1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

02:00:00

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

1

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF OHIO

WESTERN DIVISION

- - -

UNITED STATES OF AMERICA,

Plaintiff,

vs.

YANJUN XU, also known as XU

YANJUN, also known as QU HUI,

also known as ZHANG HUI,

Defendant.

:

:

:

:

:

:

:

:

:

:

CASE NO. 1:18-cr-0043

TRIAL EXCERPT

26th of OCTOBER, 2021

3:18 P.M.

- - -

EXCERPT OF TRANSCRIPT OF PROCEEDINGS

TESTIMONY OF ADAM ROBERT JAMES

BEFORE THE HONORABLE TIMOTHY S. BLACK, JUDGE

- - -

APPEARANCES:

For the Plaintiff:

Timothy S. Mangan, Esq.

Emily N. Glatfelter, Esq.

Assistant United States Attorneys

221 East Fourth Street, Suite 400

Cincinnati, Ohio 45202

and

Matthew John McKenzie, Esq.

United States Department of Justice

National Security Division

950 Pennsylvania Avenue NW

Washington, D.C. 20530

and

Jacqueline K. Prim

Special Assistant, Paralegal

United States Department of Justice

National Security Division

950 Pennsylvania Avenue NW

Washington, D.C. 20530

For the Defendant:

Ralph William Kohnen, Esq.

Jeanne Marie Cors, Esq.

Sanna-Rae Taylor, Esq.

Taft Stettinius and Hollister

425 East Walnut Street, Suite 1800

Cincinnati, Ohio 45202

and

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 1 of 44 PAGEID #: 3558
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

2

Robert K. McBride, Esq.

Amanda Johnson, Esq.

Taft Stettinius and Hollister

50 East RiverCenter Boulevard

Suite 850

Covington, Kentucky 41011

and

Florian Miedel, Esq.

Miedel & Mysliwiec, LLP

80 Broad Street, Suite 1900

New York, New York 10004

Also present: Mae Harmon, Interpreter

Robin Murphy, Interpreter

Yanjun Xu, Defendant

Law Clerk: Cristina V. Frankian, Esq.

Courtroom Deputy: Rebecca Santoro

Stenographer: Mary Schweinhagen, RPR, RMR, RDR, CRR

United States District Court

200 West Second Street, Room 910

Dayton, Ohio 45402

Proceedings reported by mechanical stenography,

transcript produced by computer.

*** *** *** ***

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 2 of 44 PAGEID #: 3559
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

3

INDEX OF WITNESSES

TUESDAY, OCTOBER 26, 2021

DIRECT CROSS REDIRECT RECROSS

PLAINTIFF'S WITNESSES

ADAM JAMES 5

* * * * *

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 3 of 44 PAGEID #: 3560
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:18:26

03:18:27

03:18:31

03:18:33

03:18:37

03:18:38

03:18:39

03:18:43

03:18:43

03:18:43

03:18:44

03:18:45

03:18:45

03:19:02

03:19:03

03:19:06

03:19:10

03:19:13

03:19:16

03:19:21

03:19:23

03:19:24

03:19:27

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

4

P-R-O-C-E-E-D-I-N-G-S 3:18 P.M.

(Proceedings reported but not transcribed.)

MR. McKENZIE: Your Honor, the government is ready

to call our next witness, Special Agent Adam James.

THE COURT: Very well. If we could call for the

agent, special agent.

MS. TAYLOR: Your Honor, counsel for --

THE COURT: Yes?

MS. TAYLOR: Counsel for defense is going to change

places at the tables.

THE COURT: Change what?

MS. TAYLOR: Change places at the tables if that's

okay?

THE COURT: Yes.

MS. TAYLOR: Thank you.

THE COURT: If the witness would be willing to

approach, we're going to put you in the witness stand over

here.

If you'd be willing to pause for the oath to tell the

truth. If you'd raise your right hand. Do you solemnly swear

or affirm that your testimony today will be the truth, subject

to penalty of perjury?

THE WITNESS: I do.

THE COURT: Very well. Once you get seated, get

close to the microphone.

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 4 of 44 PAGEID #: 3561
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:19:30

03:19:30

03:19:33

03:19:33

03:19:34

03:19:38

03:19:40

03:19:41

03:19:49

03:19:51

03:19:53

03:19:58

03:20:02

03:20:06

03:20:09

03:20:11

03:20:17

03:20:21

03:20:24

03:20:30

03:20:33

03:20:39

03:20:43

03:20:45

03:20:50

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

5

The lawyer for the government may begin with questions.

ADAM ROBERT JAMES, PLAINTIFF WITNESS, SWORN

DIRECT EXAMINATION

BY MR. McKENZIE:

Q. Good afternoon. My name is Matthew McKenzie.

Will you please state your full name and spell your last

name for the record?

A. My name is Adam Robert James, J-A-M-E-S.

Q. By whom are you employed?

A. The FBI.

Q. To which field office are you assigned?

A. I'm assigned to the San Diego field office.

Q. What is your current position within the FBI?

A. I am a special agent.

Q. How long have you been a special agent?

A. I became a special agent on July 5th of 2010.

Q. Do you have a particular focus?

A. Yes. I'm focused on cyber crime investigations.

Q. What types of activities are included in cyber crime?

A. There's various types of cyber crime that the FBI

investigates. It could be ransomware. It could be business

email compromises. But I mainly focus on computer intrusion

activity.

Q. Has the FBI provided you with any training regarding

computer intrusions and cyber investigations?

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 5 of 44 PAGEID #: 3562
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:20:53

03:20:54

03:20:59

03:21:01

03:21:05

03:21:08

03:21:12

03:21:13

03:21:17

03:21:20

03:21:25

03:21:29

03:21:33

03:21:37

03:21:40

03:21:43

03:21:47

03:21:51

03:21:55

03:21:59

03:21:59

03:22:03

03:22:10

03:22:15

03:22:17

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

6

A. Yes, it has.

Q. Could you provide the jury with an overview of your

training that was provided by the FBI?

A. Yes. So when you get hired by the FBI, they send you

to the FBI Academy for about five months for general

training. That covers a little bit of cyber crime training,

but very little.

When you get assigned to a cyber squad once you get out

of the academy, they send you to additional training. So

the first training I took was a two-week general cyber

investigation course where they kind of tell you here's all

the elements of the FBI that does cyber crime

investigations, and then they give you kind of like a brief

week-long course in cyber investigations.

And then since then I have taken over 400 hours of

training both online and in person. That has included

everything from interview and interrogation techniques;

hacker tactics, techniques, and procedures; reverse

engineering malware; and computer forensics; and intrusion

investigations.

Q. We'll come back and define some of those terms in a

moment. But prior to joining the FBI, where did you work?

A. Immediately prior to joining the FBI, I worked for a

computer security consulting company in Omaha, Nebraska.

Q. And what were some of your duties and responsibilities?

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 6 of 44 PAGEID #: 3563
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:22:19

03:22:23

03:22:27

03:22:33

03:22:35

03:22:41

03:22:42

03:22:49

03:22:53

03:22:58

03:23:02

03:23:05

03:23:08

03:23:12

03:23:15

03:23:19

03:23:22

03:23:26

03:23:29

03:23:33

03:23:36

03:23:40

03:23:41

03:23:42

03:23:46

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

7

A. My primary duty immediately before joining the FBI was

computer forensics and incident response. Prior to that I

did some third-party risk assessments and policy writing for

various companies.

