Silicon Valley Spy Case Links ZTE, PLA to Stolen US Technology

Tianjin University professor on trial for stealing militarily-useful wireless secrets

An aerial view shows the Silicon Valley / Getty Images
July 9, 2019

China's major telecommunications firm ZTE was offered stolen American wireless technology used in filtering electronic signals from cell phones and military communications, according to court documents in a Chinese government-linked economic spy case.

A document in the trade secrets theft case of Tianjin University professor Zhang Hao states that Zhang in 2011 emailed a representative of ZTE, China's second-largest telecommunications company and sent a PowerPoint slide containing proprietary information prosecutors say was stolen from the U.S. high-technology company Avago Technologies.

Zhang and five other Chinese nationals were indicted in April 2015 on charges of economic espionage and trade secrets theft involving Avago and another U.S. tech company, Skyworks Solutions, Inc. Avago, based in San Jose, was a leading designer, developer, and supplier of analog, digital, mixed-signal, and optoelectronics components using semiconductors.

The stolen trade secrets resulted in the Chinese government university building a state-of-the-art FBAR fabrication facility that provided components to Chinese state companies and two military institutes.

The theft was uncovered through patent applications and by an Avago executive who visited the Chinese facility in 2011 and realized that Avago's unique technology had been pilfered.

Zhang was arrested in May 2015 in Los Angeles on his way to attend a conference. The other five defendants in the federal indictment were later dropped because they are fugitives believed to be in China, a spokesman for the U.S. attorney in San Jose said.

A bench trial in the case began June 19 in federal court in San Jose but was then delayed until Sept. 10. Zhang has pleaded not guilty.

The indictment in the case outlines an elaborate scheme to steal and utilize stolen American wireless technology. The stolen FBAR technology cost Avago $50 million in research and development costs over about 20 years.

First, according to the indictment, Tianjin University used its College of Precision Instrument and Opto-Electronic Engineering to create a shell corporation in the Cayman Islands called Novana, Inc., and then created a company called Tianjin Micro Nano Manufacturing Technology that operated as the investment arm of the university. Another entity was created in 2011 called ROFS Microsystems.

The three entities were used to funnel the stolen technology into China, prosecutors have said.

The stolen technology includes what is called thin-film bulk acoustic resonator, or FBAR technology that Zhang and another Chinese national, Wei Pang, worked on while graduate students at the University of Southern California under funding from the Pentagon's Defense Advanced Research Projects Agency.

The FBAR technology market was estimated to be worth more than $1 billion at the time the thefts took place in the mid-2000s. It is used in mobile devices such as cell phones, tablets, and GPS devices. The technology employs an electronic filter for wireless signals that allows users to send and receive specific communications solely intended for each user without electronic interference.

Prosecutors said FBAR is used in both consumer phones and a variety of military and defense communications technologies.

According to intelligence sources, Tianjin University is believed to be a front for China's military in developing and acquiring foreign commercial and military technology.

A Tianjin University official identified in the indictment only as "J.Y." worked at the Academy of Sciences and ran the university's College of Precision Instrument and Opto-Electronic Engineering where Zhang and Pang are professors. The indictment says J.Y. "had substantial connections" to the Chinese government and is a member of numerous Communist Party of China political committees.

Messages obtained by federal investigators and made public in court documents reveal the plan was to "move Avago to China" and create a new company in China that Pang stated in one message would be called "Clifbaw"—short for "China lift BAW technology." BAW stands for bulk acoustic wave, an electronic filter used in cell phones to eliminate interference and one of the technologies stolen in the San Jose case.

Other text messages between Zhang and Pang submitted in the case that were obtained from Zhang's phone reveal the Tianjin professors were working with China's ZTE telecommunications company and with at least two Chinese military-related institutes.

The slide sent to ZTE bore the headline "Bulk Acoustic Wave (BAW) RF Filters For Wireless Communications."

"In addition to discussing the importance and performance of Novana's BAW products, the presentation contained published Avago product information to illustrate Novana's products, and performance charts that referenced Skyworks product performance," the document, an evidentiary stipulation of facts, states.

