Report Letters of Marque / Research report
End of an Era, Part V: Paper Tiger Diplomacy
Before September 11, a Michigan voice-network company1 had a sales partner in Zhuhai23 listed within China's Sanjiang aerospace group.4 Across the water in Hong Kong, a Chinese billionaire linked Canadian finance5 to Chinese Academy of Sciences technology alliances;6 a separate Canadian venture shared Sudan's oil-export project with China's state oil company.78 U.S. records also described Chinese satellite9 and military-aircraft cooperation with Iran and Pakistan,10 and missile-technology supply to Iran.11 These were distinct channels of the U.S.'s normalized relations with China. Yet each placed consequential technology, capital, and intelligence in the hands of aan elite circle spanning national borders, and who had the protections of national security information. While those centers of power blossomed, the CIA knew that terrorists had obtained U.S. visas, but held back a report intended for the FBI; the bureau did not receive later travel information until August 2001.1213 The record existed, but the hindsight for the general public to assemble the full breadth of intelligence did not.
Before the tragedy
In February–March 1998, the Solar Sunrise intrusions reached more than five hundred military, civilian-government and private systems while Washington prepared for possible military operations against Iraq.14 You read that right: Iraq, 1998. The intruders exploited a known Solaris weakness, gained privileged access, installed password collectors and left backdoors.14 The immediate attackers were identified, but the episode demonstrated how a campaign against American systems could be misconstrued as a state operation.14 Later, in August, al-Qaeda bombed the U.S. embassies in Kenya and Tanzania.15
Modern cyber disclosures show the duration such access can have. In 2024, CISA, the FBI, NSA and partners reported that PRC state-sponsored Volt Typhoon actors had maintained access to some U.S. critical-infrastructure environments for at least five years.16 The advisory described stolen credentials, living-off-the-land techniques and repeated returns to victim systems.16 That is a contemporary case removed from this story, but interconnected with the same organizations. It demonstrates the long-persistence problem the 2001 defenders could scarcely measure at national scale, and the recluctance or negligence by the American national security-state to mitigate those dangers without first exploiting foreseeable downstream crises.
Kuala Lumpur
On April 7, 1999, the U.S. consulate in Jeddah issued 9/11 hijacker Khalid al-Mihdhar a visa.12 Jeddah was a major Saudi port facing Sudan across the Red Sea, in the country where John Brennan served as CIA station chief during 1996–99. Sometime in mid-1999, Brennan became CIA Director Tenet’s chief of staff.17 When surveillance identified Mihdhar at a January 2000 meeting in Kuala Lumpur, CIA knew he had a U.S. visa.1213 An FBI detailee at CIA drafted a report for FBI channels that included the visa and travel information. A CIA supervisor marked it to be held and it was therefore never sent.13 By March, CIA also knew Nawaf al-Hazmi had entered Los Angeles. The FBI did not receive that travel information until August 2001.13
After a November 30, 1999 intelligence intercept, Jordanian authorities broke up a cell preparing attacks for the millennium.18 U.S. customs officers stopped Ahmed Ressam as he brought explosives from Canada toward Los Angeles International Airport.18 Al-Qaeda's attempted strike on the USS The Sullivans in Aden failed in January 2000, but the organization struck the USS Cole there in October.1819 The Kuala Lumpur intel-gathering included operatives connected to the Cole plot as well as men later involved in the 9/11 operation.18 These were distinct operations and disrupted plans spanning several countries, while select details of the same intelligence remained at separate offices.
Birth of Cyberwarfare
The same pre-9/11 years brought a public fight over encryption access, a federal push to defend computerized infrastructure, and a widely publicized year-2000 ("Y2K") remediation deadline. Technology companies contested proposals for government access to encryption keys.2021 Separately, the 1997 President’s Commission on Critical Infrastructure Protection led to PDD-63 in May 1998, and the FBI’s National Infrastructure Protection Center began work that year22.