Q. Did you ever -- in that capacity as a consultant, did you

ever contract with the U.S. government?

A. I took a -- about a nine-month leave of absence from my

job with the consulting company, and I did media forensics

for a U.S. military in Iraq.

Q. Will you just explain to the jury in basic terms what you

did over in Iraq?

A. Yeah. So basically what my job was, is when the

military would go out and detain suspected terrorists or

insurgents, they would take the person and all of their

papers, electronic devices, computers, all that type of

stuff. They would bring them back to be reviewed and

interrogated. So while the military was interrogating the

suspect, my job would be to go through all of their

electronic media and pull off whatever information was

available.

Q. What was your first job in information technology --

A. My first --

Q. -- after you graduated?

A. My first job in information technology, I was a

business analyst at Mutual of Omaha. And I worked up

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 7 of 44 PAGEID #: 3564
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:23:50

03:23:54

03:23:57

03:24:01

03:24:06

03:24:07

03:24:10

03:24:12

03:24:13

03:24:14

03:24:15

03:24:18

03:24:21

03:24:25

03:24:26

03:24:30

03:24:31

03:24:32

03:24:34

03:24:37

03:24:39

03:24:44

03:24:45

03:24:48

03:24:55

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

8

through several jobs at Mutual of Omaha, from a business

analyst to a computer programmer, and then ultimately I was

a security analyst at Mutual of Omaha.

Q. Did you earn a bachelor's degree?

A. I did.

Q. From which institution did you earn that degree?

A. The University of Nebraska at Omaha.

Q. When did you earn the degree?

A. In 2003.

Q. What was the subject?

A. Management information systems.

Q. What is information systems?

A. Information systems is a, I guess a generic term for

computers.

Q. After earning your bachelor's degree, did you go on to

earn a master's degree?

A. I did.

Q. Where did you earn this degree?

A. Also from the University of Nebraska at Omaha.

Q. And what was the subject of your degree?

A. Management information systems.

Q. And when did you earn it?

A. In 2005.

Q. In addition to your education and work experience, have

you had the occasion to earn professional certifications?

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 8 of 44 PAGEID #: 3565
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:25:00

03:25:00

03:25:03

03:25:05

03:25:09

03:25:15

03:25:19

03:25:24

03:25:29

03:25:34

03:25:39

03:25:44

03:25:49

03:25:55

03:25:56

03:25:59

03:26:01

03:26:05

03:26:10

03:26:14

03:26:19

03:26:23

03:26:27

03:26:31

03:26:33

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

9

A. I have.

Q. Could you explain to the jury some of the certifications

that you've earned and held?

A. Yes. So probably the biggest certification I've held

was I held a CISP, which is a very broad industry standard

certification for information security. And I've also held

multiple more specific certifications, several related to

computer forensics, one related to reverse engineering

malware, one related to computer networking devices, and,

you know, several other more generic ones.

Q. Through your education, your work experience with the FBI

and also prior to the FBI, have you become familiar with the

term "digital media" as it pertains to cyber investigations?

A. Yes, I am.

Q. Will you please explain to the jury what "digital media"

means and give some common examples?

A. Okay. So digital media is going to be anything that

can store data in a binary format or in a data format used

by computers. And that could include a computer, your cell

phone, the MMC card or the multimedia card you put into your

camera, a CD. It could be a, you know, electronic music

device. All of those would be considered digital media.

Q. Are you familiar with the term "forensic examination" as

it pertains to digital media?

A. I am.

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 9 of 44 PAGEID #: 3566
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:26:33

03:26:38

03:26:40

03:26:44

03:26:49

03:26:52

03:26:57

03:27:02

03:27:09

03:27:12

03:27:18

03:27:20

03:27:22

03:27:26

03:27:27

03:27:29

03:27:33

03:27:38

03:27:41

03:27:46

03:27:49

03:27:52

03:27:57

03:28:00

03:28:05

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

10

Q. Will you please provide a basic definition of what this

means, "forensic examination"?

A. Yes. So for -- a forensic examination of digital media

is analyzing a piece of digital media -- so it could be a

computer, cell phone, anything -- in a manner which can be

replicated and verified by another person.

Q. Including your work in private industry, including your

time in Iraq and your time with the FBI, approximately how

many forensic examinations have you conducted?

A. I've performed over 100 examinations of digital media.

Q. And approximately how many hours of training have you

received in this field?

A. In the field specific of digital media examinations

or --

Q. Yeah.

A. I would say over a hundred hours of training.

Q. Will you please explain to the jury the basic steps in

conducting a forensic examination of digital media?

A. Okay. So the first basic step that's going to be

conducted when you are analyzing digital media is you are

going to make a copy of the original media. We call that a

forensic image. And the reason in which you do that is,

again, as I stated, computer forensics is conducting an

analysis in a way that's repeatable and able to be verified.

So when I take a forensic copy, I'm going to try to

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 10 of 44 PAGEID #: 3567
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:28:08

03:28:11

03:28:16

03:28:20

03:28:23

03:28:26

03:28:28

03:28:31

03:28:35

03:28:36

03:28:39

03:28:45

03:28:50

03:28:54

03:28:59

03:29:02

03:29:06

03:29:08

03:29:14

03:29:16

03:29:17

03:29:24

03:29:24

03:29:26

03:29:29

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

11

work off of something that's not the original media in

case -- so that we limit or minimize the changes that occur

to the original evidence. And then we run a set of

standardized tools that will extract evidence from the

specific media type for the investigation that is being

conducted.

Q. And what types of files are you looking for during a

forensic examination of a hard drive in a computer intrusion

case?

A. So in a computer intrusion case we would generally be

looking for two general types of files. One is malicious

tools, so that could be malware or any additional file used

by the computer intruders. And then we are also looking for

files which contain information about how the malware was

executed on the system.

Q. So I think to back up and define computer intrusion -- I

should have done that earlier. What is a computer intrusion?

A. A computer intrusion is when somebody accesses a

computer without authorization or exceeds their

authorization.

Q. And I heard the word "malware."

A. Um-hmm.

Q. What is malware?

A. Malware is any code that is placed on a computer that

does something that the user doesn't want their computer to

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 11 of 44 PAGEID #: 3568
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:29:32

03:29:36

03:29:40

03:29:41

03:29:42

03:29:44

03:29:49

03:29:51

03:30:00

03:30:02

03:30:07

03:30:12

03:30:13

03:30:17

03:30:22

03:30:26

03:30:27

03:30:31

03:30:35

03:30:39

03:30:43

03:30:47

03:30:51

03:30:58

03:30:58

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

12

do. So there's a lot of different types of malware.

Q. Are there common names that people use to refer to

malware?

A. Yes.

Q. What are some of those common names?

A. So a common term would be a computer virus, would be

what most people think about when they think of malware.

Q. Now, is there just one thing called malware, or are there

many types of malware?

