Attacks/Breaches
11/18/2008
01:57 PM
50%
50%

Chinese-Born Scientist Pleads Guilty To Tech Espionage

Quan-Sheng Shu, who was also charged with illegal arms exports, faces up to 10 years in prison.

A Chinese-born scientist working in Virginia has pleaded guilty to selling U.S. technology and military secrets for rocket propulsion to China, though news service XFN-Asia reported that the Chinese government insists the charges were "completely fabricated."

Quan-Sheng Shu pleaded guilty Monday in U.S. District Court in Norfolk to charges of bribery in violation of the Foreign Corrupt Practices Act and breaking the federal Arms Export Control Act.

The U.S. Department of Justice said the physicist in Newport News exported technical space launch data and defense services to the People's Republic of China and offered bribes to Chinese government officials.

Shu, a naturalized U.S. citizen, exported defense services from January 2003 through October 2007 by helping China design and develop a cryogenic fueling system for space launch vehicles in Hainan, China, U.S. prosecutors said in an indictment. China plans to use the facility to launch space stations, satellites, manned space flights, and lunar missions, according to the complaint. The People's Liberation Army's General Armaments Department and the 101st Research Institute, which is overseen by China's Industry for the National Defense, run the facility.

The U.S. government also claimed that Shu illegally exported controlled military data in a document entitled "Commercial Information, Technical Proposal and Budgetary Officer -- Design, Supply, Engineering, Fabrication, Testing & Commissioning of 100m3 Liquid Hydrogen Tank and Various Special Cryogenic Pumps, Valves, Filters and Instruments," on December 20, 2003.

Finally, the U.S. government also charged Shu with using his U.S. company, AMAC, and a French company he represented, to offer money to Chinese government officials for a contract for the development of a 600 liter per hour liquid hydrogen tank system. The complaint states that he offered "percentage points" worth about $56,800 in February and April 2006. In May 2006, he offered another $75,700 in points, bringing the total to $189,300, according to the complaint.

In January 2007, the French company that Shu represented won the $4 million hydrogen liquefier project.

Shu, 68, will be sentenced April 6, 2009. He faces a maximum sentence of 10 years in prison and a fine of $1,000,000 for each violation of the Arms Export Control Act, and a possible maximum sentence of five years in prison and a fine of $250,000 or twice the gross gain for violating the Foreign Corrupt Practices Act.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.