17 ms·

The superseding indictment alleges that she then attempted to delete a digital folder of documents on an external hard drive that she possessed containing recor

The superseding indictment alleges that she then attempted to delete a digital folder of documents on an external hard drive that she possessed containing records relating to her military service and visa fraud, including: - A digital version of a letter from Song, written in Chinese and addressed to the People’s Republic of China consulate in New York, in which Song explained that her stated employer, “Beijing Xi Diaoyutai Hospital” was a false front, and that because relevant approval documents were classified, she had attempted to mail them; - An image of Song’s PLA credentials, with a photograph of her in military dress uniform, covering the time period from July 2016 to July 2020; and - A digital version of a resume for Song, written in Chinese, again with a photograph of her in military dress uniform and listing her employer as the Air Force General Hospital. Yikes, that sounds pretty damning. I’m not an expert in digital forensics but I wonder why she wouldn’t destroy the hard drive after. Or is that not enough?

lopatin 6y ago
Follow up question, as someone who knows even less about forensics, what kind of traces stay on a hard drive if you just delete a file?
- aliceryhl 6y ago
  Generally when you just delete a file, its contents are marked as "unused", but not actually erased. This is why deleting a large file takes the same time as deleting a small file. Then, whenever a new file is created, it might be put (partially) on top of the old file, overwriting the old contents for good.
- bsamuels 6y ago
  the whole file is still there until it gets overwritten by new data
- bsder 6y ago
  A lot. You need to write a drive with zeros(minimum)/random data(preferably) at least once to make forensic recovery difficult. I know all about the "5 times" rule, but I've never heard of anyone recovering a drive after even a single overwrite. Personally, I just hammer a screwdriver through the platter. It generally converts it into glass shards--the drive sounds like a maraca afterward. Flash, of course, is different. I suspect that writing zeros/random once is probably enough. However, I tend to just use diagonal cutters and slice through the chips. If someone wants to reconstruct my drive after I've physically destroyed it, they've probably got enough money to just fabricate the evidence against me anyway.
  - desine 6y ago
    I have a few HDs with bullet holes in them, and the platters are still intact. I've messed around with a lot of drives and never shattered a disk like glass. I've heard that there's labs that specialize in reading disks without even needing to spin them, but information seems to be tightly guarded about the processes.
    - daniel_reetz 6y ago
      The platters I've seen are aluminum alloy.
    - deleted 6y ago
      [deleted]
  - astrange 6y ago
    > Flash, of course, is different. I suspect that writing zeros/random once is probably enough. SSDs won't necessarily actually erase a block when you tell them to, due to wear-leveling and weird internal RAID setups they could be doing anything in there.
- Jtsummers 6y ago
  https://en.wikipedia.org/wiki/Data_remanence https://en.wikipedia.org/wiki/Data_remanence That link has a bit more, but the main issue is what the others wrote. Deleting a file from your disk may not actually delete it. It can leave an entry in the file system that marks it as deleted (for undeletion later) or it may just remove the entry, in which case the data is still on the disk and recoverable.
- Sylamore 6y ago
  On most file systems, just deleting a file simply deletes the link between the filename and the data on disk, the actual data remains fully intact until the blocks are overwritten by new data. It's trivial to recover recently deleted files, and often not much more effort to recover less recently deleted files. It only becomes a challenge if the data has been long deleted or was intentionally overwritten before deletion (or the disk wiped using random data), in some cases becoming effectively impossible to recover.
- desine 6y ago
  The file is still there. A regular delete just tells the disk that the segments of memory are available to be overwritten. Zeroing out (or /dev/urandom) the memory is an option, but even that is not 100% safe, especially when it comes to forensic labs with the ability to read and analyze platters removed from a complete, sealed disk. Really safe deleters will overwrite the segments of memory multiple times to scramble magnetic signatures
  - noir_lord 6y ago