A. There are many types of malware.

Q. Are you familiar with the term "remote access trojan"?

A. I am.

Q. Is that also referred to as a RAT?

A. It can be.

Q. Will you please explain to the jury what a remote access

trojan is?

A. A remote access trojan is a program on a computer that

provides remote access to the computer to a user that the

owner of the computer would prefer not to have access.

There are legitimate remote access tools, which especially

in current times with remote work you see commonly. But

what sets a RAT, or a remote access trojan, apart is that

the user or owner of the computer does not intend it to be

there.

Q. In general, how does a RAT or how does a remote access

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 12 of 44 PAGEID #: 3569
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:31:03

03:31:04

03:31:09

03:31:13

03:31:18

03:31:22

03:31:25

03:31:27

03:31:31

03:31:33

03:31:38

03:31:44

03:31:45

03:31:52

03:31:53

03:32:00

03:32:05

03:32:09

03:32:13

03:32:16

03:32:16

03:32:19

03:32:25

03:32:33

03:32:38

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

13

trojan work?

A. There's two general ways a remote access trojan can

work. The first way is it can be installed on a computer

and it can open up the computer to access remotely on an

inbound connection from another location. So think of that

as it opens up the door. As long as somebody can see that

the door is open, they can walk in.

The other manner in which a remote access trojan can

operate is it can get installed on the computer and it can

initiate a connection outbound to some place on the Internet

to let the remote user or the remote intruder know that it's

there to be used.

Q. Is there a name for that process of the program reaching

out to a remote user?

A. Yes. We generally call that a beacon.

Q. Now, is there only one remote access trojan or are there

multiple versions of remote access trojan?

A. There are many versions of remote access trojans.

Q. Are you familiar with the term "Sakula"?

A. I am.

Q. What is Sakula?

A. Sakula is a specific type of remote access trojan.

Q. And just for the court reporter, it's S-A-K-U-L-A.

Will you explain to the jury how Sakula works?

A. Yeah. Sakula is a fairly basic remote access trojan.

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 13 of 44 PAGEID #: 3570
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:32:42

03:32:46

03:32:49

03:32:53

03:32:57

03:33:01

03:33:04

03:33:10

03:33:16

03:33:21

03:33:22

03:33:26

03:33:29

03:33:34

03:33:39

03:33:40

03:33:48

03:33:51

03:33:54

03:33:58

03:34:00

03:34:06

03:34:08

03:34:11

03:34:14

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

14

So when it gets installed on a user's computer, it will

reach out to somewhere on the Internet with a beacon, and it

has a very specific beacon format. So there is a protocol

it uses to communicate with its controller on the Internet.

And what it allows the remote user to do is it can upload

files, download files, and run arbitrary commands on the

computer. It also can be told to uninstall itself.

Q. Does Sakula -- what, if any, remote access or control

does Sakula give somebody of a computer on which it is

installed?

A. So like I said before, they can run whatever commands

they want to at the command line of the system. They also

can upload and download files.

Q. How do you distinguish Sakula from another remote access

trojan?

A. We generally distinguish remote access trojans based on

two general things. One is the control that's present on

the disk; and the other thing, which is more pertinent to

this case, is the communication format that it uses when it

beacons.

Q. What does that mean in general terms, the communication

format it uses to beacon?

A. We call that a communication protocol. So what a

communication protocol is, is the way two things

communicate. In this case it's on the Internet, but it can

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 14 of 44 PAGEID #: 3571
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:34:16

03:34:18

03:34:21

03:34:24

03:34:27

03:34:30

03:34:34

03:34:36

03:34:42

03:34:44

03:34:47

03:34:53

03:34:54

03:34:55

03:34:59

03:35:03

03:35:08

03:35:12

03:35:16

03:35:20

03:35:21

03:35:25

03:35:25

03:35:27

03:35:32

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

15

be in your normal, everyday life.

So a good example of a communication protocol would be

if you want to make a phone call to somebody else in the

U.S., you pick up the phone, you dial the number that you

want to call. You start to hear it ring. So that's the

first part of the protocol. The other person hears it ring

on their end, and they pick up the phone. When they pick up

the phone -- in my case I say, "Hello. This is Adam." Then

you know that you have established a communication that is

an English phone call.

Q. Are you familiar with the term "plugX."

A. I am.

Q. What is plugX?

A. PlugX is a variant of a remote access trojan.

Q. In general terms, how does plugX work?

A. PlugX works very similar to Sakula. It gets installed

on a computer, and it will initiate a beacon outbound to a

predefined location on the Internet.

Q. Does plugX have a different protocol than Sakula?

A. It does.

Q. Is the ultimate affect of providing remote access

similar, though?

A. It is similar.

Q. Just one more term I'd like to loop back to. Are you

familiar with the phrase "executable file"?

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 15 of 44 PAGEID #: 3572
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:35:36

03:35:37

03:35:42

03:35:47

03:35:47

03:35:50

03:35:55

03:35:57

03:36:00

03:36:03

03:36:08

03:36:12

03:36:12

03:36:18

03:36:20

03:36:23

03:36:24

03:36:27

03:36:32

03:36:34

03:36:40

03:36:44

03:36:47

03:36:49

03:36:51

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

16

A. I am.

Q. Could you provide a basic definition of what this term

means and provide a couple examples of what are executable

files?

A. An executable file is a program that can be run on a

computer. So a good example of an executable file is if you

go to your computer or your phone or whatever you use to

browse the Internet and you click on the icon that opens up

a web browser, what the computer in the background is doing

is opening up an executable file that causes the browser to

be displayed to you, which then allows you to be connected

to the Internet.

Q. I'd like to direct your attention now to October of 2019.

Did there come a time that you conducted a forensic

examination of a hard drive?

A. Yes, I did.

Q. Who provided you with the hard drive?

A. The hard drive was provided by DGSI.

Q. What is DGSI?

A. DGSI is roughly equivalent to the domestic

investigation and intelligence arm of the French government

as it relates to cyber matters.

Q. Does it have a law enforcement component to it?

A. Yes, it does.

Q. And does the FBI and DGSI have a law enforcement

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 16 of 44 PAGEID #: 3573
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:36:55

03:36:56

03:36:57

03:37:01

03:37:02

03:37:03

03:37:08

03:37:11

03:37:12

03:37:19

03:37:23

03:37:24

03:37:30

03:37:34

03:37:37

03:37:40

03:37:44

03:37:46

03:37:49

03:37:53

03:37:57

03:37:58

03:38:04

03:38:05

03:38:11

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

17

relationship?

A. We do.

Q. And as a result of this relationship, did they share this

computer with you?

A. Yes.

Q. Did you then conduct a forensic examination of the

computer -- or of the hard drive? Excuse me.

A. Yes, I did.

Q. As part of that examination, were you able to determine

what computer system and network the hard drive belonged to?

A. Yes.

Q. And what company, if any, did the hard drive belong to?

A. So the company was registered -- sorry. The hard drive

was registered to Snecma.

Q. And what is Snecma?

A. Snecma is a subsidiary of Safran Group.

Q. And where is Safran located?

A. Safran is headquartered in France.

Q. And as part of your examination of the hard drive, were

you able to identify a user profile?