FedCIRC handled federal civilian incidents, while Carnegie Mellon’s CERT Coordination Center received 419 vulnerability reports and handled 8,268 computer-security incidents in 1999.2223 Federal teams also planned heightened monitoring for the millennium rollover.22 CIA launched In-Q-It in 1999 to connect intelligence needs with private technology companies and universities.24 This was soon rebranded into its modern "In-Q-Tel" and directed by university, investor, defense, and public-sector executives.24
Graphic 01 — Federal cyber-defense institutions
The other side of the story
In Tsinghua University’s network orbit, the China Education and Research Network established CCERT in May 1999 as an incident-response center.252627 CERNET signed an interconnection agreement with the U.S. Internet2 consortium in 2000.25 As U.S. technology shares fell after their March 2000 peak,28 Semiconductor Manufacturing International Corporation began building its first Shanghai wafer fab in August 2000; pilot production began in September 2001 and commercial production in January 2002.29
The spate of pre-9/11 cyberattacks' mechanics were being written about inside Chinese universities while similar attacks hit American networks. A 1997 University of Electronic Science and Technology of China paper treated malicious programs as tools of information warfare, including propagation, latency and back-door access.30 Tsinghua researchers submitted a distributed intrusion-detection design in September 1999 that modeled network scanning and worm spread.31 In April and May 2001, Southeast University's NJCERT received reports of hosts scanning ports 111 and 80. NJCERT's May 19 analysis described propagation through Solaris sadmind and Microsoft IIS weaknesses, code upload and reboot persistence.32
Canada
Canada developed a less publicized, quieter role in the pre-attack picture. Hong Kong-based Sun Wah’s archived financial history places its majority stake in Canada’s Kingsway International Group in 1998, the year Sun Wah says it began high-technology alliances with Chinese Academy of Sciences (CAS) institutes.56 A later interview dates Sun Wah president Jonathan Choi’s appointment as an economic adviser to the CAS president to 1998, and MSU identified him in that role in 2004.3334 He also appears in the CPPCC’s 1998 National Committee membership roster, years before a 2020 Hong Kong exchange filing described him as a Standing Committee member.3536
Along another Canadian lead, founder Sheema Khan’s 2003 affidavit recounted CAIR-branded chapters in Montreal in 1996 and Ottawa in 1998, followed by CAIR-CAN’s incorporation in June 2000.3738 NCCM, the successor organization, says it has always been independent of CAIR in the United States but the affidavit identified a U.S. trademark license, later raised in Canadian Senate testimony.373839 Across the border in the U.S., the Wen Ho Lee case linked these advocacy circles in print: Committee of 100 cofounder Henry Tang later recalled that Lee came to the group through defense lawyer Brian Sun; a March 2000 Minaret article to which Lee’s daughter Alberta contributed invoked a CAIR alert and directed readers to CAIR for legal referrals.4041 Lee was indicted in December 1999 for mishandling classified nuclear-weapons information, not for selling secrets to China.42
Another Canadian–Chinese route ran through Sudan. Talisman Energy acquired a 25 percent interest in the Greater Nile Oil Project in 1998 alongside China National Petroleum Corporation’s 40 percent stake.78 The consortium began shipping oil through its pipeline to Port Sudan on the Red Sea in August 1999.8 There were multiple avenues through the Canadian private sector for exchanges off the books.
Good intentions with unintended consequences
Michigan-based CC&T Technologies was incorporated in February 1998.1 Lionel Ni and En-Wei Chai built a business around Internet telephony, network-phone servers and the equipment and software needed to move voice traffic through data networks.12 A contemporary trade reporter described CC&T as a partner of 3JET Network Engineering & Service in Zhuhai, China.2 An archived 3JET page identified CC&T as its U.S. agent; Sanjiang Aerospace Group’s archived site listed Zhuhai Siruijie—3JET—among its companies.34 This is a well-documented commercial and institutional route running from Okemos, Michigan through Zhuhai into a Chinese aerospace group, documented back to 1998.
