8 ms·
Federal Charges Against Stanford University Researcher Expanded
- Raymondfx 6y agoGrand Jury Adds Obstruction, Alteration of Records, and False Statements to Visa Fraud Charges Against Visiting Researcher Alleged to Be Member of China’s People’s Liberation Army
- kevinventullo 6y agoThe superseding indictment alleges that she then attempted to delete a digital folder of documents on an external hard drive that she possessed containing records relating to her military service and visa fraud, including: - A digital version of a letter from Song, written in Chinese and addressed to the People’s Republic of China consulate in New York, in which Song explained that her stated employer, “Beijing Xi Diaoyutai Hospital” was a false front, and that because relevant approval documents were classified, she had attempted to mail them; - An image of Song’s PLA credentials, with a photograph of her in military dress uniform, covering the time period from July 2016 to July 2020; and - A digital version of a resume for Song, written in Chinese, again with a photograph of her in military dress uniform and listing her employer as the Air Force General Hospital. Yikes, that sounds pretty damning. I’m not an expert in digital forensics but I wonder why she wouldn’t destroy the hard drive after. Or is that not enough?
- lopatin 6y agoFollow up question, as someone who knows even less about forensics, what kind of traces stay on a hard drive if you just delete a file?
- aliceryhl 6y agoGenerally when you just delete a file, its contents are marked as "unused", but not actually erased. This is why deleting a large file takes the same time as deleting a small file. Then, whenever a new file is created, it might be put (partially) on top of the old file, overwriting the old contents for good.
- bsamuels 6y agothe whole file is still there until it gets overwritten by new data
- bsder 6y agoA lot. You need to write a drive with zeros(minimum)/random data(preferably) at least once to make forensic recovery difficult. I know all about the "5 times" rule, but I've never heard of anyone recovering a drive after even a single overwrite. Personally, I just hammer a screwdriver through the platter. It generally converts it into glass shards--the drive sounds like a maraca afterward. Flash, of course, is different. I suspect that writing zeros/random once is probably enough. However, I tend to just use diagonal cutters and slice through the chips. If someone wants to reconstruct my drive after I've physically destroyed it, they've probably got enough money to just fabricate the evidence against me anyway.
- desine 6y agoI have a few HDs with bullet holes in them, and the platters are still intact. I've messed around with a lot of drives and never shattered a disk like glass. I've heard that there's labs that specialize in reading disks without even needing to spin them, but information seems to be tightly guarded about the processes.
- daniel_reetz 6y agoThe platters I've seen are aluminum alloy.
- deleted 6y ago[deleted]
- astrange 6y ago> Flash, of course, is different. I suspect that writing zeros/random once is probably enough. SSDs won't necessarily actually erase a block when you tell them to, due to wear-leveling and weird internal RAID setups they could be doing anything in there.
- Jtsummers 6y agohttps://en.wikipedia.org/wiki/Data_remanence https://en.wikipedia.org/wiki/Data_remanence That link has a bit more, but the main issue is what the others wrote. Deleting a file from your disk may not actually delete it. It can leave an entry in the file system that marks it as deleted (for undeletion later) or it may just remove the entry, in which case the data is still on the disk and recoverable.
- Sylamore 6y agoOn most file systems, just deleting a file simply deletes the link between the filename and the data on disk, the actual data remains fully intact until the blocks are overwritten by new data. It's trivial to recover recently deleted files, and often not much more effort to recover less recently deleted files. It only becomes a challenge if the data has been long deleted or was intentionally overwritten before deletion (or the disk wiped using random data), in some cases becoming effectively impossible to recover.
- desine 6y agoThe file is still there. A regular delete just tells the disk that the segments of memory are available to be overwritten. Zeroing out (or /dev/urandom) the memory is an option, but even that is not 100% safe, especially when it comes to forensic labs with the ability to read and analyze platters removed from a complete, sealed disk. Really safe deleters will overwrite the segments of memory multiple times to scramble magnetic signatures
- noir_lord 6y agoThe world has moved on. You can’t transplant a platter into another reader, the old days of Guttman method don’t really apply anymore, density is so high that outside of research settings it’s just not practical. That said I still put a drill through mine before disposing of them, because close to zero isn’t zero.
