US charges former Air Force intelligence specialist with spying for Iran

The US has charged a former Air Force intelligence specialist with spying for Iran, according to an indictment unsealed in federal court. