In a turn of events which doesn’t often come to the forefront, the Department of Justice unsealed the criminal complaint against Edward Peng, aka Xuehua Peng a U.S. citizen resident in Hayward, CA, for his role supporting espionage between a U.S. double agent located in the United States and the Chinese Ministry for State Security (MSS) in China.
Peng a sleeper intelligence officer or a classic support asset?
Peng entered the U.S. in June 2001 as a non-immigrant worker and in 2006 was issued lawful permanent residence. He became a naturalized citizen in September 2012.
Peng, a U.S. citizen, was an individual who could move about the country without drawing undue attention, whereas a MSS officer assigned to the San Francisco mission or Washington embassy of the PRC would most likely come to the attention of the FBI. What we don’t know is whether Peng was an individual sent to the U.S. under non-official cover, with the mission to ingratiate himself into the U.S., acquire citizenship and when called upon to act as a handler for sensitive human source of the MSS – which apparently was the case of a Chinese citizen who recently attempted to infiltrate the U.S. Army reserves.
Or perhaps, Peng was simply an individual who caught the eye of the MSS and was recruited by the Chinese some time ago.
What we do know is that he enjoyed the full trust of the MSS, given they had him service the intelligence collection from a valued asset with whom they wished to distance themselves.
Chinese tradecraft
Peng acted as the middle-man cutout and would retrieve materials from sources and in return leave funds as directed by the MSS.
In this instance, the MSS and Peng used a modified dead-drop scenario. Peng and the MSS used hotels as their location of choice, both utilizing the front desk of establishments and hotel rooms rented by Peng. As with any dead-drop, the source and handler (Peng) would have to be at the same place, though at different times.
The use of hotels, however, no doubt left behind a significant paper trail (room rentals normally do) and no doubt video evidence (every hotel has video surveillance in 2019).
As the operation evolved, the folly of the use of hotels would be revealed when the U.S. double-agent was asked to produce identification at one of the hotels.
U.S. double agent provides counterintelligence bonanza
Successful offensive counterintelligence operations often times uncover both requirements and infrastructure of the targeted entity. Chinese intelligence has picked up its pace, targeting U.S. interests, and is always playing the long game when it comes to intelligence collection efforts against the U.S.
In this case, U.S. intelligence initiated a human intelligence (HUMINT) operation in March of 2015. A U.S. double-agent (a trusted individual acting on behalf of the U.S.) met with MSS intel officers and provided to them classified national security information, and received financial payments in return. This initial meeting occurred outside the U.S.
It was at this initial meeting that the MSS revealed their modus operandi of the quasi-dead drop. They instructed the double-agent to put classified information on an Secure Digital card (SD), place the card in a book, wrap it in a bag and mark the package for “Ed.” Then leave the package at the front desk of a Newark, CA hotel. They asked that the first use of the methodology be a dry-run without any classified information being shared. On 13 June 2015 at about 0830 hours the double-agent entered the hotel, spoke with the receptionist and left a package for Ed. At approximately 1010 hours a California plated Mercedes pulls up and an Asian male (Peng) entered the hotel and retrieved the package. The vehicle was registered to an associate of Peng’s, who resided at the same Hayward, CA residence.
On 25 October 2015 the above scenario was replayed with live classified feed materials. Peng retrieved the package and then flew China Air from San Francisco non-stop to Beijing on 25 October 2015. Now with confirmation that Peng as indeed operational, the FBI dug deeper. The Call Data Records obtained on Peng’s phone number showed contact with the MSS. His iCloud account provided information on his contacts and when the contact entries were created. He had numerous ones dating back to 2012.
In November 2015 the double agent again had personal contact with the MSS. They modified the above process for future exchanges. The modification had the double agent advising via email when he had something to deliver. He was to proceed to Oakland, CA and go to a specific hotel (which coincidentally was partially owned by a relative of Peng’s) between 1600-1800 hours and to go to the front desk and ask for the “Key left by Ed.” Then the double agent was to proceed to the room and place the card (concealed in a small package) taped in the dresser under the room’s television. At that location there would be a package for the double-agent which contained funds.
This second scenario was replayed both in Oakland in April 2016 and then shifted to Columbus, GA. in July and September 2017, then again in June 2018. The move to Georgia was to accommodate the double agent’s “complaint” that San Francisco was too far to travel. It also served to make the MSS engage in additional espionage support tasks, which could possibly reveal additional resources available to the MSS. In addition the hotel in Georgia had no family connection to Peng and thus the FBI could mount their counterintelligence surveillance and collection efforts with little risk of discovery.
And that is exactly what the FBI did.
During the Columbus, GA exchanges the FBI had clandestinely video taped the activities within the hotel rooms used by Peng and the double agent. They witnessed Peng’s placement of envelopes with money and then the double agent’s collection of the envelopes and depositing the SD cards. Peng would then return and collect the SD card, and return to California and then shortly thereafter fly onward to China with the SD card to deliver it to the MSS.
U.S. Attorney David L. Anderson for the Northern District of California summed it nicel, “The conduct charged in this case alleges a combination of age-old spycraft and modern technology. Defendant Xuehua (Edward) Peng is charged with executing dead drops, delivering payments, and personally carrying to Beijing, China, secure digital cards containing classified information related to the national security of the United States.”
The DoJ advises on Friday, September 27 2019, Peng was arrested at his residence in Hayward and made his initial appearance in federal court in San Francisco. He is being held without bond and his next hearing is scheduled for October 2, 2019, at 10:30 a.m.
