Democratic California Mayor Admits to Spying for China
On May 11, 2026, the US Department of Justice announced that Eileen
Wang — the Democratic mayor of Arcadia, California — will plead guilty
under 18 U.S.C. § 951 to acting in the United States as an illegal agent
of the People’s Republic of China. The same statute was used against
the 2010 Russian Illegals: ten deep-cover SVR officers run out of
Moscow Center. According to the plea agreement, between late 2020 and
2022, Wang coordinated with PRC government officials, took editorial
direction from a PRC handler over WeChat, and posted Beijing’s
propaganda — including verbatim denial of the Xinjiang genocide — from
her own US-based community news site within minutes of receiving the
tasking. The handler’s reply: “So fast, thank you everyone.”
The plea agreement establishes that a PRC Consul General used the Los
Angeles Times as a vector for the campaign — publishing an essay on the
Xinjiang issue that Wang’s network then amplified as community
reporting. Wang’s co-conspirator, Yaoning “Mike” Sun, is already serving
four years in federal custody on a related plea. Before any of this,
Wang and Sun co-founded a California company called US Pacific Logistics
Inc. with Zhao Jianjun — also known as Jeffrey Chao — the co-founder
and chief executive of TP-Link. TP-Link is currently under a federal
national-security probe and Commerce Department subpoena because its
routers were the access vector for the Volt Typhoon, Flax Typhoon, and
Salt Typhoon hacking campaigns — PRC state-sponsored cyber actors that
sat on US water utilities, telecommunications networks, and other
critical infrastructure.
The case looks like a routine § 951 conviction. The operational read is
different. You have, on one record, a propaganda layer running through
an American elected official. On a separate record, a corporate
logistics tie between that official and the chief executive of a
hardware company whose products served as the access path for the
People’s Liberation Army Strategic Support Force into American homes.
The Deputy Attorney General of the United States, Todd Blanche, signed
the plea personally on 31 March 2026. The Department held it for six
weeks and announced it on 11 May 2026 — forty-eight hours before the
President’s wheels-down in Beijing. The next question is whether more
nodes in the network get rolled up, and whether the TP-Link probe moves
from investigation to indictment.
Eric Garland is an intelligence analyst personally sanctioned by the
Russian Federation in May 2022 for his work on Russian intelligence
operations. He is the author of the 2016 “Game Theory” thread, named by
The New York Times as one of the 25 most important tweets in history.
🔔 Subscribe for daily geopolitical intelligence analysis.
📝 Substack: ericgarland.substack.com
🎤 Book Eric to speak: https://www.executivespeakers.com/speaker/eric-garland
SOURCES
US Department of Justice, USAO Central District of California — “Arcadia Mayor Federally Charged with Acting as Illegal Agent of the People’s Republic of China” — 11 May 2026
https://www.justice.gov/usao-cdca/pr/arcadia-mayor-federally-charged-acting-illegal-agent-peoples-republic-china
United States v. Eileen Wang, Plea Agreement — 2:26-cr-00186-WLH (C.D. Cal.) — signed 31 March 2026, lodged 1 April 2026
18 U.S.C. § 951 — Agents of foreign governments — Cornell Law (LII)
https://www.law.cornell.edu/uscode/text/18/951
US Department of Justice — Anna Chapman et al. (Russian Illegals Program), 2010 prosecution under the same statute
The Record — “TP-Link routers a national security threat, lawmakers claim”
https://therecord.media/routers-from-tp-link-security-commerce-department
Tom’s Hardware — “TP-Link under DOJ investigation for predatory pricing and national security concerns”
https://www.tomshardware.com/networking/routers/tp-link-under-doj-investigation-for-alleged-predatory-pricing-practices-and-national-security-concerns
CISA — Volt Typhoon advisory, PRC state-sponsored cyber actor targeting US critical infrastructure
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