Sanjiang
A September 1999 U.S. Army War College study identified Sanjiang’s Base 066 as a developer of solid-fueled tactical ballistic missiles, including the M-11.43 A later corporate filing dates the establishment of its Wuhan import-export company to November 1998.44 Ni has since recalled securing $2 million in initial 3JET funding and concentrating on product delivery to those investors.45 The wider U.S.–China technology record was already consequential: Congress’s 1999 Cox report found that Hughes and Loral supplied launch-failure analysis affecting China’s Long March guidance system,46 while a 2002 GAO review documented China’s acquisition of foreign semiconductor production technology for both consumer electronics and more capable weapons systems.47
Wormhole design
CC&T’s EMIP-1 was part of that market. An independent August 1999 test examined the Linux-based Internet/WAN emulator supplied on an industrial PC.48 It could impose bandwidth limits, packet loss and delay, generate background traffic and report packet statistics while developers evaluated networked products.48 Its usefulness was plain: a vendor could make a local test network behave like an unreliable long-distance one before deploying a voice service. CC&T’s own archived product page later said a Chinese government laboratory was using EMIP-1 to evaluate VoIP equipment.49 The laboratory was unnamed in the page; the contemporaneous claim nevertheless put the product’s evaluation inside a Chinese government setting by April 2001.49
The American public-research route was visible too. NIST had made its own Linux network-emulation tool, NIST Net, publicly available by 1998.5051 An NSF award beginning in 2000 funded Michigan State University equipment for the EMPOWER network-emulation testbed; Pei Zheng and Ni published an EMPOWER framework in 2002.5253 MSU listed a $30,000 CC&T gift to Engineering for fiscal 2000–01.54 Ni's student Vibhavasu (Vasu) Vuppala coauthored a 1999 paper with him on virtual network ports.5556 He later co-chaired a distributed-data-services collaboration at MSU's Facility for Rare Isotope Beams (FRIB), whose partners included Brookhaven and Beijing's Institute for High Energy Physics.57
The bridge is built
The Chinese-side product record did not stop at a company name. Sanjiang’s archived late-2001 catalog listed an NPS Network Integrated System among its Internet-telephony products;58 its English corporate overview claimed research, manufacturing and intellectual property in Internet-telephone service devices.59 3JET’s archived product page identified specific NPS gateway models and an accompanying control-and-management system: call routing, charging and account authentication, browser-operated management, and SeeNPS monitoring of real-time system workload and voice quality60. CC&T’s own operations page described distributed ChargeNPS settlement across multiple network operators and remote technical support through SeeNPS.61 These were commercial servers, gateways and software with documented operational functions during the shift from conventional telephones to data networks.
Graphic 02 — NPS product functions
The regional technology routes were active in the same years. China’s space agency records an April 1998 small-satellite cooperation memorandum with Iran and Pakistan;9 an August 2000 U.S. Army War College study documents CATIC’s military-aircraft exports to both countries and its 1998 fighter co-development agreement with Pakistan.10 A CIA assessment covering January–June 2000, entered in the Congressional Record on September 6, 2001, described continuing Chinese work on two Iranian nuclear projects and Chinese entities among Iran’s largest missile-technology suppliers.11 Chinese firms also laid fiber-optic links for Iraqi air defenses before the 2003 invasion;62 the Iraq Survey Group later recovered records of an October 2001 Syrian approach to Chinese air-defense firms on Iraq’s behalf.63
Standard American foreign policy
The Committee of 100 occupied the foreign and domestic policy side of that landscape. Its own history records a 1998 China-policy paper delivered to National Security Adviser Sandy Berger, 1999 activity around Wen Ho Lee, a 2000 Beijing high-tech financing conference and a 2001 Greater China delegation.64 Years later, it and the Council on American-Islamic Relations signed the same March 2018 letter seeking a meeting with FBI Director Christopher Wray over his comments about Chinese-origin students and researchers.65 The coalition was public. This is how civil rights and diaspora politics met in the same institutional arena.
