"Mallory expressed surprise at seeing some secure message history."

On June 22, Kevin Patrick Mallory was brought before a US federal judge for his first hearing on charges that he sold highly classified documents to a Chinese intelligence agent. These documents, which are considered "National Defense Information," included at least one Top Secret document and three classified as Secret and were found on a phone Mallory had been provided by his Chinese contacts. Mallory, a 60-year-old former Central Intelligence Agency employee living in Leesburg, Virginia, had thought the documents were in messages that had been deleted automatically from the device. Mallory faces life in prison if convicted.

Mallory, an independent consultant, had previously been an employee of "various government agencies" as well as several defense contractors. An Army veteran, Mallory worked at the State Department from 1987 to 1990. And according to The Washington Post, Mallory was also confirmed to have worked at the CIA, among other places. According to the FBI, Mallory was also an Army reservist during this time and served on active duty for several deployments. For much of his career, he held a Top Secret clearance, which was rescinded when he left government service in 2012.

According to the indictment, at some point during his service at the unnamed agency or at a defense contractor, Mallory—who is fluent in Mandarin—secreted out a collection of documents. Mallory told the FBI that while in China doing consulting work for a state-funded think tank in March and April of this year, he was approached by individuals he then believed to be with China's intelligence service and was given a phone to communicate with them secretly. During an interview with the FBI on May 24, FBI agent Stephen Green recounted in an affidavit requesting an arrest warrant:

Mallory told the agents that during his most recent trip to the PRC in April 2017, he had been given the device by [one Chinese contact] and was trained to use it specifically for private communications with [that contact], an individual he believes works for the PRCIS [Peoples' Republic of China Intelligence Services]. Mallory based this assessment on the multiple examples of PRCIS tradecraft and taskings which would be consistent with PRC government officials or intelligence officers (hereinafter "IOs"), and would be inconsistent with the practices of a legitimate commercial company. Mallory told the FBI agents that he was a former U.S. government employee who had training and overseas operational experience, which made it easy for him to spot tradecraft.

Mallory's problems began when he returned from China on April 21, when US Customs and Border Protection found $16,500 in cash in his luggage that he had failed to declare. Mallory told the Customs agents interviewing him that he had gone to China to meet "with an individual whom he knew through Mallory's church, and stated that he was consulting with this individual on anti-bullying/family safety development," the FBI affidavit states. Mallory also told CBP that he had not received anything from that person.

Immediately after he was allowed to amend his declaration and completed his customs interview, Mallory tried to contact an employee at an unnamed government agency (likely the CIA) to set up a meeting to tell them about his contacts in China. On May 12, he got that meeting and was asked to bring the phone in for analysis. When he returned for that second meeting (on May 24), he was greeted by FBI agents and agreed to a voluntary interview. He claimed that he had been paid for "white papers" he had written for his "client" and had not transferred any classified data.

As Mallory explained the device to the agents, he showed the secret messaging app he had been instructed to use. Unfortunately for Mallory, the FBI affidavit reports, "When doing this, Mallory expressed surprise at seeing some secure message history. Prior to the demonstration, he had told the agents that he believed the communication system was designed to delete all previous history." The message history included one from him that said, "I can also come in the middle of June, I can bring the remainder of the documents I have at that time."

Mallory claimed to agents that he was "stringing along" the Chinese.

The FBI took a forensic image of the device and were able to recover other messages exchanged after Mallory's return from China. They were damning:

• Mallory requesting tech support: "Also, we may need to go again step by step in my getting the document to become part of the image. Then sending it to you."
• The Chinese contact: "I suggest you send all and retype the handwriting. And [document] NO1 is obvious the first page of a complete article, where the else is and why it is black on top and bottom....We will try our best to apply for another sum of amount, as you required. However, I'm not sure it will be the Same amount for now and I will try, and for safety, we cannot send u in one time or in a short period altogether, need to figure out a better way."
• Mallory responded: "The black was to cross out the security classification (TOP SECRET//ORCON//...I had to get it out without the chance of discovery. Unless read in detail, it appeared like a simple note...I have arranged for a USD account in another name. You can send the funds broken into 4 equal payments over 4 consecutive days.. .When you agree I will send you the bank E.g. instructions."
• Mallory again, talking apparently about the Customs interview: "It was dicey (look it up) when they asked for me by name. If they we looking for me in terms of State Secrets, and found the SD card..., we would not be talking today. I am taking the real risk as you, [another China contact], and higher up bosses know... When you get the OK to replace the prior payment, then I will send more docs. I will also type my notes. NOTE: In the future, I will destroy all electronic records after you confirm receipt... I already destroyed the paper records. I cannot keep these around, too dangerous."
• Another Mallory message: "your object is to gain information, and my object is to be paid for."
• His contact's response: "My current object is to make sure your security and try to reimburse you."

Images found in the phone's data included a handwritten index of eight documents. Four of those documents were on the phone, and they included Top Secret and Secret classified data.