Wang a k a UglyGorilla SUN KAILIANG a k a Sun Kai Liang a k a Jack Sun WEN XINYU a k a Wen Xin Yu a k a WinXYHappy a k a a k a Lao Wen HUANG ZHENYU a k a Huang Zhen Yu a k a hzy_lhx and GU CHUNHUI a k a Gu Chun Hui a k a KandyGoo aided and abetted by others unknown to the Grand Jury intending and knowing that the offense would benefit a foreign government instrumentality and agent namely China did knowingly and without authorization copy download upload replicate transmit deliver send mail communicate and convey a trade secret and did attempt to do so specifically a file named wd rar containing proprietary and confidential technical and design specifications owned by Westinghouse which were related 45 Case Document 3 Filed 05 01 14 Page 46 of 56 to the pipes pipe supports and pipe routing within the nuclear power plant All in violation of Title 18 United States Code Sections 183l a 2 and 2 46 Case Document 3 Filed 05 01 14 Page 47 of 56 COUNT Theft of a Trade Secret The Grand Jury further charges 56 The allegations set forth in paragraphs 1-42 and 44 of this Indictment are incorporated herein as if set forth in full 57 On or about May 6 2010 in the Western District of and elsewhere Defendants WANG DONG a k a Jack Wang a k a UglyGorilla SUN KAILIANG a k a Sun Kai Liang a k a Jack Sun WEN XINYU a k a Wen Xin Yu a k a WinXYHappy a k a a k a Lao Wen HUANG ZHENYU a k a Huang Zhen Yu a k a hzy_lhx and GU CI-IUNHUI a k a Gu Chun Hui a k a KandyGoo aided and abetted by others unknown to the Grand Jury with the intent to convert a trade secret to the economic benefit of someone other than Westinghouse and intending and knowing that the offense would injure Westinghouse did knowingly and without authorization copy duplicate download upload replicate transmit deliver send mail communicate and convey a trade secret and attempt to do so specifically a file named wd rar containing proprietary and confidential technical and 47 Case Document 3 Filed 05 01 14 Page 48 of 56 design specifications owned by Westinghouse to the pipes pipe supports and pipe routing namely the nuclear power plant placed in interstate and foreign commerce All in violation of Title 18 United States Sections l832 a 2 and 2 A true bill i DAVI HICKTON Unite States Attorney PA ID NO 34524 48 which were related in ea product that was produced for and Code Case Document 3 Filed 05 01 14 Page 49 of 56 EXHIBIT A Wang Dong a k a Jack Wang a k a UglyGorilla run Case Document 3 Filed 05 01 14 Page 50 of 56 EXHIBIT SUN KAILIANG a k a Sun Kai Liang a k a Jack Sun IA IL 9 PHOTOBYHEX T7 TT 7 Case Document 3 Filed 05 01 14 Page 51 of 56 EXHIBIT WEN XINYU a k a Wen Xin Yu a k a WinXYHappy a k a i a k a Lao Wen Case Document 3 Filed 05 01 14 Page 52 of 56 EXHIBIT HUANG ZHENYU a k a Huang Zhen Yu a k a hzy_lhx Case Document 3 Filed 05 01 14 Page 53 of 56 EXHIBIT GU CI-IUNHUI a k a Gu Chum Hui a k a KandyGoo Case Document 3 Filed 05 01 14 Page 54 of 56 EXHIBIT 030 Dr uaww coil C m I 2293 3 5 3 com mean -33 0355 mza co um 3 van a _aEo 53 Pcob _mEoa 56 953 Case Document 3 Filed 05 01 14 Page 55 of 56 3 3 30 CJWTI I023 1 In nu - 1 36 ass 3 3 com mgm aow we_29_n mac 0 3 an m 8m Em ou 3 tom 52 Aatcsv EmEoa 3a _nacoU 62 Zn 3 52 06 30 Case Document 3 Filed 05 01 14 Page 56 of 56 1953 id 0 05 1 R213 cam 6 3896 we 1 5 3 39 13ran am we ESuua 1 4 3 Em 35 33 uawn 22 I 50 2 5 590 33 can M98 ow AEON oE ok_ man 92 35 ace an m 3a _am ou 5 m _mEo_u 58 P36 can acob Case Document 3-1 Filed 05 01 14 Page 1 of 1 IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF UNITED STATES OF AMERICA v Criminal No