1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

02:00:00

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

1

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF OHIO

WESTERN DIVISION

- - -

UNITED STATES OF AMERICA,

Plaintiff,

vs.

YANJUN XU, also known as XU

YANJUN, also known as QU HUI,

also known as ZHANG HUI,

Defendant.

:

:

:

:

:

:

:

:

:

:

CASE NO. 1:18-cr-0043

TRIAL EXCERPT

27th of OCTOBER, 2021

9:39 A.M.

- - -

EXCERPT OF TRANSCRIPT OF PROCEEDINGS

TESTIMONY OF ADAM ROBERT JAMES

BEFORE THE HONORABLE TIMOTHY S. BLACK, JUDGE

- - -

APPEARANCES:

For the Plaintiff:

Timothy S. Mangan, Esq.

Emily N. Glatfelter, Esq.

Assistant United States Attorneys

221 East Fourth Street, Suite 400

Cincinnati, Ohio 45202

and

Matthew John McKenzie, Esq.

United States Department of Justice

National Security Division

950 Pennsylvania Avenue NW

Washington, D.C. 20530

and

Jacqueline K. Prim

Special Assistant, Paralegal

United States Department of Justice

National Security Division

950 Pennsylvania Avenue NW

Washington, D.C. 20530

For the Defendant:

Ralph William Kohnen, Esq.

Jeanne Marie Cors, Esq.

Sanna-Rae Taylor, Esq.

Taft Stettinius and Hollister

425 East Walnut Street, Suite 1800

Cincinnati, Ohio 45202

and

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 1 of 50 PAGEID #: 3602
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

2

Robert K. McBride, Esq.

Amanda Johnson, Esq.

Taft Stettinius and Hollister

50 East RiverCenter Boulevard

Suite 850

Covington, Kentucky 41011

and

Florian Miedel, Esq.

Miedel & Mysliwiec, LLP

80 Broad Street, Suite 1900

New York, New York 10004

Also present: Mae Harmon, Interpreter

Robin Murphy, Interpreter

Yanjun Xu, Defendant

Law Clerk: Cristina V. Frankian, Esq.

Courtroom Deputy: Rebecca Santoro

Stenographer: Mary Schweinhagen, RPR, RMR, RDR, CRR

United States District Court

200 West Second Street, Room 910

Dayton, Ohio 45402

Proceedings reported by mechanical stenography,

transcript produced by computer.

*** *** *** ***

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 2 of 50 PAGEID #: 3603
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

3

INDEX OF WITNESSES

WEDNESDAY, OCTOBER 27, 2021

DIRECT CROSS REDIRECT RECROSS

PLAINTIFF'S WITNESSES

ADAM JAMES 5 31 47 48

* * * * *

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 3 of 50 PAGEID #: 3604
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

09:39:50

09:41:30

09:41:32

09:42:05

09:42:08

09:42:12

09:42:15

09:42:18

09:42:22

09:42:26

09:42:28

09:42:31

09:42:31

09:42:36

09:42:39

09:42:45

09:42:46

09:42:48

09:42:52

09:42:54

09:42:56

09:42:56

09:42:56

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

4

P-R-O-C-E-E-D-I-N-G-S 3:18 P.M.

(Proceedings reported but not transcribed.)

THE COURT: Let's call for the jury.

THE COURTROOM DEPUTY: All rise for the jury.

(Jury in at 9:41 a.m.)

THE COURT: You may all be seated. Thank you. The

15 jurors have arrived. Good morning and welcome back. I

told you this a couple of times; I want you to believe it

deep, deep inside. The Court and the community and the

participants appreciate your work.

We're going to continue with the testimony of this

gentleman. He's still under oath.

The government may proceed.

ADAM ROBERT JAMES, PLAINTIFF WITNESS, PREVIOUSLY SWORN

MR. McKENZIE: Thank you, Your Honor. For the

record, this is Matthew McKenzie for the government.

THE COURT: Very well. Can you orient those

microphones, please.

MR. McKENZIE: Is this better, Your Honor?

THE COURT: A little bit.

MR. McKENZIE: I will try to keep my voice up.

THE COURT: That's perfect.

DIRECT EXAMINATION (CONT.)

BY MR. McKENZIE:

Q. Speaking of reorienting, Special Agent James, I'd like to

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 4 of 50 PAGEID #: 3605
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

09:43:00

09:43:03

09:43:11

09:43:18

09:43:27

09:43:30

09:43:32

09:43:36

09:43:37

09:43:43

09:43:48

09:43:52

09:43:58

09:44:00

09:44:06

09:44:08

09:44:10

09:44:12

09:44:17

09:44:18

09:44:24

09:44:25

09:44:30

09:44:35

09:44:37

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

5

direct your attention to the forensic analysis that you

conducted of the hard drive that we discussed yesterday.

You mentioned a type of malware that you found called

Sakula. Remind the jury what type of malware Sakula is.

A. Sakula is a remote access trojan that beacons to the

Internet.

Q. Do remote access trojans, are they a type of trojan

horse?

A. They are.

Q. And please remind us, on what date was the Sakula malware

installed on the hard drive you analyzed?

A. January 25th of 2014.

MR. McKENZIE: Your Honor, I ask that we publish

Government's Exhibit 110 on page 1 -- on page 3.

THE COURT: It's been admitted?

MR. McKENZIE: Which has been admitted, yes.

THE COURT: Yes, you may publish it.

And if the special agent would keep his voice up, please.

THE WITNESS: Yes, sir.

MR. McKENZIE: I apologize. Page 4. My mistake.

BY MR. McKENZIE:

Q. Just to again get us reoriented, directing your attention

to the first message sent on January 25, 2014, will you please

read that message?

A. "The horse is planted. This morning."

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 5 of 50 PAGEID #: 3606
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

09:44:40

09:44:42

09:44:46

09:44:49

09:44:54

09:45:06

09:45:06

09:45:06

09:45:09

09:45:12

09:45:12

09:45:16

09:45:24

09:45:25

09:45:28

09:45:33

09:45:38

09:45:45

09:45:45

09:45:48

09:45:52

09:46:02

09:46:04

09:46:04

09:46:10

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

6

Q. Who sent that message.

A. Tian Xi.

MR. McKENZIE: To refresh our recollection on who

Tian Xi is, may I please publish Government's Exhibit 111,

page 6, which is in evidence?

THE COURT: Yes.

BY MR. McKENZIE:

Q. Directing your attention to the top right column, do you

see the name Tian Xi?

A. I do.

Q. Directing your attention to the first sentence of the

first full paragraph, does it identify Tian Xi as a

manufacturing engineer?

A. It does.

MR. McKENZIE: Okay. I would like to return one

more time to Government's Exhibit 110, page 4?

THE COURT: Yes.

BY MR. McKENZIE:

Q. Directing your attention to the first message of January

25, 2014, to whom did Tian send that message?

A. Xu Yanjun.

Q. Okay. I think we are now back to where we were

yesterday.

I'd like to return to your forensic analysis. Yesterday

you discussed the Sakula malware, but you also mentioned a

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 6 of 50 PAGEID #: 3607
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

09:46:14

09:46:17

09:46:19

09:46:22

09:46:28

09:46:28

09:46:33

09:46:33

09:46:37

09:46:43

09:46:46

09:46:50

09:46:54

09:46:56

09:46:57

09:46:58

09:47:01

09:47:03

09:47:10

09:47:14

09:47:19

09:47:23

09:47:27

09:47:31

09:47:32

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

7

second type of malware that you discovered. Will you remind

us what that program is called?

A. That program is called plugX.

Q. How many types of variants of plugX did you find on

the -- on the hard drive?

A. There were two different versions of plugX on the hard

drive.

Q. Will you explain to the jury what it means to have

multiple versions of plugX?

A. What it means to have multiple versions of plugX is

there are actually two sets of files related to the plugX

malware that were independent of each other.

Q. Did you analyze both sets of files?

A. I did.

Q. Did both of them work?

A. No, they did not both work.

Q. Tell the jury what you mean by that.

A. So the plugX malware is composed of several different

files that it needs to have in order to operate correctly.

One of the variants of plugX, one of the files appeared to

be corrupted, and so it did not run properly when you

attempted to run it. Or when I attempted to run it.

Q. And what about the other variant of plugX? Did that

work?

