Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 1 of 41

JOHN W. HUBER, United States Attorney (No. 7226)

ROBERT A. LUND, Assistant United States Attorney (No. 9579)
KARIN FOJTIK, Assistant United States Attorney (No. 7527)
ALICIA H. COOK, Trial Attorney, U.S. Department of Justi~ICT)J¢N ijM"Pf)D STATES DISTRICT
MARK K. VINCENT, Assistant United States Attorney (No. 536fll}JRT, DISTHICT OF UTAH
PATRICK T. MURPHY, Trial Attorney, U.S. Department of Justice (MD Bar)
ADAM L. SMALL, Trial Attorney, U.S. Department of Justice (NY slJNrB?J)601B)
Attorneys for the United States of America D. MARK JONES, CLERK
111 South Main Street, Suite 1800 BY_ _==·::::-:-::,c:-:::=~--
Salt Lake City, Utah 84111 DEPU1Y CLE~1K

Telephone: (801) 524-5682

IN THE UNITED STATES DISTRICT COURT

DISTRICT OF UTAH, NORTHERN DIVISION

UNITED STATES OF AMERICA, Case No.

Plaintiff, FELONY
COMPLAIN T
VS.
COUNT 1, 18 U.S.C. § 794(a)­
RON ROCKWELL HANSEN, Attempt to Gather or Deliver Defense
Information;

COUNT 2, 18 U.S.C. § 951-

Agent of a Foreign Government;

COUNTS 3 - 5, 31 U.S.C. § 5332-

Bulk Cash Smuggling;

COUNTS 6 - 13, 31 U.S.C. § 5324-

Structuring Monetary Transactions;

COUNTS 14 & 15, 18 U.S.C. § 554 -

Smuggling Goods from the United States;

FILED IN UNITED STATES DISTRICT

COURT, DISTRICT OF UTAH

a
JUN O 2018
' JONES, CLERK
DEPUTYC L E R ~ -
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 2 of 41

Before the Honorable Paul M. Warner, United States Chief Magistrate Judge for the

District of Utah, appeared the undersigned, who on oath deposes and says:

AGENT INTRODUCTION

1. I am a Special Agent of the Federal Bureau ofinvestigation (FBI). I entered on duty as a

Special Agent with the FBI on August 3, 1997. Prior to joining the FBI, I graduated from the

New England School of Law in Boston, Massachusetts, and am currently an active member of

the Utah State Bar. I am also a member of the United States Supreme Court Bar. During my

twenty years with the FBI, I have served as a Special Agent, a Supervisory Special Agent, a

Legal Instructor, and Legal Advisor. As such, I have conducted multiple national security

investigations, which have involved violations of federal law. Additionally, I have written

affidavits, executed search warrants, interviewed victims, interviewed suspects, and conducted

arrests. I also served for five years at the FBI Academy where I taught Constitutional Law,

Criminal Law, Criminal Procedure, and National Security Law to Special Agents and other law

enforcement officers from around the United States. As a Special Agent, I am authorized to

investigate violations of the laws of the United States and execute warrants issued under the

authority of the United States.

2. The statements contained in this affidavit are based on written and oral information

provided by other law enforcement investigators assigned to this case, on information provided

by confidential sources, on information contained in records obtained by investigators, and on

my own training, experience, and background. Since this affidavit is being submitted for the

limited purpose of obtaining a criminal complaint, not every fact concerning the investigation

has been included, but only the facts necessary to establish a foundation for an arrest warrant on

the charges alleged in this complaint.

2
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 3 of 41

BACKGROUND

Affiant is aware that at all times material to this Complaint:

The United States Intelligence Community

3. The United States Intelligence Community (USIC) consisted of U.S. executive branch

agencies and organizations that worked separately and together to conduct intelligence activities

necessary for the conduct of foreign relations and the protection of the national security of the

United States.

4. The U.S. Department of Defense (DoD) was a U.S. executive branch agency tasked with

providing the military forces needed to deter war and to protect the security of the United States.

5. The Defense Intelligence Agency (DIA) was a component of DoD and the

USIC, which collected (including through classified means), analyzed, produced, and
' '

disseminated foreign intelligence and counterintelligence to support national and DoD missions.

The DIA planned, managed, and executed intelligence operations during peacetime, crisis, and

war. The DIA provided defense-related intelttgence for the Secretary of Defense, th~hainnan

of the Joint Chiefs of Staff, combatant commanders, other DoD components, and non-DoD ,

agencies. Furthermore, the DIA conducted administrative and technical support activities within

and outside the United States as necessary for cover arrangements. Other DoD components of

the USIC include U.S. Army Intelligence.

6. The FBI was a U.S. government intelligence and law enforcement agency and was a

component of the USIC. The FBI was responsible for, among other things, conducting

counterintelligence investigations and activities.

3
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 4 of 41

Classified Information

7. National security information constituted information owned by, produced by, produced_

for, and under the control of the United States government that related to the conduct of foreign

relations or the national defense. Pursuant to Executive Order 13526 and its predecessors,

national security infonnation corresponded to three possible classification levels:

a. Information was classified as TOP SECRET if the unauthorized disclosure of that

information reasonably could be expected to cause exceptionally grave damage to the

national security that the original classification authority was able to identify and

describe.

b. Information was classified as SECRET if the unauthorized disclosure of that

information reasonably could be expected to cause serious damage to the national

security that the original classified authority was able to identify and describe.

c. Information was classified as CONFIDENTIAL if the unauthorized disclosure of that

information reasonably could be expected to cause damage to the national security that

the original classified authority was able to identify and describe.

8. Only individuals determined eligible by an appropriate U.S. government official could

lawfully access classified information. Additional requirements dictated that such an individual

sign an approved non-disclosure agreement, receive a security clearance, and possess a "need to

know" the classified information. Those authorities further required the storage of classified

infonnation in an approved facility and container conm1ensurate with its classification level.

9. Classification markings represented the usual means of communicating the need to protect

classified national security information. Classified documents typically contained banners on the

4
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 5 of 41

top and bottom stating the highest level of classification and any additional controls associated

with the materials, as well as markings relating to the information contained in each paragraph.

10. In addition to classification markings, classified information at times contained

dissemination markings which restricted the distribution of the information. These markings

include "NF" or "NOFORN" dissemination control markings that stood for "No Foreign

Dissemination." The NOFORN marking denoted a limitation to disseminate the information

only to U.S. persons.

The People's Republic of China Intelligence Services

11. The People's Republic of China intelligence services (PRCIS) encompassed both the

civilian and military components of Chinese intelligence programs. Civilian intelligence

agencies included the Ministry of State Security (MSS) and the Ministry of Public Security

(MPS). The MSS consisted of a central ministry, provincial state security departments, and

municipal state security bureaus, such as the Beijing State Security Bureau (BSS-S) andt e

Shanghai State Security Bureau (SSSB). The MPS was the principal domestic police and

security agency.

12. The MSS maintained primary responsibility for domestic counterintelligence, foreign

intelligence, and aspects of political and military security. Among other things, the MSS and its

regional bureaus focused on identifying and influencing the foreign policy of other countries,

including the United States. The MSS and its bureaus sought to obtain information on military,

political, economic, and security policies that might affect the People's Republic of China

(PRC), foreign intelligence operations directed at the PRC, and biographical profiles of foreign

politicians and intelligence officers. Much of the PRC's espionage efforts in industrialized

5
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 6 of 41

nations focused on acquiring technology that may or may not have been cleared for export. The

PRCIS commonly used agents running front companies to purchase high-technology equipment.

13. PRCIS human source operations tended to originate inside the PRC, where

the PRCIS preferred to meet with its sources or assets. The PRGIS recruited individuals with

direct and second-hand access to information. The PRCIS recruited, among others, individuals

who traveled in and out of the PRC for business or study and who could return to their home

country to gain employment in the national security system or exploit existing connections. The

PRCIS commonly used money to recruit sources.

