Who Are the Alleged Iranian Spies in Silicon Valley? Ghandali Sisters, And More

Alleged Iranian spies are already in the US - and infiltrating Silicon Valley: Samaneh Ghandali has been charged with allegedly stealing secrets from Google and other Silicon Valley tech companies

In 2026, a high-profile federal case has put three Iranian-born engineers under intense scrutiny in the United States. Prosecutors allege that Samaneh Ghandali, Soroor Ghandali, and Mohammadjavad Khosravi used their positions inside leading tech companies to access and transfer sensitive chip design and security data.

The case has quickly drawn attention not only because of the individuals involved, but also because it highlights a growing concern: how highly skilled insiders can become the most effective channel for extracting valuable technology.

Who is Samaneh Ghandali?

At the center of the case is Samaneh Ghandali, 41, the most senior and experienced of the three.

She built a strong academic and professional profile in computer engineering. After completing undergraduate and master’s degrees in Iran, she moved to the United States and earned a Ph.D. in computer engineering from the University of Massachusetts Amherst in 2019. Her research focused on hardware security, specifically hidden vulnerabilities in integrated circuits.

She joined Google as an intern in 2018 and transitioned into a full-time role in 2019. By 2021, she was working in silicon security engineering, a highly sensitive area involving processor protection, cryptography, and system-level defenses.

According to prosecutors, this role gave her access to restricted internal data related to chip architecture and security systems. Investigators allege she transferred hundreds of files over a period of nearly two years, using external communication platforms not authorized by her employer.

Who is Soroor Ghandali?

Soroor Ghandali is accused along with her sister and brother-in-law of stealing tech secrets from Silicon Valley companies

Soroor Ghandali, 32, Samaneh’s younger sister, followed a similar academic path.

She completed her education in computer science in Iran before moving to the United States for graduate study at Santa Clara University around 2020. Her academic work included research in cybersecurity and hardware-based security systems.

With help from her sister, she secured an internship at Google in 2022. Although she did not remain at the company long-term, prosecutors allege she accessed and transferred dozens of sensitive files during her time there.

Her role appears smaller in scale compared to Samaneh’s, but authorities say she was still part of the same network of activity involving shared access and coordinated file transfers.

Who is Mohammadjavad Khosravi?

Kaveh Afrasiabi, a prominent professor and author, was charged with acting as a foreign agent for Iran in 2020. He pleaded not guilty, and was given a full pardon by President Joe Biden in 2023

The third defendant, Mohammadjavad Khosravi, 40, is Samaneh’s husband and also a trained computer hardware engineer.

He holds advanced degrees in computer engineering and completed a Ph.D. in the United States around 2021. His research background includes secure data techniques and image-based information hiding, both relevant to cybersecurity.

Before moving to the U.S., he reportedly served in the Iranian army and reached the rank of lieutenant. After graduation, he applied multiple times for roles at major tech companies but was not hired by Google.

Instead, he joined another semiconductor company in 2022, where he worked on advanced mobile processors. Prosecutors allege that he later possessed or accessed confidential materials from that employer, some of which overlapped with the broader investigation.

Shahabeddin Ghandali, a former chief executive of the Teachers Investment Fund Corporation in Iran (center), is the father of two sisters who were arrested for allegedly stealing trade secrets in Silicon Valley

How the Alleged Operation Worked

What makes this case unusual is how closely connected the three individuals were. They lived together in San Jose and shared both family ties and technical expertise.

Prosecutors describe a pattern of behavior that relied on insider access rather than external hacking. Instead of breaking into systems, the defendants allegedly used legitimate credentials to obtain sensitive data, then moved it outside company networks.

The methods described include:

• Uploading files to third-party messaging platforms
• Transferring data across personal devices
• Organizing materials into labeled project folders
• Taking photos of computer screens to avoid detection

In one key incident, authorities allege that just before traveling to Iran in late 2023, Samaneh photographed sensitive information from her husband’s work computer. Some of that data was later accessed from abroad.

Why This Case Matters

This case is not just about three individuals. It reflects a broader shift in how technology-related intelligence risks are emerging.

Modern espionage does not always involve covert agents or dramatic operations. In many cases, it involves highly educated professionals working inside global companies, with legitimate access to critical systems.

Silicon Valley is a particularly attractive target because of its role in developing advanced processors, artificial intelligence, and cybersecurity tools. Information from these sectors can have both commercial and national security value.

Legal Status and What Comes Next

All three defendants have pleaded not guilty. At this stage, they are charged with offenses including theft of trade secrets and obstruction, not convicted espionage.

The outcome of the case will depend on evidence presented in court, including digital records, access logs, and communications.

Regardless of the final verdict, the case has already raised difficult questions for the tech industry: how to balance openness and global talent with the need to protect sensitive innovation.