Henry Tang, C100 chair from 1996 to 2002, already knew 7 World Trade Center from inside: a 1992 Labor Department directory listed him as a Salomon Brothers vice president on its 40th floor.6667 A Port Authority alteration record reproduced by NIST still identified that floor as Salomon Smith Barney space in 1999.68 Retired Maj. Gen. John Fugh, the Army's former Judge Advocate General, joined C100 in 1993 and later guided China operations for McDonnell Douglas, Boeing and Enron.6970 He led its 2001 Greater China delegation; in 2002, he and Tang became C100 co-chairs.7064
The bridge became functional
Interstellar (Hangzhou), doing business as eBanswers, described itself as initiated and established by CC&T and listed e-commerce, call centers, customer-management and VoIP-gateway work.71 Its October 8, 2001 notice said LJ Connection had become its Midwest U.S. agent for the e-shop and e-CRM product lines the previous day.72 LJ’s January 2002 product pages described PBX, VoIP, unified messaging, gateway, WebCall and related services.73 Pages at the same LJ domain later carried Konnech branding with materially similar product descriptions.74 Michigan records date LJ Connection’s incorporation to July 2001 and Konnech’s to March 2002; a later Michigan economic-development release described Konnech’s business origins as 1999.75
Graphic 03 — The commercial trail
Around the wire
Sun Wah established its high-technology group in 1998 and described alliances with Chinese Academy of Sciences institutes and universities.6 Hong Kong Polytechnic University reported an October 2000 Linux training and development center with Sun Wah Hi-Tech, alongside a Microsoft China academic arrangement.76 Nanjing University later recorded Sun Wah support for a software research-and-development center beginning in 2002.77 In 2004, MSU’s board recorded a $5 million Sun Wah Education Foundation grant for a U.S.–China education center; the center’s governing arrangement divided appointments between MSU and Sun Wah, with Jonathan Choi as first chair.78 These were named agreements, facilities, funds and board seats.
Sun Wah's Red Flag project was more than a training partnership. An October 2000 release said Sun Wah Hi-Tech had become a shareholder and Red Flag's first authorized master dealer in Asia.79 It described Red Flag as a Chinese Academy of Sciences Institute of Software venture and presented a server/e-business kit containing browser-based remote Linux monitoring.79 The same release named enterprises, banks, government departments and the military among markets for the server.79 The partnership joined a state-rooted operating-system developer to a Hong Kong distributor with university training and overseas sales ambitions.
Talent and financial funnels
AZKEF, the American Zhu Kezhen Education Foundation, offered a direct link from Zhejiang University in Hangzhou, Zhejiang Province to American academia, industry, and infrastructure. AZKEF's early-2000s roster named LJ Connection and Konnech founder Eugene Yu, and Lionel Ni's PhD. student, Xipeng Xiao.80 A January 2002 Microsoft letter recorded employee gifts eligible for company matching.81 Zhejiang University later counted $332,762 raised in 1996–2004, 18 U.S.-based lecturers and seven faculty funded for U.S. study.82 Carnegie Mellon’s Chuck Thorpe lectured in 1999, Harvard’s Charles Lieber in 2002, and Arizona professor Fei-Yue Wang also held CAS Institute of Automation posts before later leading AZKEF.838485 Parallel U.S. vehicles included the Tsinghua Education Foundation in North America, registered in 1997;86 Friends of Tsinghua SEM, tax-recognized in 2001;87 and Fudan’s U.S. foundation, registered in 2006.88
American institutions sustained these routes. Microsoft Research Asia began its Chinese-university joint-laboratory program in 1999,89 and a later ministry partnership brought Lionel Ni into an HKUST lab.90 Boeing subsequently commissioned HKUST aircraft and airport-maintenance wireless research,91 while Ni's CC&T "seed" Konnech appeared in a 2010 Defense Department software procurement.92 Alongside Sun Wah’s CAS and MSU agreements,678 these distinct programs show the continuing institutional demand for Chinese-linked research, talent and production even as U.S. authorities documented theft and transfer risks in the same markets.9394 The commercial benefits and the security warnings grew together.