The Defendant

14. Ron Rockwell Hansen (HANSEN), a United States (U.S.) citizen, resided in Syracuse,

Utah. HANSEN retired from the U.S. Army (Army) as a Warrant Officer with a background in

signals intelligence and human intelligence. HANSEN spoke fluent Mandarin-Chinese and

Russian. From approximately 2000 to 2006, while serving on active duty in the Army,

HANSEN worked as an mtelhgence case officer fonhe DIA. He retired ftom the Army in early

2006 after more than 20 years of service. Upon retirement, DIA hired HANSEN as a civilian

intelligence case officer. While on active duty with the Army and while employed as a DIA

civilian, HANSEN possessed a TOP SECRET security clearance.

15. As part of the training to become a case officer, HANSEN received training in managing

assets, deterring surveillance, avoiding detection, and handling classified and sensitive

information.

6
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 7 of 41

16. HANSEN eventually resigned from DIA in December 2006, after which he became a

member in two companies, H-11 Digital Forensics Company LLC and H-11 Digital Forensics

Services LLC (hereinafter referred to collectively as H-11 ). HANSEN's primary responsibilities

related to H-11 's business in Asia. From approximately 2007 until late 2011, HANSEN

maintained office space and an apartment in the PRC and traveled frequently from Utah to the

PRC.

17. According to HANSEN, he partnered with two PRC nationals, whom he identified by

anglicized names as "Amy" and "Robert," at his H-11 office in Beijing. According to HANSEN,

Robert maintained close connections to numerous contacts within PRCIS agencies.

18. From approximatGly the end of 2000 until late 2011, HANSEN performed contract work

for the U.S. government that provided HANSEN with additional access to classified national

defense information. During his military service, the U.S. government entrusted HANSEN with

access to sensitive government materials, including closely held national defense information

and classified documents and matenals.

19. Between the years 2000 and 2011, HANSEN signed multiple agreements that he would

not disclose his work with the U.S. government or the information derived from that relationship.

Over his many years of holding security clearances, HANSEN received training regarding

classified information, including the definitions of classified information, the levels of

classification, as well as the proper handling, marking, transportation, and storage of classified

materials. HANSEN received training on his duty to protect classified materials from

unauth01ized disclosure, which included complying with handling, transportation, and storage

requirements. HANSEN received instruction that the unauthorized transportation and storage of

those materials risked disclosure and that transmission of the information could endanger the

7
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 8 of 41

national security of the United States and the safety of its citizens.

20. As a prerequisite to accessing classified information during his employment with the U.S.

government agencies, HANSEN signed numerous contracts containing non-disclosure

agreements in which he acknowledged both the harm that could result from the unauthorized

disclosure of classified information and the applicability of criminal espionage laws should he

make an unauthorized disclosure of such information or should he unlawfully retain such

information.

21. Beginning in early 2012, HANSEN attempted to regain access to national defense

information by seeking positions of employment or confidence with USIC agencies, often

through former DIA associates.

a. In February of 2012, HANSEN approached U.S. Army Intelligence, through a former

DIA associate, and offered to work as a double agent against the PRCIS.

b. In May of 2012, HANSEN also applied for a position with DIA.

c. In mid-2013, in a meeting at DIA Headquarters facilitated by a high-ranking DIA

officer, HANSEN suggested to a DIA analyst assigned to a classified program targeting

the PRC that DIA operate HANSEN as a source.

d. In November of 2013, when HANSEN's efforts to gain access through those

intelligence agencies failed, HANSEN approached another component of the U.S. Army

Intelligence through another former DIA associate.

e. In February of 2015, HANSEN approached the FBI and offered to work as a double­

agent against the PRCIS.

f. In September of 2015, HANSEN contacted a United States House of Representatives

member assigned to the House Pennanent Select Committee on Intelligence, and

8
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 9 of 41

HANSEN proposed that he work as a member of the Representative's staff on

intelligence issues.

g. In May of 2016, as set forth in more detail below, HANSEN reestablished contact

with a current DIA case officer. In later meetings, HANSEN encouraged that DIA case

officer to use HANSEN as a source against the PRCIS.

22. At no time did HANSEN notify the Attorney General of the United States that he was

acting as an agent for any foreign government, including the PRC.

23. According to HANSEN' s financial records and his admissions to the FBI, between 2011

and 2016, the following companies employed HANSEN after his work with the U.S. government

ended:

Logicube September 2011 - July 2012

Smith
Electric Contractor July 2014-Marc h 2016
Vehicles

24. According to HANSEN' s financial records and business registration records, HANSEN

possessed an ownership interest in the following entities:

Amerfo;an
AC-FPS Chinese 57 W200 S Wells
March 26, Yes Fargo
Business Friendship Suite 302 Salt Owner
2013 x6750
GroupLLC Promotion Lake City,UT
Society
H-11 Digital Chief Wells
Computer 57 W 200 S Executive
Forensics Suite 302 Salt July 9, 2007 Yes Fargo
Forensics Officer/
Services Lake City,UT x3972
Company Owner
LLC
Computer 57 W 200 S Chief Wells
H-11 Digital November 20, Yes Fargo
Forensics Suite 302 Salt Executive
Forensics 2006 x8498
.Company Lake City,UT Officer/

9
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 10 of 41

Company Owner xlO00

LLC
Cloud Wells
Nuvestack 600 1?111 St November 19,
Yes Fargo
Computing Owner
LLC Denver, CO 2013 x0702
Company ..

Cloud 57 W 200 S Wells

Nuvestack September 25, Fargo
Computing Suite 302 Salt Owner Yes
I:hc. 2015
Company Lake City,UT x4721

25. Nuvestack provided cloud computing IT services. American and Chinese Friendship

Promotion Society Business Group (AC-FPS) provided a method through which HANSEN

attempted to generate revenue by providing business services in the PRC.

26. Between September of 2012 and the date of this Complaint, HANSEN had only

intermittent periods of verifiable income. HANSEN' s military pension, which paid

approximately $1,900 in net monthly income, constituted his only consistent source of income.·

27. According to jointly-filed, personal tax returns for tax years 2013 through 2016,

HANSEN claimed large losses from his affiliated partnerships, including Nuvestack, AC-FPS,

and H-11, resulting in less than $40,000 in his gross adjusted income reported each year. For tax

years 2013-2016, AC-FPS recorded business losses each year. Nuvestack filed its initial U.S.

Return of Partnership Income for tax year 2013 and claimed $0.00 income and $64,002 in

expenses. According to Nuvestack's U.S. Return of Partnership Income for tax year 2014,

business losses claimed were -$1,114,889 with only $4,000 in gross receipts. Nuvestack failed

to file taxes in 2015 and 2016 and carried significant debt.

28. In addition to the financial strain caused by his ownership interests, between 2012 and the

date of this Complaint, HANSEN's personal unsecured debt ranged from $150,000 to $200,000.

HANSEN exhausted his own credit limit and, as oflate 2016, HANSEN began to borrow funds

against credit cards belonging to his family members.

10
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 11 of 41

Meetings with the FBI

29. In 2014, the FBI commenced an investigation into HANSEN's activities. Throughout

2015, while unaware of the pending investigation, HANSEN participated in nine voluntary

meetings with FBI agents in Salt Lake City, Utah. HANSEN claimed that he initiated the

meetings with FBI in an attempt to offer his cooperation as a source. During those meetings,

HANSEN described numerous encounters with PRCIS officials, and HANSEN disclosed that

agents of the PRC IS targeted him for recruitment.

30. HANSEN told the FBI that, by at least early 2014, he began meeting with two MSS

officers known to him as "David" and "Martin." HANSEN described meeting with David and

Martin in private rooms in tea houses and hotels in Beijing, and explained that Robert set up

those meetings. HANSEN related that during a business trip to the PRC in early 2015, David

and Martin offered him $300,000 per year in exchange for providing "consulting services."

