Three Silicon Valley engineers charged with stealing Google trade secrets and sending data to Iran

Federal prosecutors in the United States have unsealed an indictment charging three Silicon Valley engineers with allegedly stealing confidential trade secrets from Google and other technology firms and transferring sensitive data to Iran, officials said Thursday. The case has sparked concerns about insider threats to U.S. technology leadership, espionage risks and the safeguarding of proprietary innovations that underpin national economic and security interests.
Allegations and Charges
A federal grand jury in the Northern District of California indicted the three defendants — Samaneh Ghandali, 41; her sister Soroor Ghandali, 32; and Samaneh’s husband, Mohammadjavad “Mohammad” Khosravi, 40 — on multiple charges, including conspiracy to commit trade secret theft, actual and attempted theft of trade secrets, and obstruction of justice. All three reside in San Jose and were arrested on February 19, 2026 before appearing in federal court.
Prosecutors allege that the trio exploited their employment at major Silicon Valley technology companies to access and exfiltrate hundreds of confidential files. These files included proprietary information related to mobile processor security, cryptography and advanced semiconductor technologies, which play crucial roles in the performance and security of modern devices.
Insider Access and Exfiltration
According to the indictment, both Samaneh and Soroor Ghandali previously worked at Google before moving to another firm referred to in court filings as “Company 3.” Khosravi was employed at a separate company identified as “Company 2,” where he worked on similar technologies. Federal prosecutors say that the defendants used their positions to collect and transfer sensitive material to unauthorized locations — including personal devices, shared work devices and third-party communications platforms — before some of the information was ultimately accessed in Iran.
Google’s internal security systems reportedly flagged suspicious activity by Samaneh Ghandali in August 2023, leading to the revocation of her access to sensitive systems. Despite this, prosecutors allege that the group continued covertly obtaining and copying information, taking deliberate steps to conceal their actions.
Efforts to Avoid Detection
Federal authorities contend that the defendants engaged in extensive efforts to evade detection. After her access was revoked, Samaneh Ghandali signed a sworn affidavit falsely denying that she had shared proprietary information outside the company. Subsequent online searches from devices linked to the couple included queries about how long mobile carriers retain messages and how to delete communications — searches prosecutors say were attempts to disable forensic traces of their activity.
When electronic uploads risked detection, the indictment alleges that the pair resorted to manually photographing computer screens displaying sensitive data, including trade secrets related to system-on-chip (SoC) designs used in advanced semiconductor processors. On the eve of a December 2023 trip to Iran, Samaneh allegedly captured dozens of these photographs on her husband’s work device. While in Iran, prosecutors allege, a personal device linked to Samaneh accessed the images, and Khosravi used another device to continue accessing confidential material.
Security and Espionage Concerns
FBI Special Agent in Charge Sanjay Virmani described the alleged conduct as a “calculated betrayal of trust,” highlighting the gravity of insiders abusing privileged access to extract sensitive intellectual property. He noted that safeguarding U.S. innovation and protecting technologies that contribute to national competitiveness is a “top priority” for federal law enforcement.
From a broader perspective, cybersecurity experts have increasingly warned that insider threats, particularly those exploiting legitimate access under the guise of professional roles, remain among the most difficult challenges for corporate and national security. The theft and unauthorized transfer of trade secrets — especially to foreign jurisdictions — raises concerns about economic espionage, unfair competitive advantage and erosion of technological leadership.
Government and Corporate Responses
In response to the incident, Google issued a statement underscoring its commitment to protecting confidential information. Company representatives said the breach was detected through routine monitoring procedures and that Google immediately alerted law enforcement once the activity was discovered. They also emphasised ongoing enhancements to internal safeguards designed to limit unauthorized access and flag anomalous behavior.
Federal prosecutors said the case is being handled by the National Security and Special Prosecutions Section of the U.S. Attorney’s Office for the Northern District of California, reflecting the serious intersection of intellectual property theft with national security interests.
Penalties and Legal Outlook
The defendants are presumed innocent unless proven guilty in court. If convicted on all counts, each faces substantial penalties: up to 10 years in prison for each trade secret theft count, up to 20 years on the obstruction charge, and fines of up to $250,000 per count. These maximum sentences reflect the severe legal exposure associated with trade secret theft and obstruction of justice in U.S. law.
Legal experts say the indictment signals continued federal resolve to prosecute sophisticated cases involving corporate insiders and the unauthorized dissemination of cutting-edge technological information — particularly where alleged transfers may benefit foreign interests.