The Espionage of Former CIA Case Officer Jerry Chun Shing Lee for China

Was Jerry Chun Shing Lee (aka Zheng Cheng Li) a recruited asset of China’s Ministry for State Security (MSS), or was he a financially strapped former CIA case officer who volunteered his services to commit espionage on behalf of the MSS?

It’s a bit like the question concerning the chicken and the egg, as Lee has been indicted for one count of conspiracy to gather and deliver defense information to aid a foreign government and two counts of unlawful retention of national defense information. Sticklers for detail will note that Lee was not charged with espionage. That charge may come in a superseding indictment or may never be put into play. From a purely counterintelligence optic, Lee’s engagement with the Chinese MSS has been neutralized and he is no longer able to do their bidding in a clandestine manner. We’ve written in the past about China’s nation state espionage activity and targeting of the United States. The Lee case is a prime example of the MSS successful actions.

Indictment of Jerry Chun Shing Lee

The Department of Justice filed the indictment of Lee on May 8 in the U.S. District Court for the Eastern District of Virginia, following his arrest at John F. Kennedy airport in New York. The indictment and prior legal filings paint a picture of Lee as a naturalized U.S. citizen who, following completion of his bachelor’s and master’s degrees at Hawaii Pacific University, joined the CIA in 1994 and departed the CIA in 2007. During that period, he was trained as a case officer and thus was provided training in asset recruitment and handling.

Lee had multiple foreign assignments with the CIA, including at least one in China. From 2007 through 2012, Lee resided in Hong Kong and during a portion of that period (2007-2009) he worked for a large tobacco company. In 2010, Lee and an unidentified associate registered the company name FTM International in Hong Kong. Lee was importing cigarettes, at least for a year, until he sold his stake in the company to his business partner in 2011.

For reasons not disclosed in the current filings, but which may come out during the future trial hearings, Lee is believed to be the source of the compromise of the U.S. stable of Chinese assets from 2010 to 2012—the period of time during which the Chinese were actively neutralizing U.S. espionage sources. This activity post-dates Lee’s 2007 departure, but begins contemporaneously with the narrative contained in the indictment—2010—and, coincidentally (or not), ends about the same time as Lee’s belongings are being lawfully searched during his transit in Hawaii in August 2012.  The possibility is real that Lee is responsible for the deaths of a number of Chinese sources of intelligence.

The Smoking Gun of a Collaboration

It was during this August 2012 transit in Honolulu where the personal notebooks of Lee were photographed by the FBI personnel conducting a search of his hotel room. Found within Lee’s belongings were multiple notebooks. These notebooks contained Lee’s personal notes on his CIA operational activities during his CIA career, according to a CIA “classification authority.” The CIA official characterized the information as “operational notes from asset meetings, operational meeting locations, operational phone numbers, true names of assets, and cover facilities.”

This proverbial smoking gun was confirmed to have been shot when the CIA researched the archive of classified cable traffic originated by Lee from abroad during his time as a CIA case officer. The CIA and FBI compared the content of the official record to that which Lee had in his possession within his notebooks and declared the content as a match.

MSS Asset Handling

The indictment shares with us and alleges how in 2010 Lee was approached by the MSS in Shenzhen, China. He reported the MSS approach to a CIA case officer (not identified) and omitted that he had been offered $100,000 by the MSS.

The FBI claims that from 2010-2013 Lee was paid hundreds of thousands of dollars by the MSS for his collaboration and responsiveness to specific MSS tasking. It would appear that his reporting the approach was simply a self-defensive smokescreen—a bit of covering of one’s ass.

What type of information did Lee provide? In response to specific tasking in 2010, Lee drew the floorplan of a classified CIA facility located abroad. MSS made 20 other separate tasking requests specific to the clandestine activity of the CIA to Lee through 2011. He responded to each of these MSS requests.

China Begins Using Lee’s Information Anew

In February 2013, the MSS is believed to have sent an open-code message to Lee via an email account set up in 2012 by the MSS, perhaps as a means to determine a sign of life or compromise of Lee.

Then a few months later, in May 2013, the MSS used Lee’s information to formulate an approach to a former CIA employee. The MSS asked this former CIA employee about her clandestine activities and assets with which she had met during her tenure with the CIA. This former employee, characterized as a cooperating witness by the FBI, reported the approach.

MSS Points Lee Back to the CIA?

In early 2012, Lee returned to the United States and reached out to the CIA.

Why? He was seeking employment. Such is the world of espionage. The best-placed source for one service is within the service of another.

The CIA engaged in pre-re-employment interviews with Lee. One of these occurred in March 2018.

Coincidentally—and probably directly connected—to his having scored an interview with the CIA, the MSS opened a number of email addresses for Lee to use to communicate with his MSS contacts. The FBI notes that one of the email addresses was made to appear as if it was the email of Lee’s daughter on Gmail. Clearly, this method of communications was not clandestine, using modern covert communications methodology, but it certainly was covert.

Over a four-day period in June 2012, the CIA brought Lee back in for additional interviews. During that time, the agency asked Lee a number of questions, some of which may have been provided by the FBI. For example, he was asked about the financial condition of FTM International, his former company to which he liquidated his share to his business partner, and responded with forged bank statements showing a far greater valuation for the company.

No doubt Lee was already of counterintelligence interest to the FBI/CIA, given the compromise of CIA assets. While Lee was being interviewed, the FBI searched his hotel room and found written on scrap paper a telephone number associated with one of the MSS officers in contact with Lee.

In addition, the CIA asked Lee if he had traveled to the People’s Republic of China during the previous two years (2010-2012). He told the CIA he had not.

Closing FBI Gambit

In a gutsy counterintelligence gambit, the FBI allowed Lee to return to Hong Kong following his re-employment interviews with the CIA. The indictment tells us that Lee also traveled to Guangzhou, China, in July 2012. While there, we can make an educated guess that Lee met with the MSS. The next month, as detailed above, Lee returned to the United States, transiting Honolulu and the compromising information is gathered by the FBI.

In addition to the aforementioned notebooks found by the search team, a thumb drive was found and examined. Someone, either Lee or his MSS handler, used a bit of technological gymnastics to store the 2010 classified CIA information into the “unallocated space” of the thumb-drive—a bit more “clandestinity” injected into the equation.

Lee is currently awaiting trial. He faces the potential for a life of incarceration.

Featured eBook
Mastering Hybrid Cloud Security

Mastering Hybrid Cloud Security

Enterprises have embraced hybrid cloud — here’s what you need to know when it comes to security You’d think by now all the cloud-computing buzzwords would’ve rained down. But hybrid cloud computing still has a fuzzy nature about it. For whatever reasons enterprises embrace cloud, hybrid cloud use is near ubiquitous. According to a 2017 ... Read More
CA Veracode

Christopher Burgess

Christopher Burgess (@burgessct) is a writer, speaker and commentator on security issues. He is a former Senior Security Advisor to Cisco and served 30+ years within the CIA which awarded him the Distinguished Career Intelligence Medal upon his retirement. Christopher co-authored the book, “Secrets Stolen, Fortunes Lost, Preventing Intellectual Property Theft and Economic Espionage in the 21st Century”. He also founded the non-profit: Senior Online Safety.

burgesschristopher has 57 posts and counting.See all posts by burgesschristopher