A. Yes, I was.

Q. Were you able to view emails and other documents?

A. Yes, I was.

Q. Were you able to identify a particular user of that hard

drive as a result of your analysis?

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 17 of 44 PAGEID #: 3574
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:38:14

03:38:14

03:38:19

03:38:20

03:38:26

03:38:30

03:38:35

03:38:38

03:38:43

03:38:47

03:38:50

03:38:51

03:39:00

03:39:00

03:39:07

03:39:11

03:39:15

03:39:16

03:39:17

03:39:22

03:39:29

03:39:35

03:39:37

03:39:41

03:39:44

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

18

A. Yes.

Q. Was that person Frederic Hascoet?

A. It was.

Q. Will you please provide the jury with an overview of how

you conducted the forensic examination of this hard drive?

A. Yes. So we first took a forensic image of the hard

drive, and then I conducted analysis against the forensic

image. The first step that I did is I created a timeline of

activities that were on the system, and then I reviewed the

timeline to see if there was any indication of a computer

intrusion.

Q. As a result of your analysis, what, if any, malware did

you find?

A. On the hard drive, I found one variant of Sakula

malware and two variants of plugX.

Q. Were you able to determine when these malware programs

were installed on the hard drive?

A. Yes.

Q. I'll come -- I'll come back to that.

I'd like to start with a discussion of Sakula. Was there

just one file associated with Sakula or were there multiple

files associated with this program?

A. For Sakula, there was two files still on disk that were

related to Sakula.

Q. Were you able to determine what Sakula was set up to do?

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 18 of 44 PAGEID #: 3575
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:39:48

03:39:50

03:39:53

03:39:57

03:40:04

03:40:04

03:40:08

03:40:12

03:40:17

03:40:22

03:40:26

03:40:26

03:40:29

03:40:33

03:40:39

03:40:43

03:40:50

03:40:56

03:40:57

03:41:02

03:41:03

03:41:04

03:41:08

03:41:09

03:41:09

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

19

A. Yes, I was.

Q. Will you please explain that to the jury?

A. The Sakula variant that was located on the hard drive I

analyzed was set up to initiate beacons to two domains on

the Internet.

Q. What is a domain?

A. A domain is a shortened version of domain name. So a

domain name is how normal people access locations on the

Internet. So computers communicate via IP addresses. So

think of an IP address of a computer as similar to your

telephone number.

A domain name would be equivalent to setting up a

contact in your phone to link a phone number to a name that

you remember. So like if I want to go to www.fbi.gov,

that's what I type in my web browser. But on the back end,

the domain name system is doing the correlation between

www.fbi.gov and an IP address that is assigned to that

domain.

Q. Quickly, for the IP address, does the "IP" stand for

Internet protocol?

A. It does.

Q. Is it a series of numbers and periods?

A. Essentially, yes.

Q. Okay.

THE COURT: Have we reached an opportunity where we

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 19 of 44 PAGEID #: 3576
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:41:10

03:41:12

03:41:13

03:41:16

03:41:19

03:41:23

03:41:25

03:41:29

03:41:31

03:41:34

03:41:36

03:42:06

03:42:19

03:42:20

03:42:24

03:42:28

03:42:30

03:42:32

03:42:34

03:42:35

03:42:40

03:42:44

03:42:46

03:42:48

03:42:48

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

20

could break?

MR. McKENZIE: Of course, Your Honor.

THE COURT: Very well. We're going to take a

20-minute break and going to come back at 4. And it would

appear you are going to survive. During the break, please

take a break. Don't discuss the case among yourselves or with

anyone else. No independent research. Continue to keep an

open mind.

Out of respect for you, we will rise as you leave.

THE COURTROOM DEPUTY: All rise for the jury.

(Jury out at 3:41 p.m.)

THE COURT: The jury's left the room. The door is

closed.

We're going to recess till 4. It's almost 20 minutes.

And then when we come back at 4, what's the likelihood that

the government will finish direct?

MR. McKENZIE: Zero percent, Your Honor.

THE COURT: Zero percent.

MR. McKENZIE: Zero percent.

THE COURT: So he is not going home to San Diego

tonight.

MR. McKENZIE: Not tonight, Your Honor.

THE COURT: We are in recess until 4. Hoping to

break at 4:30.

THE COURTROOM DEPUTY: All rise. We are in recess

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 20 of 44 PAGEID #: 3577
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

03:42:50

03:42:53

03:59:58

04:00:05

04:00:05

04:00:08

04:00:11

04:00:15

04:00:16

04:00:19

04:00:21

04:00:22

04:00:22

04:00:24

04:00:25

04:01:17

04:01:20

04:01:25

04:01:32

04:01:34

04:02:05

04:02:10

04:02:15

04:02:19

04:02:19

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

21

until 4 p.m.

(Recess from 3:43 p.m. until 3:59 p.m.)

THE COURT: Back on the record, about to get the

jury.

Mr. McKenzie, have the odds changed?

MR. McKENZIE: You know, I took another look at my

outline, and I bump up to maybe five percent. I'm feeling a

little more bullish.

THE COURT: Let the record reflect that.

Are we ready for the jury from the government's

perspective?

MR. McKENZIE: Yes, Your Honor.

THE COURT: And the defense?

MS. TAYLOR: Yes, Your Honor.

THE COURT: Very well. Let's call for the jury.

We need to remember we have an interpreter at the end of

a long day, so if we can all try and talk slowly, that will

accommodate her.

THE COURTROOM DEPUTY: All rise for the jury.

(Jury in at 4:01 p.m.)

THE COURT: You may all be seated. Thank you.

15 jurors have returned from a break. We will continue

hearing testimony from this witness, who remains under oath.

The prosecutor may continue.

BY MR. McKENZIE:

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 21 of 44 PAGEID #: 3578
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:02:24

04:02:33

04:02:41

04:02:43

04:02:50

04:02:50

04:02:53

04:02:58

04:02:59

04:03:01

04:03:04

04:03:04

04:03:10

04:03:19

04:03:25

04:03:26

04:03:29

04:03:35

04:03:42

04:03:45

04:03:46

04:03:53

04:03:54

04:03:56

04:04:00

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

22

Q. Before the break, we were defining what a domain name is.

And prior to that, you testified about Sakula beaconing to a

domain name.

How many domains, if any, did the Sakula malware beacon

to?

A. It was configured to beacon to two domain names.

Q. And were there particular domain names that the malware

beaconed to?

A. Yes, there were.

Q. Do you remember those domain names?

A. I do.

Q. What was the first domain it beaconed to?

A. The first domain was oa.ameteksen.com.

Q. Are you familiar with a company called Ametek Sensors?

A. I am.

Q. What is Ametek Sensors?

A. Ametek Sensors is a subsidiary of a larger company

named Ametek, which is a part supplier for Snecma.

Q. And by part supplier, is that like airline parts?

A. Yes.

Q. Does Ametek Sensors have a website?

A. Yes, they do.

Q. Have you visited that website?

A. I did at the time.

Q. Are you familiar with the term "doppelganger domain"?

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 22 of 44 PAGEID #: 3579
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:04:09

04:04:10

04:04:14

04:04:15

04:04:20

04:04:23

04:04:25

04:04:32

04:04:33

04:04:38

04:04:42

04:04:46

04:04:50

04:04:55

04:04:58

04:05:01

04:05:04

04:05:12

04:05:15

04:05:20

04:05:23

04:05:27

04:05:30

04:05:32

04:05:47

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

23

A. I am.

Q. Would you please explain to the jury what a doppelganger

domain is?

