Silicon Valley engineers charged with trade secret theft

What happened

Three Silicon Valley engineers were arrested in San Jose, California, on 19 February 2026 after a federal grand jury indicted them over alleged trade secret theft from Google and other technology companies, the US Department of Justice said.

Samaneh Ghandali, 41, her husband Mohammadjavad Khosravi, 40, and her sister Soroor Ghandali, 32, appeared in federal court that afternoon. All three live in San Jose. Khosravi is also known as Mohammad Khosravi.

The indictment, filed on 18 February and unsealed the following day, includes charges of conspiracy to steal trade secrets, theft and attempted theft of trade secrets, and obstruction of justice. The defendants are presumed innocent unless proven guilty beyond reasonable doubt.

According to the Justice Department’s account of the indictment, the defendants used jobs involving mobile computer processors to obtain confidential information. Prosecutors allege they then moved documents to locations where their employers had not authorised them to be held, including personal devices, other employers’ equipment and Iran.

The material allegedly included trade secrets concerning processor security and cryptography. These technologies help protect computing hardware and information; cryptography uses mathematical methods to secure data.

The Justice Department’s release is the source of this report. It presents the prosecution’s allegations and does not include responses from the defendants or their lawyers.

The background

Samaneh Ghandali and Soroor Ghandali worked at Google before joining another technology business identified in the indictment as Company 3. Khosravi worked at a separate business identified as Company 2. Neither of those companies is named in the release.

While employed by Google, Samaneh Ghandali allegedly transferred hundreds of files, including trade secrets, to channels on a third-party communications platform. Prosecutors said the channels bore the defendants’ first names. Soroor Ghandali is accused of transferring numerous Google files, also including trade secrets, to those channels.

The indictment alleges that Google trade secrets were subsequently copied to personal devices, Khosravi’s Company 2 work device and Soroor Ghandali’s Company 3 work device. The communications platform is not identified in the release.

Google’s internal security systems detected Samaneh Ghandali’s activity, and the company withdrew her access to its resources in August 2023, according to prosecutors. She then allegedly signed an affidavit stating that she had not shared Google’s confidential information outside the company. An affidavit is a written statement sworn to be true.

Prosecutors say she and Khosravi subsequently searched for information about deleting communications and other data. Those searches allegedly included how long a mobile phone provider retained messages that could be produced in court.

The couple continued to access Google trade secrets held on their personal devices, according to the indictment. Over several months, they allegedly used a camera to capture hundreds of computer screens displaying confidential information belonging to Google and Company 2.

On the night before the couple travelled to Iran in December 2023, Samaneh Ghandali allegedly took about 24 photographs with her mobile phone of Company 2 trade secrets displayed on Khosravi’s work computer. Prosecutors said a personal device associated with her accessed those photographs while in Iran, and Khosravi accessed other Company 2 trade secret information there.

The release does not identify an Iranian recipient or allege that the Iranian government directed the defendants. Its specific account of the December trip concerns access to information while the couple were in the country.

Prosecutors also allege that the defendants sought to conceal their conduct by giving employers false signed affidavits and destroying copied files and other electronic records. Photographing screens rather than transferring complete documents was another alleged means of avoiding detection.

For organisations, those allegations distinguish two forms of data removal: copying an electronic file and creating a new image of information displayed on a screen. They also show why withdrawing access to company systems cannot, by itself, establish whether earlier copies remain elsewhere.

The focus on employee access has a parallel in the separate case of an industrial company engineer charged over alleged data extortion. In that case, prosecutors alleged misuse of an administrator account to disrupt an employer’s systems. The alleged conduct differs, but both cases concern access entrusted to workers rather than an outsider first breaking into a network.

What people are saying

US Attorney Craig H. Missakian said his office would pursue people accused of taking sensitive advanced technology for improper gain or to benefit countries hostile to the United States. He described protecting American innovation as a priority for prosecutors.

Sanjay Virmani, the FBI special agent in charge, said the alleged transfer methods involved deliberate efforts to avoid detection and conceal the defendants’ identities. He said the FBI would continue working with private-sector partners to protect technologies important to the economy and national security.

What happens next

At the time of the announcement, the defendants were scheduled to return to court on 20 February 2026 for identification of counsel before US Magistrate Judge Susan van Keulen. The release does not report the outcome of that hearing.

If convicted, each defendant could face up to 10 years in prison and a $250,000 fine for each count involving conspiracy, theft or attempted theft of trade secrets. The obstruction charge carries a maximum of 20 years in prison and a $250,000 fine.

Those figures are statutory maximums, not predicted sentences. Any sentence would be decided by the court after considering federal sentencing guidelines and the applicable sentencing law.

The FBI investigated the case. The National Security and Special Prosecutions Section of the US Attorney’s Office for the Northern District of California is handling the prosecution.