In November 2021, Capt. Li Tian, an officer stationed at Joint Base Lewis-McChord in Lakewood, Washington, allegedly began emailing back and forth with a foreign national living in China. He introduced himself as a friend of Ruoyu Duan, a former Army soldier who lived in Hillsboro, Oregon. Tian said he was looking for a job opportunity.

At first, Tian sent the other person documents related to real estate investments on the East Coast of the United States, referred to in court records as a “white paper.” With Duan acting as a middle man getting money from a PayPal account based in China, Tian was reportedly paid $1,500 for the documents.

As the correspondence continued, the person in China, whose email account was based in Hong Kong, asked Tian for less “open source” material — documents that would be harder to get.

According to court documents filed last week in U.S. District Court in Western Washington and Oregon, that was the beginnings of a years-long conspiracy where Tian and another soldier based at JBLM, Sgt. Jian Zhao, gathered and sold sensitive U.S. military information to Duan and individuals in China.

Among the documents allegedly handed over were excerpts of technical manuals for operating an artillery system used on battlefields in Ukraine and copies of PowerPoint presentations specifying the positions of military personnel in a Stryker combat vehicle. Video footage from inside Zhao’s office at JBLM in November 2024 also allegedly showed him taking photos of a document pertaining to a military exercise simulating a conflict with the People’s Republic of China.

“Do you know how risky this is?!?” Zhao told an individual in China while allegedly trying to sell another sensitive military document in October.

“If I were in your position, I would not dare,” the person replied.

Zhao also is accused of selling hard drives, some classified and some labeled “SECRET,” for thousands of dollars and sending them directly to a person in China from his DuPont home.

Zhao’s indictment alleges that he accepted about $15,000 in exchange for gathering information for a co-conspirator purporting to reside in Changchun in Northeast China.

According to copies of Duan and Tian’s indictments, Duan accepted about $38,500 from two PayPal accounts based in China between June 2021 and April 2023. He allegedly received about $14,600 from two accounts on Zelle, a mobile payment app, between June 2023 and July 2024.

Those identified in the conspiracy talked on Facebook messenger, through the messaging app WeChat and via email. According to the indictments, all of their communications occurred in Mandarin.

Duan and Tian are charged in U.S. District Court in Oregon with conspiring to bribe a public official and steal government property. Zhao is charged in U.S. District Court in Western Washington with conspiring to gather, transmit or lose national defense information, as well as bribery of a public official and theft of government property.

Special Agent Mike Herrington with the FBI Seattle Field Office said in a press briefing Thursday that investigators had gathered additional information, and it is possible charges could be added.

Capt. Li Tian’s alleged involvement

Here’s how court documents filed so far describe Tian’s alleged involvement:

After Tian was asked for “less open source” material by the person he was emailing with in China in December 2021, court documents don’t describe any further communication between the two. But the next year he began sending military information to Duan, who had paid him for the “white paper” that was given to the person in China.

In October and November 2022, Tian emailed Duan links to Google Drives three times containing Open Source Intelligence reports, which were not classified.

On Feb. 20, 2023, Tian started sending Duan more sensitive information. Via email, Duan received more links that day to Google Drives which contained at least three PowerPoint presentations about the Stryker Brigade Combat Team and the Stryker vehicle. One discussed the formations, movements and employment of the team. Another, titled “CAPABILITIES.pptx,” specified the mission and capabilities of the unit. The third specified the positions of military personnel in the Stryker combat vehicle.

Also sent to Duan that day was a PowerPoint about a Department of Defense social media forum, Army mission requirements and strategy. It’s unclear what a fifth PDF document sent to Duan pertained to. It was titled “stp_91s13.pdf,” and records state its markings showed it was only authorized to be distributed to U.S. government agencies and their contractors because it contained sensitive materials.

The same day, Tian and Duan talked on Facebook Messenger.

“Please provide the tm (technical manuals) of the vehicles sent there. It is for writing an article,” Duan said.

“I don’t have access. Will need to wait until Monday,” Tian said.

Tian asked Duan to send him a list of the models he was looking for. Tian said it couldn’t be downloaded, and it had to be looked up on AESIP, the Army Enterprise Systems Integration Program Hub, which Tian said only “chief” had access to.

Tian later said his “supply” had access, who he referred to as “a guy from Beijing.” Duan said he would take them out to eat next time. Tian “liked” the message.

Later on in their conversation, Duan appeared to ask Tian if he happened to have technical manuals for German military vehicles, such as a Leopard 1, a tank, or a “Weasel,” likely referring to the Wiesel Armored Weapons Carrier. Tian said he definitely didn’t have those. Duan instead asked for American vehicles.

“I first want an M 1126 Stryker infantry vehicle, an MI 09 howitzer, and M2 Bradley fighting vehicle,” Duan wrote. “I saw Armytimes also mentioned the Patriot, but I don’t understand that stuff at all and cannot write anything.”

Three days later, after Duan offered “500” for the three “teaching materials,” Tian emailed him links to Google Drives with three PDFs. They were related to the Bradley Fire Support vehicle, which is designed for precision target location and assisting in in-direct fire. Two of the documents were technical manuals which could only be distributed to U.S. government agencies or their contractors. The third was approved for public release.