A. Doppelganger domain is a domain name that's intended to

look similar to a legitimate company's domain but it's not

owned by the legitimate company.

Q. And how are doppelganger domains used in computer

intrusions and in cyber investigations?

A. There are several ways that doppelganger domains can be

used in computer intrusion activity. One good example is if

I wanted to click on something that has malicious -- some

kind of malicious attachment. If I send you a domain name

that is maybe one letter off of something you're likely to

go to, it's going to be more likely to entice you to click

on that link and download the malware.

Another way, which is more pertinent to this instance,

is when a company has any kind of computer on their internal

network trying to reach out to something on the Internet,

they monitor those systems to make sure they are --

generally their users are going to places they should be.

And so if you create a doppelganger domain and put it in

malware, when it beacons out to the Internet it looks like

more legitimate traffic.

Q. Did you investigate or look into oa.ameteksen.com?

A. Yes, I did.

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 23 of 44 PAGEID #: 3580
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:05:47

04:05:49

04:05:50

04:06:04

04:06:07

04:06:08

04:06:11

04:06:18

04:06:22

04:06:23

04:06:31

04:06:33

04:06:38

04:06:40

04:06:44

04:06:53

04:06:59

04:07:00

04:07:01

04:07:07

04:07:09

04:07:11

04:07:20

04:07:24

04:07:34

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

24

Q. Is that a web domain name owned by Ametek Sensors?

A. It is not.

Q. Now, you mentioned that the Sakula malware beaconed to a

second domain. Will you please share that second domain with

the jury?

A. The second domain that it was configured to beacon to

was secure.safran-group.com.

Q. Are you familiar with Safran Group, the company?

A. I am.

Q. Did you visit secure.safran-group.com?

A. I did not directly visit that domain.

Q. Are you aware if safran-group.com is a legitimate domain

owned by Safran, the company?

A. It is owned by Safran, the company.

Q. Backing up to your forensic analysis. Were you able to

determine if Sakula actually did beacon to these domains?

A. I was able to determine that.

Q. And how do you know?

A. There was evidence located on the hard drive of

outbound connections to both of those domains in the format

of a Sakula beacon.

Q. Now, you mentioned earlier that there were more than one

file -- that there was more than one file associated with this

Sakula malware. Did any of those files have visible

interfaces that you could interact with and see on the screen

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 24 of 44 PAGEID #: 3581
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:07:37

04:07:37

04:07:41

04:07:43

04:07:46

04:07:55

04:07:58

04:07:59

04:08:05

04:08:05

04:08:09

04:08:14

04:08:18

04:08:22

04:08:27

04:08:34

04:08:36

04:08:40

04:08:48

04:08:48

04:08:51

04:08:55

04:08:59

04:08:59

04:09:02

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

25

of the computer?

A. Yes, one of them did.

Q. In which language was that program?

A. It was in the Chinese language.

Q. Were you able to determine when the Sakula malware was

installed on the hard drive?

A. I was.

Q. And what date was the malware installed on the hard

drive?

A. January 25th of 2014.

Q. How do you know it was January 25th of 2014?

A. Because evidence associated with the file, like the

created date indicated it was that date.

Q. What, if anything significant, happened with the hard

drive prior to Sakula being installed on the computer? What,

if anything, from the log?

A. There was several things that happened. A USB device

was inserted into the computer immediately before the

installation.

Q. What is a USB drive?

A. A USB device is a piece of removable media that is

generally used by people to store files to transfer between

computers.

Q. How do you know that a USB drive was installed into the

computer before the Sakula malware was installed?

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 25 of 44 PAGEID #: 3582
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:09:09

04:09:13

04:09:15

04:09:20

04:09:24

04:09:28

04:09:32

04:09:36

04:09:38

04:09:41

04:09:45

04:09:46

04:09:50

04:09:55

04:09:58

04:10:01

04:10:07

04:10:09

04:10:13

04:10:14

04:10:16

04:10:22

04:10:26

04:10:27

04:10:31

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

26

A. So when a user takes actions on a computer, the

operating system of that computer records information about

the actions that were taken. Generally, these are being

recorded to improve the user experience on the computer.

And so when you insert a USB device into a computer, the

computer records information about that USB device. So if

you plug the same one in again in the future, your user

experience is going to be as close to as possible as the

first time you inserted it.

Q. On what date was the USB drive installed into the hard

drive?

A. It was inserted into the computer on --

Q. Into the computer. I'm sorry.

A. -- on January the 25th, 2014.

Q. I'd like to take a step back from your forensic

examination for a moment.

As part of your investigation, did you review text

messages sent and received by the defendant?

A. I did.

MR. McKENZIE: Before we get to those, Your Honor, I

ask that we publish to the jury Government's Exhibit 21b,

which is already in evidence, and I ask that we turn to page

1.

THE COURT: Very well.

BY MR. McKENZIE:

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 26 of 44 PAGEID #: 3583
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:10:32

04:10:34

04:10:38

04:10:42

04:10:45

04:10:49

04:10:54

04:10:56

04:11:02

04:11:10

04:11:15

04:11:22

04:11:26

04:11:28

04:11:30

04:11:33

04:11:36

04:11:39

04:11:40

04:11:40

04:11:42

04:11:44

04:11:50

04:11:55

04:11:59

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

27

Q. Directing your attention to page 1, could you please read

the name listed in the top left corner?

A. Xu Yanjun.

Q. Moving to the middle of the page, can you read what is

written under "Current Post"?

A. "Deputy division director at Sixth Bureau of Jiangsu

Province Ministry of State Security."

Q. I'd like to direct your attention now to page 2. And

specifically to the job posting from August 2010 to November

2014. Could you please read that job posting?

A. "Section chief at Second Section of Fourth Bureau of

Jiangsu Ministry of State Security, the agency renamed to

the Sixth Bureau in December, 2013."

THE COURT: Sir, you are doing great. Can you keep

your voice up, please. A couple old men in the back row

having trouble hearing you.

THE WITNESS: Do you want me to read it again?

THE COURT: No.

BY MR. McKENZIE:

Q. No.

MR. McKENZIE: Your Honor, may we now publish what

is in evidence as Government's Exhibit 110, and direct the

witness's attention to page 1?

THE COURT: Yes.

BY MR. McKENZIE:

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 27 of 44 PAGEID #: 3584
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:12:02

04:12:06

04:12:10

04:12:13

04:12:20

04:12:23

04:12:31

04:12:34

04:12:40

04:12:47

04:12:48

04:12:50

04:12:52

04:12:54

04:12:58

04:12:59

04:13:02

04:13:04

04:13:09

04:13:15

04:13:21

04:13:28

04:13:28

04:13:31

04:13:33

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

28

Q. Looking at the key at the very, very top, in what color

are the messages sent by Xu Yanjun?

A. Blue.

Q. Will you please read the first message sent on November

19, 2013?

