Silicon Valley Secrets Smuggled: Google Engineers Accused of High-Tech Espionage Tied to Iran

It sounds like the plot of a cyber-thriller: trusted engineers at one of the world’s most powerful tech companies quietly siphon off sensitive secrets, their digital footprints leading from Silicon Valley to the heart of Iran. But this isn’t fiction. Last week, federal prosecutors unveiled charges against two former Google engineers and one accomplice, accusing them of orchestrating one of the most audacious trade secret heists in recent memory.

According to the Department of Justice, Samaneh Ghandali and her sister Soroor Ghandali-both former Google employees-along with Samaneh’s husband Mohammadjavad Khosravi, abused their privileged access to some of Google’s most closely guarded intellectual property. Prosecutors allege the group methodically exfiltrated confidential files concerning processor security and cryptography, not only from Google but also from other major tech companies in the competitive field of mobile computing.

The Ghandali sisters, employed on projects linked to Google’s Tensor processor (the custom chip powering Pixel phones), allegedly transferred hundreds of files to third-party messaging platforms, with channels named after each conspirator. These files were further copied to various personal devices and work-issued laptops, weaving a tangled web of digital and physical evidence.

When Google’s internal security flagged suspicious activity in August 2023, the alleged operation didn’t stop. Instead, the defendants are said to have doubled down, submitting false affidavits, destroying digital evidence, and resorting to old-school tactics-like manually photographing sensitive screens-to avoid detection by digital forensics. Investigators uncovered internet searches on how to delete communications and queries about how long mobile providers retain messages for court proceedings, suggesting a calculated effort to cover their tracks.

Perhaps most brazenly, on the eve of a trip to Iran in December 2023, Samaneh Ghandali reportedly used her mobile phone to snap dozens of photos of her husband’s work computer screen, capturing yet more trade secrets. These images later surfaced on devices linked to her in Iran, confirming the international scope of the breach.

Google, quick to respond, claims it has since tightened its data security protocols and immediately notified law enforcement upon discovering the breach. The case comes on the heels of another high-profile conviction of an ex-Google engineer who attempted to launch a startup in China using stolen corporate secrets, highlighting the global stakes of intellectual property theft in the tech arms race.

The Silicon Valley–to–Tehran pipeline exposed by this indictment is a stark reminder: in the world of high-tech innovation, the greatest threats don’t always come from faceless hackers, but sometimes from trusted insiders with access-willing to risk it all for secrets worth billions. As the legal process unfolds, the tech industry watches anxiously, aware that today’s trade secrets are tomorrow’s battlegrounds.

WIKICROOK

• Trade secret: A trade secret is confidential business information that offers a company a competitive edge and is legally protected from unauthorized disclosure.
• Exfiltration: Exfiltration is the unauthorized transfer of sensitive data from a victim’s network to an external system controlled by attackers.
• Obstruction of justice: Obstruction of justice means interfering with crime investigations, like deleting evidence or misleading authorities, and is illegal in cybersecurity contexts.
• Processor security: Processor security protects CPUs from unauthorized access, tampering, and cyber threats using hardware and software measures to ensure safe computing operations.
• Affidavit: An affidavit is a sworn written statement used as evidence, often in legal proceedings related to cybersecurity incidents or digital investigations.