The Defendants and Targets

The three defendants—all Iranian nationals residing in San Jose, California—systematically targeted the “crown jewels” of American semiconductor innovation across multiple firms. [2]

Samaneh Ghandali (41), a former hardware engineer at Google who later worked at Intel. Soroor Ghandali (32), her sister, a former Google intern and subsequent Intel graphics hardware engineer. Mohammadjavad “Mohammad” Khosravi (40), Samaneh’s husband, a former ASIC design engineer at Qualcomm who previously served in the Iranian military. [2]

Evolving Exfiltration Tactics

The operational mechanics of the espionage evolved as corporate security systems adapted to their presence. The scheme reveals a critical vulnerability: the exploitation of trusted consumer applications to bypass enterprise data loss prevention (DLP) systems. [4]

Phase 1—Direct digital theft (2022): The scheme began when Google’s physical and cybersecurity monitoring systems detected Soroor Ghandali downloading internal files to a personal USB drive in June 2022. Files were also transferred via encrypted platforms like Telegram. [2]

Phase 2—Apple ecosystem evasion: To avoid immediate detection by network monitors, the operatives utilized a sophisticated workaround. They copied data directly from Google source files into the Apple Notes application native to their corporate-issued MacBooks. This data was then converted into PDF formats and uploaded from the Google network directly into personal Google Cloud accounts, masking the exfiltration within legitimate application traffic. [4]

Phase 3—Analog exploitation (2023): After Google flagged Samaneh Ghandali’s suspicious activity in August 2023, revoked her access, and subsequently terminated her, the group resorted to analog evasion. The night before a planned trip to Iran in December 2023, Samaneh manually photographed 24 screens of her husband’s Qualcomm work computer to completely bypass digital footprint tracking. [2]

Foreign access confirmed: Prosecutors possess evidence that the stolen data was actively accessed using personal devices linked to the defendants while they were physically located in Iran in December 2023. [2]

Charges and Penalties

All three defendants face 14 felony counts, including conspiracy to commit trade secret theft, theft of trade secrets (carrying a penalty of up to 10 years in prison per count), and obstruction of justice (carrying up to 20 years) due to their attempts to delete records, research cell carrier message retention policies, and sign false sworn affidavits to their employers. [2]

The arrests were executed during a period of acute geopolitical tension, coinciding with statements from U.S. President Trump indicating a potential decision regarding military strikes against Iran within days of the indictment. [2]

Systemic Implications: AI Hardware as National Security

This case—following closely on the heels of the first-ever conviction for AI-related economic espionage involving a former Google engineer stealing secrets for a Chinese startup [7]—illuminates a critical systemic vulnerability. While hyperscalers spend billions securing data centers and encrypting final model weights, the underlying architectural blueprints for the physical compute layer remain highly susceptible to insider threats. [5]

The case underscores that artificial intelligence hardware architectures are now classified alongside advanced munitions as a matter of supreme national security, subject to relentless economic espionage by foreign actors seeking to bypass decades of engineering to achieve technological parity. [2][7]