Tricked and Extradited: Inside the First FBI Operation to Lure a Chinese Spy to the US

Sasha Ingber: Welcome to SpyCast, the official podcast of the International Spy Museum. I'm your host, Sasha Ingber, and each week, I take you into the shadows of espionage, intelligence, and covert operations across the globe.

The FBI won't discuss exactly how Chinese spy Xu Yanjun came to the attention of special agents, but Xu was handling a GE Aviation engineer in Ohio who specialized in composite fan blade technology.

That engineer, David Zheng, had been approached by an official from Nanjing University on LinkedIn with a request to give a presentation. So Zheng ended up traveling from his home in Ohio to China in the summer of 2017. He delivered a talk on aviation technology and met with officials from China's Ministry of State Security.

That included Xu, who paid Zheng's travel expenses and gave him a little stipend. US officials found Zheng carrying thousands in cash on his way back, and over the next year, Cincinnati-based FBI Special Agent Bradley Hull was part of a team that flipped Zheng to lure Xu out of China and ultimately into an American prison cell.

Xu was the first Chinese spy to be extradited to the United States to stand trial.

Hey, Bradley. Welcome to SpyCast. I know that you are still currently undercover, so I can't see you, but you can see me. Welcome. 

Bradley Hull: Thank you very much. Good afternoon. 

Sasha Ingber: So let's start off by talking about this man, Xu Yanjun, who the Justice Department says became a spy in 2003 for the Ministry of State Security.

How high up was he, and what exactly was he doing? 

Bradley Hull: He was fairly high up, uh, within the, the overall MSS organizational structure. I mean, he was deputy commander, effectively, of, of an entire branch within the, the regional, uh, office there of the JSSD in the Jiangsu State Security Department of the Ministry of State Security, located in Nanjing, China.

So his unit in particular, his group, was charged with science and technology acquisition, and specifically, his branch within the JSSD in Nanjing was responsible for the acquisition of aviation information and materiel 

Sasha Ingber: Tell us more about what you learned about him, because you executed a search warrant which gave you access to his cellphone through the cloud.

What did you find? What did you see when you were able to open up this window into Xu? 

Bradley Hull: So we served a number of search warrants, but one in particular was for an Apple iCloud account, and within it he had backed up his iPhone over a number of years, which gave us a series of snapshots of his life leading back nearly a decade while he was working with the MSS, and included in that tranche of information, and, and it was a significant amount of information.

My, my recollection of it is it was more than five terabytes of data that we recovered. Wow. It, it was significant. Important for us was the identification of his Ministry of State Security cadre evaluation form, which is effectively his spy CV. That was very significant for the investigation. Uh, as well as he, he effectively kept a diary within his iCloud on his iPhone, which gave us details into source meetings, operational activity.

Uh, it was a, it was a, a wealth of information. 

Sasha Ingber: You really got a glimpse into so much of his life. I mean, before we get into the source meetings, the dates, who those people ended up being, you also had photographs and text messages. Tell us more about what Xu was like as a person. 

Bradley Hull: So he was complicated, as I'm sure most intelligence officers probably are.

He had definitely had mixed loyalties. Uh, he liked to gamble, he liked to drink, he liked to, to womanize. Even though he was married, he had a string of affairs that we were able to identify. Unfortunately, all of that was documented for us to review. He was a loyal member of the Communist Party, especially as we saw with actions after his arrest, but I'm not say- I don't believe he was a true believer in the cause.

I don't know if it was his only career opportunity, but he definitely took advantage of the system for personal gain. 

Sasha Ingber: And tell me more about the calendar with the source meetings. Like, how often was he meeting with sources, and what was the distribution of the sources that he was meeting with? 

Bradley Hull: Well, he had a pretty broad source base.

Uh, we identified more than 2,000 contacts within his devices over the, over the, the tota- totality of the investigation. 

Sasha Ingber: And when you say contacts, do you mean sources or just people that he knew? 

Bradley Hull: So it, it's, it's, it's a real mix. So for example, uh, he would have individuals that he knew within the aviation industry in China, but then he'd have a source who would mirror that same knowledge base or that same technology sector somewhere in the West.

And while I can't say that every Western aviation company had a contact in, in, in Xu's phones that, that, that we reviewed, the vast majority of them did 

Sasha Ingber: Okay. So we're talking 2,000 people. Let's hear more. 

