Update: On June 23, Shapour Moinian, some nine months after being charged, pleaded guilty to lying on his SF-86 and to being a paid unregistered agent of the government of China. Moinian compromised a number of defense aviation projects and sold U.S. technologies to China.
“The People’s Republic of China remains determined to acquire our information and technology. In this case, we witnessed a former U.S. Government employee acting as an agent of the government of China and Chinese intelligence officers’ extensive use of social media to identify willing targets,” said Assistant Director Alan E. Kohler Jr. of the FBI’s Counterintelligence Division.
On October 4, Shapour Moinian, a defense contractor was charged in federal court for making false statements on his SF-86 in 2017 and again in 2020, with respect to his covert relationship with a Chinese national and their “paid client-consultant” relationship. The Department of Justice (DOJ) notice, indicates that both the FBI and NCIS are continuing the investigation into Moinian’s actions involving this individual and his providing information to China.
While the SF-86 Questionnaire for National Security Background Investigations contained falsehoods concerning his contact with foreign nationals and his engaging in consulting work, these charges appear to be the tip of the proverbial iceberg.
When arrested on October 1, Moinian was working for another cleared defense contractor and slated to “relocated to South Korea to work on military aircraft being produced for that country.”
FBI Special Agent, in Charge, Suzanne Turner observed, “This case serves as a stark reminder of the social media exploitation strategies Chinese intelligence agencies will utilize to target, recruit, and maintain contact with valuable foreign assets. Let this arrest serve as a deterrent to those who may consider hiding their foreign contacts in the hopes they can live a double-life and not get caught.”
How Moinian came to China’s attention
In a twist, according to the affidavit in support of DOJ’s criminal complaint, in May 2015, Moinian reached to connect to the “Executive Manger at DRHR, located in Hangzhou, Zhejiang, China via a “popular American online employment service”. What followed could have been used as the real-life case study provided by the National Counterintelligence and Security Center and the FBI in their video “The Nevernight Connection.”
Not surprising, this was viewed as a fish nibbling on the hook, and the Chinese executive (not identified) accepted the connection and immediately asked Moinian if he was “interested in part-time consultancy offer for our projects. If so we can have a further discussion” to which Moinian responded “Yes, Yes, and Yes :)”. She (the executive) followed-up with how a consultancy may be available, but explained that it would require his travel to China at DRHR’s expense for interviews.
This invitation, according to the affidavit, triggered Moinian’s recognition that what was being offered was out-of-bounds and told her, his “security clearance prevented him from supporting ‘non-U.S. person or companies'” Taking it in stride, she suggested the two remain in touch.
Fast forward to June 2016, the executive re-initiates contact with Moinian through the same online service. She uses a different name at this time and is now a “Technical Recruiter at LinkTek Technical Services” in Hangzhou. In reinitiating the contact, she moves to place Moinian back on the hook, which he wriggled off of in 2015. Her note says, she knows he works as a defense contractor and offered him an opportunity to consult in the aviation industry. She invited him to China, again, at her company’s expense for interviews, for an unidentified project.
China lands MoInian
The affidavit goes on to describe Moinian’s trip to Hong Kong between March 26-31, 2017 and his communications with the U/I female (Conspirator A), using email and an encrypted application on Moinian’s phone. In June 2017, he purchased tickets for a trip to South Korea in September. Shortly thereafter, he advises his Chinese interlocutor that he is filing for divorce and how he looked forward to their meeting during his vacation. In August, Moinian is asked if he uses various encrypted messaging platforms and moves to segue their contact to an encrypted app. On September 7, 2017, Moinian flew to South Korea to visit his step-daughter with a stop-over in Shanghai and returned to the United States on September 20.
In late-March 2018, he traveled to Hong Kong for 10 days where it is believed he met with his Chinese contact. When her returned, he evidenced that he knew exactly what was going on, as his internet search history showed him conducting open-source searches: “sabotage vs spying,” “espionage vs sabotage,” and “selling military information to foreign country is considered as.”
In late-May 2018, Moinian changed employers. A month later, in late-June, he asked the Chinese for $20,000 for a friend and asked “send it to my Korean family as usual in three deposits.” Moinian’s step-daughter’ resides in South Korea, and it was via her bank account which China wired funds (in threes):
- 2017: $3000 (October 11), $3,000 (October 12), $1600 (October 18).
- 2018: $7846.76 (June 1), $3888.99 (July 12), $2600 (August 20).
Additionally, as seen in the Kevin Mallory case, Moinian was issued a phone for use in communicating with his Chinese contacts.
The investigation into Moinian
The FBI and NCIS investigation into Moinian’s activities continues. The affidavit shows interviews with both his step-daughter (in Korea) and his wife (in the United States) occurred on October 1.
The step-daughter advised that Moinian had requested she allow funds to be deposit and that she then transfer them to the United States to Moinian. She was told that Moinian was being paid for consulting work.
The wife revealed how he had “met often with Conspirator A and/or colleagues in various countries, including China, Taiwan, Bali and South Korea, where he would receive cash payments in addition to payments that were funneled through his step-daughter’s South Korean account.” The wife continued how these trips, which occurred between 2017 and 2019 and that the two of them (Moinian and his spouse) would divide the money between them when carrying the funds back into the U.S.
As this case unravels, more will be learned of China’s continued development of their methods utilizing sites like LinkedIn to make themselves available for contact, while also initiating contact and their willingness to meet with their “consultants” in locales other than Hong Kong and China.
