Corporate espionage rarely makes for a simple whodunit, and it becomes even more high-stakes when the alleged target involves Google and sensitive technology tied to its Tensor chips. Federal prosecutors in Northern California say three Silicon Valley engineers are now facing serious charges after an investigation into the theft and attempted theft of trade secrets, along with allegations of a cover-up.
According to a press release from the U.S. Attorney’s Office for the Northern District of California, Samaneh Ghandali, Mohammadjavad Khosravi, and Soroor Ghandali have been indicted on charges that include conspiracy to commit trade secret theft from Google and other major tech companies, theft and attempted theft of trade secrets, and obstruction of justice. All three were arrested Thursday and appeared in federal court in San Jose.
Prosecutors say Samaneh Ghandali and Soroor Ghandali are sisters. Both previously worked at Google, with Samaneh employed as a hardware engineer and Soroor serving as an intern. After leaving, they moved on to another employer referenced in court records only as “Company 3.” Khosravi, Samaneh Ghandali’s husband, worked at a separate firm identified as “Company 2” and, according to the case details, had applied to Google multiple times but was rejected.
The indictment alleges the trio obtained confidential and sensitive documents and then exfiltrated them to unauthorized locations. The materials reportedly included trade secrets related to processor security, cryptography, and other technologies. Prosecutors claim the documents were moved to third-party and personal locations, including work devices tied to each other’s employers, and in some instances transferred to Iran.
One of the key allegations centers on the two sisters, who are accused of moving hundreds of files—including Google trade secrets—into accounts on a third-party communications platform. Authorities say those files were later copied to personal devices, to Khosravi’s work device at Company 2, and to Soroor Ghandali’s work device at Company 3.
Investigators also claim the defendants attempted to conceal what they were doing. The indictment describes efforts to hide digital trails, including submitting false affidavits to affected companies and attempting to delete or destroy exfiltrated content and evidence of its movement. In another striking allegation, prosecutors say they sometimes avoided transferring entire documents electronically by manually taking photos of screens displaying the information.
One incident described in the indictment took place just before international travel. Prosecutors allege that on the night before Samaneh Ghandali and Khosravi traveled to Iran in December 2023, Samaneh Ghandali used her mobile phone to capture about 24 photos of Khosravi’s work computer screen showing Company 2 trade secret information. While in Iran, authorities say a personal device linked to Samaneh Ghandali accessed those images, and Khosravi accessed other Company 2 trade secret material.
While the case is still unfolding, the mention of “processor security and cryptography” is particularly notable in the context of Google’s Pixel security architecture. Google’s Tensor platform has been paired with dedicated security hardware designed to protect sensitive user data, such as encryption keys and biometric information. That security stack includes features like a security coprocessor and isolated environments intended to keep critical controls and secrets protected even if other parts of the system are compromised. With future Tensor generations expected to continue expanding hardware security, trade secrets in this area can be among the most valuable targets in the mobile chip industry.
Because the indictment references transfers to Iran and focuses on security and cryptographic technologies, the story is likely to draw attention well beyond Silicon Valley. However, any broader conclusions about who might ultimately benefit remain speculative until more evidence is presented publicly. For now, what’s clear is that prosecutors are treating the alleged theft, attempted theft, and obstruction as a major federal case—and more details should emerge as court proceedings continue.
