FBI: Engineer Stole, Emailed Tech Secrets to Iran

The U.S. government continues to deploy a full-court press when it comes to trade secret theft.

The latest instance, the arrest of a Michigan-based engineer, was outlined last week in a criminal complaint unsealed in a Detroit federal court.

According the October 31 complaint, the suspect, 42-year old Amin Hasanzadeh, stole sensitive data from his employer and funneled it to his brother who's worked at multiple Iranian companies that specialize in nuclear weapons.

The data, which belonged to an unidentified company that serves the defense, aerospace and auto industry, pertained to an aerospace industry supercomputer.

Per reports, Hasanzadeh's brother, Sina, worked at several companies connected to Iran's military programs, including the Bashir Industrial Complex, a defense ministry affiliate.

Just six days into employment at the company, Hasanzadeh began sending his brother files via email. Between January 2015 and June 2016, Hasanzadeh, who worked as a senior hardware engineer, sent information about the company's products, trade secrets, and details on a prototype it was producing - "an electronic component for a high-speed digital board" for one of the company's products - according to the complaint.

While the company wasn't explicitly named in the complaint, outlets, including The Detroit News and NPR, did some sleuthing - looking up Hasanzadeh's LinkedIn profile - to discover the company in question is a Detroit-based company.

The company protected its data through a series of non-disclosure agreements; on top of that, employees were told they were not allowed to take work home or use personal email accounts to transfer company data. Still though, Hasanzadeh was able to. According to the complaint, he managed to transfer project documents and data, including schematics, notes, technical drawings, and zip files via email. Puzzlingly, Hasanzadeh was able to do this, repeatedly, for more than a year.

In addition to his brother, it appears Hasanzadeh also sent sensitive information to his wife, who was enrolled as a doctoral student at the University of Michigan. Upon investigation, a review of her cloud storage account revealed thousands of the company's documents, including internal company component lists, schematics, and diagrams.

While Hasanzadeh is a lawful permanent resident of the US, he's also being accused of fraud; according to the complaint, he misused visas, permits and other documents to conceal the fact that he previously worked for the Iranian military.

Simply telling Hasanzadeh not to do something and having him sign an NDA clearly wasn't enough in this instance. While the complaint is hazy on details, it sounds like Hasazadeh had very little difficulty taking data and sending it outside the company via email, raising a question what, if any, mechanisms were in place to prevent doing so in the first place.