Bradley Hull: Well, he was very good, very diligent at, at documenting what happened on a daily basis. It, it ranged from, you know, contacting sources overseas to meetings with sources within China, as well as meeting with engineers.

He would, he would document who he met with, sometimes where they met, how much they were paid, for example. He would talk about his career progression in a lot of detail. That was a source of, of, of much cataloging for him. He also talked about personal matters, so which girlfriend he was meeting on that day and where they met and what they did, effectively.

Uh, so he was, he was, he was good at documenting what happened on a daily basis. 

Sasha Ingber: And at one point, it became clear to you that he has been interacting with an Ohio-based GE Aviation engineer, David Zheng. You now have evidence that Zheng has shared information, has been paid by the Ministry of State Security, and now you're thinking that you could use Zheng to try to get at Xu.

When you approached Zheng, did he immediately confess? Was it easy to flip him and make him into a double agent? 

Bradley Hull: When we first made contact with the GE Aviation engineer, uh, no, he did not confess immediately. It was a very long and drawn-out, uh, interview, which we conducted over nearly eight hours, uh, before ultimately he, he acknowledged his culpability and the illegality of some of his actions.

And then my co-case and I, we gave him the option of a path forward, which is how we had couched it, whereby basically we, we said to him, "You know, you, you did wrong. You knew you did wrong. You didn't set out to do this necessarily, but you've, you've confessed to illegal activity. Why don't you cooperate with us, cooperate with the FBI, and we will go target those individuals who targeted you in the first place?"

Sasha Ingber: And then he says yes, and you're able to take some of the information from Xu's cell phone and apply it to building this personality for Zheng. Uh, can you talk about some of what you found on that phone that helped build up Zheng's persona so that he would be effective in communicating with Xu? 

Bradley Hull: So we dove into the weeds on what he had told the MSS about himself and his life, both in China and then in the United States, and we effectively co-opted that knowledge to create this version of the GE Aviation engineer.

We knew from the lengthy amount of diary entries and, and text messages and WeChat messages, et cetera, from, from Xu's devices, that he had a real, he, he had developed a real animus towards his immediate supervisor, whose name was Xiaorong. To the point that we also knew, uh, based off of our interpretation of Xu's personality, that he would be responsive to someone who would sympathize, uh, with him about having a, a tough, difficult, uh, boss.

And we leaned on that often in the course of communication as both a rationale, uh, for some of the, the information that was shared, uh, as well as a, a, a way to mirror, uh, what we knew about Xu. 

Sasha Ingber: So when you're working with someone who has agreed to cooperate with the Bureau, how do you get them to say and do what you need them to do?

How did Zheng know how to play this? 

Bradley Hull: So for the benefit of your listeners, if anyone remembers the Choose Your Own Adventure storybooks that were very popular when, when I was young, probably dating myself a little bit, but- 

Sasha Ingber: I'm going to be dating myself too, because I know exactly what you mean. 

Bradley Hull: So if you remember how those books would work, you would read a couple of pages, then you'd have a, a decision point, right?

Where you had to flip to page 56 or page 112. And we had a fairly lengthy pre-prepared script, uh, both in English and then in Mandarin, that he could use for those communications, uh, whereby it would follow a trajectory that we had set for the commu- for the communication, but that I didn't have to physically be with the GE Aviation engineer all of the time for all of the messaging, because often it would happen late at night, uh, for example, because of the time difference between Cincinnati and, and Nanjing, or early in the morning.

Uh, and then we would get a digest of that on a pretty regular basis, like every couple of hours, and then we could communicate with the, with the engineer to say, "Okay, well now turn to page 112 and follow this line of discussion." 

Sasha Ingber: Now, did Zheng ever have any autonomy? Did he ever stray from the Choose Your Own Adventure script?

Bradley Hull: No. He did what he was told for the most part and, and adhered to that, because if he went too far from, you know, too far left of center, uh, that could impact what we could do prosecutorily. 

Sasha Ingber: How does Zheng initially try to lure Xu out of China? What's the initial storyline that he goes with? 

Bradley Hull: So the first contact that we had made was with a co-optee from the Nanjing University of Aeronautics and Astronautics, whose name was Chen Fung.