On Feb. 24, 2023, Duan and Tian had another exchange on Facebook Messenger.

“I see that nothing happened after you said you’d ask the chief,” Duan wrote. “Don’t worry if it can’t be done. I can find materials on wiki or reddit.”

“The main thing is not to get in trouble,” Duan added. “It is not easy to get to this point in the army.”

“Downloaded,” Tian replied. “Don’t be anxious. I’m out and will send it to you when I get back.”

The next month, March 29, 2023 Duan messaged Tian that he kept forgetting to give him “the material fees.” He offered “500.” The same day, Duan accepted $2,500 from a PayPal account based in China, and he then sent $500 to Tian on PayPal.

Sgt. Jian Zhao’s alleged involvement

Here’s how court documents filed so far describe Zhao’s alleged involvement:

Zhao appears to have been looped into the conspiracy by at least April 27, 2023. According to the Army’s public affairs office at the Pentagon, that was six years after he joined the Army as a unit supply specialist, and three years after he became stationed at JBLM.

Over about a week, Zhao allegedly used his personal email to send Duan 13 documents that were excerpts of a technical manual for the HIMARS artillery system used in Ukraine. It’s unclear how he knew Duan.

Months later, in October 2023, Duan connected Zhao to foreign national living in China, identified in a court filing only as “Conspirator 3.” The foreigner introduced himself as a friend of Duan over WeChat.

“Boss Duan says you have things to sell. Mind telling what you have,” one message to Zhao said.

In November 2023, another person introduced himself to Zhao over WeChat as a friend of Duan. Identified as S.K.K. in court records, the person told Zhao he’d bought equipment from him through Duan. He said he specialized in this type of business in China, made several million dollars a year and wanted to collaborate.

Then in July 2024, Zhao and the foreign national Duan had connected him with began discussing the sale of an encryption-capable computer. The two talked pricing until Oct. 13 when Zhao received $1,000 for it via WeChat. The foreign national received it by Dec. 4.

Also in July, Zhao discussed selling classified hard drives with S.K.K. and sent him a photo of 20 of them. Zhao then spoke with the foreign national about the hard drives over WeChat. Zhao said he didn’t know the contents of the hard drives and couldn’t guarantee anything. They agreed to a price of $10,000, with half as a down payment and half paid on delivery.

The foreign national confirmed he received them Sept. 12. He later informed Zhao the buyer had only gotten 19 hard drives, three of which were corrupted. The buyer wanted to pay $500 less than what they’d agreed on. Zhao went along with it, but he reportedly said he’d never sell to this buyer again.

The next month, Zhao and the foreign national started to talk about the sale of sensitive U.S. military documents. Over WeChat, Zhao said he had “good stuff” Oct. 11 and asked the other to get a quote from a buyer before he would name his price.

“Spread the news. It’s Brigade level,” Zhao allegedly said of the document.

“Ok. Done. Recall,” the individual in China replied. “This needs some time. This is way top [we] must be very very careful.”

“Very sensitive document. Super difficult to get,” Zhao said.

As the two settled on a price over a couple weeks, tensions appeared to rise.

After the foreign national told Zhao on Oct. 22 that a buyer said one of the documents was worth $2,000 and he suggested Zhao sell two documents as a package, Zhao said he wouldn’t consider it.

“[Expletive] this world,” Zhao said. “I’m not selling, brother.”

After a voice call, the foreign national said he would ask more and find “high level people.” The next day, the foreign national still pushed selling the documents as a package. Zhao reportedly said the second document wasn’t for sale.

“I can’t afford to make this person angry,” the foreign national replied. “Don’t play me boss. At the beginning you did say two documents. You said go find high level people yesterday.”

The two continued to discuss Zhao sending both documents, and on Oct. 27, video footage from Zhao’s office at JBLM showed him leave the room emptyhanded, then return with two documents he laid on his desk.

One was called “Strategic and Operation Rockets and Missiles.” It was considered controlled unclassified information, which could only be distributed to the Department of Defense and its contractors. The second document was similarly labeled, and it described a command post exercise designed to enhance U.S. combat readiness with multinational partners.

At 12:27 p.m. that day, Zhao allegedly told the foreign national via WeChat he was “doing it now.” Video footage then showed him using his cell phone to scan the first document page by page.

Later that day, Zhao confirmed he transferred all the documents. The foreign national told Zhao he would be paid in three days. Zhao later received $4,500 in three payments.

Over the next month, video footage from Zhao’s office at JBLM showed him taking pictures of a sensitive document and videos of his government computer screen three times. The document he photographed was about a military exercise simulating a conflict with the People’s Republic of China. It’s unclear what he was videotaping on his computer screen. One video he took Nov. 7 was reportedly of an excel file he scrolled through.

In December, Zhao told the foreign national he had a “90-page manual” he was willing to sell for $1,500. The next day, Dec. 5, Zhao was told a buyer would aim to pay him in seven to 10 days. And on Dec. 19, Zhao was paid $2,000.

©2025 The News Tribune (Tacoma, Wash.). Visit at TheNewsTribune.com. Distributed by Tribune Content Agency, LLC.