A. The other variant did work properly.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 7 of 50 PAGEID #: 3608
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

09:47:34

09:47:37

09:47:41

09:47:44

09:47:45

09:47:50

09:47:52

09:47:55

09:47:55

09:47:58

09:48:04

09:48:12

09:48:17

09:48:19

09:48:24

09:48:27

09:48:33

09:48:37

09:48:38

09:48:44

09:48:49

09:48:51

09:48:51

09:48:55

09:48:56

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

8

Q. What type of malware is plugX?

A. PlugX is a remote access trojan.

Q. And what happened when you ran the variant of plugX that

worked?

A. The variant that successfully ran would issue a beacon

to a domain on the Internet.

Q. Were you able to determine what that domain was?

A. I was.

Q. And what was that domain?

A. The domain for the variant of plugX that worked was

ns24.dnsdojo.com.

Q. Do you sometimes refer to that as dnsdojo.com?

A. I do.

Q. What does it mean in plain English that the program

beaconed to this dnsdojo.com?

A. The beacon to dnsdojo.com was a way for the malware to

check in with the computer intruders that intended to

control it.

Q. Based on your analysis of the hard drive, did the plugX

program actually beacon out to dnsdojo.com?

A. From my analysis of the hard drive, I could not

determine that.

Q. Were you able to determine that it was designed to do so?

A. Yes.

Q. Are you familiar with the term "Crowd Strike"?

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 8 of 50 PAGEID #: 3609
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

09:49:02

09:49:03

09:49:05

09:49:09

09:49:10

09:49:17

09:49:18

09:49:18

09:49:24

09:49:28

09:49:34

09:49:35

09:49:37

09:49:40

09:49:42

09:49:42

09:49:45

09:49:45

09:49:48

09:49:52

09:49:55

09:49:56

09:50:00

09:50:04

09:50:07

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

9

A. I am.

Q. What is Crowd Strike?

A. Crowd Strike is a US information security and incident

response company.

Q. Does Crowd Strike publish publicly available blog posts

about hacking activities?

A. They do.

Q. Directing your attention to on or about February 25,

2014, did there come a time that you became aware of a blog

post on Crowd Strike?

MS. CORS: Your Honor, objection.

THE COURT: Basis?

MS. CORS: Hearsay.

MR. McKENZIE: I haven't gotten into the substance

of anything yet.

THE COURT: We are not there yet. Overruled.

BY MR. McKENZIE:

Q. Did you become aware of a blog post on Crowd Strike?

A. I was aware that there was a blog post.

Q. Without getting into the details, what was the general

topic of the post?

A. The general topic of the post was computer intrusion

activity targeting French aerospace.

Q. Was that post published on the Internet?

A. It was.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 9 of 50 PAGEID #: 3610
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

09:50:07

09:50:12

09:50:28

09:50:34

09:50:35

09:50:40

09:50:41

09:50:45

09:50:47

09:50:50

09:50:52

09:50:56

09:51:01

09:51:05

09:51:08

09:51:13

09:51:20

09:51:23

09:51:24

09:51:27

09:51:28

09:51:34

09:51:39

09:51:42

09:51:46

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

10

Q. I'd like to direct your attention back to Government's

Exhibit 110, page 4. And I'd like to begin with the messages

on February 25, 2014. Will you please read just the first

message?

A. "Call me back as soon as possible."

Q. Who sent that message?

A. Xu Yanjun.

Q. To whom did he send it?

A. Chai Meng.

Q. On what date was this message sent?

A. February 25th of 2014.

Q. On what date did Crowd Strike publish the blog post about

hacking activities targeting French aerospace?

A. February 25th of 2014.

Q. I'd like to read the remaining messages on the page. I

will read the messages sent by Chai Meng.

So please read the next message.

A. "What does Chen mean?"

Q. "Chen is still reporting, and I'm waiting for him to come

out."

A. "Ah. How will Chen Li react to this matter? The mail

has been forwarded to your email address."

MR. McKENZIE: Could we please go to page 5?

THE COURT: Yes.

BY MR. McKENZIE:

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 10 of 50 PAGEID #: 3611
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

09:51:46

09:51:52

09:51:53

09:51:56

09:52:05

09:52:08

09:52:10

09:52:12

09:52:13

09:52:20

09:52:22

09:52:27

09:52:31

09:52:35

09:52:37

09:52:40

09:52:44

09:52:48

09:52:50

09:52:54

09:52:55

09:52:56

09:53:02

09:53:05

09:53:07

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

11

Q. Let us continue with the next two messages.

"Okay."

A. "The part with the red marking in the attachment, is

that being flagged by Suzhou's investigation?"

Q. Who sent that last message?

A. Xu Yanjun.

Q. To whom did he send it?

A. Chai Meng.

Q. Where is Safran Suzhou located?

A. In Suzhou.

Q. And who is the parent company of Safran Suzhou?

A. Safran Group.

Q. What company owns the computer that you analyzed?

A. Safran.

Q. In what company -- in what country is Safran located?

A. They are located in France.

Q. Will you please read the next message.

A. "Your QQ."

Q. Do you know what "QQ" stands for or what "QQ" is?

A. I do.

Q. What is QQ?

A. QQ is -- the most common thing it's used for is a

mobile messaging app.

Q. Is it popular in China?

A. It is.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 11 of 50 PAGEID #: 3612
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

09:53:08

09:53:16

09:53:21

09:53:23

09:53:27

09:53:31

09:53:35

09:53:39

09:53:43

09:53:50

09:53:51

09:53:53

09:53:56

09:53:56

09:53:59

09:54:02

09:54:06

09:54:09

09:54:16

09:54:20

09:54:27

09:54:30

09:54:36

09:54:39

09:54:49

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

12

Q. We will go through these messages. I will read Song

Sicheng. He responded with a series of numbers.

Please read the next message.

A. "Received. Sent already."

Q. "Okay. I am receiving it."

Directing your attention to the next set of messages,

will you please read the -- just the next message?

A. "What does Chen mean by heaping the responsibility upon

me and furthermore having the guest to find Gu?"

Q. Who sent that message?

A. Xu Yanjun.

Q. To whom did he send it?

A. Chai Meng.

Q. All right. We will read the next exchange. I will read

the parts of Chai Meng. Please read the next message.

A. "Isn't it like putting a noose on his own neck?"

Q. "I don't know. I told him the French device was seized.

He immediately stated that he had foresight. As to matter of

finding Gu, he never told me about it."

Let's pause there for a moment.

What country did the hard drive you analyzed come from?

A. It came from France.

Q. I'd like to take a pause from Government's Exhibit 110

and turn to Government's Exhibit 111, page 1.

Directing your attention to the top of the screen next to

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 12 of 50 PAGEID #: 3613
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

09:54:53

09:54:56

09:55:00

09:55:04

09:55:06

09:55:11

09:55:12

09:55:17

09:55:18

09:55:24

09:55:26

09:55:26

09:55:28

09:55:33

09:55:34

09:55:40

09:55:40

09:55:47

09:55:52

09:55:54

09:55:57

09:56:01

09:56:04

09:56:08

09:56:10

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

13

"Name," will you please read the name?

A. Gu Gen.

Q. Scrolling down to the middle of the page where it says

"Position," will you please read the position?

A. "Senior IT infrastructure manager and information

security officer."

Q. Scrolling to the bottom of the screen underneath the red

seal, will you please read the company?

A. "Safran Beijing Enterprise Management Company, Ltd.,

Suzhou Branch.

Q. Thank you.

MR. McKENZIE: I'd like to return to Government's

Exhibit 110, which is in evidence. I believe we were on page

5.

THE COURT: Very well.

BY MR. McKENZIE:

Q. Directing your attention to the message sent at 3:10 p.m.

We'll continue reading with you reading the part of Xu Yanjun

and I'll read Chai Meng.

A. "I wanted to call him a son of a bitch. He stated the

entire thing led to an exposing is because what the guest

has planted in the French device."

Q. In the term or in the context of a cyber intrusion case,

what does "planted" mean?

A. To install.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 13 of 50 PAGEID #: 3614
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

09:56:12

09:56:16

09:56:20

09:56:24

09:56:25

09:56:34

09:56:37

09:56:40

09:56:43

09:56:49

09:56:54

09:57:00

09:57:07

09:57:08

09:57:09

09:57:10

09:57:12

09:57:13

09:57:16

09:57:18

09:57:21

09:57:23

09:57:27

09:57:28

09:57:38

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

14

Q. All right. The next message was sent at 3:12 p.m.

"It's my guess to prove his brilliance."

