Former Google Engineers Indicted for Chip Security Theft: Compliance Implications for Tech Firms

Federal prosecutors have unsealed indictments against two former Google engineers and a third associate for allegedly stealing confidential chip security and cryptography technologies, exposing significant gaps in corporate intellectual property safeguards. Samaneh Ghandali, Soroor Ghandali, and Mohammadjavad Khosravi face charges including conspiracy, trade secret theft, and obstruction of justice for allegedly exfiltrating sensitive technical data to unauthorized locations including Iran.

According to the Department of Justice indictment, while employed at Google, Samaneh Ghandali transferred hundreds of internal files containing trade secrets to third-party communication platforms accessible to the defendants. Her sister, Soroor Ghandali, similarly moved confidential documents that later appeared on personal devices. Khosravi, employed at another tech firm and married to Samaneh, allegedly coordinated access to proprietary information through his employer. The defendants reportedly employed sophisticated evasion tactics including document destruction, false statements to investigators, and photographing sensitive screens rather than direct file transfers.

This case transcends individual misconduct, revealing systemic vulnerabilities in trade secret management. Under the Defend Trade Secrets Act (18 U.S.C. § 1836) and Economic Espionage Act (18 U.S.C. § 1831), companies handling sensitive technical data must implement layered security protocols. Google confirmed implementing enhanced safeguards after discovering the breach, noting immediate law enforcement coordination. However, the incident demonstrates how insider threats can bypass conventional perimeter defenses.

Organizations should immediately audit three critical compliance areas:

1. Access Control Systems: Implement zero-trust architecture requiring multi-factor authentication and behavioral analytics for accessing proprietary technical data, particularly in semiconductor and cryptography development environments.

2. Data Loss Prevention (DLP): Deploy endpoint monitoring that flags unusual transfer patterns (e.g., mass uploads to cloud services) and detects indirect exfiltration methods like screen photography through optical character recognition analysis.

3. Third-Party Risk Management: Extend security protocols beyond direct employees to include contractors and partners with system access, requiring signed confidentiality agreements verified through regular audits.

The FBI emphasizes that protecting Silicon Valley innovation remains a national security priority. Companies should establish incident response plans meeting National Institute of Standards and Technology (NIST) SP 800-61 guidelines within 90 days, including forensic preservation workflows and mandatory employee training on trade secret identification under 18 U.S.C. § 1839. Quarterly penetration testing simulating insider threat scenarios is now considered industry best practice, with documented audits required for Defense Federal Acquisition Regulation Supplement (DFARS) compliance.

Failure to implement these measures risks not only intellectual property loss but also potential liability under international regulations like the EU Trade Secrets Directive for inadequate protection frameworks. As processor security becomes increasingly critical to national infrastructure, this case establishes a new benchmark for corporate accountability in safeguarding technological assets.