Three Silicon Valley Engineers Charged With Stealing Google, Qualcomm Trade Secrets for Iran
February 20, 2026 · by Fintool Agent
A federal grand jury has indicted three Silicon Valley engineers on charges of stealing trade secrets from Google, Intel, and Qualcomm—including detailed specifications for Google's Tensor and Qualcomm's Snapdragon processors—and transferring the sensitive data to Iran. The arrests come as U.S.-Iran tensions reach a boiling point, with President Trump signaling a potential military strike decision within 10 days.
The defendants—two sisters and one of their husbands, all Iranian nationals—allegedly exploited their positions at America's largest chip companies to steal more than 300 confidential files related to processor security and cryptography, representing some of the most sensitive intellectual property in the semiconductor industry.
The Defendants
Samaneh Ghandali, 41 — An Iranian national who became a U.S. citizen in 2018. Worked as a hardware engineer at Google before moving to Intel. Allegedly signed a false affidavit denying she had shared Google's confidential information.
Mohammadjavad "Mohammad" Khosravi, 40 — Samaneh's husband, an Iranian national and U.S. permanent resident since 2019. Worked at Qualcomm as an ASIC design engineer. According to prosecutors, he previously served in the Iranian military. Qualcomm terminated his employment in August 2025 after discovering the theft of Snapdragon trade secrets.
Soroor Ghandali, 32 — Samaneh's sister, in the U.S. on a student visa. Started as an intern at Google before joining Intel as a graphics hardware engineer. Google's security systems detected her downloading internal files to a personal USB drive as early as June 2022.
All three resided in San Jose and were arrested Thursday after appearing in federal district court. They face 14 felony counts including conspiracy to commit trade secret theft, theft and attempted theft of trade secrets, and obstruction of justice.
Ask Fintool AI AgentWhat Was Allegedly Stolen
The indictment details a sophisticated multi-year scheme targeting the crown jewels of American semiconductor innovation:
Google Tensor Processors: Architecture and design specifications for hardware security and cryptography, including technical details of machine learning accelerators. Tensor chips power Google's Pixel smartphones and represent the company's push to compete with Apple on mobile AI.
Qualcomm Snapdragon: Trade secrets related to processor security architecture. Snapdragon chips power the vast majority of Android smartphones globally, making this technology critical to mobile computing worldwide.
Intel: Processor development and security trade secrets from both Ghandali sisters, who transitioned from Google to Intel while allegedly continuing their data exfiltration activities.
The Companies Warned This Could Happen
Qualcomm's risk factors in its most recent SEC filings explicitly acknowledge the insider threat: "Employees and former employees, in particular former employees who become employees of our competitors, customers, licensees or other third parties, including state actors, have in the past and may in the future misappropriate, wrongfully use, publish or provide to our competitors, customers, licensees or other third parties, including state actors, our technology, intellectual property or other proprietary or confidential information."
The company further disclosed that "attempts to gain unauthorized access to our IT systems or other attacks have in the past, in certain instances and to certain degrees, been successful" — a remarkably candid admission that now appears to reference incidents like this one.
Timeline of the Alleged Theft
The scheme allegedly unfolded over four years:
| Date | Event |
|---|---|
| June 2022 | Google security detects Soroor Ghandali downloading files to personal USB |
| August 2023 | Google revokes Samaneh Ghandali's access after flagging suspicious activity |
| September 2023 | Samaneh Ghandali terminated from Google; signs false affidavit |
| December 2023 | Night before Iran trip, Samaneh photographs 24 screens of husband's Qualcomm computer |
| December 2023 | While in Iran, stolen data accessed from personal devices |
| August 2025 | Qualcomm terminates Khosravi after discovering Snapdragon theft |
| February 19, 2026 | All three arrested, indicted on 14 felony counts |
Evading Detection
The defendants allegedly employed increasingly sophisticated methods to avoid Google's security systems:
Initial phase: Transferring files via Telegram and USB drives to third-party platforms outside the U.S.
After detection: Manually photographing computer screens rather than electronically transferring files—a low-tech approach designed to evade digital monitoring.
Cover-up: Deleting exfiltrated files and records, searching online for "how long a cell carrier retains messages," and signing false sworn affidavits to employers.
FBI Special Agent in Charge Sanjay Virmani described the conduct as "a calculated betrayal of trust," noting the defendants "took deliberate steps to evade detection and conceal their identities."
Ask Fintool AI AgentThe Iran Connection
The timing of these arrests is striking. President Trump signaled Thursday that he will decide within 10 days whether to launch military strikes against Iran over its nuclear program, sending oil prices to six-month highs.
According to the indictment, Khosravi served in the Iranian military before immigrating to the U.S. The night before the couple traveled to Iran in December 2023, Samaneh Ghandali allegedly photographed approximately 24 screens on Khosravi's work computer containing Qualcomm trade secrets. While in Iran, prosecutors say personal devices linked to the defendants were used to access the stolen material.
The case raises urgent questions about foreign national access to sensitive U.S. technology—particularly from adversary nations—as semiconductor competition becomes central to great power rivalry.
Company Responses
Google said it detected the theft through routine security monitoring and referred the case to law enforcement after conducting an internal investigation. "We have enhanced safeguards to protect our confidential information and immediately alerted law enforcement after discovering this incident," spokesperson José Castañeda said. "Today's indictments are an important step towards accountability and we'll continue working to ensure our trade secrets remain secure."
Google noted it has since implemented additional security measures, including blocking uploads to Telegram from corporate laptops.
Qualcomm and Intel have not issued public statements.
What's at Stake
The combined market capitalization of the three victim companies exceeds $4 trillion. The stolen intellectual property touches technologies at the core of modern computing:
- Google Tensor: Powers AI features in Pixel phones competing with Apple's Neural Engine
- Qualcomm Snapdragon: Powers most Android smartphones globally
- Intel processors: Underpin enterprise servers and personal computers
U.S. Attorney Craig H. Missakian emphasized the broader stakes: "Our office will continue to lead the way in protecting American innovation and we will vigorously prosecute individuals who steal sensitive advanced technologies for improper gain or to benefit countries that wish us ill."
What to Watch
- Legal proceedings: All three defendants face up to 10 years per trade secret count and 20 years for obstruction of justice
- Company disclosures: Whether Google, Qualcomm, or Intel provide additional detail in upcoming 10-Q filings
- Policy response: Whether Congress moves to tighten employment screening for sensitive technology roles
- Iran tensions: How this case factors into the broader U.S.-Iran confrontation
Ask Fintool AI Agent