Arrests and Indictment Details
Three Silicon Valley engineers were arrested and charged with stealing trade secrets from Google and other U.S. technology firms, transferring sensitive data to unauthorized locations including Iran, federal prosecutors announced Thursday.
Samaneh Ghandali, 41, Soroor Ghandali, 32, and Mohammadjavad Khosravi, also known as Mohammad Khosravi, 40, all of San Jose, were arrested Thursday according to the Department of Justice.
A federal grand jury indicted the engineers on charges of conspiracy to commit trade secret theft, theft and attempted theft of trade secrets, and obstruction of justice.
We have enhanced safeguards to protect our confidential information and immediately alerted law enforcement after discovering this incident. Today’s indictments are an important step towards accountability and we'll continue working to ensure our trade secrets remain secure.
Employment and Theft Scheme
The defendants gained employment at technology companies focused on mobile computer processors, according to the unsealed indictment.
Sisters Samaneh and Soroor Ghandali worked at Google before moving to Company 3 in Santa Clara, California; Khosravi, married to Samaneh, worked at Company 2 in San Diego.
The DOJ alleges they used their positions to access and exfiltrate confidential documents, including trade secrets on processor security and cryptography, to work devices at each other's employers and to Iran.
Alleged Concealment Methods
- Submitting false, signed affidavits to victim companies about their conduct and stolen secrets.
- Destroying exfiltrated files and other records from electronic devices.
- Concealing exfiltration methods to avoid detection by victim companies.
As alleged, the defendants exploited their positions to steal confidential trade secrets from their employers. Our office will continue to lead the way in protecting American innovation and we will vigorously prosecute individuals who steal sensitive advanced technologies for improper gain or to benefit countries that wish us ill.
Discovery and Security Measures
Google discovered the alleged theft through routine security monitoring and referred the case to law enforcement after an internal investigation.
The company maintains robust security including limiting employee access to sensitive data, requiring device authentication, two-factor authentication for work accounts, and logging file transfers to platforms like Telegram, which it began blocking from corporate laptops last year.
Samaneh Ghandali is an Iranian national who became a U.S. citizen around 2018, Khosravi is an Iranian national and U.S. legal permanent resident since around 2019, and Soroor Ghandali was in the U.S. on a nonimmigrant student visa.
