The US has charged a former Air Force intelligence specialist with spying for Iran, according to an indictment unsealed in federal court Wednesday.
Monica Witt, who was also a former counterintelligence officer for the Air Force Office of Special Investigations, defected to Iran in 2013, according to the indictment, and remains at large.
DOJ alleges that Witt was targeted and recruited by Iran, and that after she defected, she allegedly revealed to Iran the existence of a “highly classified intelligence collection program” and the identify of a US intelligence officer, “thereby risking the life of this individual,” Assistant Attorney General John Demers said Wednesday.
“It is a sad day for America when one of its citizens betrays our country,” Demers told reporters. “It is sadder still when this person, as a member of the American armed forces, previously invoked the aid of God to bear true faith and allegiance to the Constitution of the United States and to defend her country against foreign enemies. Monica Witt is alleged to have done just this.”
From around January 2012 to around May 2015, in Iran and elsewhere outside the US, Witt conspired with Iranians to provide “documents and information relating to the national defense of the United States, with the intent and reason to believe that the same would be used to the injury of the United States and to the advantage of Iran,” the indictment reads.
Witt, 39, also “created target packages for use by Iran” against US government agents and counterintelligence officers, the indictment alleges.
Iranian government officials provided Witt with “goods and services, including housing and computer equipment,” in order to facilitate her work on behalf of the government of Iran after her defection, the indictment said.
The indictment also charges four Iranians with conspiracy, attempts to commit computer intrusion and aggravated identity theft as part of a 2014 – 2015 effort to target “through and other cyber-enabled means, at least eight US government agents, all of whom at one time worked or interacted with Monica Witt,” Demers said.
‘Cyber conspirators’
The Iranians, whom the indictment calls the “cyber conspirators” worked on behalf of the Iranian Revolutionary Guard Corps, the powerful branch of the military founded by Ayatollah Khomeini after Iran’s 1979 revolution.
Demers told reporters today that Witt allegedly worked with Iran to research and “create target packages” that “enabled the Government of Iran to identify, track, and neutralize US counterintelligence agents.”
Using phishing emails and fake Facebook accounts created in the name of one of Witt’s former colleagues, these Iranian agents sent friend requests to some of her other former colleagues. Their goal was to lure them into clicking on malware links that “would have provided the Cyber Conspirators with covert, persistent access” to the target’s computer and any associated network, the indictment said.
Another phishing effort involved sending Witt’s former colleagues messages containing a link that appeared to be to an international news outlet and a short note asking if the article was about the recipient. If clicked, the link would lead to a page controlled by the “Cyber Conspirators.”
Frustrated with ‘Iranian suspicion’
The indictment gives the barest sketch of Witt’s path from Air Force special agent to alleged traitor, but it reproduces email messages that show she considered approaching Russia as well. “I am starting to get frustrated at the level of Iranian suspicion,” she wrote at one point to her Iranian contact.
Witt was sworn in as a special agent around August 1997 and continuously held the position until in or around March 2008, when she became a government contractor for the intelligence community until about August 2010, according to the indictment.
She was trained in the Persian language Farsi and granted access to top-secret and “sensitive compartmented” national defense information that included the United States’ foreign intelligence and counter intelligence operations and the true names of its intelligence agents and its sources overseas.
From 2003 and 2008, Witt’s work involved counterintelligence assignments that took her to the Middle East. The indictment doesn’t specify the countries where Witt was assigned to work, but it lays out some of her contacts with Iran in recent years, including her email exchanges with a dual American-Iranian citizen, identified only as “Individual A.”
Described as a “spotter and assessor,” Individual A worked for the IRGC to identify people who may have access to intelligence and counterintelligence and determine their potential value as sources.
‘u were well trained’
The indictment quotes one exchange on or about October 17, 2012, when Individual A wrote to Witt saying, “should i thank the sec of defense . . u were well trained.”
Witt replies, “LOL thank the sec of defense? For me? Well, I loved the work, and I am endeavoring to put the training I received to good use instead of evil. Thanks for giving me the opportunity.”
The indictment also details her travel to Iran in February 2012, where she took part in a “Hollywoodism” conference, an IRGC-sponsored event aimed at condemning US moral standards and promoting anti-US propaganda.
Witt also appeared in one or more videos, in which she was identified as a US veteran and made comments critical of the US government, knowing the videos would be broadcast on Iranian TV. That same month, the ceremony marking Witt’s conversion to Islam was broadcast on Iranian television.
In May 2012, the FBI warned Witt that she was a target for recruitment by Iranian intelligence services. Witt responded that if she ever returned to Iran, she would refuse to provide any information about her work. The next month, Individual A traveled to the US and hired Witt to work as an assistant on an “anti-American propaganda film” that was later aired in Iran.
‘Better luck with Russia’
In February 2013, Witt traveled again to Iran for another “Hollywoodism” conference, made more videos critical of the US government and met with members of the IRGC, telling them she wanted to emigrate to Iran, the indictment said.
“If all else fails, I just may go public with a program and do like Snowden :)” Witt wrote to Individual A on June 23. On or about June 30, 2013, Witt wrote again to Individual A and said that she had gone to the Iranian embassy in Kabul, Afghanistan, and “told all.”
“They are going to get back to me on if they can help me very soon before I leave” Witt continued. “I told them I am down to little choices and will be traveling to other areas to request assistance.”
Individual A wrote back on July 1, telling Witt that they had been “talking to people until about 2 in the morning about your case. I have several different channels working on it, but to be honest with one of them, he said they got suspicious that on one hand, you said u had no money and on the other hand u r going from country to country.”
Later that day, Witt replied, “:( Grrr………..No matter what, they are just going to be suspicious, right? . . . I just hope I have better luck with Russia at this point. I am starting to get frustrated at the level of Iranian suspicion.”
Two days later, on July 3, 2013, Witt wrote that, “I think I can slip into Russia quietly if they help me and then I can contact wikileaks from there without disclosing my location.”
‘MONICA ARE YOU THERE????’
At the end of the month, on or about July 30, 2013, Individual A wrote, “MONICA ARE YOU THERE????. . .The name of the [Iranian] ambassador is Mr. Shehr Doost. His mobile is 009929 196[xxxxx]. Right now he is not in Dushanbe, but you are to call him at 7pm and then go and see him. When you call him on the phone just say that you are the one who is suppose (sic) to see him today for a visa and that’s it.”
Witt wrote back: “Okay. Quick update. They are giving me money to head to Dubai. I will wait to get the approval there and get it from the embassy in Dubai. They are so kind…even taking me to the airport.”
On or about August 25, 2013, Witt sent Individual A an email titled “My Bio and Job History” that included a typewritten narrative of Witt’s bona fides and “conversion narrative,” as well as a chronological listing of her work history and a copy of her “Certificate of Release or Discharge From Active Duty.”
Just nine minutes later, Individual A forwarded Witt’s email and its attachments, without comment, to an email address associated with Iran.
Between July 2013 and on or about August 28, 2013, Witt spent time conducting multiple searches on Facebook for the names of her former fellow counterintelligence agents, including those targeted by the cyber conspirators, according to the indictment.
On or about August 28, 2013, Witt sent Individual A an email saying that she was about to board her flight from Dubai to Tehran — her defection was underway.
Punctuating her message with a smiley face emoji, she wrote, “I’m signing off and heading out! Coming home.”