- XorNot 6y agoThe reality though is we have no idea what's possible here: we just know what's not commercially viable to offer as a service. HDD recovery research is almost certainly a well-funded area of intelligence services, so I imagine their are a few electron microscopes and STMs which can do it. There's certainly no military data destruction guide which doesn't start with "shred the platter to this grain size".
- layoutIfNeeded 6y ago>You can’t transplant a platter into another reader Then why do I get tons of results on YouTube of people doing exactly that, when searching for “HDD transplant”?
- Judgmentality 6y agoI typed it into YouTube and every result (of the first dozen or so) is years old, including the most recent video citing an example where it's impossible. https://www.youtube.com/watch?v=bml8ovt4nfI https://www.youtube.com/watch?v=bml8ovt4nfI
- HarryHirsch 6y agoWhat exactly do they have on the lady, except that she is an officer in the PLA? OK, she's wearing uniform and is employed at a military hospital, but members of the US Medical Corps are officers at military hospitals. It's easy to understand why a physician might wish to work in brain disease. What secrets were exfiltrated?
- syops 6y agoFrom the article: "Members of the Chinese People's Liberation Army cannot lie on their visa applications and come to the United States to study without expecting the FBI and our partners to catch them." said Assistant Director Alan E. Kohler Jr. of the FBI's Counterintelligence Division. "Time and again, the Chinese government prioritizes stealing U.S. research and taking advantage of our universities over obeying international norms." It doesn't matter if she was unsuccessful at exfiltrating secrets. What matters is that, apparently, she's an agent of a foreign government who lied about said affiliation on her application for a visa.
- dogma1138 6y agoThis is what foreign nationals are prosecuted for when it comes to espionage - failure to declare yourself as a foreign agent. Most espionage laws are only directly applicable to citizens of the state in question.
- kevinventullo 6y agoI’m not sure what else, but this alone would prove she lied on her Visa application and lied to authorities in an interview. From the article: If convicted, she faces a maximum statutory penalty of up to 10 years in prison and a fine of $250,000 for the visa fraud count; up to 20 years in prison and a fine of $250,000 for each of the obstruction and alteration charges; and up to five years in prison and a fine of $250,000 for the false statements charge.
- HarryHirsch 6y agoThe point is: why bother prosecuting that crap when patently no state secrets are involved? Why not simply revoke the visa, deport the person and ban her from re-entry? Do they want to create uncertainty for people who have served in the PLA or generally discourage Chinese researchers from working in the US? The purpose of the exercise is wholly unclear! What is the Department of State up to?
- notadev 6y agoThe FBI probably had a copy of the drive prior to her ever realizing she was under investigation. They have some pretty advanced physical access methods, even having cans of spray able dust to ensure nothing looks disturbed.
- ManBlanket 6y agoAfter reading these charges it sounds like less of a spy situation and more of an unfortunate past she was knew would conflict with her current goal of getting the F out of China. I'm pretty skeptical because like most cases involving state security, this one involves a desperate rube and a grandiose story that'll bolster some agents' careers. Maybe she didn't think her service was that relevant to working in neurology, but destroying a hard drive would make it seem like she was really a spy? Like she'd rather everyone forget about it because it never should have been of concern to begin with. I have neglected to check the, "Have you ever been charged with a crime?" box on job applications and if for some reason my mug shots were hanging about my workstation I'd throw them in the trash. Maybe I can or can't relate but I see why someone would go to some effort to keep something like that from coming to light without committing to the foregone conclusion implied by the charges. To be honest this story seems barely newsworthy, I have known a lot of grad students who lie on their Visa documents. But in this day and age people want to read news about Chinese spies being deported, so god help her that's what the news is going to report.
- throwawaysea 6y agoHow widespread are cases like this? I'm not an expert on this topic but from reading this it feels like such an investigation is expensive and time consuming. I imagine for every person identified there must be many more whose secret affiliations with the foreign powers won't be uncovered.
- iscrewyou 6y agoOn the other hand, I also wonder how easy it is to connect her, ways of doing things, contacting other people, to other secret entities. And they can even watch anyone who was spooked after the news and anyone who went silent. Because detection works both ways. I recently read somewhere that secret angencies likely watch suspects and see when they turn off their phones or when they turn them back on for example when they have a meeting. This is a good way to narrow in on other people connected to the suspect by watching their patterns.