WANG DONG a k a Jack Wang UNDER SEAL a k a UglyGorilla CERTIFICATION AND NOTICE FOR FILING PRETRIAL MOTIONS I hereby certify that have Ibeen notified tn the United States Magistrate Judge that all pretrial motions must be filed within fourteen 14 days of Arraignment unless the Court extends the time upon written application made within said fourteen 14 day period Date Attorney for Defendant WANG DONG a k a Jack Wang a k a UglyGorilla Case Document 3-2 Filed 05 01 14 Page 1 of 1 IN THE UNITED STATES DISTRICT COURTS oi FOR THE WESTERN DISTRICT OF UNITED STATES OF AMERICA V Criminal 1 SUN KAILIANG a k a Sun Kai UNDER SEAL 1 Liang a k a Jack Sun CERTIFICATION AND NOTICE FOR FILING PRETRIAL MOTIONS I hereby certify that IE have ibeen notified tn the United States Magistrate Judge that all pretrial motions must be filed within fourteen 14 days of Arraignment unless the Court extends the time upon written application made within said fourteen 14 day period Date Attorney for Defendant SUN KAILIANG a k a Sun Kai Liang a k a Jack Sun Case Document 3-3 Filed 05 01 14 Page 1 of 1 IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF UNITED STATES OF AMERICA V WEN XINYU a k a Wen Xin Yu a k a WinXYHappy a k a a k a Lao Wen Criminal No UNDER SEAL CERTIFICATION AND NOTICE FOR FILING PRETRIAL MOTIONS I hereby certify that 12 have been notified kxy the United States Magistrate Judge that all pretrial motions must be filed within fourteen Court extends said fourteen l4 Date 14 days of Arraignment unless the the time upon written application made within day period Attorney for Defendant WEN XINYU a k a Wen Xin Yu a k a WinXYHappy a k a a k a Lao Wen Case Document 3-4 Filed 05 01 14 Page 1 of 1 IN THE UNITED STATES DISTRICT COURT pA_ FOR THE WESTERN DISTRICT OF I UNITED STATES OF AMERICA v Criminal No 8 HUANG ZHENYU a k a Huang Zhen UNDER SEAL Yu a k a hzy_lhx CERTIFICATION AND NOTICE FOR FILING PRETRIAL MOTIONS I hereby certify that ll have been notified by the United States Magistrate Judge that all pretrial motions must be filed within fourteen l4 days of Arraignment unless the Court extends the time upon written application made within said fourteen 14 day period Date Attorney for Defendant HUANG ZHENYU a k a Huang Zhen Yu a k a hzy_lhx I A Case Document 3-5 Filed 05 01 14 Page 1 of 1 IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF UNITED STATES OF AMERICA v Criminal GU CHUNHUI a k a Gu Chun Hui UNDER SEAL a k a KandyGoo CERTIFICATION AND NOTICE FOR FILING PRETRIAL MOTIONS I hereby certify that 12 have ibeen notified the United States Magistrate Judge that all pretrial motions must be filed within fourteen 14 days of Arraignment unless the Court extends the time upon written application made within said fourteen 14 day period Date Attorney for Defendant GU CHUNHUI a k a Gu Chun Hui a k a KandyGoo Case Document 3-6 Filed 05 01 14 Page 1 of 1 IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF UNITED STATES OF AMERICA V Criminal WANG DONG a k a Jack Wang UNDER SEAL a k a UglyGorilla ARRAIGNMENT PLEA Defendant WANG DONG a k a Jack Wang a k a UglyGorilla being arraigned pleads in open Court this day of 20 14 Defendant's Signature H 5' Attorney for Defendant Case Document 3-7 Filed 05 01 14 Page 1 of 1 IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF UNITED STATES OF AMERICA v Criminal No SUN KAILIANG a k a Sun Kai UNDER SEAL Liang a k a Jack Sun ARRAIGNMENT PLEA Defendant SUN KAILIANG a k a Sun Kai Liang a k a Jack Sun being arraigned pleads in open Court this day of 20 14 Defendant's Signature Attorney for Defendant j 1 1T