Chen Fung had been sort of the first individual from China that made contact with our GE Aviation engineer in order to get him to go to China in the first place So following the protocol that had been told to our cooperator here in Ohio, we first reached out to Chen Feng indicating we'd be willing to come back to give another presentation at NUAA.

And I specifically picked Chinese New Year because it's the single largest mass migration of people on the planet on an annual basis, and I knew that no one would be at NUAA to be there for the talk. And it worked, and it caused Chen Feng to say that he wasn't available, nor was NUAA, and he would, he would pass our GE Aviation engineer, uh, off to another individual who he had met before, who was Xu Yanjun.

So that's how we opened the-- That's how we opened it.

Sasha Ingber: Very convenient. And this back and forth is essentially building Xu's confidence in Zheng, that this is a person who is legitimately sharing, um, information on aviation technology with the Ministry of State Security. Now, incidentally, Zheng tells Xu that he has this difficult boss who won't let him go to China, and instead could they meet in Europe?

And, and he integrates this company, um, based in France that he previously worked for called Safran. 

Bradley Hull: So initially, Xu had instructed our cooperator that he wanted to meet him in Amsterdam, in the Netherlands, whereby he was instructed to bring his GE Avia- Aviation laptop and hand it to the MSS. The MSS then intended to keep that for a week and then planned on meeting the GE Aviation engineer in Paris about a week later to return the GE laptop, um, so that our cooperator could then go back to the United States.

That is what he was instructed to do, uh, by Xu and his colleagues at the MSS. We, the FBI, settled on Brussels as the ultimate operational location because the Belgians had agreed to cooperate, uh, with the FBI in the operation, critically because they have an economic espionage law that is very, very similar to that in the United States.

And when you're looking to extradite an individual, the similarity of the laws is a great benefit when you're trying to explain to a judge in that foreign country, uh, that what the US government is trying to accomplish is, is very similar to what, in this instance, the Belgian government was trying to accomplish.

Uh, which is part of the rationale that we ended up cooperating with the Belgians, uh, for the operation. 

Sasha Ingber: Right. It's almost like you're reverse engineering that extradition. Which country is going to be permissible to this happening after they arrest him? 

Bradley Hull: Correct. 

Sasha Ingber: Okay. So now we're in Belgium. This is go time.

Take us into the moment. 

Bradley Hull: Well, we had many days of communication with Xu, both audio and, and, and textual, to convince him to veer from that initial trajectory of meeting in Amsterdam and then meeting a week later in Paris, and instead meeting our GE Aviation engineer in, in Brussels. And our rationale for it wa- was, was complex.

We had indicated that the testing at the Safran facility, uh, in Fontainebleau, just south of Paris, um, had been going well, but the entire GE Aviation team needed to transition to Belgium to work at another Safran facility just west of the city of Liege in, in eastern Belgium. And then the rationale for, uh, our inability for our cooperator to travel to Amsterdam was that since it was last minute, the GE Aviation boss, which we had referenced many, many times in the communication, felt guilty for ruining the team's Easter holiday weekend, whereby they should have had a three-day weekend.

And to make up for that, he wanted to take the entire GE Aviation team out for an Easter brunch, which is fortunately just late enough in the day that our cooperator cannot travel to Amsterdam, but also not so early that there isn't time to meet with, with the MSS, with Xu, uh, in Brussels. There was a lot of communication a- about this particular operational pivot.

Um, and eventually he, he acquiesced, uh, and agreed after much cursing at us, uh, to, to, to come to Brussels to meet. 

Sasha Ingber: Oh, really? Xu was cursing at Zheng? And thereby- 

Bradley Hull: Oh, he was, he was... 

Yes, he was furious. Um, at one point he said, "I have blankety blank permission from the Chinese government to travel to the Netherlands.

I have blankety blank permission to travel to France. I don't have permission to go to blankety blank Brussels." 

Sasha Ingber: Huh. 

Bradley Hull: Whereby we apologized profusely in as many ways possible, uh, but said, unfortunately, that's where we could meet and when we were available. 

Sasha Ingber: When we come back, how the arrest went down and what became of Xu.

We're talking about a lunch late in the day. You're good at exploiting holidays, evidently, between the Chinese New Year and Easter Sunday. Uh, FBI acting best as they can as aviation engineers. You wanna paint that scene for us? 