HANSEN reported that David and Martin asked him to attend conferences or exhibitions on

forensics, information secunty, and military communications and to conduct prom:rct research.

HANSEN stated that David and Martin gave him money by overpaying him for purchases of

computer forensic products.

31. In March of 2015, when asked how he could obtain information for the PRC IS,

HANSEN told the FBI that he "could start going to Washington, D.C. and meeting with friends

who are in the intelligence community and try and elicit classified info from them." However,

HANSEN ac;knowledged that doing so would constitute "alerting behavior." Physical

surveillance and court-authorized intercepted phone calls confirm that HANSEN began reaching

out to former DoD and DIA associates that same year and continuing into 2016. Several of those

associates had not had contact with HANSEN in many years.

11
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 12 of 41

32. In June and July of 2015, HANSEN gave the FBI two thumb drives containing several

reports that he wrote and other materials he obtained during his work with the U.S. government.

When asked by the agents how he safeguarded the material, HANSEN replied that he stored the

material on external drives and maintained these drives in a safe in his home. The two thumb

drives did in fact contain classified information that HANSEN was not authorized to retain.

33. In December of 2015, in the final meeting with FBI agents, HANSEN reiterated his

potential value to the PRCIS, suggesting the PRCIS could direct him to cont~ct two specific DIA

case officers in Texas and Georgia. At the conclusion of the meeting, FBI agents admonished

HANSEN that he must not accept the MSS 's offer to work for them. The FBI agents further

instructed HANSEN that he must inform the FBI if the PRC IS continued to contact him. At no

point thereafter, despite his later admissions to others about his continual meetings with the

MSS, did HANSEN report any further interaction with PRCIS to the FBI. As described more

fully below,'in May of 2016, HANSEN traveled to Texas and met with one of the DIA case
-
officers he mentioned to the FBtiIT1)1"'er,;ce5'f11mome5'frr:2rtQH-1_,,5-.- - - - - - - - - - - - - - - - - - -

Attending Conferences

34. During the course of the investigation, the FBI learned that HANSEN began attending

conferences on behalf of the PRC and its officials as early as 2013 and continued doing so

through 2017. The FBI conducted surveillance of HANSEN at some of those conferences. FBI

surveillance personnel observed HANSEN typing notes on his laptop computer and taking

photographs of the presenters.

35. From September 9-10, 2015, HANSEN attended the Intelligence & National Security

Summit in Washington, D.C. sponsored by the Intelligence and National Security Alliance

(INSA) and the Armed Forces Communications and Electronics Association (AFCEA). From

12
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 13 of 41

April 20-22, 2016, HANSEN attended the AFCEA-sponsored Defense Cyber Operations

Symposium in Washington, D.C. From September 7-8, 2016, HANSEN again attended.the

Intelligence & National Security Summit in Washington, D.C. From November 15-17, 2016,

HANSEN attended the AFCEA-sponsored TechNet Asia Pacific Conference in Honolulu,

Hawaii. From September 6-7, 2017, HANSEN attended the Intelligence & National Security

Summit in Washington, D.C.

36. Although HANSEN registered for conferences under the name ofNuvestack Inc., he

listed his home address rather than the Nuvestack address on registration documents. Recorded

phone calls reveal that HANSEN attempted to conceal his attendance at the TechNet conference

by asking a close Nuvestack associate not to disclose his location while at the conference. While

at the conferences, HANSEN also affirmatively misrepresented to the Nuvestack president and

other employees that he had been recalled to military duty.

HANSEN's Travel and Searches

37. During the investigation, the FBI also monitored HANSEN's travel. On several

instances during the investigation, the FBI enlisted the assistance of officers from U.S. Customs

and Border Protection (CBP) to assist with searching and questioning HANSEN as he traveled

back to the U.S. from the PRC. Between 2014 and 2017, in each instance that officers from CBP

searched HANSEN'S luggage or carry-on baggage, while he cleared customs on his travel back

to Utah from the PRC, HANSEN carried currency and various digital devices, including cellular

phones, smart phones, thumb drives, a laptop computer, and/or other digital storage media.

38. HANSEN traveled to the PRC on June 30, 2014, and returned to the U.S. through the

Detroit Metropolitan Airport on_ July 9, 2014. Upon his return, HANSEN knowingly failed to

13
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 14 of 41

report that he was carrying currency in excess of $10,000, and he failed to complete and submit a

Report of International Transportation of Currency or Monetary Instruments (FINCEN Form

105) as required. In Detroit, CBP conducted a secondary inspectionofHAN SEN's carry-on

luggage. When HANSEN realized that CBP intended to search his possessions, HANSEN told

the CBP officer that he had failed to declare currency over $10,000. After the interaction with

the CBP officer, HANSEN then disclosed that, in fact, he carried $19,222. HANSEN

subsequently completed the required FINCEN Form 105.

39. HANSEN traveled to the PRC on December 5, 2015, and he returned to the U.S. on

December 14, 2015. Upon his return, a court-authorized search of HANSEN's carry-on luggage

revealed a passcode-protected thumb drive concealed behind a sock in the toe of a shoe. A

forensic image of the thumb drive revealed the file names of photographs and notes related to the

September 2015 INSA Summit. The forensic examination also revealed that the thumb drive

had been accessed during HANSEN's stay in the PRC. HANSEN's suitcase contained brochures

and other materials related to the September 2015 INSA smmnit. The suitcase also contained a

print-out establishing HANSEN's membership in AFCEA starting in June of 2013. HANSEN

also carried his MacBook Pro computer and $53,000 in cash. HANSEN told CBP officers that

the $53,000 represented proceeds from the sale of a Netwitness server; however, HANSEN

could not produce any documentation to verify the sale of the product.

40. On April 18, 2016, during HANSEN's trip to Washington, D.C. to attend the AFCEA

conference, the FBI conducted a court-authorized search of HANSEN' s hotel room and created a

forensic image ofHANSEN's MacBook Pro computer. One document found on the computer,

saved under the file name "Business Development," contained expenses related to HANSEN's

attendance at conferences, AFCEA membership renewal, and INSA membership. The Business

14
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 15 of 41

Development document also contained a list of names and contact information of former

DoD/DIA associates of HANSEN. Several of the contacts continued to work for the United

States government, including an individual who later began operating as a Confidential Human

Source ("CHS"). The Business Development document also included names of U.S. politicians

representing the State of Utah. HANSEN did not have any business dealings with the vast

majority of the individuals listed in the document. Additionally, during the forensic

examination, the FBI discovered printer file records indicating that, days before his trip to the

PRC in December of 2015, HANSEN printed information from Linkedin related to several

former and current DIA case officers.

41. Other documents stored on the computer contained information about the U.S. military

and other conferences that HANSEN previously attended, including information detailing U.S.

Cyber Command locations, personnel, and organizational structure.

42. HANSEN traveled to the PRC again on July 17, 2016, and he returned to the U.S. on July

23, 2016. A court-authorized search of HKN~mN's luggage when he returned revealectthat he

carried the same password-protected thumb drive with him as he had on December 14, 2015. A

forensic examination revealed two documents located in the unallocated space on the thumb

drive, evidencing an attempt to delete the documents. One document contained notes about the

Defense Information Systems Agency, relating to the AFCEA conference HANSEN attended in

April of 2016. The examination further revealed that the thumb drive had last been accessed on

July 18, 2016, during HANSEN's trip to the PRC.

43. The other document started with an itemized list of expenses related to his May 2016 trip

to Texas. The document also contained past and current locations of DIA facilities in San

Antonio, as well as cryptic notes related to the classified program and DIA personnel, and

15
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 16 of 41

cryptic notes about a DIA case officer hiring initiative. The document also contained dates,

titles, and locations of upcoming military, intelligence, and technology conferences.