Case Document 3-8 Filed 05 01 14 Page 1 of 1 IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF UNITED STATES OF AMERICA v Criminal No WEN XINYU a k a Wen Xin Yu UNDER SEAL a k a WinXYHappy a k a a k a Lao Wen ARRAIGNMENT PLEA Defendant WEN XINYU a k a Wen Xin Yu a k a WinXYHappy a k a a k a Lao Wen being arraigned pleads in open Court this day of 20 14 Defendant's Signature Attorney for Defendant Case Document 3-9 Filed 05 01 14 Page 1 of 1 IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF UNITED STATES OF AMERICA v Criminal No HUANG ZHENYU a k a Huang Zhen UNDER SEAL Yu a k a hzy_lhx ARRAIGNMENT PLEA Defendant HUANG ZHENYU a k a Huang Zhen Yu a k a hzy_1hx being arraigned pleads in open Court this day of 20 14 Defendant's Signature Attorney for Defendant Case Document 3-10 Filed 05 01 14 Page 1 of 1 IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF UNITED STATES OF AMERICA Qriminai No GU CHUNHUI a k a GU Chum Hui UNDER SEAL a k a KandyGoo ARRAIGNMENT PLEA Defendant GU CHUNHUI a k a Gu Chum Hui a k a KandyGoo being arraigned pleads in ope Court this day of 20 14 Defendant's Signature Attorney for Defendant Case Document 3-11 Filed 05 01 14 Page 1 of 2 CRIMINAL CASE INFORMATION SHEET Pittsburgh Erie Johnstown Related to No Judge All criminal prosecutions arising out of the same criminal transaction or series of transactions are deemed related CATEGORY 1 Narcotics and Other Controlled Substances la and Other Controlled Substances 3 or more Defendants 2 and Property Offenses 2a Fraud and Property Offenses 3 or more Defendants 3 Crimes of Violence 4 Sex Offenses 5 Firearms and Explosives 6 Immigration 7 All Others Defendant's name WANG DONG Is Indictment waived Yes No Pretrial Diversion Yes No Juvenile proceeding Yes No Defendant is Male Female Superseding Indictment or Information Yes NO Previous case number If superseding previous case was will be Dismissed on defendant's motion Dismiss on governments motion After appellate action Other explain County in which first offense cited occurred Allegheny County Previous proceedings before Magistrate Judge Case No PLEASE INCORPORATE MAGISTRATE CASE WITH CRIMINAL CASE Case Document 3-11 Filed 05 01 14 Page 2 of 2 Date arrested or date continuous U S Defendant Name of Institution Custody is on Detainer filed Date detainer filed Total defendants Total counts Data below applies to defendant No Defendant's name COUNT U S cooa 1 18 U S C 1030 b 2-9 18 S C 1o3o a 2 c 2 10-23 18 U S C lO30 a 5 A 2 24-29 18 U S C lO28A a l 2 30 18 U S C l83l a 2 2 31 18 U S C l832 a 2 2 custody began is not in custody is in custody this charge another charge another conviction State Federal yes no 31 WANG DONG SUMMARY OF COUNTS OFFENSE FELONY Conspiracy to Commit Computer Fraud Illegal Access Obtaining Information from a Protected Computer Intentional Damage to a Protected Computer Aggravated Identity Theft Economic Espionage Theft of Trade Secrets I certify that to the best of my knowledge the above entries are true and correct 12 88-3-9-zewf DATE MAY 0 1 20M As ant U S Attorney JA KITCHEN PA ID No 308565 MI I Case Document 3-12 Filed 05 01 14 Page 1 of 2 CRIMINAL CASE INFORMATION SHEET Pittsburgh Erie Johnstown Related to No Judge All criminal prosecutions arising out of the same criminal transaction or series of transactions are deemed related CATEGORY 1 and Other Controlled Substances la and Other Controlled Substances 3 or more Defendants 2 and Property Offenses 2a Fraud and Property Offenses 3 or more Defendants 3 Crimes of Violence 4 Sex Offenses 5 Firearms and Explosives 6 Immigration 