A former US air force intelligence officer who defected to Iran in 2013 has been charged with espionage, giving away the identity of a US agent and other secrets.
Monica Witt, aged 39, was a cryptologist and a counter-intelligence investigator for the US air force for more than 10 years before working as an intelligence analyst for the defence contractor Booz Allen Hamilton for five months in 2008 and doing other private sector work.
According to charges unsealed on Wednesday by the justice department, she defected to Iran in August 2013, taking with her details of US counter-intelligence agents she had worked with who were then targeted by Iranian hackers, four of whom are named in the indictment and charged alongside Witt.
“It is a sad day for America when one of its citizens betrays our country,” the assistant attorney general for national security, John Demers, said.
Demers said: “Ms Witt was recruited by Iran as part of a program that targets former intelligence officers and others who have held security clearances. Following her defection to Iran in 2013, she is alleged to have revealed to the Iranian government the existence of a highly classified intelligence collection program and the true identity of a US intelligence officer, thereby risking the life of this individual.”
The indictment suggests Witt defected for ideological motives, and was recruited when she visited Iran in February 2012 to attend a conference on US cultural influence called “Hollywoodism”.
The conference was organised by an group called New Horizon, which was put under US sanctions on Wednesday for allegedly serving as a front from the Quds Force, the external arm of the Islamic Revolutionary Guard Corps (IRGC-QF).
“New Horizon Organization hosts international conferences that serve as a platform for the IRGC-QF to recruit and collect intelligence from attendees,” a US treasury statement said. Witt is alleged to have made videos at that time identifying herself as a US veteran, criticising the US government and publicly converting to Islam.
Witt was warned by the FBI that she was a target for recruitment as an Iranian spy, and she said she would not disclose information about her time in air force intelligence. But she went on to help make a propaganda video and return to Iran for a second Hollywoodism conference in February 2013, where she allegedly approached the IRGC and offered to defect.
Over the next few months, before she defected, her point of contact is alleged to be an Iranian woman, referred to as individual A. At one point Individual A flatters her by saying: “Should I thank the sec [secretary] of defence … u were well trained.”
Witt replied: “LOL thank the sec of defence? For me? Well, I loved the work, and I am endeavouring to put the training I received to good use instead of evil. Thanks for giving me the opportunity.”
In July 2013, according to the indictment, individual A told Witt that Iranian officials were suspicious of her and wondered how she managed to travel around Asia while claiming to have no money.
Witt replied: “Grrr … No matter what, they are just going to be suspicious, right? I just hope I have better luck with Russia at this point. I am starting to get frustrated at the level of Iranian suspicion.”
The indictment quotes her as threatening to “slip into Russia quietly” and contact the WikiLeaks organisation from there. She had already threatened to “do like Snowden”, a reference to the NSA contractor and whistleblower Edward Snowden, and go public with what she knew about US intelligence operations.
Prosecutors say she eventually defected to Iran on 28 August 2013, flying to Tehran from Dubai, writing to individual A “I’m signing off and heading out! Coming home.”
An FBI missing person poster from the time shows two pictures of Witt wearing a headscarf and saying she was last known to be traveling and working in south-west Asia.
The FBI alert read: “She was last believed to be in either Afghanistan or Tajikistan in July 2013, where she was working as an English teacher. Witt may have also traveled to the United Arab Emirates or Iran, where she had previously traveled on at least two other occasions.
“The last known contact with her is believed to have been in June 2013. She had been working overseas for more than a year. Witt’s friends recently reported her missing after not receiving any response from her in several months.”
In the few weeks before her defection, Witt is alleged to have conducted searches on Facebook for the names of former fellow counter-intelligence agents, and the spouse of one of them. On arrival in Iran, the Tehran government is said to have provided her with housing and computer equipment for her to help track down US intelligence officers.
The indictment alleges that between January 2014 and May 2015, she created “target packages”, or dossiers on her former counter-intelligence colleagues, including the identity of an undercover agent and a secret US counter-intelligence operation against a particular target, which is not named.
Over the same period, the four Iranians charged in the same indictment, named as Mojtaba Masoumpour, Behzad Mesri, Hossein Parvar and Mohamad Paryar, as well as unnamed co-conspirators, are alleged to have mounted hacking attacks against the current and former US intelligence agents Witt had identified.
They are said to be charged with using malware, phishing attacks and false identities, including one called Bella Wood on Facebook, who successfully friended one of the US agents while they were deployed as a military intelligence officer in Kabul.
That was followed by an email offering a link to a “pretty card” which, if opened, would have taken the intelligence officers to an Iranian-controlled server.