The cyber waves
The aviation attacks of 9/11 arrived amid a rising tide of publicized network incidents. CERT’s 2001 record separately dated the vulnerabilities, advisories and active worms: the sadmind/IIS campaign, Code Red in July, Code Red II in August and Nimda in September.9596 Code Red II installed persistent access on affected IIS systems.96 CERT reported that Nimda scanned for backdoors left by Code Red II and sadmind/IIS while spreading by email, shared files, compromised websites and vulnerable servers.9597 F-Secure reported that ordinary infected user computers could reach intranet websites behind firewalls that Code Red could not reach directly.97 The technical record itself therefore explains that one wave of exposure led into the next without making all the worms the same code.
The sequence is remarkably important. CERT’s Nimda advisory was released September 18 and revised September 25; F-Secure says the first variant was found September 18.9597 Those are announcement and detection dates, but not proof of the first launch.9597 CERT described a host-local registry value under which Nimda would repeat address harvesting and email sending every ten days.95 At about 15:00 GMT on October 11, F-Secure observed hundreds of Nimda.A emails that appeared to come from its research manager’s old company domain.97 F-Secure traced them apparently to an infected machine somewhere in Canada.97
Graphic 04 — 2001: The cyber waves
October 11 was thirty days after September 11. A machine first infected on September 11 could, on that ten-day schedule, have sent again around September 21 and October 1 before the observed October 11 burst.9597 The October 11 emails are an observation; the September 11 start and intervening mailings are an inference from the documented timer and the calendar.
The same distinction applies to Klez. F-Secure dated the first located Klez/ElKern infections and its detection update to October 26.98 It first observed Klez.D in the wild on November 11; that variant sought to terminate processes with names including Nimda and Code Red.98
The result in 2001 was not merely a collection of memorable malware names. Compromised servers could remain available to later intruders, especially if left unpatched.9596 The pattern lasted: a 2023 multiagency advisory found that in 2022 attackers exploited older vulnerabilities more frequently than newly disclosed ones, targeting unpatched internet-facing systems.99 Ordinary workstations became scanners.9597 A preserved corporate-record aggregation dates LJ Connection’s incorporation to July 2, 2001100101—days before Code Red was first reported.102 Infected web pages carried malicious content into browsing sessions.9597 Defenders had to find an attack’s origin while incidents crossed organizations, private networks and countries. The public documentation shows a system in which first discovery could come well after the first compromise—and where repairing one visible worm did not reveal every earlier visitor to the same machine.
October Surprises
On October 4, 2001, George Tenet signed the CIA threat assessment used to support President George W. Bush’s first authorization for electronic surveillance inside the United States.103104 The analysts who prepared the continuing assessments initially did not know the surveillance program their work supported.103 Tenet’s chief of staff added a recommendation for domestic electronic surveillance, using language he recalled receiving from White House counsel Alberto Gonzales or Vice President Cheney’s counsel David Addington.103 The authorization was renewed again and again.103
On October 7, LJ Connection entered the eBanswers ecosystem.72 On October 11, F-Secure observed the Nimda email burst from Canada.97 On October 26, it found the first Klez/ElKern infections.98 Government was acquiring new powers, commercial networks kept expanding and compromised systems kept producing evidence of earlier access.
On November 23, 2001, U.S. authorities arrested Fei Ye and Ming Zhong at San Francisco International Airport as they tried to leave for China with Sun Microsystems and Transmeta trade secrets.93 They later pleaded guilty to economic espionage and admitted an intended microprocessor venture financed in part through Hangzhou and Zhejiang interests.93 In another case, former Boeing engineer and naturalized U.S. citizen Dongfan Chung was sentenced in 2010 after convictions for economic espionage benefiting the PRC.105 Inside the American aerospace market, Boeing agreed in 2006 to pay $615 million to resolve criminal and civil allegations that included its possession of Lockheed Martin launch-vehicle competition material.106 Defense secrets and competitive information moved through employees and companies, not merely through foreign intrusions. The later record became more explicit about cyber access and semiconductor production. Su Bin pleaded guilty in 2016 to conspiring to hack U.S. defense contractors and send export-controlled military data to China, including C-17 and fighter-aircraft material.94 Taiwan’s UMC pleaded guilty in 2020 to possessing stolen Micron trade secrets in a DRAM project linked to PRC state-owned Fujian Jinhua; the admitted facts included recruitment from Micron’s Taiwan operation and off-network laptops.107 In 2017, ZTE pleaded guilty to shipping U.S.-origin technology to Iran in violation of sanctions, obstruction and false statements.108 Its own managers described using intermediary or “isolation” companies to conceal supply routes.108 These proceedings are separate, adjudicated examples of how personnel, intellectual property, supply chains and jurisdiction can be exploited across the same markets that governments also cultivate.
