Feds: 3 Iranian Engineers Stole Google Trade Secrets, Sent Data to Iran

Federal prosecutors have indicted three Silicon Valley-based Iranian engineers on charges of stealing confidential information from Google and other major technology companies and transmitting sensitive data to Iran.

CNBC reports that a federal grand jury has brought charges against three Iranian engineers working in Silicon Valley accused of stealing trade secrets from Google and other tech firms while transferring proprietary data to Iran. The defendants, Samaneh Ghandali, 41, her sister Soroor Ghandali, 32, and Mohammadjavad Khosravi, 40, were all arrested on Thursday and made their initial appearance in federal district court the same day, according to prosecutors. All three defendants are residents of San Jose and have been identified as Iranian nationals. Soroor Ghandali was in the United States on a nonimmigrant student visa, while her sister Samaneh later obtained U.S. citizenship. Khosravi, who is married to Samaneh, became a U.S. legal permanent resident. According to prosecutors, Khosravi previously served in the Iranian army.

The charges filed by the U.S. attorney’s office for the Northern District of California include conspiracy to commit trade secret theft, theft and attempted theft of trade secrets, and obstruction of justice. Prosecutors allege that the three defendants leveraged their positions at prominent technology companies specializing in mobile computer processors to obtain hundreds of confidential files, including sensitive materials related to processor security and cryptography.

Both Samaneh and Soroor Ghandali previously worked at Google before moving to another firm identified in court documents only as Company 3. Khosravi was employed at a separate company referred to as Company 2, which develops “system-on-chip” platforms used in smartphones and other mobile devices.

System-on-chip technology represents a type of semiconductor that integrates multiple components, including graphics processing units and memory, into a single power-efficient package. Well-known examples of SoC technology include Qualcomm’s Snapdragon processors, which are found in most high-end Android smartphones, and Apple’s A-series chips used in iPhones.

Google detected the alleged theft through its routine security monitoring procedures and subsequently reported the incident to law enforcement authorities. In a statement provided to CNBC, Google spokesman José Castañeda said, “We have enhanced safeguards to protect our confidential information and immediately alerted law enforcement after discovering this incident.”

The technology giant outlined various measures it employs to protect trade secrets, including limiting employee access to sensitive information, implementing two-factor authentication for work-related Google accounts, and maintaining logs of file transfers to third-party platforms such as Telegram.

According to the indictment, the defendants allegedly routed stolen files through a third-party communications platform to channels named after each of their first names. From there, they allegedly copied the material to personal devices, each other’s work devices, and ultimately sent the data to Iran.

FBI Special Agent in Charge Sanjay Virmani stated, “The method in which confidential data was transferred by the defendants involved deliberate steps to evade detection and conceal their identities.”

Prosecutors allege that the defendants attempted to cover their tracks after Google’s internal security systems flagged suspicious activity by Samaneh Ghandali and revoked her access to company resources in August 2023. According to the indictment, she signed an affidavit falsely claiming she had not shared Google’s confidential information outside the company. During this same period, a personal laptop linked to both Samaneh and Khosravi was allegedly used to search for methods to delete communications and to research how long mobile carriers retain message records.

The couple also allegedly photographed hundreds of computer screens containing confidential information from both Google and Company 2, which prosecutors suggest was an attempt to circumvent digital monitoring tools. On the night before traveling to Iran in December 2023, Samaneh allegedly took approximately 24 photographs of Khosravi’s work computer screen that contained trade secrets belonging to Company 2, including information about its Snapdragon SoC products.

While the couple was in Iran, prosecutors allege that a device linked to Samaneh accessed those photographs, while Khosravi accessed additional proprietary information from Company 2, including Snapdragon SoC hardware architecture details.

If convicted on all charges, each defendant faces a maximum sentence of 10 years in prison for each trade secret charge and up to 20 years for obstruction of justice. Additionally, they could face fines of up to $250,000 per count.