    The world has moved on. You can’t transplant a platter into another reader, the old days of Guttman method don’t really apply anymore, density is so high that outside of research settings it’s just not practical. That said I still put a drill through mine before disposing of them, because close to zero isn’t zero.
    - XorNot 6y ago
      The reality though is we have no idea what's possible here: we just know what's not commercially viable to offer as a service. HDD recovery research is almost certainly a well-funded area of intelligence services, so I imagine their are a few electron microscopes and STMs which can do it. There's certainly no military data destruction guide which doesn't start with "shred the platter to this grain size".
    - layoutIfNeeded 6y ago
      >You can’t transplant a platter into another reader Then why do I get tons of results on YouTube of people doing exactly that, when searching for “HDD transplant”?
      - Judgmentality 6y ago
        I typed it into YouTube and every result (of the first dozen or so) is years old, including the most recent video citing an example where it's impossible. https://www.youtube.com/watch?v=bml8ovt4nfI https://www.youtube.com/watch?v=bml8ovt4nfI
HarryHirsch 6y ago
What exactly do they have on the lady, except that she is an officer in the PLA? OK, she's wearing uniform and is employed at a military hospital, but members of the US Medical Corps are officers at military hospitals. It's easy to understand why a physician might wish to work in brain disease. What secrets were exfiltrated?
- syops 6y ago
  From the article: "Members of the Chinese People's Liberation Army cannot lie on their visa applications and come to the United States to study without expecting the FBI and our partners to catch them." said Assistant Director Alan E. Kohler Jr. of the FBI's Counterintelligence Division. "Time and again, the Chinese government prioritizes stealing U.S. research and taking advantage of our universities over obeying international norms." It doesn't matter if she was unsuccessful at exfiltrating secrets. What matters is that, apparently, she's an agent of a foreign government who lied about said affiliation on her application for a visa.
  - dogma1138 6y ago
    This is what foreign nationals are prosecuted for when it comes to espionage - failure to declare yourself as a foreign agent. Most espionage laws are only directly applicable to citizens of the state in question.
- kevinventullo 6y ago
  I’m not sure what else, but this alone would prove she lied on her Visa application and lied to authorities in an interview. From the article: If convicted, she faces a maximum statutory penalty of up to 10 years in prison and a fine of $250,000 for the visa fraud count; up to 20 years in prison and a fine of $250,000 for each of the obstruction and alteration charges; and up to five years in prison and a fine of $250,000 for the false statements charge.
  - HarryHirsch 6y ago
    The point is: why bother prosecuting that crap when patently no state secrets are involved? Why not simply revoke the visa, deport the person and ban her from re-entry? Do they want to create uncertainty for people who have served in the PLA or generally discourage Chinese researchers from working in the US? The purpose of the exercise is wholly unclear! What is the Department of State up to?
notadev 6y ago
The FBI probably had a copy of the drive prior to her ever realizing she was under investigation. They have some pretty advanced physical access methods, even having cans of spray able dust to ensure nothing looks disturbed.
ManBlanket 6y ago
After reading these charges it sounds like less of a spy situation and more of an unfortunate past she was knew would conflict with her current goal of getting the F out of China. I'm pretty skeptical because like most cases involving state security, this one involves a desperate rube and a grandiose story that'll bolster some agents' careers. Maybe she didn't think her service was that relevant to working in neurology, but destroying a hard drive would make it seem like she was really a spy? Like she'd rather everyone forget about it because it never should have been of concern to begin with. I have neglected to check the, "Have you ever been charged with a crime?" box on job applications and if for some reason my mug shots were hanging about my workstation I'd throw them in the trash. Maybe I can or can't relate but I see why someone would go to some effort to keep something like that from coming to light without committing to the foregone conclusion implied by the charges. To be honest this story seems barely newsworthy, I have known a lot of grad students who lie on their Visa documents. But in this day and age people want to read news about Chinese spies being deported, so god help her that's what the news is going to report.

