Sentinel Vault
← All field notes
Cyber Leadership & Risk · May 13, 2026

Thank You, Leader: What Arcadia Tells Us About the China Threat in Our Cities

Thank You, Leader: What Arcadia Tells Us About the China Threat in Our Cities

What Wang admitted, by the numbers

Her name is Eileen Wang, 58, of Arcadia, California. In November 2022, she became the first Chinese-American woman elected to the Arcadia City Council, a five-person governing body. The mayor is selected from that body on a rotating basis. Wang rotated into the role. She resigned in May 2026, days before signing a plea agreement with the Justice Department.

The charge is one count of acting in the United States as an illegal agent of a foreign government, in violation of 18 U.S.C. § 951. Maximum sentence: 10 years in federal prison. She was charged by information, not by grand jury indictment, which signals a pre-arranged plea. She is expected to plead guilty in the coming weeks.

The charged conduct runs from late 2020 through 2022. Wang and her co-conspirators operated U.S. News Center, a website that presented itself as local news for the Chinese-American community while publishing content at the direction of PRC officials, including denial of Xinjiang abuses.

Two quotes from the DOJ announcement:

Assistant Attorney General for National Security John A. Eisenberg: "It is deeply concerning that someone who previously received and executed directives from PRC government officials is now in a position of public trust at all, but particularly so because that relationship with that foreign government had never been disclosed."

Assistant Director Roman Rozhavsky of the FBI's Counterintelligence and Espionage Division: "By her own admission, Eileen Wang secretly served the interests of the Chinese government. Let this serve as a clear warning: Individuals who act on behalf of foreign governments to influence our democracy will be identified, investigated, and brought to justice."


The Arcadia network

Wang did not operate alone.

Yaoning "Mike" Sun, 65, of Chino Hills, was Wang's campaign treasurer, political adviser, and former fiancé. He co-operated U.S. News Center with her while managing her 2022 council campaign. Sun pleaded guilty in October 2025 to acting as an illegal agent of a foreign government. He is currently serving a four-year federal prison sentence.

John Chen is the third node in the cluster. In November 2021, Wang messaged Chen directly with content she flagged as coming from the top: "This is what the Ministry of Foreign Affairs wants to send." Court documents describe Chen as "a high-level member of the PRC intelligence apparatus" who attended elite CCP functions including military parades and personally met PRC President Xi Jinping. Chen is a Los Angeles resident.

In July 2024, Chen pleaded guilty in the Southern District of New York to two charges: acting as an illegal agent of the PRC, and conspiracy to bribe a federal officer. That second count involved a $5,000 cash payment to an undercover agent posing as an IRS official, as part of a scheme to strip Falun Gong practitioners of their tax-exempt status. In November 2024, Chen was sentenced to 20 months in federal prison.

Three convicted nodes. All in or directly tied to Greater Los Angeles. Sun pleaded October 2025. Chen pleaded July 2024. Wang signed her agreement May 2026. Each case took years of FBI counterintelligence work to develop before a single charge was filed.


The playbook is older than Wang: Christine Fang

The Arcadia case didn't appear from nowhere. The pattern has a longer California record.

In December 2020, Axios reporters Bethany Allen-Ebrahimian and Zach Dorfman published an investigation identifying Christine "Fang Fang" Fang as a suspected Chinese Ministry of State Security officer. Fang operated in the Bay Area from roughly 2011 to 2015. She attended Cal State East Bay and embedded herself in regional political circles, focusing on up-and-coming California politicians.

Per the Axios reporting: Fang bundled fundraising contributions for multiple campaigns, including Rep. Eric Swalwell's 2014 reelection. She placed an intern in Swalwell's congressional office. FBI electronic surveillance captured evidence of sexual or romantic relationships between Fang and at least two Midwestern mayors. In August 2015, the FBI gave Fremont Mayor Bill Harrison a defensive counterintelligence briefing. That same year, Fang left the United States abruptly. No charges have ever been filed against her.

Swalwell was the subject of an FBI defensive briefing. He was never charged with any wrongdoing. The House Ethics Committee closed an inquiry in May 2023, finding no evidence of impropriety.