A. "It feels bitterly disappointing to have leaders like

that."

"Can you suggest not letting the guest go to find Gu?

First, the guest is not exposed; two, Gu doesn't have the

power to decide. Thirdly, Gu would report the situation to

me at any time."

Q. We will continue on to the first message from February

26, 2014. Will you please read the first message?

A. "France is letting Little Gu to check out this record,

ns24.dnsdojo.com. Does it have anything to do with you

all?"

Q. Who sent that message?

A. Xu Yanjun.

Q. To whom did he send it?

A. Chai Meng.

Q. In what country is Safran located?

A. They are located in France.

Q. Who did Gu Gen work for?

A. Safran Suzhou.

Q. To what domain did the plugX malware you found on the

hard drive beacon?

A. Ns24.dnsdojo.com.

Q. At 3:08 Chai Meng responded, "Let me ask."

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 14 of 50 PAGEID #: 3615
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

09:57:43

09:57:48

09:57:53

09:58:02

09:58:05

09:58:14

09:58:26

09:58:30

09:58:32

09:58:35

09:58:35

09:58:37

09:58:39

09:58:41

09:58:46

09:58:46

09:58:50

09:58:52

09:58:55

09:58:59

09:59:04

09:59:11

09:59:14

09:59:33

09:59:26

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

15

Directing your attention to the next message sent on

February 27, 2014, will you please read that message?

A. "France is asking Little Gu to inspect this record,

ns24.dnsdojo.com. Is it related to you?"

Q. To what domain did the plugX malware beacon?

A. Ns24.dns.dojod.com.

Q. Directing your attention back to Government's Exhibit

111, page 1.

MR. McKENZIE: And if I may publish to the jury,

Your Honor.

THE COURT: Yes. It's been admitted, right?

MR. McKENZIE: Yes, Your Honor.

BY MR. McKENZIE:

Q. Scrolling down to "Position." Will you read Gu Gen's

position?

A. The senior IT infrastructure manager and information

security officer.

Q. Based on your years of experience in information

technology and security and work in cyber intrusion

investigations, what is the role of senior IT and security

officers in investigating cyber intrusions for a company?

A. Generally, your information security office would be

the office that conducts computer or -- well, intrusion,

computer intrusion investigations into the company.

Q. I'd like to direct your attention back to Government's

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 15 of 50 PAGEID #: 3616
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

09:59:29

09:59:35

09:59:41

09:59:48

09:59:49

09:59:55

09:59:56

09:59:57

09:59:59

10:00:01

10:00:05

10:00:11

10:00:11

10:00:12

10:00:17

10:00:20

10:00:22

10:00:33

10:00:37

10:00:43

10:00:49

10:00:51

10:00:58

10:00:59

10:01:01

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

16

Exhibit 110, page 5, which is in evidence.

I'd like to move on now to the message sent on -- the

messages sent on March 11, 2014. Will you please read the

first message?

A. "When did Gu ask you? When did France ask you?"

Q. Who sent that message?

A. Xu Yanjun.

Q. To whom did he send it?

A. Tian Xi.

Q. I will read the messages sent by Tian Xi.

"Gu received an email from the French side, asked me

yesterday."

A. "Have you seen the email?"

Q. "No."

What country is Safran located in or headquartered in?

A. They are headquartered in France.

Q. Could we please see the next page.

For March 17th, will you please read the messages sent by

Xu Yanjun, and I will read the messages sent by Tian Xi?

A. "Anything new? I sought out Little Gu last week and

current France has not finding suspicious documents in the

record."

Q. "Nothing."

A. "Should there be something new be prompt notifying me

and I will communicate with Little Gu."

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 16 of 50 PAGEID #: 3617
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:01:03

10:01:04

10:01:10

10:01:15

10:01:18

10:01:21

10:01:23

10:01:28

10:01:31

10:01:33

10:01:37

10:01:38

10:01:40

10:01:41

10:01:43

10:01:46

10:01:47

10:01:52

10:01:54

10:02:00

10:02:02

10:02:04

10:02:08

10:02:11

10:02:17

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

17

Q. "Understand."

Directing your attention now to April 17, 2014, messages,

let's read the first three messages, you reading those sent by

the defendant, I'll read those sent by Tian Xi.

A. "Of the matter, any new situation?"

Q. "No."

A. "Good."

Q. Directing your attention to the next message that was

sent, will you please read the message?

A. "Any updates on that incident?"

Q. Who sent the message?

A. Xu Yanjun.

Q. To whom did he send it?

A. Gu Gen.

Q. Who does Gu Gen work for?

A. Safran Suzhou.

Q. I will read Gu's response.

"Still checking. They found that someone had connected

to our server via a tool called psexec. The period is from

July last year to February this year."

Will you please read the next message?

A. "No conclusion?"

Q. Directing your attention to the next message, the second

message sent at 9:46 a.m., will you please read that message?

A. The latest status from Suzhou: They found an intrusion

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 17 of 50 PAGEID #: 3618
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:02:22

10:02:28

10:02:31

10:02:33

10:02:35

10:02:37

10:02:38

10:02:41

10:02:42

10:02:53

10:02:59

10:03:02

10:03:06

10:03:06

10:03:08

10:03:12

10:03:15

10:03:18

10:03:22

10:03:28

10:03:29

10:03:31

10:03:32

10:03:34

10:03:37

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

18

to our server through a psexec tool. The time frame is from

July last year to February this year."

Q. Who sent that message?

A. Xu Yanjun.

Q. To whom did he send it?

A. Chai Meng.

Q. And what is the location of Safran's subsidiary in China?

A. Suzhou.

Q. Directing your attention to the next message sent at 9:55

a.m., did Gu Gen send a message to the defendant which said,

"So far, no. They will examine by remotely connecting to this

server"?

A. He did.

Q. How did the defendant respond?

A. "Do they think China is hacking them?"

Q. And will you please read Gu's response?

A. "Don't think so."

Q. Directing your attention now to the messages sent on

August 18, 2014. Who sent the first message that we see on

that date?

A. Xu Yanjun.

Q. To whom did he send it?

A. Tian Xi.

Q. Please read the defendant's messages. I'll read Tian's

response.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 18 of 50 PAGEID #: 3619
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:03:38

10:03:41

10:03:50

10:03:51

10:03:53

10:04:01

10:04:01

10:04:04

10:04:09

10:04:11

10:04:19

10:04:20

10:04:23

10:04:23

10:04:26

10:04:28

10:04:32

10:04:37

10:04:40

10:04:44

10:04:49

10:04:52

10:04:58

10:04:59

10:05:05

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

19

A. "About that matter, any new situation?"

Q. "No new news. Should be an unsolved mystery."

A. "Ho, ho."

MR. McKENZIE: For a final time, I would like to

return to Government's Exhibit 111, page 1, which is in

evidence, Your Honor.

BY MR. McKENZIE:

Q. Will you please read the title of the document which is

displayed at the top of the screen?

A. "Employment Dismissal Record Form for Employers of

Suzhou Industrial Park."

Q. Please read the name that's listed at the top of the

screen.

A. Gu Gen.

Q. Scrolling down and directing your attention to the middle

of the screen, what was Gu's position?

A. Senior IT infrastructure manager and information

security officer.

Q. When it says "Type of" -- directing your attention to the

box below it, next to "Type of Contract Dissolution

(Termination)," which box has been selected?

A. The box for "Employer Initiated Dissolution" is

highlighted.

Q. Scrolling down, who is listed as the employer?

A. Safran Beijing Enterprise Management Company, Ltd.,

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 19 of 50 PAGEID #: 3620
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:05:10

10:05:12

10:05:15

10:05:16

10:05:18

10:05:21

10:05:30

10:05:34

10:05:34

10:05:41

10:05:43

10:05:45

10:05:50

10:05:53

10:05:57

10:06:02

10:06:05

10:06:08

10:06:12

10:06:12

10:06:14

10:06:19

10:06:21

10:06:26

10:06:31

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

20

Suzhou Branch.

Q. And directing your attention to that same box, what is

listed as the date?

A. November 28 of 2018.

Q. I'd like to direct your attention now to page 6 of the

same exhibit.

Directing your attention to the top left. Who is the

sender of this letter?

A. Safran Aircraft Engines, Suzhou Co., Ltd.

Q. Who is the recipient of the letter?

A. Tian Xi.

Q. In the -- in that same column, what is the date of the

letter?

