Security1 distinct publisher3 min readPublished
A Waterloo undergraduate was told to burn SIM cards and keep his Huawei phone out of the country. What got him noticed was standing on a forklift in a FedEx employee lot.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
The instructions Zeng described are communications hygiene bolted onto a collection problem that was never electronic. Destroy the SIM cards, delete the chats, delete the images, keep the Huawei handset on the Canadian side of the border [9][10]. All of that protects the link between handler and collector. None of it protects the collector standing on a forklift in the FedEx employee parking lot at O'Hare with a camera pointed at aircraft [3]. That is the part someone saw, and the thread investigators pulled was a dark blue Chrysler Town & Country leaving the area [4].
The money is worth doing arithmetic on. The affidavit puts the rate at $20 to $30 per picture and the total at $500 across two accepted tasks in about 18 months [8][14][13]. That is somewhere between 17 and 25 paid images [18], and a run rate near $28 a month [19]. Then the payoff: according to Zeng, his contact said the photographs were fine but not what was expected [16]. A tasking that failed on delivery cost the sponsor less than a week of one analyst's time. Records of this kind were first surfaced by Seamus Hughes of Court Watch [17].
The recruitment channel is the detail security teams should sit with. Zeng said the approach came through an aviation spotter website roughly 18 months earlier; when the FBI looked, the site appeared not to exist [11]. The cover story arrived pre-installed with the hobby, and he used it at the border, telling agents he photographs aircraft for a flight radar site [6]. Enthusiast communities produce exactly the artefacts the tasking wanted, which means the pretext survives a first-pass interview and only breaks under repetition. Zeng also told the FBI he believed the contact was tied to the Chinese Communist Party, that the person sent a photo of an official-looking badge, and that the language was organised and managed rather than the way friends talk [12].
What makes this a site-surveillance file rather than an espionage curiosity is the specificity of the requirement. Assigned planes with assigned tail numbers [8]. A United jet in a temporary paint scheme whose photographs were, in Zeng's telling, highly desired [15]. Named cities for future work: Orlando, Las Vegas, Los Angeles, and the interior of the FedEx facility at O'Hare [13]. Someone maintains a list, and an airport tenant reading this should be less interested in who wandered the ramp than in which of its facilities and airframes sit on it. The controls that would have caught this earlier are badge discipline in employee lots, camera review, and a staffed number to call when a stranger climbs the equipment. None of them report to a security operations centre.
The affidavit is an allegation and Zeng's account is his own, recorded by an FBI agent [1][2]. Read as tradecraft rather than as a case, it describes a sponsor who spent almost nothing, accepted a high chance of the collector being burned, and lost only the collector when he was.
Ranked by verification strength, evidence, and original report placement.
An FBI Special Agent's affidavit states that Weiheng Zeng is an undergraduate student at the University of Waterloo in Ontario, Canada, and has crossed into the United States around two dozen times since 2022.
Newly filed court records allege a Chinese national studying in Canada crossed into the United States earlier this year to photograph facilities near the Chicago airport at the direction of a suspected Chinese government official.
In April, an unknown person was seen inside the FedEx employee parking lot at O'Hare International Airport appearing to photograph aircraft or parts of the airport, climbed onto a forklift to take photos toward the aircraft, and tried to get into a FedEx truck.
Authorities later determined the person in the FedEx lot was Zeng, based on the dark blue Chrysler Town & Country that left the area and that he was connected to.
When Zeng tried to enter the United States last Sunday, Customs and Border Protection interviewed him repeatedly; he first said he planned to travel with his sister and a classmate.
CBP agents reviewed Zeng's phone and found multiple photos of aircraft; Zeng said he takes pictures of model aircraft being tracked for a flight radar website, and at one point said the photos were his hobby.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Primary court filing, single outlet, unadjudicated
The reporting quotes and paraphrases an FBI Special Agent's affidavit directly, which is strong documentary grounding for what has been alleged: the O'Hare FedEx lot conduct, the vehicle identification, the border interview, the per-photo payments, and the communications instructions. But the cluster has one publisher, the filing is a prosecutorial document with no adjudication or defense response, several load-bearing elements are the subject's own shifting statements, and the record's own check on the claimed recruitment website came back negative.
One documented penetration, two accepted tasks
Treating real-world footprint as adoption, the documented activity is narrow: two accepted tasks over 18 months, one intrusion into a cargo tenant's employee lot, roughly 17 to 25 paid photographs, $500 total, requests at Orlando, Las Vegas and Los Angeles declined, and a handler reportedly dissatisfied with the output. The article asserts a broader pattern of student-sourced imagery collection but the cluster documents only this case.
Pattern framing outruns a small, unadjudicated case
The concrete detail is well documented, but the interpretive frame runs ahead of it: the article generalizes to Chinese state actors continuing to 'crowd source' imagery of sensitive U.S. sites from students, while the record supports one student, two accepted taskings, $500, a recruitment site the FBI could not find, a state link asserted mainly by the subject, and photographs the handler called unsatisfying. The overstatement is in the scale and attribution language rather than in the underlying facts, so the gap is moderate and positive.
Charging document plus scoop dynamics
The underlying text is an FBI affidavit written to justify enforcement action, so it selects facts that support the government's theory and includes no adversarial testing. The records were surfaced by a court-records publisher whose product is exactly this kind of filing, and the story ran as a single-outlet scoop, which rewards the strongest available framing. These are ordinary, disclosed incentives rather than hidden ones: the outlet names its provenance and repeatedly attributes statements to the document and to Zeng.
Solid on the filing, weak on the conclusion
Confidence is moderate. What the affidavit says is well evidenced and quoted, and the physical-security read of the case is robust to the caveats. What remains uncertain is the part most likely to be repeated: who the handler actually was, whether the tasking connects to any larger program, and whether the allegations survive adjudication. One publisher, one document, and an internally contradicted recruitment story keep this below a high-confidence assessment.
product
The UK plant that went dark for four days was too small to have to tell anyone1 distinct publisher
build
China's accelerator swap makes Cambricon supply, not export policy, your ship-date risk1 distinct publisher
invest
A Connecticut judge just priced prompt injection: no fine, no e-filing2 distinct publishers
security
CISA finally counts the water intrusions: 100-plus exposed systems behind cellular modems2 distinct publishers
Distinct publishers with included, body-backed reporting in this cluster.