Fang ran the playbook Wang executed a decade later, in the same San Gabriel Valley political circles, working through the same Asian-American community infrastructure, applying the same MSS and United Front Work Department operational doctrine. The names changed. The method did not.


How long until they're caught?

In 2013, the FBI briefed a sitting U.S. Senator that one of her San Francisco office staffers, a person who had worked in that office for roughly 20 years, had been targeted by Chinese intelligence. No charges were ever filed. The institutional fact here is what matters: federal counterintelligence opened a file on someone two decades into the relationship before the sitting senator knew about it.

That case is part of a pattern. Since 2013, at least the following California-tied individuals and operations have been charged, convicted, sentenced, or publicly identified by U.S. counterintelligence as having worked at PRC direction inside U.S. political and civic infrastructure:

  • A 20-year staffer in a sitting U.S. Senator's San Francisco office (FBI defensive briefing, 2013; no charges filed, per CBS San Francisco)
  • A suspected MSS operative cultivating Bay Area political networks (Christine Fang, no charges; FBI defensive briefing of Fremont Mayor, 2015)
  • A UC Davis researcher who sheltered inside the PRC Consulate in San Francisco for a month before arrest (Tang Juan; charges later dismissed in 2021)
  • The mayor of Arcadia and her campaign treasurer (Wang and Sun, both pleaded guilty)
  • A Los Angeles-resident PRC agent who participated in a federally directed bribery scheme targeting U.S. religious minorities (John Chen, sentenced to 20 months; DOJ SDNY)
  • A Los Angeles "110 Overseas" Chinese police service center, publicly identified by Safeguard Defenders as part of a global PRC transnational repression infrastructure; not yet prosecuted

Six discrete California fact patterns. Only one (Wang and Sun) was surfaced through anything other than federal counterintelligence developing the file first.

How many more are there in LA County?

We don't know. The structure of U.S. law doesn't require proactive registration under 18 U.S.C. § 951. Nobody audits city-council relationships with foreign officials. The number is not zero. And the public has no way to learn what it is without a federal indictment.


From propaganda to procurement

Wang's charged conduct was words. She wrote articles, edited them at official request, reported view counts back up the chain.

But she also sat for two years on a five-person body that votes on city contracts.

What Wang did with words, the next person in her seat could do with contracts. Body-worn cameras. Public-safety drones. Traffic-management video. Municipal Wi-Fi. The supply chain for all of those runs through vendors that the federal government has already banned itself from using.

Wang's conduct and her council seat are separate legal facts. The point is not that she steered a procurement. The point is that the same access that makes a council seat useful for influence operations also makes it useful for supply-chain decisions, and nobody was watching either one.


NDAA Section 889 and the California gap

Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 prohibits federal agencies from procuring telecommunications and video-surveillance equipment from five companies: Huawei, ZTE, Hytera, Hangzhou Hikvision, and Dahua, along with their subsidiaries and affiliates. Direct procurement from those companies became prohibited on August 13, 2019. Contracts with entities that use covered equipment came under the ban on August 13, 2020. There is no commercial-item exception and no micro-purchase floor. The DoD Acquisition guidance is explicit on both points.

Section 889 does not bind state and local governments. They can still buy these brands with state and local funds. California has not passed a state-level parallel.

Comparitech research documents that San Jose has the highest per-capita density of NDAA-prohibited camera networks in the country, with tens of thousands of Hikvision units across municipal facilities. That is not a security posture; it is a documented exposure.

In April 2024, the D.C. Circuit upheld the FCC's authorization ban against Hikvision USA. The legal posture at the federal level is settled. The gap at the state and local level is not a legal ambiguity. It is a policy choice the California legislature has not made.


Why this matters: Volt Typhoon, Salt Typhoon, TP-Link

The Wang case is about a propaganda operation. The broader context is about infrastructure.

