A chilling breach of trust has unfolded, revealing a calculated scheme to steal invaluable technological secrets from the heart of Silicon Valley and deliver them to Iran. A federal grand jury has indicted three individuals accused of pilfering hundreds of confidential files from Google and other leading tech companies.
The alleged ringleaders are Samaneh Ghandali, a 41-year-old U.S. citizen, her sister Soroor Ghandali, 32, an Iranian national studying in the United States, and Samaneh’s husband, Mohammadjavad Khosravi, 40, an Iranian national and legal permanent resident. All three resided in San Jose, California, while allegedly carrying out this audacious operation.
Samaneh and Soroor Ghandali both previously held positions at Google before moving to another, currently unnamed, tech firm. Khosravi, with a background as a former member of the Iranian army, worked for a company specializing in system-on-chip platforms – the very technology powering flagship devices like Qualcomm’s Snapdragon and Apple’s iPhones.
The indictment details charges of conspiracy to steal trade secrets, theft, attempted theft, and obstruction of justice. The stolen data included critical processor security information, cryptographic materials, and the intricate hardware architecture of Snapdragon SoCs – intelligence that would be exceptionally difficult for competitors to acquire legitimately.
This wasn’t a simple download and transfer. The trio employed a sophisticated network of evasion tactics, routing files through platforms like Telegram, copying data to personal devices, and even resorting to photographing computer screens to circumvent digital monitoring systems. Their methods were deliberately designed to remain undetected.
Just before Samaneh Ghandali and Khosravi departed for Iran in December 2023, a particularly brazen act occurred: Samaneh photographed her husband’s work screen, capturing images of sensitive company secrets. Once in Iran, devices connected to the suspects were found to have accessed the stolen information.
Google’s internal security team first detected the suspicious activity in August 2023, flagging Samaneh Ghandali’s actions and promptly revoking her access. This triggered an immediate notification to law enforcement, initiating a full investigation.
Investigators uncovered searches on the suspects’ devices revealing attempts to delete communications and determine data retention policies of telecommunication carriers. Samaneh Ghandali even signed a false affidavit, falsely claiming she had not shared Google’s confidential information.
The investigation revealed a deliberate effort to conceal identities and evade detection, according to authorities. The stolen data represents a significant compromise, offering a competitive advantage and potentially posing national security concerns.
Each defendant now faces a potential sentence of up to 10 years in prison for each trade secret violation and up to 20 years for obstruction of justice, alongside substantial fines reaching $250,000 per charge. The unsealed indictment arrives during a period of increased vigilance regarding Iran’s cyber activities and espionage efforts.
