Silicon Valley Engineers Charged With Theft of Google, Tech Trade Secrets

Federal prosecutors have arrested three Silicon Valley engineers accused of stealing sensitive chip security trade secrets from Google and others and routing them to unauthorized locations including Iran, raising national security concerns.

A federal grand jury in the U.S. District Court for the Northern District of California has returned indictments against Samaneh Ghandali, Soroor Ghandali and Mohammadjavad Khosravi. The charges were filed Wednesday and unsealed Thursday in San Jose, according to a statement from the DOJ.

While working at Google, Samaneh Ghandali allegedly transferred “hundreds of files, including Google trade secrets, to a third-party communications platform” to channels using each defendant’s first name, the DOJ said.

A copy of the unsealed indictment was not immediately available at press time. Declutter has contacted the appropriate DOJ office for further information and comment.

The trio allegedly used their jobs at Google and two other unnamed companies to gain access to confidential files related to mobile computer processors. According to the DOJ, the stolen material contained trade secrets related to processor security and cryptography, and Google material was later copied to personal devices and to work devices at the other companies where the defendants worked.

Prosecutors allege that the defendants attempted to conceal their actions by deleting files, destroying electronic data and filing false affidavits with victim companies denying that they had shared confidential information outside the company.

In an episode detailed in the indictment, the DOJ alleges that in December 2023, the night before he traveled to Iran, Samaneh Ghandali photographed approximately two dozen images of another company’s computer screen showing trade secrets.

While in Iran, a device linked to her allegedly gained access to those photos, and Khosravi allegedly gained access to additional trade secret material.

According to the DOJ, Google’s internal security systems detected suspicious activity in August 2023 and revoked Samaneh Ghandali’s access. The suit alleges that she later signed an affidavit stating that she did not share Google’s confidential information outside the company.

All three defendants are charged under federal law with conspiracy and theft of trade secrets, and with obstruction of justice under federal law. statute which criminalizes the corrupt alteration, destruction or concealment of documents or other objects in order to hinder their use in an official proceeding.

The obstruction charge carries a maximum statutory penalty of 20 years in prison.

Risks and consequences for safety

Observers say the case illustrates how insider access to advanced semiconductor and cryptographic systems can impact national security.

“Employees with legitimate access can quietly extract highly sensitive IP data over time, even with existing controls,” said Vincent Liu, Chief Investment Officer at Kronos Research. Declutter.

The risk to semiconductor and cryptography companies often comes from “trusted insiders, not hackers,” he added, describing insider risk as a “persistent, structural vulnerability that requires constant monitoring and strict data compartmentalization.”

In such cases, “the insider is the attack surface,” Dan Dadybayo, strategy lead at crypto infrastructure developer Horizontal Systems, told me. Declutter. “Firewalls don’t matter when the exfiltration vector is legitimate access,” he said, arguing that when engineers can “move architecture, key management logic, or hardware security design out of controlled environments, the ‘perimeter’ collapses.”

If a sensitive processor and cryptographic IP reached Iran, Dadybayo said regulators would likely respond aggressively.

He pointed to “stronger enforcement of perceived export regulations where access to knowledge itself counts as an export” and “stricter segmentation, monitoring and licensing requirements within US companies,” adding that advanced chips and cryptography are “no longer treated as neutral commercial goods” but as “tools of geopolitical power.”

The case also exposes the gap between formal compliance and resilience in the real world.

“In most technology organizations, it is believed that the risks of information theft are mitigated by obtaining SOC 2 and ISO certifications,” Dyma Budorin, executive chairman of crypto security and compliance firm Hacken, told me. Declutter.

Such frameworks “often measure compliance maturity, rather than actual resilience against a determined attacker – especially an insider.”

Certification, he said, proves that controls exist “at the time of the audit,” but “it does not prove that sensitive data cannot be stolen.”

Because these standards prescribe common safeguards, Budorin argued, they can make defense predictable.

For advanced attackers, “compliant” often means predictable, he added, cautioning that true security requires “continuous validation, behavioral monitoring and adversary testing,” otherwise organizations risk being “compliant on paper while being critically exposed in practice.”