Graphic 05 — Business routes for technology
Spy games
The surveillance build-out had its own history. Congress's 1994 Communications Assistance for Law Enforcement Act required carriers to make authorized interception technically possible, but industry litigation, standards disputes and deadline extensions delayed implementation. The FBI offered a packet-mode deployment initiative in August 2001.109 The new counterterrorism bill also underwent negotiation: the Senate passed an early version on October 11 and the House acted the next day.110 A letter containing anthrax was opened in Senate Majority Leader Tom Daschle's office on October 15;111 the FBI and Justice Department later attributed its spores to a stock held by Bruce Ivins at USAMRIID, Fort Detrick.112
Congress completed the USA PATRIOT Act on October 25 and President Bush signed it the following day.113 Its sections 215 and 216 widened access to business records and non-content electronic routing and addressing information;113 section 217 authorized interception of a computer trespasser's communications under specified conditions with the system owner's consent.113 Lawful demands on commercial data and monitoring of intruder traffic now had broader statutory channels alongside the still-unfinished interception infrastructure. In that environment, products that kept communications observable and analyzable had growing institutional value.
Graphic 06 — Surveillance authority and cyber incidents
The cost was also measured in military decisions. In February 2002, Tenet described Iraq’s contacts with al-Qaeda as tenuous and mutually wary.114 CIA’s June papers treated operational cooperation as a possibility resting on reports of varying reliability.114 By September, a Counterterrorist Center paper had been circulated to a narrow senior audience, while Pentagon policy officials carried an alternative Iraq–al-Qaeda presentation to White House and vice-presidential staff.114115116 The October WMD estimate contained dissent and uncertainty; the public paper did not convey all of it.115 Later Senate and inspector-general reviews found that important judgments were overstated, caveats lost or differences between products inadequately identified.115116117 American forces acted within a picture other people assembled.
One year after the original Tenet assessment, on October 4, 2002, Tenet released a public paper on Iraq’s weapons programs.115 The classified National Intelligence Estimate issued three days earlier contained the State Department’s dissent on whether Iraq had reconstituted a nuclear program and the Energy Department’s technical judgment about the aluminum tubes at the center of that argument.115 A Senate investigation later found that the public version omitted important caveats and alternative agency views.115117 Another CIA assessment, Iraqi Support for Terrorism, had gone to twelve senior administration officials on September 19.115 Congress did not receive its copy until October 2003.115 The audiences were different, but so were the products placed before them.