- FpUser 6y agoWas she out of her mind keeping this kind of stuff? Can't believe the stupidity.
- xyzzyz 6y agoProbably she thought she’ll get away with it, like thousands of her colleagues have.
- crb002 6y agoSeems a bit racist. Israel/Finland/Germany all have universal conscription so they don't get harassed like the Chinese.
- Jtsummers 6y agoAs I understand it, the issue is the false claims in the visa application more than the military service. If they'd known she was an (apparently) active member of the Chinese military, she wouldn't have gotten the visa in the first place. In her visa application she admitted to prior military service and still received the visa so military service itself is not a fundamental blocker for Chinese visa applicants.
- nradov 6y agoThis is one reason why US visa application forms include a question which basically asks "Are you a spy?". Which might seem silly because obviously a real spy would never answer yes. But the real point of the question is that if the government finds later that someone lied on the form it becomes easier to charge them with a crime or deport them. Edit: some of you take comments way too literally so for your benefit here is the exact question on form DS-160. "Do you seek to engage in espionage, sabotage, export control violations, or any other illegal activity while in the United States?"
- thaumasiotes 6y agoThe system described sounds like a terrible idea. In order to prove someone lied on the form when they said "No" to "Are you a spy?", you have to prove they're a spy. At that point, you're free to deport them; the form is irrelevant.
- hn_throwaway_99 6y agoNo, it's not that simple. The question isn't literally "are you a spy", I'm sure it's a more relaxed version, e.g. "have you ever been employed by a foreign government" or some such. The point is to lower the barrier of proof. The government doesn't have to prove someone is an actual "spy", with the gray area that can entail, only that they lied on the form. It's a similar idea behind the recent "Have you traded in any cryptocurrency" IRS question on tax returns. The idea is that it prevents anyone from claiming ignorance as to their responsibilities to disclose.
- president 6y agoFor every one of these cases, there are likely tons more that have gone undetected. Our open institutions don't work in a world filled with rich nation states with bad intentions and a populace and politicians totally misinformed about the current threat and/or unwilling to do anything about it. China has bested the US and we should at least be honest about it.
- thaumasiotes 6y ago> Our open institutions don't work in a world filled with rich nation states with bad intentions How does that sentiment apply here? Suppose the maximum possible malice on the part of the CCP, the PLA, and Song Chen. What could they have accomplished by getting a neurologist into a research project?
- refurb 6y agoStealing IP that rightfully belonged to Stanford, starting their own institute in China based on it and then owning the entire field?
- thaumasiotes 6y agoThe concept of "stealing IP that rightfully belonged to Stanford" does not obviously apply to a research university. There is no way for Stanford to claim ownership of research IP without publishing that IP. If the CCP wants to steal it, they can read Stanford's papers. Then, on a more fundamental level, the more people who know how to do neurology research, the better. There's no way for the world to be made worse through too much neurology research. The more they do in China, the less everyone else needs to do everywhere else. But the even more important problem with your scenario is that it is completely unaffected by whether, at the time she's studying at Stanford, Song Chen is also on the PLA payroll. Learning Stanford's research methods and then moving on with their lives is the entire point of anyone joining a research project at Stanford. If she hadn't been formally employed by the PLA, she would have been not just entitled, but expected to do everything you just described. And it was fine in that hypothetical case. She got a permit specifically allowing her to do it. So why isn't it fine here?
- rbetts 6y agoI wonder if other industrial-revolution monopolies in history also led to corporate-disobedience - akin to civil disobedience - where employees intentionally break rules considered unethical.
- renewiltord 6y agoHaha, their spies are undone by their bureaucrats. Amazing.
- thaumasiotes 6y agoI have to admit, I wonder why she needs to submit documentation to the consulate specifying that Beijing Xi Diaoyutai Hospital is a front for PLA-employed doctors. Shouldn't they know?
- renewiltord 6y agoConsidering I've definitely been part of businesses which self information about some company back to them, I wouldn't be surprised if they just didn't.