44. HANSEN traveled to the PRC again on December 14, 2017, and he

returned to the U.S. on December 19, 2017. Upon his return during customs processing, the FBI

conducted a court-authorized search of HANSEN's luggage and possessions. HANSEN carried

a MacBook Air computer. A forensic examination of the computer revealed a document saved

to the computer under the file name "Notes_INSA Summit2016." The document contained

several pages of extensive notes about the INSA Summit that HANSEN attended in Washington,

D. C. in September of 2016, as well as cryptic notes about his meetings with three former DIA

associates during that trip to Washington, D.C.

45. The notes also included expenses related to HANSEN's travel and attendance at the

summit in Washington, D.C. The cryptic notes included the initials of the first and last names of

the former DIA associates, the dates he met them, and other information likely related to his

iscussions with them, including cryptic notes related to their enrployment,-sucl~r~as~w~a-11-s::~w-it-h------­

"special ops community" and a specific U.S. government intelligence agency. The cryptic notes

also included the initials of the spouse of one of the former DIA associates and the date in July of

2016, when HANSEN had a chance meeting with her while traveling in Japan. At the time, the

spouse worked as a DIA employee. The cryptic notes also included the initials of the CHS with

an August date, followed by the note "med board," referring to discussions between HANSEN

and the CHS about the CHS' medical condition and the CHS' U.S. Army medical board status.

The document also contained the date, title, and location of a November 2016 military,

intelligence, and technology conference, which HANSEN attended.

HANSEN's Communications with PRCIS

16
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 17 of 41

46. HANSEN consistently touted his access to PRCIS intelligence officers throughout the

2015 voluntary meetings with the FBI. As noted above, in February 2015, HANSEN described

hfa ongoing meetings with MSS intelligence officers David and Martin; saying those meetings

began in 2014 and continued into 2015. He explained that he stopped traveling to the PRC after

December of 2011 while he was applying to return to work with DIA, but he resumed travel in

April of 2013 upon learning he would not be hired. HANSEN described a succession of PRC IS

intelligence officers with whom he met during visits to the PRC. He identified one of the

officers as Max, who he said later introduced him to David and Martin, who he then began

meeting with exclusively.

47. In the next voluntary meeting with the FBI in March of 2015, HANSEN further described

the PRC IS intelligence officer as Max Tong, but said he was unsure if Tong was Max's real last

name. HANSEN said he met with Max and Martin in 2013. In the May2015 voluntary meeting

with the FBI, HANSEN again described various PRCIS intelligence officers with whom he met

m the PRC over his years of travel. He admitted to using his personal email accounts, including

his @ac-fps.org account, to comm1micate with certain PRCIS intelligence officers. He provided

a sheet of paper with the names and contact information of some of the PRC IS intelligence

officers. HANSEN identified Max on the sheet of paper he provided, which listed him as "Max

Rain'' with an email address @foxmail.com. He again identified Max as the PRCIS intelligence

officer who introduced him to MSS intelligence officers David and Martin. In the September

2015 voluntary meeting with the FBI, HANSEN provided another document listing his PRCIS

contacts, including the years of contact and the officers' affiliation. He identified Max Tong as

an MSS intelligence officer assigned to "HUMINT," an acronym for Human Intelligence, with a

first meeting date of March 2011.

17
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 18 of 41

48. A court-authorized search of HANSEN's email account related to [email protected]

address revealed three email exchanges with Max using [email protected] email account. One

of HANSEN's email responses to Max included a contact title of "Rain" for [email protected] ·

email address, further showing these email exchanges were with Max Tong during 2012-13.

49. The emails were sent in mid-2012 and early 2013, and they showed Max's eagerness for

HANSEN to resume travel to the PRC. In emails exchanged in July of 2012, HANSEN revealed

to Max that he decided to go back to his job at the Department of Defense and he would not be

able to travel to the PRC that month. At that time, HANSEN had applied for a position with

DIA, which required a security clearance and would have given him renewed access to

intelligence reporting. Max sent another email to HANSEN in January of 2013, noting he

looked forward to hearing from HANSEN. HANSEN replied in April of 2013, about the time he

learned he would not be hired by DIA and right before his first trip back to the PRC since

December of 2011, noting he had good news. He wrote that he would be in the PRC the

followmg week, adding that his schedule was busy so they would need to meet early in the

morning. He added that he looked forward to seeing Max. HANSEN failed to disclose his

ongoing contacts with Max, someone he knew to be a PRCIS intelligence officer, to DIA during

his application and security clearance background check investigation.

50. When HANSEN first approached the FBI in February of 2015, he explained that Robert

set up his meetings with MSS intelligence officers David and Martin. At a subsequent voluntary

meeting with the FBI in March of 2015, when HANSEN again stated that Robert brokered

HANSEN's meetings with David and Martin and other PRCIS intelligence officers, the FBI

asked HANSEN about Robert's background and why he had direct contact with PRCIS

intelligence officers. HANSEN described Robert's access to hundreds of PRCIS officers, adding

18
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 19 of 41

that Robert visited PRCIS offices, including the MSS office. At a subsequent voluntary meeting

with the FBI in September of 2015, HANSEN explained that David and Martin opted to no

·1onger utilize Robert to arrange meetings with HANSEN, but they instead gave HANSEN a ·

XINDA-model PRC cell phone with Martin's name and telephone number preprogrammed to

allow HANSEN to communicate directly with Martin to set up in-person meetings after

HANSEN arrived in the PRC.

51. The investigation revealed that, as early as July of 2014, HANSEN used various cell

phones to communicate with Martin and others in the PRC. HANSEN's use of multiple cell

phones to communicate covertly with intelligence officers is consistent with case officer

tradecraft training HANSEN received from DIA to communicate securely with human sources.

52. When HANSEN returned from the PRC on July 9, 2014, CBP officers conducted a

secondary inspection ofHANSEN's luggage and possessions and found an inexpensive NOKIA­

brand, PRC cell phone. HANSEN also had a U.S. smartphone.

J.Wb:erri=I:A:NSEt\f returned from the PRC on :Becembe1 14, 2015, the FBI conducted a

court-authorized search of his luggage and possessions and found an inexpensive XINDA-brand

PRC cell phone packed in his carry-on luggage, which he possessed in addition to the U.S. and

PRC smartphones he carried in his briefcase .. The XINDA phone had call data showing

communications with "Martin."

54. Upon HANSEN'S return to the U.S. in July 23, 2016, following his travel to the PRC, the

FBI conducted another court-authorized search of his luggage and possessions and found an

inexpensive NOKlA-brand PRC cell phone packed in his carry-on luggage separate from his

U.S. and PRC srnartphones located in his briefcase. This NOKIA phone call data showed

communications with "Martin." This was not the same NOKlA-brand cell phone found in

19
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 20 of 41

HANSEN's possession by CBP in July of 2014.

55. On July 11, 2017, the FBI conducted a court-authorized search ofHANSEN's checked

luggage prior to his flight to the PRC and foundHANSEN'sHuawei~brand -PRe smartphone

packed in the luggage. The FBI obtained a forensic image of the phone and found several stored

incoming and outgoing calls and text messages. The forensic image showed HANSEN began

using this smartphone during his travel to the PRC in February of 2015, shortly before he

contacted the FBI and reported the alleged recruitment pitch by the PRCIS. The forensic image

from July 11, 2017 revealed consistent communication to and from a contact identified in the

smartphone as "Martin Chen," beginning with HANSEN's trip to the PRC in December of2016

and including each subsequent trip to the PRC prior to this outbound travel. Those trips occurred

in February of 2017, April of 2017, and May of 2017.

56. When CBP questioned HANSEN about the $53,000 in U.S. currency that he declared

upon his return travel from the PRC on December 14, 2015, HANSEN explained that he sold a

piece of computer forensic equipment t ~ S . On February 28, 20t'r,when

describing his meetings with the MSS in the PRC, HANSEN told the CHS that the MSS always

knows he is coming to the PRC, adding that they do not call themselves the MSS, they call

themselves the MPS.