Graphic 07 — Terror networks and cyber incidents
The attacks beyond the United States continued. Singapore's Internal Security Department began arrests of a Jemaah Islamiyah cell in December 2001 after its members had surveyed diplomatic, military and infrastructure targets.118 On October 12, 2002, Jemaah Islamiyah bombed Bali.119 On November 28, bombers struck a hotel in Mombasa while a missile attack missed a departing Israeli Boeing 757.120
Putting 25 years into perspective
Between 1998 and 2002, American funding and customers helped sustain cross-border laboratories, server businesses and semiconductor production1678 while U.S. investigations warned of technology flowing into China’s military-commercial system.4647 The hijackers used international finance, travel, flight training and public computers121122 during the same years that intelligence about particular men failed to reach the agencies that could act on it.1213 Worms and backdoors made network access harder to date or even attribute.9596 After the attacks, surveillance authority expanded103104 and the Iraq case showed how differently scoped intelligence products—or the withholding of them—could steer global decisionmaking.115117
An FBI report places Mohamed Atta at a Las Vegas cybercafé on June 28–30, 2001, Khalid al-Mihdhar and Nawaf al-Hazmi at New Jersey public computers on August 9, and Atta at Fort Lee’s Web Station on August 12.121 The Moussaoui indictment records Ziad Jarrah’s August 22 purchase of GPS equipment and Boeing 757 cockpit diagrams.122 In 2004, 9/11 Commission staff described the training value of commercial cockpit software and the navigational possibilities of a 757/767 flight-management computer.123 The NTSB’s recovered-data study more specifically found Mode Control Panel inputs steering Flights 77 and 93 during their hijacked segments and autopilots disengaged before the final impacts.124 The reports establish distinct preparations, capabilities and observed flight modes. They also define the next disclosure question: what surviving onboard, airline and ground-system records were examined together with the cyber-incident record, and what would their joint analysis show?
Graphic 08a — Research and access
Graphic 08b — Business and supply
A 1992 federal directory placed Henry Tang at Salomon Brothers on the 40th floor of 7 World Trade Center; he later chaired the Committee of 100.6667 The Committee’s co-founder I.M. Pei had, through his firm, joined Silverstein Properties in the separate Federal Triangle development bid,64125 while retired Army general John Fugh helped lead the Committee’s 2001 China delegation.64 For the next 25 years, the Committee of 100 maintained direct lines to government, industry, commerce, technology, and academia, in large part as a result of their bonds forged in the events surrounding 9/11. Years after the tragedy, Jonathan Choi appeared on Hong Kong's Maritime Silk Road Society's roster as an honorary president.126127 The Society also published a Chinese-language CV for engineer Patrick Ng (吳惠明), a former chair of the Hong Kong Institution of Engineers’ Public Relations Committee.128129 It says his media work on technical crises included the collapse of the World Trade Center on September 11.128129
Graphic 09a — Overlapping subject timelines, 1998–2002
Graphic 09b — Timeline source documents
The same interests surrounding the cyberattacks and the calamity of 9/11 are now the very same interests surrounding the AI discussion, the surveillance conversation, geopolitical discourse, race relations, and preserving the billionaire class from the consequences of their own incompentence and irresponsibility.
If industrial and defense knowledge could move through lawful partnerships and illicit markets at once, the history of 9/11 cannot end with the airport checkpoint. It must reckon with who could assemble the intelligence, technology-transfer and cyber records before the attacks, why they remained apart, and which original evidence is still withheld from investigators. Robert Mueller had answers until he didn't. The man with the answers now is John O. Brennan.
Footnotes
7. Talisman SEC filing, 1998 acquisition of its Greater Nile interest.
8. 2000 U.S. House hearing, Sudan oil consortium shares and August 1999 pipeline shipments.
9. China National Space Administration, China’s Space Activities (2000), regional cooperation.
10. U.S. Army War College, Chinese Arms Exports (August 2000), pp. 48–49.
12. 9/11 Commission, terrorist-travel staff monograph, chapter 2.
13. DOJ Inspector General, FBI handling of pre-9/11 intelligence, chapter 5.
14. U.S. Senate Judiciary Committee, 1999 cyber-threat hearing, Solar Sunrise account, pp. 24–25.
15. 9/11 Commission, Chapter 4, the August 1998 U.S. embassy bombings.
16. CISA, NSA, FBI and partners, advisory AA24-038A, February 2024.
18. 9/11 Commission, Chapter 6, millennium plots and the Kuala Lumpur meeting.
20. 1999 Congressional Record on proposed limits to compulsory key escrow.