On February 7, 2024, CISA, NSA, and FBI jointly published Advisory AA24-038A on Volt Typhoon, a PRC state-sponsored actor group. The advisory documented persistent access to U.S. critical infrastructure across communications, energy, transportation, and water sectors, in some cases maintained for five or more years. The stated purpose: pre-positioning for disruptive attack at a time of the PRC's choosing.

On August 27, 2025, the same agencies published Advisory AA25-239A on Salt Typhoon. PRC actors compromised major U.S. telecom networks including Verizon, AT&T, and Lumen. The breach targeted communications of political figures. It also reached the lawful-intercept systems carriers use to fulfill law-enforcement requests. The systems LE uses to investigate crimes were inside the breach.

On October 30, 2025, the Commerce Department, backed by DOJ, DHS, and DoD, formally proposed banning future U.S. sales of TP-Link networking gear on national security grounds. TP-Link controls roughly 65% of the U.S. home and small-office router market. It was among the brands identified in connection with the Typhoon campaigns.

In April 2024, FBI Director Christopher Wray addressed these threats directly at the Vanderbilt Summit on Modern Conflict and Emerging Threats. China is "positioning its enormous hacking enterprise to give itself the ability to physically wreak havoc on our critical infrastructure at a time of its choosing." He also put the resource imbalance plainly: PRC hackers outnumber FBI cyber personnel 50-to-1.

The Wang case and the Typhoon campaigns are not separate problems. One is access through people. The other is access through equipment. The PRC does not treat them as separate, either.


What to do: for SMB owners and local leaders

Five actions, none of them complicated.

1. Inventory your stack. Identify any Hikvision, Dahua, Huawei, ZTE, Hytera, TP-Link, or Lenovo equipment in your business or your city's facilities. The brand is on the device. Make a list.

2. Ask your council members, publicly and on the record. Have you ever received content, talking points, or directives from a representative of a foreign government and acted on them? The honest answer should be easy.

3. Push for a California state analog to NDAA Section 889. The federal posture is settled. The state gap is a choice the legislature can fix.

4. If you sit on a procurement committee, require origin and ownership disclosures for any networking, video-surveillance, or critical-infrastructure equipment purchase. That information is publicly available. You just have to ask for it.

5. If you run an SMB, audit your network for the brands above. Replacing the hardware is cheaper than post-incident forensics.

None of this requires a security clearance or a federal budget. The exposure is visible. The question is whether anyone in the room is looking.


What comes next

The Wang plea is one case, in one city, on one end of the operational chain. The PRC's influence infrastructure in California is not a single operation that ends when one actor pleads guilty. Sun is in prison. Chen is out. Wang's plea is pending. The network they worked within is broader than what three guilty pleas describe.

Section 951 prosecutions take years, require sustained FBI counterintelligence resources, and depend on digital evidence most targets don't know they're generating. That is a slow filter for a fast problem.

The federal posture on equipment bans, infrastructure warnings, and counterintelligence is clearer than it has ever been. The state and local response is not keeping pace. That gap is where the next case is developing right now.


Author note: I write a crime-fiction series called Fleeced Nation about industrialized PRC-aligned fraud operations that exploit American soft spots, from elder fraud call centers to municipal procurement. The Arcadia case sits directly on the seam my series explores. I started writing it as fiction. Reality keeps closing the distance.

About the author
Pete Hish, Sentinel Vault founder
Taught by Pete Hish · Founder

A working cyber-fraud supervisor, not a vendor consultant.

US Army veteran. Active sergeant supervising a cyber and fraud investigations team at a large Southern California law-enforcement agency. Ten-plus years inside the cases that hit small businesses, families, and public-sector agencies first. The training is shaped by what actually goes wrong, not what vendor decks predict.

Certified Cybersecurity SpecialistCertified Cyber Fraud SpecialistCalifornia POST Certified Instructor
Hacked or Hardened? book cover
Prefer the long-form version?

Hacked or Hardened? covers these patterns end-to-end — the four ways small businesses get hit, what to fix first, and how to lead through an incident.

Related field notes
Next step

Want this kind of analysis for your team?

A 2–4 hour cyber risk briefing: the threats specific to your business, the controls that actually pull their weight, and a 90-day action plan.