Three San Jose engineers thought they had covered their tracks perfectly, then Google’s security system caught something they never anticipated

Three San Jose engineers have been indicted by a federal grand jury for allegedly stealing trade secrets from Google and transferring sensitive data to Iran. Samaneh Ghandali, 41, her sister Soroor Ghandali, 32, and Mohammadjavad Khosravi, 40, were all arrested and appeared in federal district court. Prosecutors are calling it a sophisticated espionage operation.

According to CNBC, the three face charges of conspiracy to commit trade secret theft, actual theft and attempted theft of trade secrets, and obstruction of justice. Prosecutors allege they used their positions at major tech firms that develop mobile computer processors to obtain hundreds of confidential files, including materials related to processor security and cryptography.

The stolen information included proprietary data about system-on-chip (SoC) platforms, such as the Snapdragon series found in high-end Android phones. An SoC is a semiconductor that combines components like graphics processors and memory into one compact package. These trade secrets have independent economic value and are not public knowledge.

Google’s everyday security monitoring proved to be the defendants’ biggest obstacle

Samaneh and Soroor both previously worked at Google before moving to a third company, while Khosravi worked at a different firm that develops SoC platforms. The indictment identifies all three as Iranian nationals. Soroor was in the U.S. on a student visa, Samaneh later became a U.S. citizen, and Khosravi, her husband, became a U.S. legal permanent resident. Khosravi also has a background of serving in the Iranian army.

Google detected the alleged theft through routine security monitoring and immediately alerted law enforcement. José Castañeda, a spokesman for Google, said, “We have enhanced safeguards to protect our confidential information and immediately alerted law enforcement after discovering this incident.” Google restricts employee access to sensitive information, requires two-factor authentication for work accounts, and logs file transfers to third-party platforms. 

This case is one of several recent incidents where Google’s systems flagged large-scale attacks aimed at extracting sensitive information. Authorities allege the defendants took deliberate steps to hide their tracks. They routed stolen files through a third-party communications platform to channels named after each of them, before the material was transferred to their personal devices, each other’s work devices, and eventually to Iran. 

FBI Special Agent in Charge Sanjay Virmani noted, “The method in which confidential data was transferred by the defendants involved deliberate steps to evade detection and conceal their identities.” Their cover-up efforts increased after Google’s internal security systems flagged Samaneh’s activity and revoked her access in August 2023. 

She allegedly signed an affidavit falsely claiming she had not shared Google’s confidential information outside the company. Around the same time, a personal laptop linked to Samaneh and Khosravi was reportedly used to search for ways to delete communications and research how long mobile carriers keep message records.

The defendants also allegedly photographed hundreds of computer screens containing confidential information to get around digital monitoring tools. The night before the couple traveled to Iran in December 2023, Samaneh allegedly took about 24 photos of Khosravi’s work computer screen, showing Company 2’s trade secrets, including Snapdragon SoC data. 

While in Iran, a device linked to Samaneh reportedly accessed those photographs, and Khosravi accessed additional proprietary information. Security footage and digital evidence have increasingly become key tools in catching people who lie about their actions, as seen in other recent high-profile cases. If convicted, each defendant faces up to 10 years in prison for each trade secret charge and up to 20 years for obstruction of justice, along with fines of up to $250,000 per count.