A. It appears to be November 13th of 2018.

Q. As displayed on the screen currently to your bottom left,

what is the title of this letter?

A. "Re: Termination Letter."

MR. McKENZIE: If we can scroll down to where we can

begin with "Dear Sir."

BY MR. McKENZIE:

Q. Will you please read the English section of this letter?

A. "Dear Sir,

"Following our meeting on October 31, 2018, the company

has decided to dismiss you from your position of

manufacturing engineer. This decision is justified by the

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 20 of 50 PAGEID #: 3621
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:06:36

10:06:38

10:06:41

10:06:45

10:06:51

10:06:55

10:06:59

10:07:07

10:07:10

10:07:11

10:07:14

10:07:16

10:07:21

10:07:26

10:07:30

10:07:39

10:07:40

10:07:43

10:07:47

10:07:54

10:07:58

10:08:03

10:08:07

10:08:09

10:08:13

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

21

following reasons:

"You have materially breached the employer's rules and

regulation. Therefore, the company hereby terminates your

employment contract in accordance with its Article 7 and PRC

applicable laws, including Article 39 of the Labor Contract

Law of the PRC. Your employment contract entered with the

company on December 10, 2007, will terminate with immediate

effect. Therefore, you will leave the company on November

13, 2018.

"In consideration of the above, the company will not

pay you any compensation.

"Before leaving the company, please surrender any and

all relevant work, documents, equipment, and property,

together with all keys, relating to the company and/or any

of its clients to Patrick Calero.

"As from the date of the termination of your

employment, you will remain bound by the confidentiality

undertaking stipulated in your employment contract which

stipulates that you shall keep strictly secret and

confidential, and not disclose to any third party any and

all technical, economic, financial, or marketing information

acquired from the company and/or obtained because of your

activities in the company.

"The company reserves all rights to bring suits,

claims, or any other actions against you.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 21 of 50 PAGEID #: 3622
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:08:17

10:08:19

10:08:23

10:08:23

10:08:32

10:08:34

10:08:35

10:08:37

10:08:40

10:08:44

10:08:47

10:08:50

10:08:54

10:09:00

10:09:02

10:09:03

10:09:43

10:09:45

10:09:48

10:09:51

10:09:59

10:10:03

10:10:08

10:10:09

10:10:13

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

22

"Yours sincerely."

Q. And then what is -- who is listed as the company sending

the letter?

A. Safran Aircraft Engines, Suzhou Co., Ltd.

THE COURT: Counsel, I'd like to take a break at an

appropriate point.

MR. McKENZIE: Perfect timing, Your Honor. The

government has no further questions.

THE COURT: Very well. We are going to recess for

20 minutes, until 10:30.

Members of the jury, as you know, please do not discuss

the case among yourselves or with anyone else. No independent

research. Continue to keep an open mind.

We'll rise as you leave.

THE COURTROOM DEPUTY: All rise for the jury.

(Jury out at 10:09 a.m.)

THE COURT: Jury's left the room and the door is

closed. We're going to break until 10:30, at least as to the

jury. That's my intention.

We can chat in 15 minutes or the issues that are arising

may not require attention yet. When is the witness to be

called that Mr. --

THE INTERPRETER: Your Honor, the interpreter is

having a hard time hearing you. I'm sorry.

THE COURT: That's okay.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 22 of 50 PAGEID #: 3623
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:10:19

10:10:24

10:10:28

10:10:30

10:10:35

10:10:36

10:10:38

10:10:43

10:10:46

10:10:52

10:10:56

10:10:57

10:11:00

10:11:02

10:11:03

10:11:06

10:11:07

10:11:10

10:11:16

10:11:22

10:11:26

10:11:33

10:11:37

10:11:44

10:11:51

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

23

Do I need to address the defense's concerns about Arthur

Gau now from the government's perspective?

MR. MANGAN: He is the next witness. It's a matter

of whether you wanted to wait until the next break or not.

We're fine either way.

THE COURT: Why don't we be seated and hear the

issue. We're outside the presence of the jury. We're talking

about the next witness.

Mr. Miedel, forget my lapse. I know exactly who you are.

MR. MIEDEL: You can just keep calling me the New

York lawyer. That's okay.

THE COURT: If you can take the mask off and tell me

what I can call you.

MR. MIEDEL: The New York lawyer.

THE COURT: I didn't want to do that.

MR. MIEDEL: Your Honor, I wanted to raise this

issue because, as I said, Arthur Gau is the next witness. And

according to the government's exhibit book, they, I think,

will attempt to introduce Exhibit 81a and 81b through Arthur

Gau.

Exhibit 81 is a Chinese letter, in Chinese, and 81b is

the English translation of it. And it essentially is a typed

letter that Arthur Gau will testify was given to him in 2003,

purportedly by an individual named Zha, Z-H-A, Rong, R-A-N-G

[sic], who I think the government will argue was somehow

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 23 of 50 PAGEID #: 3624
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:11:53

10:11:58

10:12:04

10:12:12

10:12:15

10:12:21

10:12:25

10:12:29

10:12:36

10:12:41

10:12:44

10:12:49

10:12:53

10:12:58

10:13:00

10:13:04

10:13:09

10:13:14

10:13:21

10:13:25

10:13:30

10:13:39

10:13:42

10:13:46

10:13:50

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

24

associated with MSS, or at least later was.

And that letter contains a number of questions about what

seemed to be engineering questions or problems. We object to

the introduction of that exhibit for a couple of reasons. The

first is that it is hearsay. It is an out-of-court statement

obviously made, proposed for the truth of the matter because

the government wants to show that the document is asking

Arthur Gau specific engineering questions or presents

engineering issues that they want him to respond to.

There is no applicable hearsay exception because this

letter was created and given to Arthur Gau ten years before

the beginning of the conspiracy in this case. It was given in

2003. The conspiracy begins, according to the indictment, in

2013.

And if it's not being introduced for the truth, then it

has no relevance, because if it is not for purposes of the

charged conspiracy, the letter itself does not ask for any

specific trade -- it doesn't ask for the -- Mr. Gau to reveal

trade secrets. As noted, it was written 10 years before the

conspiracy. At that point in 2003, Mr. Xu was not involved in

that. There is no evidence that he was even working with Zha

Rong at that time. There is no evidence that Zha Rong was

working for MSS at the time. Arthur Gau will testify,

presumably, that he believe that Zha Rong was working for

NUAA.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 24 of 50 PAGEID #: 3625
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:13:52

10:13:59

10:14:04

10:14:08

10:14:09

10:14:16

10:14:20

10:14:23

10:14:28

10:14:32

10:14:32

10:14:35

10:14:41

10:14:50

10:14:52

10:14:55

10:15:01

10:15:05

10:15:07

10:15:10

10:15:15

10:15:18

10:15:19

10:15:25

10:15:26

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

25

In terms of relevance, it is absolutely more prejudicial

than probative, again because -- the probative value is

minimal again because it occurred ten years before the charged

conspiracy.

The document is signed by Zha Rong -- it's typed, so it's

not signed but it's typed with his name, but we don't actually

have any way of knowing who wrote it. It was not given to

Arthur Gau by Zha Rong; it was given to him by somebody else.

The document doesn't actually ask him to reveal any trade

secrets.

And I think that what the problem is, the prejudice is

that the jury could mistakenly conclude that this was a

decades-long pattern in an effort to get Mr. Gau to cough up

trade secrets when, in fact, there is -- this document doesn't

advance that theory at all. And the jury could mistakenly

consider it to be meaningful when it's not. Thank you.

THE COURT: When did this issue -- when did you

become aware of it?

MR. MIEDEL: Well, I was aware of it for a while

but, again, Mr. Gau wasn't scheduled to be testifying until

today. So I notified the government of it this morning. I

think they are prepared to argue it.

THE COURT: The Court prefers to get a heads-up.

MR. MIEDEL: I understand.

THE COURT: The government wish to be heard?

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 25 of 50 PAGEID #: 3626
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:15:28

10:15:34

10:15:39

10:15:42

10:15:46

10:15:51

10:15:59

10:16:02

10:16:04

10:16:08

10:16:10

10:16:13

10:16:16

10:16:21

10:16:24

10:16:27

10:16:32

10:16:37

10:16:39

10:16:42

10:16:49

10:16:52

10:16:57

10:17:04

10:17:06

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

26

MR. MANGAN: Yes, Your Honor. What I would say in

response is, first of all, this does pertain to an individual

named Zha Rong, and there's already been evidence submitted in

the case relating to Mr. Zha Rong and his relationship to the

defendant. As we've asserted, he is the direct supervisor of

the defendant within the MSS.