7 All Others Defendant's name SUN KAILIANG Is Indictment waived Yes No Pretrial Diversion Yes No Juvenile proceeding Yes No Defendant is Male Female Superseding Indictment or Information Yes No Previous case number If superseding previous case was will be Dismissed on defendant's motion Dismiss on governments motion After appellate action Other explain H1 County in which first offense cited occurred Allegheny County Previous proceedings before Magistrate Judge Case No PLEASE INCORPORATE MAGISTRATE CASE WITH CRIMINAL CASE Case Filed I%F3ag%ey2yQf2 Date arrested or date continuous U S custody began Defendant is in custody is not in custody Name of Institution Custody is on this charge another charge another conviction Detainer filed Date detainer filed Total defendants Total counts Data below applies to defendant No _jL_ Defendant's name SUN KAILIANG SUMMARY OF COUNTS COUNT U S CODE OFFENSE FELONY 18 U S C lO30 b Conspiracy to Commit Computer Fraud 2-9 18 U S C l030 a 2 C Illegal Access Obtaining Information 2 from a Protected Computer 10-23 l8 U S C l030 a 5 A Intentional Damage to a Protected 2 Computer 24-29 18 U S C 1028A a l Aggravated Identity Theft CH4 2 30 l8 U S C l83l a 2 Economic Espionage 2 31 18 U S C l832 a 2 Theft of Trade Secrets 2 2 I certify that to the best of my know dge the above entries are true and correct DATE2014 JA KITCHEN As i ant U S Attorney I PA No 308565 Tiimiww Case Document 3-13 Filed Page1of2 CRIMINAL CASE INFORMATION SHEET Pittsburgh Erie Johnstown Related to No Judge All criminal prosecutions arising out of the same criminal transaction or series of transactions are deemed related CATEGORY l _ __Narcotics and Other Controlled Substances la __mwNarcotics and Other Controlled Substances 3 or more Defendants 2 and Property Offenses 2a Fraud and Property Offenses 3 or more Defendants 3 Crimes of Violence 4 Sex Offenses 5 Firearms and Explosives 6 Immigration 7 All Others Defendant's name WEN XINYU Is Indictment waived Yes No Pretrial Diversion Yes No Juvenile proceeding Yes No Defendant is Male Female Superseding Indictment or Information Yes NO PJSEVIOUS case number If superseding previous case was will be Dismissed on defendant's motion Dismiss on governments motion After appellate action Other explain County in which first offense cited occurred Allegheny County Previous proceedings before Magistrate Judge Case No PLEASE INCORPORATE MAGISTRATE CASE WITH CRIMINAL CASE all COUNT U S Case Document 3-13 Filed 05 01 14 Page 2 of 2 Date arrested or date continuous U S Custody began Defendant is in custody Name of Institution is not in custody Custody is on this charge another charge another conviction Detainer filed Date detainer filed Total defendants Total counts Data below applies to defendant No _ iW Defendant's name WEN XINYU SUMMARY OF COUNTS CODE OFFENSE 1 18 U S C 1030 b Conspiracy to Commit Computer Fraud 2-9 18 U S C lO30 a 2 C Illegal Access Obtaining Information 2 from a Protected Computer 10-23 18 U S C 1030 a 5 A Intentional Damage to a Protected 2 Computer 24-29 18 U S C 1028A a 1 Aggravated Identity Theft 2 30 18 U S 183l a 2 Economic Espionage 2 31 18 U S 1832 a 2 Theft of Trade Secrets 2 I certify that to the best of my knowledge the above entries are true and correct JAM I KITCHEN 20 Ass U S Attorney PA I No 308565 DATE FELONY Case Document 3-14 Filed 05 01 14 Page 1 of 2 CRIMINAL CASE INFORMATION SHEET Pittsburgh Erie Johnstown I Related to No Judge All criminal prosecutions arising out of the same criminal transaction or series of transactions are deemed related CATEGORY l and