A. Xu Yanjun contacted Tian Xi. He said, "On what date

does the Frenchman arrive? Is it possible to make

arrangements for him to meet with Teacher Wu Tieying and I

in Suzhou? Under the name of Nanjing University of

Aeronautics and Astronautics in the evening."

Q. In what country is Safran located?

A. They are located in France.

Q. Who sent this message that you just read?

A. Xu Yanjun.

Q. And who received the message?

A. Tian Xi.

MR. McKENZIE: Your Honor, I ask that we now show

the witness what is in evidence as Government's Exhibit 111.

And I ask that we direct the -- or excuse me -- publish to the

jury 111 and direct the witness's attention to page 6.

THE COURT: Yes.

BY MR. McKENZIE:

Q. I am showing you what is in evidence as Government's 111.

Are these business records from Safran?

A. Yes, it is.

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 28 of 44 PAGEID #: 3585
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:13:34

04:13:43

04:13:45

04:13:51

04:13:56

04:14:00

04:14:04

04:14:08

04:14:10

04:14:13

04:14:18

04:14:18

04:14:19

04:14:22

04:14:30

04:14:30

04:14:31

04:14:41

04:14:47

04:14:55

04:14:58

04:15:03

04:15:08

04:15:10

04:15:16

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

29

Q. Directing your attention to the -- the top of the page,

who is the sender of this letter?

A. Safran Aircraft Engines Suzhou Company, Limited.

Q. Turning your attention to the first paragraph of the

column on the right. Who is the recipient of this letter?

A. Tian Xi.

Q. About midway through there is a title. Will you please

read the title of this letter?

A. "Position of Manufacturing Engineer."

Q. Under "Re:" -- do you see where it says "Re: Termination

Letter"?

A. Oh, yes.

Q. And then directing your attention to the first full

paragraph, does it list Tian Xi's position as manufacturing

engineer?

A. It does.

Q. We'll return to this exhibit later. I would like to

please go back to Government's 110, page 1.

I will read the responses from Tian Xi, and you please

read the messages for Xu Yanjun.

Tian responded, "Next Monday. I'll be here with another

Frenchman that frequently comes to Suzhou. I think they will

be together all the time. It's not good to talk to both of

them. I will [mention] it to him."

"Mention it to him and see what reaction he has."

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 29 of 44 PAGEID #: 3586
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:15:21

04:15:25

04:15:32

04:15:39

04:15:40

04:15:45

04:15:45

04:15:48

04:15:50

04:15:53

04:15:57

04:15:57

04:16:00

04:16:05

04:16:08

04:16:11

04:16:15

04:16:17

04:16:20

04:16:21

04:16:24

04:16:28

04:16:31

04:16:32

04:16:33

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

30

A. Xu Yanjun then replies, "Good, thanks."

Q. Moving to November 25, 2013, will you again read the

messages from Xu Yanjun, and I will read the messages from

Tian Xi.

A. "Do you have any knowledge of the company Firth Rixon

Company?"

Q. "The Suzhou Company isn't far from us but I've no

knowledge of it."

A. "Are those two Frenchmen arriving today? Are they

going to Shanghai together on the weekend?"

Q. "Yes."

A. "What's the other Frenchman's name? What position does

he hold? Is it his first time here? Will come often in the

future? Are you familiar with him?"

Q. "Both come often. One has been here ten times or so this

year. The other's office is next door. First time coming

over."

A. "Do you have their business cards? If not, can you get

them?"

Q. "I have one. Will ask the other one."

A. "Okay. Please help me to get the information. I'm

sending what I need to your email. Thanks."

Q. "Got it."

A. "Email sent. Please check."

Q. "Okay."

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 30 of 44 PAGEID #: 3587
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:16:36

04:16:40

04:16:47

04:16:52

04:16:55

04:16:59

04:17:04

04:17:08

04:17:10

04:17:12

04:17:15

04:17:17

04:17:19

04:17:21

04:17:22

04:17:24

04:17:30

04:17:34

04:17:38

04:17:43

04:17:47

04:17:50

04:17:53

04:17:57

04:18:01

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

31

Will you please read the message from November 26, 2013?

A. "When is it convenient for you to talk on the phone?"

Q. Will you please read the last message on this page from

November 27, 2013?

A. "I'll bring the horse to you tonight. Can you take the

Frenchman out for dinner tonight? I'll pretend I bump into

you at the restaurant to say hello. This way we don't need

to meet in Shanghai."

Q. Who sent that message?

A. Xu Yanjun.

Q. To whom did he send it?

A. Tian Xi.

Q. What does the phrase "horse" mean in cyber

investigations?

A. Remote access trojan.

Q. Where does the horse -- how does trojan derive -- let me

rephrase. How do you get "horse" from the phrase "trojan"?

A. Yes. So the name "remote access trojan" in computer

security is taken from the old Greek mythology of the trojan

horse. So in that story in Greek mythology the Greeks built

a trojan horse. They enticed the trojans to bring it inside

their city, and then it allowed -- you know, some soldiers

got out and opened the gates to allow the Greek Army in.

And so that's similar to a piece of malware being

installed on your computer and then allowing your remote

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 31 of 44 PAGEID #: 3588
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:18:05

04:18:08

04:18:08

04:18:11

04:18:12

04:18:14

04:18:14

04:18:20

04:18:23

04:18:27

04:18:27

04:18:31

04:18:33

04:18:39

04:18:42

04:18:42

04:18:44

04:18:47

04:18:51

04:18:55

04:18:59

04:19:03

04:19:07

04:19:11

04:19:14

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

32

user to access it, similar to how it was used Greek

mythology.

Q. Is a remote access trojan a type of trojan horse?

A. It is.

Q. Is Sakula a type of trojan horse?

A. It is.

Q. And remind me, where is Safran located?

A. It's headquartered in France.

MR. McKENZIE: Could we please see page 2 of Exhibit

110.

BY MR. McKENZIE:

Q. I'd like to continue reading the messages from November

27th. I will read Tian Xi.

He responded, "I will find out if they have other

arrangements."

A. "Good. Is tonight on?"

Q. "No."

A. "I'm on the train. Be in Suzhou around five."

"Best to have dinner arrangement for tonight. If not,

I'll stay at the hotel where they stay and then you can say

we'll have breakfast with them tomorrow morning and can go

to work together. This way I can also meet them."

"Most important is to meet them face to face."

Q. "Got it. They'll have a telephone conference call this

afternoon with France. I am discussing with them the matter

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 32 of 44 PAGEID #: 3589
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:19:18

04:19:25

04:19:33

04:19:37

04:19:37

04:19:38

04:19:40

04:19:43

04:19:47

04:19:49

04:19:55

04:19:58

04:20:01

04:20:02

04:20:06

04:20:07

04:20:13

04:20:15

04:20:18

04:20:22

04:20:24

04:20:27

04:20:31

04:20:36

04:20:39

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

33

of having dinner tonight."

I'd like to move on to the next set of messages.

"It's possible they don't get off work until rather

late."

A. "Okay."

"It's tough."

"If you're successful in arranging a meal, where would

it be? I'll soon be in Suzhou."

"I can wait for you there first."

