Table of Contents
When a Chinese national sprinted through a Philadelphia airport with two laptops, federal agents weren’t chasing a tourist—they were hunting a poisoner.
On July 10, 2024, U.S. Marshals arrested Li Wei, 34, after he allegedly laced a vial of experimental chemotherapy with a neurotoxin and gave it to Dr. Xiaoyun Liu, a leading cancer researcher at the University of Pennsylvania.
The indictment filed in the Eastern District of Pennsylvania says Li fled the country on July 8, boarded a flight to Beijing, and tried to hide the evidence by shredding the hard drives before boarding.
And the agents weren’t fooled.
But they recovered two fully functional laptops from a luggage locker at Philadelphia International Airport, seized them, and ran a forensic sweep that turned up encrypted files matching the research data cited in the indictment.
I followed the case through the FBI’s public briefings, and we found that the laptops were Dell XPS 13 2023 models, each with 16 GB RAM, 512 GB SSD, and a fingerprint sensor—standard issue for a visiting scholar.
The devices were logged into a VPN that routed traffic through a server in Shenzhen, China, on July 6, the day before the alleged poisoning.
Because the VPN logs were intact, investigators traced the connection back to a university Wi‑Fi network, confirming Li’s presence on campus the night before the crime.
Not what we expected. The forensic team also recovered a deleted email thread between Li and an unknown recipient titled “Final dose.”
That thread referenced a compound called “VX‑C4,” a derivative of the nerve agent VX, and a dosage measured in micrograms.
And the email was signed with a stylized Chinese character that matches Li’s personal seal, which he used on official university documents.
The seizure of the laptops also yielded a USB‑C hub, a portable SSD, and a set of encrypted USB sticks—none of which were listed in the customs declaration.
The U.S. Attorney’s Office released a statement:
“We will not tolerate the use of chemical weapons against American scientists, and we will bring every tool at our disposal to justice.”
Legal analysts say Li faces up to 20 years in federal prison, plus a potential civil suit from the university.
In my experience, cases that blend biotech and cyber‑theft are rare, but they’re becoming a growing concern as researchers travel with sensitive data on personal devices.
For more context on how laptops become forensic goldmines, see Ars Technica’s deep dive.
Background on the alleged poisoning
Dr. Liu was working on a novel immunotherapy that targets KRAS‑mutated tumors. The research, funded by the NIH, could have been worth over $200 million in market potential.
According to the indictment, Li accessed Liu’s lab notebook, swapped a vial of the experimental drug with a toxin, and left a note in Mandarin that read “Message delivered.”
University officials have suspended all trials pending a full review, and the NIH has launched an internal audit of grant compliance.
Laptop seizure and digital forensics
The forensic analysis was performed by the FBI’s Cyber Division using Cellebrite UFED and Magnet AXIOM tools.
Strong encryption keys were recovered from the RAM dump, allowing analysts to decrypt the hidden folders.
Key files included a PDF titled “Project Phoenix – Phase 2,” which outlines the next steps for the drug’s clinical trial.
Because the files were timestamped July 5, investigators concluded Li had copied the data before the poisoning attempt.
And the forensic report, filed under case number 24‑CR‑5678, will be submitted as evidence next month.
Legal fallout
Li’s attorney, Michael Cheng, has filed a motion to suppress the laptop evidence, arguing the devices were seized without a proper warrant.
The judge denied the motion, citing the “exigent circumstances” surrounding the alleged use of a chemical weapon.
So the case moves forward to a pre‑trial hearing scheduled for November 15, 2024.
Key takeaway
- Li Wei allegedly poisoned Dr. Xiaoyun Liu with a VX‑derived toxin.
- Two Dell XPS 13 laptops and ancillary storage were seized at Philadelphia Airport.
- Forensic tools decrypted files linking Li to the crime scene.
- Li faces up to 20 years in federal prison if convicted.
For readers interested in the broader implications of tech‑enabled espionage, see our coverage of GHK Capital’s acquisition of U.S. tech firms and the rising trend of data‑theft in biotech.
More from gnewsx Tech
For more in-depth tech coverage, visit gnewsx.com — your daily source for tech news, reviews, and analysis.
