By Andy Sullivan and Lisa Lambert
WASHINGTON, Feb 13 (Reuters) – U.S. authorities on Wednesday charged former Air Force intelligence officer Monica Witt with helping Iran launch a cyber-spying operation that targeted her former colleagues after she defected from the United States.
The U.S. Justice Department said Witt, 39, assembled dossiers on eight U.S. military intelligence agents she had worked with for Iranian hackers, who then used Facebook and e-mail to try to install spyware on their computers.
She defected to Iran in 2013 and presumably still lives there, U.S. officials said.
“She decided to turn against the United States and shift her loyalty to Iran,” said Jay Tabb, the FBI’s executive assistant director for national security. “Her primary motivation appears to be ideological.”
Washington also charged four Iranian nationals who it said were involved in the cyberattacks. U.S. officials also imposed sanctions on an Iran firm, Net Peygard Samavat Company, that it said conducted the hacking operation, and Iranian events company, New Horizon Organization, that it said works to recruit foreign attendees.
Witt faces two counts of delivering military information to a foreign government and one count of conspiracy.
According to an indictment unsealed on Wednesday, Witt served as a counterintelligence officer in the Air Force from 1997 until 2008 and worked as contractor for two years after that.
During that time, she was granted high-level security clearances, learned Farsi at a U.S. military language school, and was deployed overseas for counterintelligence missions in the Middle East.
Witt appears to have turned against the United States some time before February 2012, when she traveled to Iran to attend a New Horizon conference that featured anti-U.S. propaganda.
When warned by the FBI that trip that Iranian intelligence services were trying to recruit her, Witt allegedly promised that she would not talk about her counterintelligence work if she returned to Iran.
But later that year, she helped an unnamed Iranian-American official produce an anti-American propaganda film. “I am endeavoring to put the training I received to good use instead of evil,” she told that person in an email.
In February 2013, Witt returned to Iran for another New Horizon conference and told officials there that she wanted to emigrate.
She faced resistance for months.
“I just hope I have better luck with Russia at this point,” Witt wrote her Iranian-American contact in July. “I am starting to get frustrated at the level of Iranian suspicion.”
She successfully defected in August 2013, after providing a resume and “conversion narrative” to her contact. “I’m signing off and heading out! Coming home,” she wrote as she was about to board her flight from Dubai to Tehran.
Provided with housing and computer equipment by the Iranian government, Witt tracked down U.S. counterintelligence agents she used to work with on Facebook, the indictment said, and disclosed the classified identity of at least one of those agents, according to the charges.
Iranian hackers then set up fake Facebook personas to befriend those agents and attempt to install spyware that would track their computer activity, the indictment said. The hackers managed to gain access to a Facebook group of U.S. government agents.
Iranian nationals Mojtaba Masoumpour, Behzad Mesri, Hossein Parvar and Mohamad Paryar were charged with computer intrusion and aggravated identity theft.
Mesri, Masampour and Parvar also face sanctions for their involvement with Net Peygard, according to the U.S. Treasury Department.
The Air Force has adjusted its security measures to prevent similar incidents in the future, said Terry Phillips, a special agent in the Air Force’s Office of Special Investigations.
(Additional reporting by Makini Brice; Editing by Doina Chiacu, Steve Orlofsky and Tom Brown)