"I'm in a taxi, first heading to Yinxiang City."

Q. "Let's meet in Yinxizng City. They're having a telephone

conference meeting and will be late."

A. "Good."

Q. "They are going straight to eat at the hotel today."

A. "I am here."

"I'm on the fourth floor, Dayu. Waiting for you at the

booth seat in the back."

Q. "Haven't left work yet. Wait an hour for me."

A. "No worry, this is a buffet. I can wait."

"Which hotel are they staying at?"

Q. "Crowne Plaza."

A. "I've arrived."

Q. Let's continue to read the messages from November 29,

2013.

A. "No chance these two days?"

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 33 of 44 PAGEID #: 3590
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:20:41

04:20:50

04:20:51

04:20:51

04:20:54

04:20:58

04:20:58

04:21:01

04:21:02

04:21:04

04:21:05

04:21:09

04:21:12

04:21:13

04:21:16

04:21:20

04:21:24

04:21:28

04:21:34

04:21:36

04:21:39

04:21:45

04:21:51

04:21:54

04:21:56

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

34

Q. "Not yet. I'll pay attention."

A. "Good."

MR. McKENZIE: Can we turn to the next page, please.

BY MR. McKENZIE:

Q. Will you please read the first message from December 6,

2013?

A. "Horse hasn't been planted."

Q. Who sent that message?

A. Xu Yanjun.

Q. To whom did he send it?

A. Tian Xi.

Q. In the context of cyber investigations, what does it mean

to plant a horse?

A. To install a remote access trojan.

Q. Let's continue reading the messages.

"Not yet. I'll replay your email this weekend."

A. "Good."

Q. And let's continue on to December 9, 2013.

A. "Have you sent the email to me?"

Q. "Will send tonight, sorry about that."

A. "It's nothing. Ho, ho."

Q. And we'll continue on to the 26th of December.

A. "That old man came over this time but still can't find

an opportunity?"

Q. "No. Will notify you when it's planted."

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 34 of 44 PAGEID #: 3591
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:22:03

04:22:06

04:22:11

04:22:16

04:22:23

04:22:29

04:22:30

04:22:33

04:22:34

04:22:38

04:22:40

04:22:43

04:22:49

04:22:52

04:22:54

04:22:54

04:22:54

04:22:59

04:23:02

04:23:05

04:23:07

04:23:10

04:23:16

04:23:16

04:23:20

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

35

Again, what does "planted" mean in this context?

A. To install a remote access trojan.

Q. Directing your attention to the first message of January

16, 2014. Will you please read just the first message?

A. "Little Gu, will you be in Suzhou tomorrow?"

Q. Who sent that message?

A. Xu Yanjun.

Q. And who received the message?

A. Gu Gen.

MR. McKENZIE: Your Honor, at this time I ask

permission to publish to the jury what is in evidence as

Government's 111 and show the jury page 1.

THE COURT: Yes, it's in evidence. I thought we

were just looking at that.

MR. McKENZIE: Yes.

THE COURT: Okay. Page 1.

BY MR. McKENZIE:

Q. Directing your attention to the top left of the page,

what is listed under "Name"?

A. Gu Gen.

Q. Near the bottom of the screen that's being displayed

right now, will you please read what it is in the box next to

"Position"?

A. "Senior IT infrastructure manager and information

security officer."

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 35 of 44 PAGEID #: 3592
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:23:22

04:23:26

04:23:31

04:23:34

04:23:39

04:23:43

04:23:45

04:23:47

04:23:51

04:23:55

04:23:58

04:23:58

04:24:02

04:24:07

04:24:08

04:24:14

04:24:15

04:24:17

04:24:24

04:24:36

04:24:36

04:24:39

04:24:42

04:24:47

04:24:48

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

36

Q. Directing your attention to the bottom of the page, which

will require a scroll down, will you please read who is listed

as the employer where we have that stamp?

A. It says, "Safran Beijing Enterprise Management Company

Limited, Suzhou Branch."

Q. All right.

MR. McKENZIE: Your Honor, I ask to return to

Government's 110, page 3, and publish that now to the jury.

THE COURT: Yes.

MR. McKENZIE: And could we scroll down now to the

messages on January 16th.

BY MR. McKENZIE:

Q. I will read the Gu Gen response.

"Yes."

A. "I may go to Suzhou tomorrow. Let's meet if you are

available."

Q. "Okay."

Can we please read the first set of messages on January

17, 2014? And we'll stop when we get to 11:07 a.m.

A. Okay.

"Let's meet in the evening at Yinxiangcheng."

"What time do you prefer?"

Q. Gu Gen replied, "I should be able to get there around 6."

A. "Okay."

"Little Gu, my schedule changed. I may arrive in

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 36 of 44 PAGEID #: 3593
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:24:52

04:24:59

04:25:03

04:25:05

04:25:07

04:25:10

04:25:12

04:25:15

04:25:20

04:25:21

04:25:22

04:25:25

04:25:30

04:25:30

04:25:35

04:25:36

04:25:38

04:25:39

04:25:41

04:25:44

04:25:48

04:25:55

04:26:00

04:26:04

04:26:06

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

37

Suzhou late. Shall we meet at 8 instead? Still in 'Tea and

Seat' in Yinxiangcheng. Let's just have a chat instead of

dinner. What do you think?"

"Sorry about that."

Q. "8 o'clock is a little bit too late. What about we do a

phone chat instead?"

A. "It won't take long. 30 minutes will do. I will

arrive in Suzhou around 7. I can be there by 7:30 at the

earliest."

Q. "Okay."

A. "I got on an earlier train. Will arrive at

Yinxiangcheng in 30 minutes."

MR. McKENZIE: Can we please go to page 4.

BY MR. McKENZIE:

Q. "Okay. I'm on my way."

A. "I have arrived."

Q. "Will be there soon."

A. "No hurry."

Q. Let's -- let's stop right there.

I'm going to direct your attention to just the next

message. Will you please read that message?

A. "I just met with Little Gu and he said Safran cautioned

people were posing as company leadership sending out

letters. Did you all do that?"

Q. Who sent that message?

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 37 of 44 PAGEID #: 3594
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:26:08

04:26:10

04:26:12

04:26:16

04:26:18

04:26:22

04:26:25

04:26:25

04:26:29

04:26:36

04:26:39

04:26:42

04:26:49

04:26:50

04:26:52

04:26:57

04:26:58

04:27:02

04:27:02

04:27:10

04:27:13

04:27:17

04:27:20

04:27:22

04:27:25

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

38

A. Xu Yanjun.

Q. To whom did he send it?

A. Chai Meng.

MR. McKENZIE: Your Honor, I ask that we publish to

the jury what is in evidence as Government's 39b and direct

their attention to page 1.

THE COURT: Yes.

BY MR. McKENZIE:

Q. Directing your attention to the fourth message sent on

the right there. Is that the message that you just read?

A. That is what I just read.

Q. And is the recipient there on the left Chai Meng?

A. Yes, it is.

MR. McKENZIE: Your Honor, I'd like to return now to

the Government's Exhibit 110, where we left off.

THE COURT: Very well.

MR. McKENZIE: Page 4? Page 3. I apologize. With

the Chai Meng. No, page 4. On page 4.