- thaumasiotes 6y agoWell, there are several scenarios: - The consulate has no need for the information about an expat's employer, and never reads it. - The consulate checks up on the employer information for some reason best known to them. Maybe they call the employer and ask "does this person work for you?" Or maybe they look up the employer in some kind of database. Or maybe they already know the employer and automatically recognize the name. But there's no case where the expat needs to submit secondary documentation saying how her official employment is a false front. No matter what happens, that information should be delivered to the consulate, if they need it, by some other means. They could answer the phone at Beijing Xi Diaoyutai and say "yes, she works here". Or they could have a special diplomatic database entry. Or the consulate staff might deal with them all the time and recognize the Beijing Xi Diaoyutai name. What purpose is served by sending the information through the expat?
- renewiltord 6y agoMaybe there's no channel. Incompetent bureaucracies are usually like that. There is simply no way for someone in arm A to talk to arm B. Maybe you haven't worked in a place like this, but I lived in one for a while. It would be completely normal for someone at the government office to claim that the bank-supplied identification you brought with you isn't real, both of them owned wholly by the state with the bank ID being intended for the purpose you're using it for. Will they do the simple thing of calling the bank? No. They will just say you're SOL. "But I am a Very Important Person with Very Important Things". Yeah yeah, everyone is, we hear that all the time. Bring back a real bank ID next time, you faker. Next in line! So then you go back to the highest authority you know, get a letter from them, and you walk it up there to the guy, who instantly panics and delivers on what he was supposed to do. If you don't know what these bureaucracies are like, you are blessed.
- thaumasiotes 6y ago> "This prosecution will help to protect elite institutions like Stanford from illicit foreign influences." ...how? I assume everyone was aware that if she said something, it was being said by her. Where does the illicit foreign influence come in? Suppose her cover story had been completely accurate -- instead of being a member of the PLA, she was someone who had "only" served in the PLA for 11 years. That person had no problem getting a visa. Is there a difference in her expected influence on Stanford? > "Time and again, the Chinese government prioritizes stealing U.S. research and taking advantage of our universities over obeying international norms." Ok, but that would clearly be happening with civilian researchers too. Also, we publish our research on purpose. You can't steal public information. Was she admitted to a classified research program as a presumably-reformed 11-year veteran of the PLA? Why isn't there an indictment for espionage, or theft of private information, or anything similar to these complaints? What exactly is Stanford being protected from?
- zapita 6y agoIf there was nothing nefarious going on, why did she attempt to conceal her identity?
- refenestrator 6y agoWhat nefarious goal could there be for this medical research? Are we at the point of zero-sum where a successful treatment in China is a loss for us? Sure, deport her if she lied, but I'd stop way short of 'nefarious' myself.
- zapita 6y agoThat doesn’t answer the question of why she attempted to conceal her identity. There’s also the question of why the PLA would bother to assign an active duty soldier, with instructions to break US law, if there wasn’t some purpose which the US government would consider nefarious. If this is just harmless scientific collaboration, then why is the military involved?
- ilaksh 6y agoHow much of the work done by researchers like her is actually secret? I am under the impression that most everything gets published in open papers. Or is it common to withhold key information from what is published?
- random873161763 6y agoUse a throwaway account. I graduated from a top university in China and then came to US to get my PhD and now work in bay area. -Why people like Song would lie / conceal their identity to come to US? Lot of Chinese people, esp among these with colleague education, and not brain-washed by government, actually think very high of US and their education system. It's not surprise a few of them would lie to get Visa. There are many online forum providing tips on how to "pass" Visa interviews. BTW, inside China mainland, not speaking truth to government officials is not a big deal in the eye of many Chinese. In fact, being 100% truth with government officials is rare. Unfortunately, US visa officials sometimes are treated the same way as to Chinese government officials. -Does Song have any concealed goal in US? I do not think so. It's laughable to think Song trying to "steal" US research. Basic science research is all open. You can read Science / Nature / Cell / ... journals to know the latest research. And you can ask the authors on how to perform the experiments to reproduce their published results. The goal of Song is almost surely personal: to get something good on her resume so she can have better career.
- loceng 6y agoAre there likely to be many more researchers in the US who's purpose was similar?