WASHINGTON (CN) – Federal prosecutors unsealed an indictment Wednesday against a woman who defected to Iran after working for the U.S. Defense Department on classified counterintelligence missions.
Filed in Washington, D.C., this morning, the 27-page indictment charges Monica Elfriede Witt, a 39-year-old U.S. citizen, with helping Iranian intelligence services target the same agents in the U.S. Intelligence Community who had once been her colleagues.
Witt is also alleged to have disclosed the code name and classified mission of a U.S. Department of Defense Special Access Program.
Authorities have issued an arrest warrant for Witt, who defected to Iran in 2013, but she remains at large.
A press release from the Justice Department details Witt’s more-than-decade-long service with the U.S. Air Force as an intelligence specialist and special agent with the Air Force Office of Special Investigations.
She separated from the military in 2008 and ended her contract work with the Defense Department two years later.
Armed with high-level security clearances, Witt “was deployed overseas to conduct classified counterintelligence missions,” according to the press release.
Witt is charged in the indictment alongside four Iranian nationals — Mojtaba Masoumpour, Behzad Mesri, Hossein Parvar and Mohamad Paryar — with conspiracy, attempts to commit computer intrusion and aggravated identity theft. As with Witt, the co-conspirators face arrest warrants but remain at large.
Prosecutors say the co-conspirators worked on behalf of the Iranian Revolutionary Guard Corps, using fictitious and imposter social media accounts in an attempt to deploy malware against targets to make infiltration of their computers and networks possible.
Mesri had access to computer and online infrastructure, according to the indictment, because he worked as a manager for an Iranian company that conducted computer intrusions against targets inside and outside the United States on behalf of the IRGC.
Prosecutors say Mesri began sending spearfishing messages to the IRGC's targets in late 2014. One of the imposter accounts that the hackers created between January and May 2015 was made in the name of former colleague of Witt's from the U.S. Intelligence Community. Prosecutors say the hackers used legitimate information and photos from the employee’s actual Facebook account, and that several of Witt’s former colleagues wound up accepting the account's “friend” requests.
“This case underscores the dangers to our intelligence professionals and the lengths our adversaries will go to identify them, expose them, target them, and, in a few rare cases, ultimately turn them against the nation they swore to protect,” Assistant Attorney General John Demers said in a statement. “When our intelligence professionals are targeted or betrayed, the National Security Division will relentlessly pursue justice against the wrong-doers.”
Separate from the indictment, the U.S. Treasury Department announced parallel economic sanctions Wednesday in connection to the case.
The sanctions relate to an IRGC-sponsored conference on “Hollywoodism” that was organized by a group called the Iranian New Horizon Organization.
Among other things, the event was aimed at condemning American moral standards and promoting anti-U.S. propaganda.
Prosecutors say Witt traveled to Iran to attend the conference in February 2012 and then successfully arranged to re-enter Iran in August 2013 with help from an unnamed individual who is a dual citizen of the United States and Iran.
Given housing and computer equipment by the Iranian government, Witt began divulging U.S. classified information. Prosecutors say she also began researching her former Intelligence Community colleagues, and “using that information to draft “target packages” against these U.S. agents.”
“Treasury is taking action against malicious Iranian cyber actors and covert operations that have targeted Americans at home and overseas as part of our ongoing efforts to counter the Iranian regime’s cyberattacks,” Treasury Secretary Steven Mnuchin said in a statement. “Treasury is sanctioning New Horizon Organization for its support to the IRGC-QF. New Horizon hosts international conferences that have provided Iranian intelligence officers a platform to recruit and collect damaging information from attendees, while propagating anti-Semitism and Holocaust denial. We are also sanctioning an Iran-based company that has attempted to install malware to compromise the computers of U.S. personnel.”
Follow @bleonardcns
Subscribe to Closing Arguments
Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.