BY MR. McKENZIE:

Q. And I will read Chai Meng's response.

"We pretended to be the webmaster sending out the letter

but not posing as leadership. It's unknown how many want to

engage Safran each day."

A. "How is it that you all didn't bother them by

cautioning? I just stated that it was you that had done

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 38 of 44 PAGEID #: 3595
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:27:30

04:27:30

04:27:33

04:27:34

04:27:41

04:27:46

04:27:47

04:27:52

04:27:55

04:27:58

04:28:01

04:28:05

04:28:08

04:28:11

04:28:13

04:28:18

04:28:19

04:28:26

04:28:31

04:28:35

04:28:37

04:28:41

04:28:44

04:28:49

04:28:50

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

39

it."

Q. "Gu believed we did it?"

A. "No doubt."

Q. Are you familiar with the term "phishing," spelled

P-H-I-S-H-I-N-G, in the context of cyber intrusions?

A. I am.

Q. Will you explain to the jury what phishing is?

A. Phishing is when you send an email to somebody that

looks like an email that they would get from a person that

they would expect to get an email from, but what you do is

you embed some kind of either malicious link or you add a

malicious attachment that if they click on it or open the

attachment, it will compromise their computer and give you

access to it.

Q. What stands out to you about this exchange that we just

read?

A. What stands out to me most is that Gu had told them

that Safran had cautioned people, that people were posing as

the leadership to send out letters, which could also be

emails.

Q. I'd like to pause from reading these messages for a

moment and return to your analysis of the computer.

On which date was the Sakula malware you found installed

on the computer?

A. January 25th of 2014.

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 39 of 44 PAGEID #: 3596
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:28:55

04:28:58

04:28:59

04:29:03

04:29:08

04:29:14

04:29:17

04:29:17

04:29:21

04:29:26

04:29:29

04:29:32

04:29:32

04:29:35

04:29:36

04:29:39

04:29:43

04:29:43

04:29:52

04:29:54

04:30:01

04:30:02

04:30:03

04:30:05

04:30:07

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

40

Q. On which date was the USB drive installed on the

computer?

A. It was inserted into the computer on January 25, 2014.

Q. Returning to the Government's Exhibit 110, I would like

to begin reading the messages from January 25, 2014. Is this

the same day that the malware was installed?

A. It is.

Q. Will you please read, even though it's in green, but will

you please read the first message from January 25, 2014?

A. "The horse is planted this morning."

Q. Will you please remind the jury what it means to plant a

horse?

A. To install a remote access trojan.

Q. Who sent that message?

A. Tian Xi.

Q. To whom did he send it?

A. Xu Yanjun.

Q. Will you please read just the defendant's response?

A. "Good."

Q. Now, the next message on the screen, who sent that

message?

A. Xu Yanjun.

Q. To whom did he send it.

A. Chai Meng.

Q. What did the defendant tell Chai Meng?

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 40 of 44 PAGEID #: 3597
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:30:09

04:30:14

04:30:17

04:30:19

04:30:25

04:30:30

04:30:35

04:30:41

04:30:46

04:30:50

04:30:51

04:30:57

04:31:01

04:31:05

04:31:11

04:31:12

04:31:17

04:31:21

04:31:26

04:31:29

04:31:31

04:31:35

04:31:38

04:31:44

04:31:51

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

41

A. "I have reported the Suzhou incident to Zha, and I will

start my vacation today. Please direct any inquiries or

reports to Chen. Thanks."

Q. I will now read Chai Meng's response.

"Okay. A device with a Nanjing IP address is now online.

I'm taking a look at."

Will you please remind the jury what an IP address is?

A. An IP address is how a device that's on the Internet is

communicated with. So it's the address at which that device

is located.

Q. What does it mean to have a Nanjing IP address?

A. There are ways to geolocate, so to determine where a

physical computer is, based on the IP address. So in this

instance, they indicate that the IP address is geolocating

to Nanjing.

Q. In the context of remote access trojans in general and

Sakula in particular, what does it mean to be online?

A. To be online for remote access trojan means that the

beacon has been received by a controller that is controlled

by the IP intruders.

Q. Based on your review of the Sakula malware, does that

program allow a user to take a look at the computer?

A. Yes, it would allow them to access the computer.

Q. Will you please read the next message?

A. "I saw this person's device, but his IP shows Nanjing.

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 41 of 44 PAGEID #: 3598
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:31:56

04:31:58

04:31:59

04:32:02

04:32:04

04:32:06

04:32:10

04:32:14

04:32:20

04:32:23

04:32:25

04:32:28

04:32:29

04:32:32

04:32:34

04:32:35

04:32:39

04:32:41

04:32:44

04:32:45

04:32:47

04:32:50

04:32:54

04:32:54

04:32:59

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

42

Is that person in Nanjing?"

Q. Who sent that message?

A. Xu Yanjun.

Q. To whom did he send it?

A. Tian Xi.

Q. And how did Tian Xi respond?

A. "No, he is in Suzhou."

Q. Directing your attention now to January 26, 2014,

messages, will you please read the first message that was

sent?

A. "Destroy the horse."

Q. Who sent that message?

A. Xu Yanjun.

Q. To whom did he send it?

A. Tian Xi.

Q. Did Tian Xi reply, "Acknowledged"?

A. He did.

THE COURT: We are past 4:30. Are we at a good

break point?

MR. McKENZIE: As good as any, Your Honor.

Actually, you know what? If I can ask two more

questions, we will be at an even better break point.

THE COURT: I'll count them. Go ahead.

BY MR. McKENZIE:

Q. Question 1: Based on your review, your forensic review

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 42 of 44 PAGEID #: 3599
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

04:33:02

04:33:10

04:33:11

04:33:11

04:33:18

04:33:20

04:33:25

04:33:28

04:33:30

04:33:32

04:33:34

JAMES - DIRECT

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

43

of the computer, was the Sakula malware altered on January 26,

2014?

A. It was not.

Q. In this context, what does "destroy the horse" mean?

A. In this context, it could mean to either remove the

malware from the compromised computer or to destroy the

device that the horse was originally located on.

MR. McKENZIE: I'm a man of my word, Your Honor. I

will pause questioning until tomorrow.

THE COURT: Let the record reflect that.

(Proceedings reported but not transcribed.)

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 43 of 44 PAGEID #: 3600
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

Mary A. Schweinhagen, RDR, CRR (937) 512-1604

44

CERTIFICATE OF REPORTER

I, Mary A. Schweinhagen, Federal Official Realtime

Court Reporter, in and for the United States District Court

for the Southern District of Ohio, do hereby certify that

pursuant to Section 753, Title 28, United States Code that the

foregoing is a true and correct transcript of the

stenographically reported proceedings held in the

above-entitled matter and that the transcript page format is

in conformance with the regulations of the Judicial Conference

of the United States.

s/Mary A. Schweinhagen

__________________________________ 15th of December, 2021

MARY A. SCHWEINHAGEN, RDR, CRR

FEDERAL OFFICIAL COURT REPORTER

Case: 1:18-cr-00043-TSB Doc #: 183 Filed: 12/15/21 Page: 44 of 44 PAGEID #: 3601