22. GAO account of PDD-63, NIPC, FedCIRC and Y2K incident preparations.
25. CERNET history, 1999 CCERT and 2000 Internet2 agreement.
28. Federal Reserve, June 2001 account of the U.S. technology-stock correction.
29. SMIC SEC Form 20-F, company and Shanghai fabrication timeline.
30. UESTC paper on computer viruses and information warfare, June 1997.
31. Tsinghua DIDAPPER intrusion-detection paper, submitted September 1999.
33. Shanghai Securities News interview dating Choi’s CAS adviser appointment to 1998.
35. People’s Daily, January 24, 1998, CPPCC National Committee membership roster.
36. Hong Kong Exchange 2020 filing, later Standing Committee title, p. 69.
39. Canadian Senate testimony quoting the affidavit’s trademark-license terms.
41. Maha El-Genaidi, “FBI and Muslims,” The Minaret, March 2000, pp. 19–21.
43. U.S. Army War College, China’s Strategic Modernization (September 1999), Appendix I, Base 066.
44. Sanjiang subsidiary table in 2018 corporate prospectus, p. 3-3-1-35.
47. GAO, Rapid Advances in China’s Semiconductor Industry (April 19, 2002).
51. RFC 2398, §2.4.
56. MSU graduation record naming Ni as Vuppala's major professor.
57. Argonne/EPICS, FRIB Introduction and FRIB Controls, May 2013, slide 23.
60. 3JET NPS gateway and software product page, archived December 2000.
61. CC&T worldwide operations and NPS support page, archived April 2001.
63. Iraq Survey Group, Comprehensive Report, recovered procurement records.
66. U.S. Department of Labor, Glass Ceiling Commission Members, revised November 24, 1992, p. 2.
68. NIST, Port Authority record W99-7172, Table 4-7, p. 118.
70. Committee of 100, Committee Bridges, Summer 2002, pp. 3–4.
72. eBanswers announcement posted October 8, 2001, describing LJ Connection’s October 7 appointment.
75. Michigan Economic Development Corporation, Konnech history.
79. Sun Wah Hi-Tech and Red Flag Software press release, October 18, 2000.
83. AZKEF lecturers.
84. AZKEF fellows.
86. TEFNA history.
88. Fudan University account of its 2008 New York foundation event and 2006 registration.
100. LJ Connection Michigan corporate-record aggregation, preserved image.
102. CERT/CC, 2001 incident-note collection, Code Red entry.
103. Joint Inspectors General, President’s Surveillance Program review, volume II, pp. 7–10.
104. volume I, p. 10.
106. DOJ, Boeing settlement.
107. DOJ, UMC guilty plea.
110. Congressional Record, October 11–12, 2001 counterterrorism-bill proceedings.
114. Senate Intelligence Committee, Iraq–al-Qaeda public-statement review, pp. 62–63.
115. Senate prewar-assessments report, pp. 286–313, 361–63.
116. WMD Commission, note 834.
118. Singapore Ministry of Home Affairs, Jemaah Islamiyah cell investigation.
123. 9/11 Commission, January 27, 2004 hearing, staff statement on the four flights.
124. NTSB, study of Flight 77 and Flight 93 autopilot and navigation activity, February 13, 2002.
125. Washington Post, November 16, 1997, Delta Partnership’s separate Federal Triangle bid.
Additional source material
Background and parallel records for readers following the wider source trail; the footnotes above identify the records used for particular statements.
Earlier reporting in this series: End of an Era, Part I, Part II, Part III, Part IV, and The Phantom Hack.
Broader 9/11 investigations: the complete 9/11 Commission Report, its Terrorist Financing Staff Monograph, and Congress's Joint Inquiry into Intelligence Community Activities Before and After the Attacks.
Federal cyber-defense background: the White House National Plan for Information Systems Protection, GAO's critical-infrastructure protection review, and GAO's FedCIRC review.
Incident-response record: Carnegie Mellon CERT/CC's 1999 annual report summary and 2001 incident-note collection.
World Trade Center technical investigations: NIST's final report on the towers and its separate final report on Building 7.
Wider technology-transfer context: the House Select Committee's 1999 U.S.–China national-security report and GAO's 2002 review of China's semiconductor industry.
Other records retained from the former bundled notes
Sun Wah archived technology account.
Gus Quixote, “Theory No More, Part One: Frien-emies,” May 25, 2023.