ZTE was slapped with crippling sanctions by the Trump administration last year for illicit dealings with Iran and North Korea. The sanctions, however, were lifted when the company agreed to a personnel restructuring and a $1 billion fine was imposed.

ZTE and Huawei Technologies, another major telecommunications firm, currently are the target of Trump administration efforts to limit China's government from penetrating overseas computer and communications networks.

Commerce Secretary Wilbur Ross in June identified the companies as posing national security threats. "Both are doing practices that we think are potentially injurious to our national security," Ross told CNBC.

The messages in the economic espionage case obtained from WeChat, a Chinese messaging service, quote Zhang in 2015 as saying "Institute 13 is our only client for military products."

Institute 13 refers to the China Electronics Technology Group Corp. (CETC) Research Institute 13. The institute specializes in electro-optical work and is headquartered in Shijiazhuang, China.

Last year, the Commerce Department's Bureau of Industry and Security placed CETC 13 and a dozen of its subordinate institutes on the Entity List—a blacklist of foreign companies banned from purchasing U.S. goods. The ban was imposed after BIS ruled the institutes "are involved in the illicit procurement of commodities and technologies for unauthorized military end-use in China."

In another message, Zhang asked about work on a "5g oscillator " and noted that "Institute 23 is pushing for results."

CETC Research Institute 23 is China's largest information transmission line technology research institute, according to the CETC website. The institute also conducts fiber optic and cable research.

In 2016, Zhang mentioned in a message that "there is one issue here and that is, many bad wafers will be generated by the military products."

China's use of universities for technology and intelligence collection was discussed by a senior State Department official last month.

Chris Ford, assistant secretary of state for international security and nonproliferation, said in a June 20 speech that China's technical universities are key elements of a program called "military-civilian fusion" to exploit military and civilian technology.

Ford said "the entire Chinese university system is considered … the front line of [military civilian fusion]."

The program includes developing a talent pool of doctoral, masters, and undergraduate-level researchers in high technology fields that are then certified to conduct classified research for the military. "To date, more than 80 Chinese universities have already been certified to undertake Top Secret or Secret level military research and development under this program," Ford told the congressional U.S.-China Economic and Security Review Commission.

The program is funded by state-owned defense enterprises that pay for the education of students and provide living stipends.

"It is extremely important to put some national security brakes on the Chinese system’s massive technology transfer bureaucracy," Ford said.

Former Defense Intelligence Agency official Nicholas Eftimiades said: "China's practice of employing universities, state owned enterprises, and commercial entities to steal U.S. Intellectual property and technology, supports its 'Made in China 2025' industrial development plan and military modernization efforts."

Prosecutors declined to comment on the case.

Zhang's lawyer, August Gugelmann, did not return an email seeking comment.

However, Zhang told the Communist Party-affiliated newspaper Global Times that he will be cleared of the economic spying charges. "I am under great pressure and what I wish now is to resume teaching and scientific research as soon as possible after I am cleared," Zhang said in 2015, adding that "it is by no means acceptable that the U.S. government accused us, since it is rightful to capitalize our own research results."

ZTE did not respond to an online request for comment.

Melina Haag, the U.S. attorney at the time the indictment was issued, said the case demonstrates "sensitive technology developed by U.S. companies in Silicon Valley and throughout California continues to be vulnerable to coordinated and complex efforts sponsored by foreign governments to steal that technology."

David J. Johnson, FBI Special Agent in Charge of the San Francisco Division at the time of the indictment, said the Zhang case revealed "a methodical and relentless effort by foreign interests to obtain and exploit sensitive and valuable U.S. technology through the use of individuals operating within the United States."

"Complex foreign-government sponsored schemes, such as the activity identified here, inflict irreversible damage to the economy of the United States and undercut our national security," he said.

The 32-count indictment includes charges of conspiracy to commit economic espionage, conspiracy to commit theft of trade secrets, economic espionage, and theft of trade secrets.