Monica Elfriede Witt, a former counterintelligence officer with the U.S. Air Force, has been charged with giving the Iranian government classified information in an indictment unsealed today. The U.S. Department of Justice (DOJ) says that information provided by Witt aided Iranian hackers in a phishing campaign directed against her former colleagues in the American intelligence community.
The 39-year-old Witt worked for the Air Force until 2008 and as a Department of Defence contractor until 2010, according to details released by the DOJ. The U.S. government claims that Witt travelled to Iran in 2012 for a conference and then defected to the country in 2013. The indictment states that Witt once held Top Secret security clearance and had access to “details of ongoing counterintelligence operations, true names of sources, and the identities of U.S. agents.”
The DOJ claims that Witt was given computer equipment and housing accommodations by the Iranian regime in exchange for her cooperation in mounting a campaign against U.S. intelligence. She also allegedly used her knowledge of the U.S. intelligence community to help Iranian hackers target other Americans with spyware.
Using Witt’s information, the hackers allegedly used Facebook to make fake accounts that friended American spies and enticed them to click phishing links. From the DOJ news release:
In one such instance, the Cyber Conspirators created a Facebook account that purported to belong to a [U.S. Intelligence Community] employee and former colleague of Witt, and which utilised legitimate information and photos from the [U.S. Intelligence Community] employee’s actual Facebook account. This particular fake account caused several of Witt’s former colleagues to accept “friend” requests.
But Witt wasn’t the only one charged today. The DOJ is also charging the Iranian hackers she allegedly worked with.
“Four Iranian cyber hackers are also charged with various computer crimes targeting members of the U.S. intelligence community who were Ms. Witt’s former colleagues,” Assistant Attorney General John Demers said in a statement.
“This case underscores the dangers to our intelligence professionals and the lengths our adversaries will go to identify them, expose them, target them, and, in a few rare cases, ultimately turn them against the nation they swore to protect,” Demers continued. “When our intelligence professionals are targeted or betrayed, the National Security Division will relentlessly pursue justice against the wrong-doers.”
It’s not mentioned in the DOJ release, but the FBI issued a missing person poster for Witt sometime around 2014, complete with photos of her. The missing person poster did nothing to suggest that Witt was wanted for national security reasons. It simply said that her “friends” had reported her missing. (This poster was taken down shortly after today’s announcement, and the FBI then released a wanted poster.)
Witt also popped up in a story published by Iranian state media in June of 2016. The article includes a photo of Witt converting to Islam from Christianity and says that Witt participated in the Occupy Wall Street protests of the early 2010s. That timeline would match up with Witt’s departure from the American defence community in 2010.
Needless to say, the intelligence community is not happy with Witt’s alleged betrayal.
“The alleged actions of Monica Witt in assisting a hostile nation are a betrayal of our nation’s security, our military, and the American people,” Special Agent Terry Phillips of the Air Force Office of Special Investigations said in a statement.
“While violations like this are extremely rare, her actions as alleged are an affront to all who have served our great nation.”