U.S. Charges Former Air Force Officer With Spying for Iran

WASHINGTON (Reuters) -
Assistant Attorney General for National Security John Demers. (AP Photo/Jacquelyn Martin/File)

The United States on Wednesday charged former U.S. Air Force intelligence officer Monica Witt with helping Iran in a cyber-spying operation that targeted her former colleagues.

As part of its action, the United States also charged four Iranian nationals who it said were involved in the cyber attacks.

Washington additionally sanctioned two Iran-based firms — New Horizon Organization and Net Peygard Samavat Company — and several individuals associated with them.

U.S. officials said Witt supplied classified information about U.S. intelligence officers she had worked with in her military career after defecting to Iran in 2013.

She remains at large.

Witt, 39, was recruited for the operation after attending two conferences in Iran organized by New Horizon, which supported efforts by Iran’s Revolutionary Guard’s Quds Force to recruit and collect intelligence from foreign attendees, the officials said.

Witt served as a counterintelligence officer in the Air Force from 1997 until 2008 and worked as contractor for two years after that.

During that time, she was granted high-level security clearances, learned Farsi at a U.S. military language school, and was deployed overseas for counterintelligence missions in the Middle East.

Using information supplied by Witt, Net Peyguard launched a cyber campaign in 2014 that targeted her former colleagues using fictional social media accounts and other forms of deception to try to install malware that would be able to track their keystrokes and other activity, according to an indictment unsealed by the U.S. Justice Department.

Net Peygard targeted current and former U.S. government and military personnel with a malicious cyber campaign, officials said.

Witt faces spying and conspiracy charges.

Iranian nationals Mojtaba Masoumpour, Behzad Mesri, Hossein Parvar and Mohamad Paryar were charged with computer intrusion and aggravated identity theft.