What we are going to go through with Arthur Gau is a

number of trips that he took over to China and that he met

with Zha Rong on a number of those trips and then eventually

was introduced to the defendant.

And so our assertion, Your Honor, is that the

relationship started with Zha Rong. It was more or less

passed over to the defendant, to kind of continue with the

relationship in later visits, and that will be the heart of

the testimony, will be these later visits. However, to

explain sort of where it all started, his first visits were,

you know, back in that time period, when he went back to China

in, you know, the year 2000 and so on.

When he got back to the U.S. after one of these visits

where he met with an NUAA professor and he met with Zha Rong,

at that time the son of the professor showed up at Mr. Gau's

house in the U.S. and handed him this letter. So in the

letter it is written and signed by Zha Rong asking him to see

if he's willing to do a project that would prepare a lot of

technical information.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 26 of 50 PAGEID #: 3627
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:17:08

10:17:11

10:17:16

10:17:19

10:17:24

10:17:29

10:17:31

10:17:35

10:17:43

10:17:46

10:17:48

10:17:51

10:17:56

10:18:01

10:18:06

10:18:11

10:18:16

10:18:18

10:18:22

10:18:26

10:18:32

10:18:38

10:18:40

10:18:48

10:18:49

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

27

So from our standpoint, Your Honor, there is two things.

One, to the extent it is simply a question or it is asking him

to do work and setting forth what they are asking for, that is

not hearsay. It's simply a question or it's a request or a

demand. Those are not assertions of fact.

In addition, Your Honor, to the extent any of the letter

would be interpreted as an assertion of fact, we would assert

that statements by Mr. Zha Rong are statements of a

co-conspirator and therefore also would be admissible.

As to the time frame, Your Honor, this is really -- we

understand we are limited by the years in the indictment

regarding the defendant's conduct. And that is from 2013, you

know, to the time of his arrest. This is kind of introductory

evidence to help the witness explain where the relationship

started and, you know, then ultimately explain where it went

in the years of 2016 through 2017.

THE COURT: So how is the letter necessary? Why

can't Gau just explain the origins of their relationship?

MR. MANGAN: He can, Your Honor. What we wanted to

also bring out was that at one point Zha Rong did make an ask

for him to do technical work that he had declined. And then

there is a break in time, and then the relationship is

restarted. So we did see some significance in that.

MR. MIEDEL: Your Honor, may I respond?

THE COURT: Yes, you get the reply.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 27 of 50 PAGEID #: 3628
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:18:52

10:18:54

10:18:57

10:19:02

10:19:05

10:19:09

10:19:13

10:19:18

10:19:23

10:19:27

10:19:35

10:19:40

10:19:43

10:19:47

10:19:51

10:19:55

10:20:00

10:20:05

10:20:11

10:20:11

10:20:15

10:20:19

10:20:24

10:20:32

10:20:35

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

28

MR. MIEDEL: A couple things. First of all, while

the government has some evidence that Zha Rong worked with

Mr. Xu or was his supervisor in, I don't know, 2015, 2016,

that's 13 years after this letter. There is zero evidence

that Zha Rong worked with Mr. Xu in 2003.

Secondly, to the extent that the government is simply

suggesting that this letter asked for, quote, technical work,

that's irrelevant. The issue at this trial is whether Mr. Xu

conspired or attempted to gain trade secrets, not technical

work. But it is -- and so there is a ten-year gap between any

correspondence between Mr. Gau in 2003 and Mr. Zha Rong in

2003 and the next time that they talk. So the suggestion that

there is some sort of pattern or a beginning of a relationship

is simply belied by -- will be belied by the testimony of

Mr. Gau. There was no contact between them for a decade. And

so it is simply way outside the scope of the conspiracy. It

cannot -- you cannot be a co-conspirator outside the scope of

the conspiracy. And so it's just, I think, improper to admit

this document.

And I think -- I agree with Your Honor that Mr. Gau can

certainly talk about his visits to China in 1997 and 2000 and

2002 and who he met there if he wants, but the introduction of

this document is prejudicial.

THE COURT: The Court sustains the defendant's

objection. What Zha Rong may have been doing in 2003 is not

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 28 of 50 PAGEID #: 3629
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:20:41

10:20:47

10:20:53

10:20:58

10:20:58

10:21:02

10:21:08

10:21:13

10:21:17

10:21:21

10:21:24

10:21:27

10:21:30

10:21:31

10:21:33

10:21:34

10:21:37

10:21:38

10:21:39

10:41:53

10:41:57

10:42:01

10:42:07

10:42:11

10:42:17

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

29

relevant, the background as to how Mr. Gau came to be involved

with the defendant, and he can explain that, he can explain, I

suppose, that he knew Zha Rong in 2003 and later met the

defendant.

If the defendant on cross questions Gau's explanation of

how he initially came to meet Zha Rong and, later, defendant,

then, by all means, the letter would start to become relevant.

But as an initial matter, Gau can explain it as an initial

matter without the letter, and the objection is sustained.

We're going to go into our recess unless there is

something else I need to address outside the presence of the

jury at this moment. Is there from the government?

MR. MANGAN: No, Your Honor.

THE COURT: The defense?

MR. MIEDEL: No, Your Honor. Thank you.

THE COURT: We're in recess.

THE COURTROOM DEPUTY: All rise. This court's now

in recess.

(Recess from 10:21 until 10:41 a.m.)

THE COURT: Back in the courtroom late. The jury's

not yet here.

We've had some drama. When my daughters used to live at

home with my wife and me, we had drama every day. I am well

trained in drama. It arises out of primarily the fact that

the second interpreter who had joined us today has indicated

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 29 of 50 PAGEID #: 3630
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:42:21

10:42:27

10:42:33

10:42:39

10:42:43

10:42:47

10:42:51

10:42:59

10:43:05

10:43:08

10:43:10

10:44:32

10:44:34

10:45:06

10:45:09

10:45:11

10:45:18

10:45:24

10:45:28

10:45:31

10:45:36

10:45:39

10:45:45

10:45:52

10:45:52

JAMES - DIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

30

that she typically translates hospital proceedings and does

not feel that she is adequately trained to assist us in a

courtroom that's intimidating with a bunch of lawyers. And I

appreciate her speaking the truth, and I have released her.

That means we're going to have to go in chunks as we've

been doing previously. We're going to work as hard as we can

to get a second one because the current interpreter is

whipped. But she has agreed with me that she will take a deep

breath out of recognition that we're going to take short

breaks.

So we can call for the jury now.

THE COURTROOM DEPUTY: All rise for the jury now.

(Jury in at 10:44 a.m.)

THE COURT: You may all be seated. The 15 jurors

have rejoined us.

And I kept you waiting again. And I apologize for that.

I hate that. My mother would be all over me if I were keeping

a bunch of important people waiting. But there are times when

you leave that I have to address stuff that I need to deal

with outside your presence. The long break here had nothing

to do with any of the lawyers or the parties. I had to deal

with something. It's on me. I hope you will forgive me.

So we will continue with testimony. Redirect, is that

right?

MR. McKENZIE: Cross-examination at this time, Your

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 30 of 50 PAGEID #: 3631
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:45:54

10:45:54

10:45:56

10:45:57

10:46:00

10:46:03

10:46:07

10:46:12

10:46:17

10:46:17

10:46:18

10:46:18

10:46:20

10:46:22

10:46:24

10:46:32

10:46:35

10:46:39

10:46:40

10:46:45

10:46:47

10:46:49

10:46:52

10:46:57

10:47:01

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

31

Honor.

THE COURT: Cross-examination.

MS. CORS: Thank you, Your Honor.

THE COURT: You may approach.

The witness remains under oath. The attorney for the

defense has an opportunity to ask questions.

MS. CORS: Thank you, Your Honor. And if I go too

fast, I assume someone will let me know to slow down so that

the interpreter can keep up.

THE COURT: You better believe it.

CROSS-EXAMINATION

BY MS. CORS:

Q. Good morning, Special Agent. How are you today?

A. I'm good. How are you?

Q. Good.

Over the past couple days you have been asked to read

from a number of text messages involving Mr. Xu, correct?