57. During his voluntary meetings with the FBI in 2015, HANSEN explained his extensive

interaction with the MPS. The court-authorized search ofHANSEN's MacBook Pro computer in

April of2016 revealed photographs saved to the computer depicting HANSEN with uniformed

MPS officers, including some in a room with the MPS logo on the wall of the room, confirming

admissions he made to the CHS about having ties to the MPS.

58. During a meeting with CHS in April of 2018, as they discussed how they could

20
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 21 of 41

communicate to avoid detectipn, HANSEN suggested to CHS they use a covert means of

communication using email.

...... Movemerifof Money From the PRC to the United States·· ···· ··· ·

59. HANSEN did not travel to the PRC during 2012, but he resumed frequent travel to the

PRC in April 2013. Since 2013 and through the date of this Complaint, HANSEN traveled to the

PRC 40 times.

60. Since at least April of 2013, HANSEN's return from travel to the PRC coincided with

him receiving large amounts of money. HANSEN moved money from the PRC to the U.S. using

three methods: physically carrying cash across the border after trips to the PRC, Visa card

transactions originating from the PRC, and wire transfers originating from the PRC.

61. Since 2008, Amy and Robert operated a PRC-based entity called Beijing Hua Heng

Infosec Company (Infosec) which partnered with H-11 to sell computer forensic products in the

PRC. During the course of the partnership, H-11 shipped computer forensic products to Infosec.

For example, email correspondence 111 August of 2013 between HANSEN's @ac-fps.co m email

account and an email account @hlldfs.co m provide shipping details for a product shipped

internationally on or about August 8, 2013 from a domestic vendor to Infosec in Beijing. An

analysis of bank records revealed that Amy and Robert paid for these products via wire

transactions originating from the PRC to H-11 business accounts in the United States. In

contrast, beginning in May of 2013, Amy and Robert began wiring funds to an AC-FPS business

account controlled by HANSEN on dates that coincided with HANSEN's trips to the PRC.

62. For example, HANSEN traveled to the PRC on August 5, 2013, and he returned to the

U.S. on August 27, 2013. On or about August 19, 2013, HANSEN sent an email from his@ac­

fps.com email account to Amy and Robert at [email protected] email accounts asking Robert if

21
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 22 of 41

he received $15,000 U.S. dollars from HANSEN's driver in the PRC. HANSEN then instructed

Robert to send the money to his AC-FPS business account in Utah. On or about August 28,

- -2013, HANSENreceived a $14,985 wire- originating

, from the PRC inhis AC~FPS business

account.

63. Starting in May of 2013 through June of 2014, HANSEN's travel to the PRC coincided

with large cash deposits to HANSEN's personal and business accounts without declarations of

currency at the border. In addition, between May of 2013 through September of 2014, Amy and

Robert wired funds directly into HANSEN's AC-FPS business account, as set forth in Table 1

below:

May 3, 2013 $4,000

x4798 Hansen personal
April 20 - May 3, None $1,000 Cash
May 7, 2013
2013 Portland,OR $12,000
x6750 AC-FPS
May 13, 2013 $14,985 Wire

March 26, 2014 $9,900

x0702 Nuvestack
March 19 - March None $9,900
March 27, 2014 Cash
26,2014 Seattle,WA $1,000
x4798 Hansen personal
March 31, 2014 $6,400

22
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 23 of 41

June 11, 2014 $7,985 Wire x6750 AC-FPS

June 13, 2014 $5,000
June 4- June 13, None
. . 2014 .. - _JuneJ7,2Ql'4. $J,30_0_
Seattle;WA f----------+- ------1··cash x:4798 Hansen personal
June 20, 2014 $1,000
June 30, 2014 $2,000

64. After his interdiction by CBP on July 9, 2014, HANSEN began declaring U.S. currency

on a regular basis upon his return from the PRC. HANSEN's travel to the PRC from June 2014

through December 2015 similarly coincided with large cash deposits to HANSEN's personal and

business accounts, as set forth in Table 2 below:

July 10, 2014 $9,000 x4798 Hansen personal

$19,222 in Detroit, MI July 11, 2014 $2,500 x4892 K.H. personal

June 30 - July 9, Cash
2014 (Form Filed) July 17, 2014 $1,000 x4798 Hansen personal
July 18, 2014 $1,800 x4892 K.H. personal

$5,000 x4798 Hansen personal

April 6 -April 16, $30,040 in Seattle, WA April 17, 2015
$6,800 Cash
2015 (Fom1 Filed) xl 730 Hansen personal
April 27, 2015 $4,500

23
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 24 of 41

July 27, 2015 $5,000 xl 730 Hansen personal

July 30, 2015 $5,000 x6750 AC-FPS
$20,700 in San Fran,
July 21 - July 26, August 10, 2015 $3,000 Cash xl 730 Hansen personal
CA
2015
(Form Filed) August 11, 2015 $1,008
x4798 Hansen personal
August 24, 2015 $3,300

$8,000 xl 730 Hansen personal

December 14, 2015
$8,000 x4798 Hansen personal
December 5 - $53,000 in Seattle, WA $7,400 Cash x6750 AC-FPS
December 15, 2015
December 14, 2015 (Form Filed)
December 16, 2015 $1,000 x4892 K.H. personal
January 6, 2016 $2,900 x4798 Hansen personal

65. In conversations with law enforcement officials and others, HANSEN offered varying

explanations regarding the source of his cash. For example, HANSEN claimed to CBP and FBI

on at least one occasion that the cash related to the sale of surplus inventory and equipment

following the 2013 closing of H-11 Beijing. However, in March of 2015, HANSEN told the FBI

that he no longer had surplus inventory and equipment to sell in the PRC. W11en questioned by

CBP about cash carried into the U.S., HANSEN never provided any documentation to confirm

the sale of any surplus inventory or equipment from H-11 Beijing. As Tables 2 and 3 illustrate,

· HANSEN continued to bring significant sums of cash into the U.S. even after he advised CBP

officers and FBI agents that little or no H-11 inventory or equipment remained to sell.

66. After receiving scrutiny by CBP regarding his pattern of carrying cash into the U.S.

following trips to the PRC, HANSEN developed another method to transfer U.S. currency to his

24
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 25 of 41

U.S. bank accounts using credit cards. •During a phone call with a business associate on or about

June 10, 2016, HANSEN stated that he found "another way" to move money out of the PRC.

HANSEN explainedthatthe PRC government places an annual-limit of $50;000 per individual

to transfer funds out of the PRC. To avoid the $50,000 limit, HANSEN further explained that an
, .
individual could transfer funds out of the PRC using credit cards.

67. Emails confirm that, as early as March of 2016, HANSEN transferred money from the

PRC using Visa cards with the assistance of Amy and Robert. The emails containing Visa card

numbers included references such as "for Ron," "Ron's money," and "Money In from RH."

Amy provided the Visa card numbers to both HANSEN and an accountant. Thereafter, at

HANSEN's direction, the accountant processed the Visa card transactions through U.S.-based

merchant accounts and then transferred the funds to HANSEN's personal and business accounts,

as demonstrated in examples detailed below.

68. HANSEN traveled to the PRC on July 17, 2016, and he returned to the U.S. on July 23,

2(Jl 6. HANSEN did not declare any currency at the ahport. When questioned byeB--,

HANSEN admitted carrying $9,970, an amount just under the reporting threshold. HANSEN

told CBP officers that he would no longer carry currency across the border and that he would

instead have money sent to him via Visa card transactions. HANSEN told CBP the Visa card

transactions would involve a 3% fee, but he would rather pay the fee than be interviewed by

CBP. On or about July 24, 2016, Amy sent an email to HANSEN and the accountant stating that

there was "USD15,000 in this visa card for Ron." On July 27, 2016, the accountant processed

the $15,000 Visa card transaction through the Nuvestack merchant account.