lopatin 6y ago

Follow up question, as someone who knows even less about forensics, what kind of traces stay on a hard drive if you just delete a file?

aliceryhl 6y ago
Generally when you just delete a file, its contents are marked as "unused", but not actually erased. This is why deleting a large file takes the same time as deleting a small file. Then, whenever a new file is created, it might be put (partially) on top of the old file, overwriting the old contents for good.
bsamuels 6y ago
the whole file is still there until it gets overwritten by new data
bsder 6y ago
A lot. You need to write a drive with zeros(minimum)/random data(preferably) at least once to make forensic recovery difficult. I know all about the "5 times" rule, but I've never heard of anyone recovering a drive after even a single overwrite. Personally, I just hammer a screwdriver through the platter. It generally converts it into glass shards--the drive sounds like a maraca afterward. Flash, of course, is different. I suspect that writing zeros/random once is probably enough. However, I tend to just use diagonal cutters and slice through the chips. If someone wants to reconstruct my drive after I've physically destroyed it, they've probably got enough money to just fabricate the evidence against me anyway.
- desine 6y ago
  I have a few HDs with bullet holes in them, and the platters are still intact. I've messed around with a lot of drives and never shattered a disk like glass. I've heard that there's labs that specialize in reading disks without even needing to spin them, but information seems to be tightly guarded about the processes.
  - daniel_reetz 6y ago
    The platters I've seen are aluminum alloy.
  - deleted 6y ago
    [deleted]
- astrange 6y ago
  > Flash, of course, is different. I suspect that writing zeros/random once is probably enough. SSDs won't necessarily actually erase a block when you tell them to, due to wear-leveling and weird internal RAID setups they could be doing anything in there.
Jtsummers 6y ago
https://en.wikipedia.org/wiki/Data_remanence https://en.wikipedia.org/wiki/Data_remanence That link has a bit more, but the main issue is what the others wrote. Deleting a file from your disk may not actually delete it. It can leave an entry in the file system that marks it as deleted (for undeletion later) or it may just remove the entry, in which case the data is still on the disk and recoverable.
Sylamore 6y ago
On most file systems, just deleting a file simply deletes the link between the filename and the data on disk, the actual data remains fully intact until the blocks are overwritten by new data. It's trivial to recover recently deleted files, and often not much more effort to recover less recently deleted files. It only becomes a challenge if the data has been long deleted or was intentionally overwritten before deletion (or the disk wiped using random data), in some cases becoming effectively impossible to recover.
desine 6y ago
The file is still there. A regular delete just tells the disk that the segments of memory are available to be overwritten. Zeroing out (or /dev/urandom) the memory is an option, but even that is not 100% safe, especially when it comes to forensic labs with the ability to read and analyze platters removed from a complete, sealed disk. Really safe deleters will overwrite the segments of memory multiple times to scramble magnetic signatures
- noir_lord 6y ago
  The world has moved on. You can’t transplant a platter into another reader, the old days of Guttman method don’t really apply anymore, density is so high that outside of research settings it’s just not practical. That said I still put a drill through mine before disposing of them, because close to zero isn’t zero.
  - XorNot 6y ago
    The reality though is we have no idea what's possible here: we just know what's not commercially viable to offer as a service. HDD recovery research is almost certainly a well-funded area of intelligence services, so I imagine their are a few electron microscopes and STMs which can do it. There's certainly no military data destruction guide which doesn't start with "shred the platter to this grain size".
  - layoutIfNeeded 6y ago
    >You can’t transplant a platter into another reader Then why do I get tons of results on YouTube of people doing exactly that, when searching for “HDD transplant”?
    - Judgmentality 6y ago
      I typed it into YouTube and every result (of the first dozen or so) is years old, including the most recent video citing an example where it's impossible. https://www.youtube.com/watch?v=bml8ovt4nfI https://www.youtube.com/watch?v=bml8ovt4nfI

HarryHirsch 6y ago

What exactly do they have on the lady, except that she is an officer in the PLA? OK, she's wearing uniform and is employed at a military hospital, but members of the US Medical Corps are officers at military hospitals. It's easy to understand why a physician might wish to work in brain disease. What secrets were exfiltrated?

syops 6y ago
From the article: "Members of the Chinese People's Liberation Army cannot lie on their visa applications and come to the United States to study without expecting the FBI and our partners to catch them." said Assistant Director Alan E. Kohler Jr. of the FBI's Counterintelligence Division. "Time and again, the Chinese government prioritizes stealing U.S. research and taking advantage of our universities over obeying international norms." It doesn't matter if she was unsuccessful at exfiltrating secrets. What matters is that, apparently, she's an agent of a foreign government who lied about said affiliation on her application for a visa.
- dogma1138 6y ago
  This is what foreign nationals are prosecuted for when it comes to espionage - failure to declare yourself as a foreign agent. Most espionage laws are only directly applicable to citizens of the state in question.
kevinventullo 6y ago
I’m not sure what else, but this alone would prove she lied on her Visa application and lied to authorities in an interview. From the article: If convicted, she faces a maximum statutory penalty of up to 10 years in prison and a fine of $250,000 for the visa fraud count; up to 20 years in prison and a fine of $250,000 for each of the obstruction and alteration charges; and up to five years in prison and a fine of $250,000 for the false statements charge.
- HarryHirsch 6y ago
  The point is: why bother prosecuting that crap when patently no state secrets are involved? Why not simply revoke the visa, deport the person and ban her from re-entry? Do they want to create uncertainty for people who have served in the PLA or generally discourage Chinese researchers from working in the US? The purpose of the exercise is wholly unclear! What is the Department of State up to?

notadev 6y ago

The FBI probably had a copy of the drive prior to her ever realizing she was under investigation. They have some pretty advanced physical access methods, even having cans of spray able dust to ensure nothing looks disturbed.

ManBlanket 6y ago

After reading these charges it sounds like less of a spy situation and more of an unfortunate past she was knew would conflict with her current goal of getting the F out of China. I'm pretty skeptical because like most cases involving state security, this one involves a desperate rube and a grandiose story that'll bolster some agents' careers. Maybe she didn't think her service was that relevant to working in neurology, but destroying a hard drive would make it seem like she was really a spy? Like she'd rather everyone forget about it because it never should have been of concern to begin with. I have neglected to check the, "Have you ever been charged with a crime?" box on job applications and if for some reason my mug shots were hanging about my workstation I'd throw them in the trash. Maybe I can or can't relate but I see why someone would go to some effort to keep something like that from coming to light without committing to the foregone conclusion implied by the charges. To be honest this story seems barely newsworthy, I have known a lot of grad students who lie on their Visa documents. But in this day and age people want to read news about Chinese spies being deported, so god help her that's what the news is going to report.