A. I have.

Q. And were these documents that you obtained through any

forensic analysis you conducted?

A. The text messages were not.

Q. Okay. Where did you get those text messages from?

A. I received them from the search warrant data from the

Cincinnati -- Cincinnati case.

Q. And you testified regarding your background in cyber

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 31 of 50 PAGEID #: 3632
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:47:07

10:47:14

10:47:19

10:47:20

10:47:22

10:47:24

10:47:27

10:47:28

10:47:34

10:47:44

10:47:49

10:47:55

10:47:57

10:47:58

10:48:03

10:48:11

10:48:20

10:48:22

10:48:22

10:48:27

10:48:29

10:48:32

10:48:38

10:48:43

10:48:46

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

32

counterintelligence, correct? And computer security, and

explained to the jury much of the education you have had

relating to computers.

Do you have any training as an engineer?

A. I do not have any training as an engineer.

Q. And any training in the aviation field?

A. I do not.

Q. Okay. Thank you.

Now, you have testified about events in Suzhou relating

to what I believe you described as the insertion of a USB

drive into a computer in January of 2014, correct? January

25, 2014?

A. Yes.

Q. Okay. What I'd like to do is walk through the timeline

of events that you've testified to. So as I understand it, on

January 25, 2014, a USB was inserted into the computer of

Mr. Hascoet, correct?

A. That is correct.

Q. And that occurred in, you believe and have testified, his

office in Suzhou; is that correct?

A. I don't know where it was inserted physically.

Q. Okay. So you don't know where it was inserted. But at

some point on that date, based on your forensic analysis, this

USB drive was inserted into his computer. Is that fair?

A. That is correct.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 32 of 50 PAGEID #: 3633
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:48:47

10:48:55

10:49:02

10:49:02

10:49:03

10:49:08

10:49:11

10:49:16

10:49:17

10:49:18

10:49:23

10:49:23

10:49:27

10:49:30

10:49:34

10:49:41

10:49:45

10:49:49

10:49:52

10:49:58

10:49:58

10:49:59

10:50:03

10:50:03

10:50:05

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

33

Q. And you testified that on that same day, from that USB

drive, a certain virus malware was placed on the computer of

Mr. Hascoet, correct?

A. That is correct.

Q. And then I believe you testified that shortly thereafter

you read some text messages, I believe it was maybe the day

after, where there were communications about someone looking

at that computer, correct?

A. That is correct.

Q. And can you explain to the jury again what that meant to

you?

A. What that means to me is somebody verified that the

computer had beaconed in, and they would have had the

ability to look at files on the computer if they wanted to.

Q. So in or around the 25th, 26th, based on your review of

that computer and what happened with that malware and the

beaconing, it's your understanding that at that point in time

someone who had access to this server, wherever it was, would

have had the ability to access the computer of Mr. Hascoet,

correct?

A. That is correct.

Q. And that would include looking at items on the computer;

is that correct?

A. That is correct.

Q. Okay. And I believe you mentioned that would also

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 33 of 50 PAGEID #: 3634
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:50:08

10:50:12

10:50:12

10:50:17

10:50:18

10:50:19

10:50:22

10:50:25

10:50:29

10:50:33

10:50:37

10:50:39

10:50:42

10:50:43

10:50:44

10:50:54

10:51:01

10:51:05

10:51:11

10:51:13

10:51:14

10:51:26

10:51:33

10:51:35

10:51:41

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

34

provide access to upload or download documents; is that

correct?

A. Upload or download files.

Q. Files, okay.

A. Yes.

Q. And I believe, based on your testimony, that that laptop

became connected to that server, I think, around the 27th of

January of '14. Does that sound correct to you?

A. There was evidence on the hard drive that it -- the

Sakula malware connected outbound as of that date.

Q. And that was to that domain you were talking about

earlier; is that correct?

A. Yes, that's correct.

Q. And what was that domain again?

A. There was two domains. One was oa.ameteksen.com, and

the other one was secure.safran-group.com.

Q. And then on or around January 30th, was that when, based

on your forensic analysis, some additional malware virus, the

key logger, was installed on that computer?

A. I believe that is correct.

Q. Okay. And at the time -- strike that. Then near the end

of January, around January 31, 2014, I believe in your report

there is an indication that the computer starts communicating

with secure.safran-group.com; is that correct?

A. The computer would have continued to communicate to

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 34 of 50 PAGEID #: 3635
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:51:45

10:51:46

10:51:48

10:51:52

10:51:53

10:51:54

10:52:00

10:52:09

10:52:12

10:52:17

10:52:18

10:52:21

10:52:26

10:52:31

10:52:37

10:52:39

10:52:42

10:52:45

10:52:48

10:52:48

10:52:49

10:52:50

10:52:56

10:53:00

10:53:04

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

35

that domain, yes.

Q. Okay. So it continues to communicate, continues to

provide access. Whoever has access to that domain has access

to Mr. Hascoet's computer, correct?

A. That would be correct.

Q. Okay. And then when did that computer, from your

recollection, stop communicating with that domain?

A. Based on the evidence available on the hard drive, I

believe it was on or about February 20 -- February 14th, if

I remember correctly.

Q. Okay. So the computer stops communicating around

February 14th with this domain. And then at the same time,

does the key logger stop recording or was that a little later?

A. I would have to go back and look at the key logger data

to see when the key logger stopped.

Q. About around the same time, is it your recollection?

A. It would probably be around the same time.

Q. Okay. I think I've seen February 17, 2014?

A. Okay.

Q. Does that sound --

A. Yeah, that sounds correct.

Q. Okay. So from January 25th, we know that, based on your

forensic analysis, malware is put on this computer, we know

that the computer starts communicating with a domain, and we

know that that communication stops on or around February 14th,

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 35 of 50 PAGEID #: 3636
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:53:10

10:53:10

10:53:13

10:53:15

10:53:16

10:53:19

10:53:22

10:53:32

10:53:34

10:53:39

10:53:43

10:53:44

10:53:48

10:53:49

10:53:55

10:54:03

10:54:09

10:54:13

10:54:15

10:54:18

10:54:20

10:54:29

10:54:32

10:54:32

10:54:38

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

36

correct?

A. That's --

Q. So three to four weeks, correct?

A. Yep.

Q. And based on your analysis, at any point during that time

was an effort made to target any documents on that computer?

A. Based on the evidence on the hard drive? It's hard to

determine that.

Q. Okay. And based on your forensic analysis, was there any

effort to obtain or download a trade secret from that

computer?

A. That could not be determined from my analysis. I did

not find evidence of that.

Q. Okay. But you did find analysis, did you not, that after

these -- this virus/malware was installed on the computer, was

anything accessed after January 30th?

A. I could not determine that from my analysis. I could

not determine that anything was accessed.

Q. Okay. So you don't know anything either way?

A. No, don't know either way.

Q. Now, this computer was also forensically analyzed by the

French Intelligence Service as well; is that correct?

A. That is correct.

Q. And a report dated September 17, 2014, does that sound

familiar? That was prepared by the French?

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 36 of 50 PAGEID #: 3637
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:54:43

10:54:43

10:54:47

10:54:52

10:54:55

10:54:56

10:54:58

10:54:59

10:55:01

10:55:03

10:55:05

10:55:11

10:55:16

10:55:20

10:55:22

10:55:22

10:55:26

10:55:29

10:55:36

10:55:42

10:55:46

10:55:53

10:55:58

10:56:03

10:56:07

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

37

A. That's probably correct.

Q. And do you recall as one of the findings of that report

that any data recovery, if any took place, did not appear to

be targeted in any matter?

MR. McKENZIE: Objection, Your Honor.

THE COURT: Your objection?

MR. McKENZIE: Objection, Your Honor.

THE COURT: Basis?

MR. McKENZIE: Hearsay.

MS. CORS: Your Honor, I am asking for a finding. I

am not asking for him to repeat what was in the report.

THE COURT: Objection's overruled.

You can answer the question, if you remember it.

THE WITNESS: Could you repeat the question, please?

BY MS. CORS:

Q. Sure. So as -- was it your understanding that one of the

findings of this report was that any data recovery did not

appear to be targeted in any manner?

A. I don't recall that statement, and I'm a little bit

confused on the term "data recovery" being used there. Is

that downloading of files, I guess is what my question is?

Q. Did you have any understanding as to whether the French

forensic analysis concluded that any files were exported?