69. HANSEN traveled to the PRC on December 3, 2016, and he returned to the U.S. on

December 10, 2016. On or about December 12, 2016, in a telephone conversation with the

25
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 26 of 41

accountant,HANSEN described how he directed Amy and Robert to send $49,000 to the U.S. in

increments of $10,000, $10,000, $15,000, and $14,000. On or about December 9, 2016,

···-·· ·-·December-14,-2016, and-December 22, 2016,Amy-sent emails to-HANSENandthe accountant·-­

with subject lines "Ron's money" and "third part of Ron's money." At HANSEN's direction, the

accountant processed $49,000 total in Visa card transactions through the Nuvestack merchant

account.

70. On February 28, 2017, HANSEN told the CHS that the MSS always pays him in cash

and he gives the cash to Amy and Robert to wire to him. HANSEN also told the CHS that he

sometimes carries cash but he has to declare it ifit is over $10,000.

71. HANSEN traveled to the PRC on May 11, 2017, and he returned to the U.S. on May 16,

2017. On or about May 17, 2017, HANSEN spoke with Robert by telephone. Robert stated that

HANSEN could access the money the following night. Robert said that he can only deposit

5,000 U.S. dollars each day in the PRC, and it takes three days to deposit 15,000 U.S. dollars.

On or about May 1~ Amy sent an email to HANSEN and the accountant with subject line

"money for Ron," notifying them of the availability of $15,000 "for Ron" on a Visa card. On or

about May 19, 2017, the accountant processed the $15,000 Visa card transaction through the

Nuvestack merchant account.

72. HANSEN traveled to the PRC on July 11, 2017 and he returned to the U.S. on July 18,

2017. On or about July 19, 2017, Amy sent an email to HANSEN and the accountant stating that

"there is USD9000 for Ron on this Visa card." On or about July 20, 2017, the accountant

processed the $9,000 Visa card transaction through the Nuvestack merchant account.

73. HANSEN traveled to the PRC on September 21, 2017, and he returned to the U.S. on

September 28, 2017. On or about September 28, 2017, HANSEN wrote in an email to a friend in

26
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 27 of 41

the PRC, "I have attached the Bank Information for the AC-FPS Business Group. Thank you.

Hope to see you soon in Utah. Ron Hansen, CEO I AC-FPS Business Group." The friend

- ~-tespondea; "OK:,,_ On September 29; 2017; ba:nl(tecords-show that a wire originating from the - -- - -

PRC in the amount of $9,985 posted to the AC-FPS business account. On or about October 2,

2017, HANSEN, on a telephone call with a Nuvestack employee, explained the delay in paying

the Nuvestack employee. HANSEN explained that the money was not "here" yet because

" ... they've gotta put some money in the bank ... then put some money on a credit card that I can

swipe here because the money's coming from Asia." On or about October 4, 2017, Amy sent an

email to the accountant and HANSEN stating there was "USD30000 in this visa card for Ron."

On or about October 6, 2017, the accountant processed the Visa card through the Nuvestack

merchant account.

74. HANSEN traveled to the PRC on November 16, 2017, and he returned to the U.S. on

November 21, 2017. On or about November 16, 2017, during a telephone call, a business

partner asked HANSEN to repay a $50,000 loan. During a later call;-rr-A"NSEN stated that he

could not produce a $50,000 lump sum payment, but "there are some things aligning."

HANSEN stated he would probably get $10,000 to the business partner the following week. On

or about November 22, 2017, HANSEN received a $27,985 wire originating from the PRC in his

AC~FPS business account from the same friend referenced above. On or about November 22,

2017, HANSEN transferred $10,000, through the Nuvestack business account, to this business

partner.

75. HANSEN traveled to the PRC on December 14, 2017, and he returned to the U.S. on

December 19, 2017. On or about December 22, 2017, Amy sent an email to HANSEN about

transferring money to HANSEN. Bank records show that on December 27, 2017, and January 3,

27
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 28 of 41

2018, two Visa card transactions were received in the Nuvestack business account in the

amounts of $10,000 and $13,000 respectively.

-- ,6-:-Between July-of 2016and-the-dateofthis Complaint;-more than$200;000 was processed

through the Nuvestack merchant account from PRC bank-issued Visa cards provided by Amy

and Robert. For tax year 2016, despite receiving approximately $90,000 through the Nuvestack

merchant account using Amy and Robert's Visa cards, Nuvestack failed to file any corporate tax

filings with the Internal Revenue Service.

77. For the merchant transactions, wires, and cash deposits described below in Table 3,

HANSEN used the majority of the funds to benefit himself, his family members, and other

entities, such as Nuvestack and AC:-FPS, in which HANSEN held a vested financial interest.

Bank records confirm that HANSEN did not transfer those funds to H-11 or use the funds in a

way that benefitted H-11. Table 3 illustrates the methods HANSEN employed to transfer U.S.

currency from the PRC to the U.S., after scrutiny by CBP in December of 2015:

December 12, 2016 $10,000

December 3-
None $10,000 Card x4721 Nuvestack
December 10, December 13, 2016
Seattle,WA >--------------,f--------<
2016 December 16, 2016 $15,000

28
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 29 of 41

December 19, 2016 $1,000 Cash x4798 Hansen personal

December 23, 2016 Card x4721 Nuvestack

78. Tables 1-3 summarize some, but not all, of the U.S. currency HANSEN declared to CBP

or funds deposited into U.S. bank accounts contemporaneous with his travel from the PRC.

From May of 2013 to the date of the Complaint, HANSEN received not less than $800,000 in

funds originating from the PRC.

Export Control

79. Under the International Emergency Economic Powers Act (IEEPA), 50 U.S.C. §§ 1701

el seq., Congress granted to the President of the United States the authority t0 deal with unusual

and extraordinary threats to the national security, foreign policy, and the economy of the U.S.

Under IEEP A, the President can declare a national emergency through Executive Orders that

29
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 30 of 41

carry the full force and effect oflaw.

80. The Department of Commerce, Bureau oflndustry and Security (DOC-BIS), regulated

- --·- --- the exp0rt-of0ertain-items,-sueh-as s0ftware-withcrypt0analytic-capability,-through-the-Export--­

Administration Regulations (EAR), 15 C.F.R. §§ 730-774. Under the EAR, DOC-BIS imposed

license and other requirements before a person could lawfully export an item subject to the EAR

from the U.S. DOC-BIS references such items on the Commerce Control List, published at 15

C.F.R. §774.

81. On August 17, 2001, under the authority of IEEP A, the President issued Executive Order

13222, which declared a national emergency with respect to the unrestricted access of foreign

parties to U.S. goods and technologies. By successive Executive Notices, the President extended

the finding of this national emergency and continued the EAR in effect under IEEP A, published

most recently on August 15, 2017, at 82 Fed. Reg. 39,005.

82. The Secretary of Commerce maintains the EAR, which identifies items over which DOC­

BIS exerci-ses-regctlato:ryjurisdiction. Thrnugh the EAR, DOC-BIS imposes a license or other

export authorization requirement before an item subject to the EAR may be lawfully exported

from the United States or lawfully re-exported from another country. In particular, DOC-BIS

places restrictions on the export of goods and technology that persons abroad might use to harm

U.S. national security, foreign policy, and law enforcement interests.

83. Under IEEPA and the EAR, willfully exporting, conspiring to export, attempting to

export, or aiding and abetting the export from the U.S. of any item subject to the EAR that

required a license without first obtaining the license from DOC constituted a crime.

Sumuri Recon Software

84. Sumuri LLC (Sumuri), a U.S. company located in Delaware, provided digital forensic

training, software, hardware, and services. Sumuri manufactured the Recon Mac OS X

30
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 31 of 41

Forensics with Paladin 6 software (Sumuri Recon software). That software contained

cryptographic capability. By at least June 1, 2016, the Sumuri Recon software received an

·······ExpoffControrc1assificationNumoer\ECCNYot5D002:-c~l~:A:s a·commo-dity controliedfor----~ ----····-· -··· -· -

anti-terrorism and national security reasons, the EAR prohibited the export of that controlled

commodity to the PRC without a valid export license from the DOC-BIS.