Other Controlled Substances la and Other Controlled Substances 3 or more Defendants PH 2 and Property Offenses 2a Fraud and Property Offenses 3 or more Defendants 3 Crimes of Violence 4 Sex Offenses 5 Firearms and Explosives 6 Immigration 7 All Others Defendant's name HUANG ZHENYU Is Indictment waived Yes No Pretrial Diversion Yes No Juvenile proceeding Yes No I Defendant is Male Female Superseding Indictment or Information Yes No Previous case number _ If superseding previous case was will be Dismissed on defendant's motion Dismiss on governments motion After appellate action Other explain County in which first offense cited occurred Allegheny County Previous proceedings before Magistrate Judge Case No PLEASE INCORPORATE MAGISTRATE CASE WITH CRIMINAL CASE Case Document 3-14 Filed 05 01 14 Page 2 of 2 Date arrested or date continuous U S custody began A - -V Defendant is in custody is not in custody Name of Institution Custody is on this charge another charge another conviction State Cr derai Detainer filed _1 _no Date detainer filed Total defendants _Ji_ Total counts Data below applies to defendant No Defendant's name HUANG ZHENYU SUMMARY OF COUNTS COUNT U S CODE OFFENSE FELONY 1 18 U S C 1030 b Conspiracy to Commit Computer Fraud 2-9 18 U S C 1030 a 2 C Illegal Access Obtaining Information 2 from a Protected Computer 10-23 18 U S C 1030 a 5 A Intentional Damage to a Protected 2 Computer 24-29 18 U S C 1028A a 1 Aggravated Identity Theft 2 30 18 U S C 1831 a 2 Economic Espionage 2 31 18 U S C l832 a 2 Theft of Trade Secrets 2 I certify that to the best of my knowledge the above entries are true and correct - DATE 7 I KITCHEN MAY 0 1 Z014 Assi nt U S Attorney 1-w ws PA I No 308565 it rt Case Document 3-15 Filed 05 01 14 Page 1 of 2 CRIMINAL CASE INFORMATION SHEET Pittsburgh Erie Johnstown Related to No Judge All criminal prosecutions arising out of the same criminal transaction or series of transactions are deemed related CATEGORY l and Other Controlled Substances la and Other Controlled Substances 3 or more Defendants - 2 and Property Offenses 2a Fraud and Property Offenses 3 or more Defendants 3 Crimes of Violence 4 Sex Offenses 5 Firearms and Explosives 6 Immigration 7 All Others Defendant's name GU CHUNHUI Is Indictment waived Yes No Pretrial Diversion Yes No Juvenile proceeding Yes No Defendant is Male Female Superseding Indictment or Information Yes NO PIGVIOLIS case number If superseding previous case was will be Dismissed on defendant's motion Dismiss on governments motion After appellate action Other explain County in which first offense cited occurred Allegheny County Previous proceedings before Magistrate Judge Case No PLEASE INCORPORATE MAGISTRATE CASE WITH CRIMINAL CASE Case Document 3-15 Filed 05 01 14 Page 2 of 2 Date arrested or date continuous U S Defendant Name of Institution Custody is on Detainer filed Date detainer filed Total defendants Total counts Data below applies to defendant No Defendant's name custody began C 2 1 COUNT U S coon 1 18 u s c lO30 b 2-9 18 u s c lO30 a 2 10-23 18 u s c 2 24-29 18 U S C lO28A a l 2 30 18 U S C l83l a 2 2 31 18 U S C l832 a 2 2 true and correct DATE we-H-2944-F is in custody is not in custody this charge another conviction another charge __ _Federal ill 31 GU CHUNHUI SUMMARY OF COUNTS OFFENSE FELONY Conspiracy to Commit Computer Fraud Illegal Access Obtaining Information from a Protected Computer Intentional Damage to a Protected Computer Aggravated Identity Theft Economic Espionage Theft of Trade Secrets MAY 0 1 201 4 JAME I KITCHEN Ass's nt U S Attorney PA I 0 308565