A. I don't believe they could conclude that any files were

exported.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 37 of 50 PAGEID #: 3638
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:56:10

10:56:13

10:56:16

10:56:17

10:56:19

10:56:29

10:56:32

10:56:33

10:56:35

10:56:38

10:56:39

10:56:45

10:56:52

10:56:55

10:56:57

10:57:06

10:57:11

10:57:13

10:57:16

10:57:16

10:57:18

10:57:21

10:57:22

10:57:23

10:57:24

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

38

Q. So it appears, from your perspective, their conclusions

were consistent with the conclusions of your own forensic

analysis?

A. That is correct.

Q. Now, your report analyzed a file, a self-extracting RAR

file, I believe, that contained images on Mr. Hascoet's

computer; is that correct?

A. That is correct.

Q. And can you explain to the jury what -- what those images

were?

A. The images were pictures of the various locations that

we determined to be in Nanjing, Jiangsu Province.

Q. They appeared to be vacation photos?

A. They would be consistent with vacation photos.

Q. And in the course of your investigation, you reviewed, as

I understand, communications involving Tian Xi, correct?

A. Tian Xi, yes.

Q. And many of those communications you read here for the

jury, correct?

A. That is correct.

THE COURT: Ms. Cors, could you keep your voice up,

please?

MS. CORS: Yes. Sorry, Your Honor.

BY MS. CORS:

Q. And in those communications do you recall seeing any

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 38 of 50 PAGEID #: 3639
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:57:26

10:57:28

10:57:29

10:57:32

10:57:34

10:57:35

10:57:41

10:57:42

10:57:48

10:57:49

10:57:58

10:57:59

10:58:01

10:58:08

10:58:09

10:58:13

10:58:18

10:58:20

10:58:23

10:58:27

10:58:29

10:58:34

10:58:38

10:58:41

10:58:41

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

39

reference to trade secrets?

A. I do not.

Q. Do you recall seeing any discussion about obtaining

documents from Safran?

A. I do not.

Q. Do you recall any reference to composite materials?

A. I do not.

Q. Do you recall any reference to aviation technology?

A. I do not.

Q. And do you recall any reference to fan blade technology?

A. I do not.

Q. Okay. And then you were asked to read, and I understand

you reviewed, communications involving Mr. Gu Gen, correct?

A. Correct.

Q. And who is Mr. Gu Gen again?

A. Gu Gen is the IT infrastructure and information

security officer for Safran Suzhou.

Q. Okay. And with respect to these communications, do these

communications reference any effort to obtain documents?

A. They do not.

Q. Do they reference any attempt to steal trade secrets?

A. They do not.

Q. Do they reference any -- do they reference composite

materials?

A. No.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 39 of 50 PAGEID #: 3640
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:58:41

10:58:45

10:58:48

10:58:49

10:58:51

10:58:55

10:58:59

10:59:00

10:59:02

10:59:03

10:59:06

10:59:08

10:59:14

10:59:15

10:59:16

10:59:20

10:59:20

10:59:21

10:59:25

10:59:28

10:59:34

10:59:35

10:59:37

10:59:38

10:59:44

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

40

Q. Do they reference fan blades, including fan blades

designed by GE?

A. They do not.

Q. Okay. And there were additional communications you were

asked to review and read into the record regarding alleged

colleagues of Mr. Xu, correct?

A. That is correct.

Q. Chai Meng?

A. Chai Meng.

Q. And I am going to ask you the same series of questions.

In those communications, was there any reference about

obtaining documents from Safran Suzhou or any entity of

Safran?

A. There were not.

Q. Were there any reference to trying to obtain trade

secrets?

A. There weren't.

Q. Any reference to composite materials?

A. There was not.

Q. Any reference to aviation fan blades?

A. No.

Q. Or GE Aviation?

A. There was not.

Q. Now, Mr. Gu Gen was head of security, correct?

A. He is head of information security.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 40 of 50 PAGEID #: 3641
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10:59:46

10:59:50

10:59:55

10:59:57

10:59:59

11:00:01

11:00:05

11:00:08

11:00:09

11:00:19

11:00:26

11:00:27

11:00:28

11:00:30

11:00:32

11:00:40

11:00:41

11:00:43

11:00:47

11:00:52

11:00:58

11:00:59

11:01:01

11:01:15

11:01:16

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

41

Q. And in your experience, would someone who's head of

information security have pretty broad access to the databases

and computers of the company?

A. Generally, they would.

Q. Yet, I believe you just testified there was never a

request of Mr. Gu Gen, to your knowledge, to -- to use that

access to obtain any information from the company, correct?

A. Correct.

Q. Now, on your direct testimony you talked a little bit

about the MSS and its local office in Nanjing, the JSSD,

correct?

MR. McKENZIE: Objection, Your Honor.

THE COURT: Basis?

MR. McKENZIE: Assumes facts not in evidence.

THE COURT: Sustained as to form.

BY MS. CORS:

Q. Mr. James, you were shown documents that the government

alleged related to Mr. Xu, correct?

A. Mr. Xu Yanjun.

Q. And his alleged role with MSS in its office in Nanjing,

the JSSD, correct?

A. I was shown that.

Q. The MSS and the JSSD have multiple functions, do they

not?

A. They do.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 41 of 50 PAGEID #: 3642
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

11:01:17

11:01:20

11:01:25

11:01:26

11:01:28

11:01:32

11:01:34

11:01:39

11:01:44

11:01:48

11:01:53

11:01:56

11:01:58

11:02:01

11:02:04

11:02:07

11:02:10

11:02:11

11:02:14

11:02:15

11:02:15

11:02:19

11:02:20

11:02:25

11:02:28

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

42

Q. Okay. I believe you've testified in the past that in

your view they are sort of a combination of the FBI and CIA,

correct?

MR. McKENZIE: Objection, Your Honor. Outside the

scope of direct.

MS. CORS: May I address this, Your Honor? On

direct, the issue of Mr. Xu and his employment with the MSS

was brought up. On direct the issue of an incursion into a

computer was brought up. I'm simply trying to explore what

could be the basis for an incursion.

THE COURT: The Court overrules the objection. I am

going to give you some latitude.

MR. McKENZIE: Your Honor, I am going to make a

second renewed objection under different grounds of improper

impeachment by referencing prior testimony without asking a

direct question first.

THE COURT: Overruled.

Please proceed.

MS. CORS: Thank you, Your Honor.

BY MS. CORS:

Q. Now, with respect to the MSS and the -- let me start with

this.

You had -- in connection with your investigation in the

Southern District of California, did you provide testimony to

the grand jury?

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 42 of 50 PAGEID #: 3643
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

11:02:29

11:02:30

11:02:35

11:02:40

11:02:41

11:02:41

11:02:46

11:02:49

11:02:51

11:02:57

11:03:03

11:03:06

11:03:12

11:03:14

11:03:17

11:03:17

11:03:18

11:03:22

11:03:24

11:03:25

11:03:29

11:03:35

11:03:37

11:03:37

11:03:41

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

43

A. I did.

Q. Okay. And as part of that testimony, did you opine on

the roles and functions of the MSS and its office, JSSD and

Nanjing?

A. Yes.

Q. And do you recall identifying some of those functions as

somewhat of a combination between the FBI and CIA?

A. That would be correct.

Q. And you identified one of the primary responsibilities of

MSS and JSSD as collecting of intelligence, correct?

A. That is correct.

Q. Intelligence, by definition information?

A. That could be another term for intelligence.

Q. It could also include open-source information; is that

correct?

A. It could.

Q. Some of the other functions, I believe you identified

nonmilitary foreign intelligence; is that correct?

A. That is correct.

Q. And then you also identified as a function of both the

MSS and the JSSD office performing political and domestic

security. Do you recall that?

A. I do.

Q. And could you explain to the jury what your understanding

of political and domestic security is?

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 43 of 50 PAGEID #: 3644
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

11:03:44

11:03:51

11:03:51

11:03:54

11:03:56

11:03:57

11:04:00

11:04:03

11:04:06

11:04:11

11:04:17

11:04:20

11:04:22

11:04:24

11:04:29

11:04:31

11:04:36

11:04:37

11:04:38

11:04:41

11:04:46

11:04:49

11:04:50

11:04:54

11:04:58

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

44

A. That would be looking for internal spies inside of

China.

Q. Could it also include monitoring and surveilling

foreigners or individuals who are in China?

A. It could.

Q. Could it also include monitoring and surveilling

companies that are operating within China's borders?