85. On or about November 29, 2016, Amy requested that HANSEN purchase the Sumuri

Recon software and bring it to her in the PRC. On or about December 12, 2016, HANSEN

purchased the Sumuri Recon software for $1,717.95 purportedly on behalf ofNuvestack Inc., a

U.S. company. On or about December 12, 2016, HANSEN directed an associate to ship the

Sumuri Recon software to Amy in the PRC. On or about December 23, 2016, in an email

message to HANSEN, Amy confirmed receipt of the Sumuri Recon software. HANSEN

previously dealt with DOC-BIS and knew of the licensure requirement for export controlled

products. HANSEN did not obtain the requisite license to export the Sumuri Recon software to

Vound Intella Software

86. Vound LLC (Vound), a U.S. company located in Colorado, provided products related to

forensic search, e-discovery, and information governance. Vound manufactured the Intella 100

software.

87. For the export of any commodity valued at or above $2,500, the EAR required the

exporter to complete an Electronic Export Information form (EEI), previously known as

Shipper's Export Declaration (SED), in the Automated Export System (AES). Among other

things, that form required the exporter to list the accurate value of the commodity (15 CFR 30).

Electronic filing through the AES strengthened the U.S. government's ability to prevent export

of certain items to unauthorized destinations and to unauthorized users.

31
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 32 of 41

88. On or about December 23, 2016, Arny requested that HANSEN purchase the Intella 100

Software and bring it to her in the PRC. On or about January 8, 2017, HANSEN purchased the

- ·· ·-~ Intella·software-from-Vound for$3~03 0:00 :After purchasingthe·software;-HAN8En-- -·-· ·--· -----

represented to the Vound sales manage{ that Nuvestack Inc. would be the end user of the

product. Thereafter, HANSEN directed an associate to ship the Intella software to Arny in the

PRC, arid on or about January 19, 2017, the associate did so. At the request of Amy and with

HANSEN's knowledge, HANSEN's associate listed the value of the product on the shipping

documentation at $50.00, which HANSEN well knew to be false. HANSEN previously exported

other products from the U.S. whose value exceeded $2,500. On those occasions, HANSEN

submitted the requisite form, confirming that he knew of the disclosure requirement. HANSEN

did not complete the EEI form regarding the export of the Intella software nor did he direct his

associate to do so.

The Confidential Human Source and Attempted Espionage

89. As a routme mvestlgatlve techmque, the FBI enlists the participation of confidentia

human sources (CHS) to assist in investigations.

90. On May 24, 2016, HANSEN met with two fonner DIA associates for lunch in San

Ai1tonio, Texas. After lunch, HANSEN continued to speak to one of the DIA associates,

inquiring about DIA sources and methods of operation. During the conversation, HANSEN

disclosed that the MSS approached him. He also described his meetings with the FBI and stated

that he "had to give the MSS something to keep stringing them along," while waiting for the FBI

to make a decision about his offer to work as a "double agent."

91. Based on HANSEN's statements, the DIA associate filed a suspicious incident repoti.

Thereafter, with DIA approval, the associate agreed to assist the FBI in its investigation by

32
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 33 of 41

acting in the capacity of a CHS. At the time, the CHS worked as a DIA case officer.

92. Between 2016 and 2018, the CHS spoke to HANSEN several times. During those

··· ----conversations;HA:NSBN-disclosed-ongoing ·contact with the MSS-,-including in=personmeetings ------- ··

with senior MSS officers during his trips to the PRC. HANSEN stated that he performed

consulting work for the MSS. HANSEN further stated that he sold computer forensic products

to the PRCIS for which they "grossly overpaid" him in cash.

93. In October of 2016, HANSEN told the CHS that the MSS was still willing to pay him

$300,000 a year to do consulting work. HANSEN related that the MSS asked him to write white

papers on cell pliones. HANSEN also said the MSS asked him about the views of various U.S.

politicians regarding the PRC.

94. In February of 2017, HANSEN told the CHS that he attended intelligence and military

conferences for the MSS. HANSEN stated that while none of the information at the conferences

was classified, the MSS could not obtain the same information as 'HANSEN because the MSS

would not have the same access to high ranldng military officials as HANSEN did.

95. In March of 2018, HANSEN sent the CHS a copy of certain materials that he retained

from his time as a U.S. government contractor. HANSEN asked the CHS to look for the

information in intelligence reporting to determine how, if at all, the government used it. The

materials that HANSEN sent to the CHS remained classified.

96. In March of 2018, HANSEN also told the CHS that he met with a senior MSS

intelligence officer during his March trip to the PRC. HANSEN discussed areas of interest

expressed by the MSS intelligence officer about U.S. positions related to North Korea, South

Korea, and the PRC. In addition to asking the CHS to look in intelligence reporting for

information related to the materials HANSEN sent to the CHS, HANSEN also asked the CHS to

33
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 34 of 41

look in intelligence repmiing for information on a specific issue HANSEN described related to

North Korea. HANSEN also suggested he could act as a conduit to pass infom1ation to the MSS.

97:--In-April of 20 ts ;-shortly before· HA:NSEN·travelled·a:ga:inlo-the·PRC;HANSEN alsef___ ----- -

discussed with the CHS his ability to facilitate the sale of national defense information to the

PRCIS, saying he would meet with the MSS during his April trip to the PRC and assess their

interest in information the CHS could obtain and provide. HANSEN discussed with the CHS

ways to conceal their meetings and activities in the U.S. to avoid detection of their intent to sell

national defense information to the PRCIS.

98. Later in April of 2018, HANSEN again met with the CHS shortly after returning from the

PRC. During the meeting, HANSEN discussed the details of how he and the CHS might sell

national defense information to the PRCIS. HANSEN advised the CHS regarding the type of

information the PRCIS would find useful, and HANSEN advised the CHS how to record and

transmit classified information without detection. HANSEN further suggested that the CHS

create notes relatecl to the content of any classified matenal thanlie CHS would pass to

HANSEN. HANSEN also discussed the possibility of the CHS doing a debriefing with the

PRCIS in Canada or Mexico. HANSEN asked what amount of compensation the CHS would

require for providing such information. HANSEN advised that the PRCIS might pay up to

$200,000 if the CHS could deliver the "China ops plan," the operations plan of the United States

military regarding potential military intervention with China. HANSEN explained how the CHS

could hide and launder any funds received from the PRCIS, and HANSEN offered to help

launder the money. On multiple occasions during the conversation, HANSEN asked whether the

CHS was recording the meeting or "setting [HANSEN] up to go to jail." At the end of the

meeting, HANSEN discussed using an application that provides encrypted communication for

34
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 35 of 41

their future interaction.

99. In early May of 2018, after learning of the CHS' unavailability to meet prior to

· · ·- -----HANSEN's-intended·traveJ-to-the-PRe-on-May-3-1;2018;-H:ANSEN-·suggested-hecould-delay-his-----·-

travel to the PRC to a later date in order to accommodate the CHS' availability.

100. HANSEN subsequently made plans to travel from Salt Lake City to the PRC on June 2,

2018. He confirmed with CHS that they would meet at a location close the Seattle-Tacoma

airport in Seattle, Washington, where HANSEN had a connecting flight to the PRC from the

District of Utah.

101. On June 2, 2018, during his layover, HANSEN took a cab to meet CHS at a pre­

arranged location close to the Seattle-Tacoma airport. CHS and HANSEN met in CHS' car near

the airport and drove to another location, also in the vicinity of the airport. CHS brought two

classified paper documents with him ("materials") to his meeting with HANSEN, both of which

were classified at the secret level and marked accordingly.

102. At the outset of the meetmg HANSEN stated that he did not turn on his phone after he

landed to insure that there would be no one tracking their location. CHS informed HANSEN

that he had materials to show HANSEN. HANSEN initially responded to this news that he did

not want to physically take the materials on his pending trip to the PRC. However, HANSEN

later indicated that they should give his contacts in the PRCIS something to ensure that they

would continue to work with CHS and HANSEN in the future.