Bradley Hull: Well, obviously the, the, the overall FBI footprint in, uh, Brussels is not large, but we basically co-opted every single FBI employee, uh, at the embassy-

to go out and feign that they were the GE Aviation team. Uh, we had an individual sort of walk around like they were the boss so that if the MSS were watching this, this, uh, this ruse, it would seem appropriate. Um, which, unfortunately I wasn't there. I was in the command post for this part of the operation, but, um, from the descriptions of the team, they had a very lovely morning and early afternoon at the brunch.

Sasha Ingber: Oh, yeah? It was lovely? You're not gonna say anything more on that, Bradley? 

Bradley Hull: Un- unfortunately I wasn't there to, to, to participate, but they, they, they seemed to have had a very, a very nice time. 

Sasha Ingber: Well, hopefully they saved some Prosecco for you for another day. So then you, um, you hear from the Belgian police, and they give you some pretty bad news.

Bradley Hull: So I was in the command the morning of April 1st, that Easter Sunday. There were dozens of Belgian federal police officers, um, out. We had surveillance teams out. We had uniform police going to all the major train stations looking for, uh, Xu Yanjun and another MSS colleague. And then at some point I had the surveillance commander on my right and the SWAT commander on my left, and the surveillance commander had indicated that, uh, the team thought they had seen Xu in the crowd in central Brussels, um, but unfortunately they had lost him.

Sasha Ingber: And they had lost him how? I mean, was it just that he vanished into the crowd, or what? 

Bradley Hull: So it's a very busy pedestrian zone with lots of tourists, so it's, it's not unusual to lose two individuals in a crowd of that size, but it was a bit of a, a heartrending moment for myself. 

Sasha Ingber: Yeah, that must have been. And i- is that a moment that you've been in before?

Or was that the first time you had experienced that feeling? 

Bradley Hull: No, I... It's, it's not my first overseas arrest, so I have had similar circumstances in the past. Um, but it's never pleasant. 

Sasha Ingber: I bet. I bet. So you guys settled on, uh, Pain Quotidien, and this location is chosen. Why? 

Bradley Hull: I'm a farm boy from central Ohio, but when you walk around central Brussels, it's every piece of beautiful Baroque architecture that you can imagine, right?

It's a visual cornucopia. And I'm walking around, I have not slept in several days, um, because between many, many hours of communication with Xu and everyone back in DC and, and Ohio wanting cranial updates. So I'm very tired, and I'm walking around central Brussels, and they have a covered, a covered mall, uh, 18th century covered mall called les Galerie du Saint-Hubert.

And in the middle of it is this Le Pain Quotidien, and it reminds me of one of the opening scenes of the movie Tinker Tailor Soldier Spy- ... when the KGB tries to arrest an MI6 officer, and it looked  just like that in my mind. And I said, "Well, this is where we need to have this operation happen," not because I'm a huge huge fan of John Le Carré, but that's where I was at that moment in time.

Operationally speaking, the reason that I picked it is it was in a pedestrian-only zone. Uh, we had indicated that we wanted to meet on the second floor of this cafe, which means we would put him on such a small X, it would be impossible to miss and to effect the arrest. 

Sasha Ingber: Fascinating to hear just the strategic, uh, approach to choosing the Pain Quotidien.

And of course, this arrest is not quotidien at all. Tell us exactly what happened when Xu is back in the sights of Belgian police, and he's getting closer to this cafe. 

Bradley Hull: So he had returned to the meeting location for a second time, and was taking pictures, uh, of the location when the arrests happened very, very quickly.

There were four Belgian SWAT operators in plainclothes who walked up to Xu Yanjun and his NSS colleague who was with him, and they lift them up off the ground and just started walking away with them through the crowd. Uh, and they had to carry them about 300 yards to where they had stationed, uh, police vehicles to effect the arrest, to finalize the arrest as it were, uh, whereby Xu was informed that he was under arrest on a provisional arrest warrant from the FBI and the United States government.

Sasha Ingber: Now, according to an unsealed court document, agents found $7,000 in cash on Xu. They also found blank memory cards, a reader, a laptop, and four cell phones between him and his colleague, which showed Xu's intelligence work. Quote, "However, agents were unable to obtain information from the fourth phone because it was remotely wiped shortly before Xu's arrest."