A. It could.

Q. And, in fact, would you agree that China views cyberspace

within its national borders as a proper area of control?

MR. McKENZIE: Objection as to first being outside

the scope and, second, relevance.

THE COURT: Second, what?

MR. McKENZIE: Relevance as to his opinion.

THE COURT: Overruled.

I'm going to need to break momentarily, but finish up.

MS. CORS: Okay. I can finish this up.

BY MS. CORS:

Q. And as part of any functions with respect to political

and domestic security, there are a number of methods the

Chinese government can use to do that; isn't that correct?

A. That is correct.

Q. Okay. Do some of those include searching hotel rooms?

A. I'm not familiar with exactly what the MSS does or

doesn't do inside of China.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 44 of 50 PAGEID #: 3645
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

11:05:01

11:05:05

11:05:10

11:05:14

11:05:15

11:05:16

11:05:18

11:05:20

11:05:23

11:05:25

11:05:27

11:05:29

11:05:32

11:05:33

11:05:36

11:05:39

11:05:42

11:05:47

11:05:50

11:05:51

11:05:52

11:06:31

11:06:34

11:06:37

11:06:41

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

45

Q. In terms of monitoring, surveilling, in your experiences

as a cyber expert, could bugging or intruding into someone's

computer to monitor that computer be a technique that --

A. That could be.

Q. -- is used?

Is that a technique that governments sometimes use to

conduct such surveillance?

A. It could be.

THE COURT: I'm going to interject here and ask if

we can break.

MS. CORS: Certainly, Your Honor.

THE COURT: And I think we're straying a bit, but I

gave you some latitude.

Members of the jury, we are going to break for 20

minutes. During the break, take a break. As you know, don't

discuss the case among yourselves or with anyone else. No

independent research. Continue to keep an open mind.

Out of respect for you, we'll rise as you leave for 20

minutes.

THE COURTROOM DEPUTY: All rise for the jury.

(Jury out at 11:05 a.m.)

THE COURT: The jury's left the room. The door is

closed. Is there anything that requires my attention before

we break for 20 minutes? First, from the government?

MR. McKENZIE: No, Your Honor.

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 45 of 50 PAGEID #: 3646
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

11:06:42

11:06:43

11:06:44

11:06:46

11:06:49

11:06:52

11:06:54

11:31:17

11:31:20

11:31:23

11:31:24

11:31:26

11:31:27

11:31:28

11:32:38

11:32:39

11:33:10

11:33:17

11:33:21

11:33:22

11:33:26

11:33:30

11:33:33

11:33:33

11:33:34

JAMES - CROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

46

THE COURT: From the defense?

MS. CORS: No, Your Honor.

THE COURT: Very well.

Let the record reflect that Judge Cole is here observing

my work during recess.

THE COURTROOM DEPUTY: The court is now in recess.

(Recess from 11:06 a.m. until 11:31 a.m.)

THE COURT: May we call for the jury from the

government's perspective?

MR. McKENZIE: Yes, Your Honor.

THE COURT: And from the defense as well?

MS. CORS: Yes, Your Honor.

THE COURT: Let's call for the jury. Let me get my

mask. You can call for the jury.

THE COURTROOM DEPUTY: All rise for the jury.

(Jury in at 11:32 a.m.)

THE COURT: You may all be seated. Thank you.

The 15 jurors have rejoined us after a break. Thank you

for your patience.

We'll continue with the testimony of this witness.

MS. CORS: Thank you, Your Honor.

Your Honor, I have no further questions for this witness.

Thank you.

THE COURT: Very well.

Redirect, if any?

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 46 of 50 PAGEID #: 3647
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

11:33:41

11:33:44

11:33:46

11:33:46

11:33:52

11:33:56

11:34:01

11:34:04

11:34:05

11:34:10

11:34:16

11:34:18

11:34:19

11:34:28

11:34:31

11:34:34

11:34:37

11:34:41

11:34:45

11:34:49

11:34:50

11:34:53

11:35:00

11:35:18

11:35:24

JAMES - REDIRECT (McKENZIE)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

47

MR. McKENZIE: Very briefly, Your Honor.

THE COURT: Very well.

REDIRECT EXAMINATION

BY MR. McKENZIE:

Q. Special Agent James, when you analyzed the Sakula

malware, were you able to determine whether or not it beaconed

out to a domain?

A. Yes, I was.

Q. Were you able to determine whether any particular files

were transferred from the computer to anywhere else?

A. I could not determine that.

Q. Why not?

A. Depending on how the files are transferred, our records

are not maintained on the hard drive so it's really hard to

determine that after the fact. Generally, you would need to

actually watch the transfer occur.

Q. And so just to be clear, is it the case that you

determined that no files were transferred, or is it the case

that you could not determine what files, if any, were

transferred?

A. There was no evidence to support whether or not files

were transferred either way.

Q. During your years of experience in cyber intrusion cases

involving remote access trojans, is part of the purpose that

they're installed to take files?

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 47 of 50 PAGEID #: 3648
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

11:35:27

11:35:28

11:35:30

11:35:33

11:35:34

11:35:40

11:35:41

11:35:48

11:35:52

11:35:57

11:36:00

11:36:04

11:36:10

11:36:12

11:36:16

11:36:19

11:36:20

11:36:22

11:36:24

11:36:26

11:36:27

11:36:30

11:36:33

11:36:35

11:36:35

JAMES - RECROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

48

MS. CORS: Objection, Your Honor.

THE COURT: Basis?

MS. CORS: Leading and beyond the scope.

THE COURT: Overruled.

Don't lead the witness. Go ahead, ask.

BY MR. McKENZIE:

Q. As part of your experience, what are some of the reasons,

some of the main reasons that you've experienced for why

people installed remote access trojans on computers?

A. Some of the primary reasons are, one, to gain access to

the computer so that you can use it to do what your motive

is. Once you have access, you can run commands and

compromise other computers on the network.

In this case, they used computers that were compromised

to compromise other companies.

MS. CORS: Objection, Your Honor.

THE COURT: Beyond the scope?

MS. CORS: Yes, beyond the scope.

THE COURT: Sustained.

MR. McKENZIE: No further questions, Your Honor.

THE COURT: Very well.

Redirect or recross on redirect?

MS. CORS: Thank you, Your Honor.

RECROSS-EXAMINATION

BY MS. CORS:

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 48 of 50 PAGEID #: 3649
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

11:36:38

11:36:42

11:36:46

11:36:46

11:36:46

11:36:49

11:36:54

11:36:57

11:37:02

11:37:07

11:37:08

11:37:08

11:37:12

11:37:16

11:37:17

11:37:23

11:37:24

11:37:26

11:37:26

11:37:28

11:37:30

11:37:33

JAMES - RECROSS (CORS)

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

49

Q. Special Agent James, you just testified that this type of

virus malware can be used to gain access to achieve motives,

correct?

A. That is correct.

Q. And in this instance, you are not in any position to know

what those motives were, correct?

A. Can we be more specific on the question?

Q. Well, there can be many different reasons why a person or

entity may seek to install this type of file on a computer,

correct?

A. That is correct.

Q. And one of those reasons could be to gain access to the

computer and to see what is in the computer to surveil, to

monitor, correct?

A. That is correct.

MS. CORS: No further questions. Thank you.

MR. McKENZIE: Nothing further, Your Honor. Thank

you.

THE COURT: Are you going back to San Diego?

THE WITNESS: I hope so.

THE COURT: Travel safe. You may step down, sir.

THE WITNESS: Thank you.

(Proceedings reported but not transcribed.)

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 49 of 50 PAGEID #: 3650
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

50

CERTIFICATE OF REPORTER

I, Mary A. Schweinhagen, Federal Official Realtime

Court Reporter, in and for the United States District Court

for the Southern District of Ohio, do hereby certify that

pursuant to Section 753, Title 28, United States Code that the

foregoing is a true and correct transcript of the

stenographically reported proceedings held in the

above-entitled matter and that the transcript page format is

in conformance with the regulations of the Judicial Conference

of the United States.

s/Mary A. Schweinhagen

__________________________________ 15th of December, 2021

MARY A. SCHWEINHAGEN, RDR, CRR

FEDERAL OFFICIAL COURT REPORTER

Case: 1:18-cr-00043-TSB Doc #: 184 Filed: 12/15/21 Page: 50 of 50 PAGEID #: 3651