103. CHS had the materials in a concealment device. CHS offered the materials in the

device to HANSEN, who attempted to open the device but could not. CHS then took the device

back, opened the device; and asked HANSEN ifhe wanted to see the materials. HANSEN stated

that he did and HANSEN then accepted the materials from CHS.

35
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 36 of 41

104. While reviewing the materials HANSEN indicated that each paragraph of the materials

would be worth a separate ten-minute conversation with the PRCIS. CHS and HANSEN

- - -------discussed tlfe content of the materials-for almosttwo hours::A:nY:rrepoint;-CHSasked-H:ANSEN------

how he would remember all of their discussions and HANSEN stated that he would remember

the highlights. CHS observed HANSEN take hand-written notes during their conversation.

When CHS dropped off HANSEN, HANSEN indicated that he would take his hand-written

notes and incorporate them into an existing Word document. During the majority of their two-

hour meeting, HANSEN had the materials in his possession and reviewed them. HANSEN asked

the CHS specific questions about the materials for the majority of their time together. At one

point during the two hours, CHS left the car for between five and ten minutes. During this time,

HANSEN continued to review the materials.

105. CHS and HANSEN also discussed how CHS should procure and store documents that

CHS would obtain in the future for the PRCIS. HANSEN advised CHS that he should buy a

computer and scanner and take steps to move the materials mto a d1g1tal format. He also

suggested that CHS cut a hole in a nearby tree and hide materials in that location.

106. HANSEN also informed CHS that the PRCIS would have to vet CHS. HANSEN asked

for CHS' date of birth, email addresses, employment locations, his social media accounts, and

information about CHS' family members to provide to the PRCIS to facilitate the PRCIS vetting

process.

107. HANSEN told CHS that he would not receive money after this trip to the PRC.

However, he advised CHS that he would arrange for CHS to receive payment after his next trip

to the PRC later in June. HANSEN stated he would arrange for his contacts in the PRC to give

the money to one ofHANSEN's business associates in the PRC who would then wire the funds

36
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 37 of 41

to one ofHANSEN's businesses. HANSEN would then have the funds "expensed" and arrange

for them to be sent to CHS.

--·· -·-··-· - --·--- --~10s~-After·their meeting,-eHS-dropped-H:ANSEN-off at-a-location-close-to~the-Seattle~ ----------- ---

Tacoma airport. HANSEN then walked approximately a block from the drop-off location toward

the entrance to a pedestrian bridge that accessed the airport when he was apprehended by the

FBI.

109. When apprehended, HANSEN had in his possession a single page of hand-written

notes. These notes included specific numbers from the materials that HANSEN incorporated into

Utah phone numbers to mask their meaning. Additionally, the notes on the page included CHS'

date of birth, email addresses, and employment locations.

THE UNITED STATES COMPLAINS THAT:

COUNT 1
18 U.S.C. § 794(a)
(Attempt to Gather or Deliver Defense Information)

110. Paragraphs 1-109 of this Complaint are incorporated by reference and re-alleged as

though set forth fully herein.

111. On or about June 2, 2018, in the Northern Division of the District of Utah and

elsewhere,

RON ROCKWELL HANSEN,

the defendant herein, did knowingly and unlawfully attempt to communicate, deliver and

transmit directly and indirectly to a foreign government, to wit: the Government of the People's

Republic of China, and representatives, officers, agents, employees, subjects and citizens thereof,

documents and information relating to the national defense of the United States including a

document marked SECRET//NORFORN that related to military readiness in a particular region,

37
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 38 of 41

attempt to transport such currency from a place outside the United States to a place inside the

United States, all in violation of 31 U.S.C. § 5332, as set forth below:

5 July 9, 2014
July 17, 2014

July 18, 2014

WF: Wells Fargo

COUNTS 6-13
31 u.s.c. § 5324
(Structuring Monetary Transactions)

Paragraphs 1-115 of the Complaint are incorporated by reference and re-alleged as set

forth fully herein.

117. Beginning on a date unknown to the United States, but at least by April

2013, and continuing until the date of this Complaint, in the Northern Division of the District of

Utah and elsewhere, the defendant,

RON ROCKWELL HANSEN,

did lmowingly and for the purpose of evading the reporting requirements of Title 31, United

States Code, Section 5313(a), and the regulations promulgated thereunder, structure and attempt

to structure any transaction with one or more domestic financial institutions, as set forth below:

39
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 39 of 41

·-·- ...... . -·~·-·--- --- ----·- --······-

$5,000 x4798 WF Hansen personal

$30,040 in April 17, 2015
$6,800
10 April 16, 2015 Seattle, WA xl 730 BAF Hansen personal
(Form Filed) April 27, 2015 $4,500
May 4, 2015 $2,000 x4798 WF Hansen personal

WF: Wells Fargo, BAF: Bank ofAmerican Fork

And did aid and abet therein, all in violation of 31 U.S.C. § 5324 and 18 U.S.C. §2.

COUNT 14
18 u.s.c. § 554
(Smuggling Goods from the United States)

118. Paragraphs 1-117 of the Complaint are incorporated by reference and re-alleged as set

forth fully herein.

40
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 40 of 41

119. From on or about November of 2016 through January of 2017, in the Northern Division

of the District of Utah and elsewhere, the defendant,

R0N-R0eRWEJ::;-L~H-ANSEN,

and others known and unknown, fraudulently and knowingly did attempt to export and send from

the United States, any merchandise, article, and object contrary to any law and regulation of the

United States, and did attempt to receive, conceal, buy, sell, and facilitate the transportation,

concealment, and sale of such merchandise, article, and object, prior to exportation, knowing the

same to be intended fQr exportation contrary to any law and regulation of the United States, and

aided and abetted the same, to wit, HANSEN did cause to be exported from the United States

Sumuri Recon software containing password recovery capability without first having obtained

the required licenses from the United States Department of Commerce, and did aid and abet

therein, all in violation of 50 U.S.C. §§ 1702 and 1705, 18 U.S.C. §§ 554 and §2, and 15 C.F.R.

§ 764.2(b).

18 u.s.c. § 554
(Smuggling Goods from the United States)

120. Paragraphs 1-119 of the Complaint are incorporated by reference and re-alleged as set

forth fully herein.

121. From on or about December 23, 2016 through on or about January 19, 2017, in the

Northern Division of the District of Utah and elsewhere, the defendant,

RON ROCKWELL HANSEN,

fraudulently and knowingly did attempt to export and send from the United States, any

merchandise, article, and object contrary to any law and regulation of the United States, and did

attempt to receive, conceal, buy, sell, and facilitate the transportation, concealment, and sale of

41
 Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 41 of 41

such merchandise, article, and object, prior to exportation, knowing the same to be intended for

exportation contrary to any law and regulation of the United States, and aided and abetted the

------------------same,-t0-wit,HANSEN-EiiEi-oauset0-be-exporteEi-fr0m-the-United-States-¥0und,Intella-so-ft-ware------- ----------­

with a falsified value, and did aid and abet therein, all in violation of 18 U.S.C. § 554 and §2, 13

U.S.C. § 305, 15 C.F.R. §30.71, 15 C.F.R. §764.2(g).

122. Based upon the foregoing infonnation, your affiant respectfully requests that an arrest

warrant be issued for Ron Rockwell Hansen for the above-referenced violations of federal law.

DATED this 2nd day of JUNE, 2018.

HAN RUDD, Special Agent

Fed al Bureau of Investigation

SUBSCRIBED and SWORN BEFORE ME this 2nd day of June, 2018.

·~h(J~
- - - - - - - - - - - - - - - - - - - pA:B:L--M-:--W:A:-RN-ER;--Chief'Magis-tra-te-fttdg,,,.____ _ _ _ __
United States District Comi

JOHN W. HUBER
United tates Atto

-~~.

42