Any thoughts on what might have been on that cell phone? 

Bradley Hull: I mean, I, I, I could speculate, but, uh, unfortunately we, we lost that opportunity for a collection. It was the device of his MSS colleague, of Xu Yanjun’s MSS colleague, and had it been even half as, as valuable as Xu's devices, it would have opened up a whole nother line of, of investigation for the FBI.

Sasha Ingber: Did Xu say anything when the SWAT team members lifted him and his colleague up? Did he stay silent? 

Bradley Hull: No, he did not speak. 

Sasha Ingber: We get to the extradition in 2018, October, but there was no trial until 2021. Why that wait? 

Bradley Hull: The simplest answer is COVID. The complicated answer is we had a treasure trove of information that we had to break down to help, uh, the US Attorney's office build the case, as it were, and that took a significant amount of time and resources to accomplish.

I had five terabytes of data in Mandarin. Uh, I don't know how many Mandarin linguists the FBI has, but at one point most of them were working on this case. 

Sasha Ingber: Now, you testified, your colleagues at the Bureau testified, members of GE and Safran also sat down in court. Xu gets convicted on all counts. In 2022, he is sentenced to 20 years.

What is that moment like for you, having spent so much time working this case? 

Bradley Hull: I mean, I was very proud. I mean, he got the maximum, uh, concurrent sentence that the judge could have offered. The intention was to send a message, uh, from the FBI back to the MSS that, that we know what you guys are doing here.

It, it was also a good deterrent point for others who might think about cooperating with the MSS in aviation, or frankly, any other tech sector in United States or in the West. Uh, but critically, it was a, an opportunity for the FBI to point to an investigation, to talk about economic espionage when we talk to corporations.

Because I've, I've been in the Bureau a long time, and we've talked about the Chinese threat for a long time, and I've often heard, "Well, where's your example? Where's the case? What can you share with us?" Well, this is the, the perfect example, and the most complete case, uh, in fact, it's the first case of its kind, uh, that we can say to, to corporate America, The thing that we've been telling you for 15 years has been happening the whole time.

Here's an example where we can show you soup to nuts what the MSS does, how they do it, and what you stand to lose from it.

Sasha Ingber: I'm also wondering if China, if the government was funding his defense, or if they pretended like they had no affiliation whatsoever with Xu. 

Bradley Hull: Well, I, I, I can't speculate on that. I, I can imagine how expensive his defense attorneys were.

Uh, they're from the Taft Law Firm here in Cincinnati, as in founded by the family of the president, former president of the United States, Taft. Uh, frankly, that always irked me a little bit. 

Sasha Ingber: You wonder what he would think about that. 

Bradley Hull: I, I, I, I have had that thought before, yes. But I can't imagine it was inexpensive.

And it would certainly more, be more than an, an average MSS employee could be able to pay for. But we'll let, we'll let your listeners decide on that. 

Sasha Ingber: Mm-hmm. And this resulted in more trials, more arrests, even though you didn't get access to that fourth cell phone's contents. But among them, you also learned that Xu had recruited a Chinese student who had actually joined the US Army in a program for people who spoke Chinese.

So after Xu is arrested, and after all is said and done, what's the scale and the scope of what Xu did in terms of sources and damage? 

Bradley Hull: So it, it was significant. Um, uh, unfortunately I can't go into the numbers of cases that were opened as a result of the investigations, but we can talk about those, those that were prosecuted.

Uh, the individual in Chicago that you referenced, his name is Ji Chaoqun. Um, he was a, a source of the MSS who was inserted into the United States to assist the MSS, which he did. Uh, he was in the Army when he was arrested. He, he lied to the US military about his association, uh, with foreign governments.

There were a number of engineers and software developers, um, around the United States, uh, who were arrested and, and, and charged and sentenced and found guilty. Um, but I'll, I'll, I'll, I'll couch it to you like this. So as we were prepping for trial, um, I asked the team at GE Aviation to imagine that this GE computer, the one that the MSS thought they were gonna get, had actually been released to the Chinese.

And I said, "You know, we need a dollar amount, right, for prosecution. Like, if, if this went downrange, if you lost this, how much did it hurt GE? Right? How much testing did you pay for?” Uh, how many, you know, man-hours or, or engineer hours were, were used for the information that was contained on this device?

And they came back and said that the approximate loss between, you know, salary hours and testing hours and information was $1.42 billion. So that's one engineer at one company. And again, as I referenced earlier in, in, in the chat, that we had almost 2,000 contacts around the world, many of whom were in Western aviation companies.

I'm not saying all 2,000 of the individuals gave up their laptops, but if enough did, it's hugely damaging to the avian in- industries in the West and, and our ability to maintain our lead, uh, within that sector. 

Sasha Ingber: That is a staggering number. And has this case helped to open the doorway to private businesses that weren't necessarily as open to working with the FBI in some of these counterintelligence cases?

Because I'll tell you that when it comes to bottom line, I know that some American businesses will still do business with China just because it's cheaper. 

Bradley Hull: I, I think that's a, a choice each individual company's gonna have to make on their own. The, the risk versus reward calculus that each must do. Uh, and I have known in my career many companies that we have approached and said, "You know, we have an individual in your company that we're concerned about."

They ask who the individual is, and they fire them, and they say, "Thank you very much," and that's the end of it. I would hope that this example with, with GE would, would open the eyes to some of those individuals in the C-suite to say, "Okay, there is an alternative here." Because we, as a company, need to know how damaging this could be, right?

If you work with the FBI, we can help you stop it. Uh, if you don't, you will never know how far it could have gone or what damage happened once you leave your firewall, right? And that's the thing that we could do, that we could share with GE as we work the investigation, the things that happen outside of their walls, which is something the FBI can offer that I don't believe corporate America really can.

Sasha Ingber: So curious to know, um, what happened to Zheng? He helped secure this 20-year prison sentence for Xu. Is he still in Ohio? Does he have to worry about his own safety? 

Bradley Hull: So he signed a non-prosecution agreement with US Attorney's office here in Cincinnati, uh, whereby he would not be prosecuted if he agreed to cooperate with the FBI for the duration of the investigation.

And the one caveat that was placed on that non-prosecution agreement was that he was never allowed to work in aviation ever again. Um, that's a price the US government was not, you know, was prepared for him to pay, uh, for, for what he had done leading up to that point. Last time I checked, he is, he is still in Ohio.

He's, has another good job, but he's not in aviation any longer. 

Sasha Ingber: So he's no longer working in GE Aviation, now called GE Aerospace, but why did it take until 2018 for the United States to extradite its first Chinese spy when, as you alluded to, Chinese intellectual property theft and espionage had been going on for years before this?

Bradley Hull: Well, I, I can't speculate on what has worked or not worked in the past, um, but this is the first instance of a successful arrest, extradition, trial, and sentencing of an MSS officer because they are a very, very good service, and they're very, very difficult to, to counter. And we were fortunate here. We had an excellent case team.

Uh, we had a, a great set of circumstances that we were able to exploit, uh, this particular MSS officer. Uh, and I imagine it has caused more than a few waves within the overall hierarchy back in China within the MSS because of what happened, uh, in, in this investigation. 

Sasha Ingber: Have there been other cases that are anywhere close to this?

Have we seen other Chinese spies end up being extradited here to the US? 

Bradley Hull: To my knowledge, this one remains unique. 

Sasha Ingber: Would you say that that was the, the highlight of your career in however many years you've now been in the Bureau? 

Bradley Hull: Well, it's the highlight of that I will ever be able to talk about. How about that?

Sasha Ingber: All right. Well, we'll, we'll want you back on to talk about the next thing, Bradley. I need to mention that, uh, President Joe Biden granted Xu clemency in November of 2024, and then Xu was released as part of a prisoner swap for Americans who were imprisoned under false charges. Thank you so much for walking us through this case detail by detail.

Bradley Hull: Thank you very much. 

Sasha Ingber: Thanks for listening to this episode of SpyCast. If you like the episode, give us a follow on Apple, Spotify, or wherever you get your podcasts, and leave us a rating or review. It really helps. If you have any feedback or you wanna hear about a particular topic, you can reach us by email at spycast@spymuseum.org.

I'm your host, Sasha Ingber, and this show is brought to you by N2K Networks, Goat Rodeo, and the International Spy Museum in Washington, DC.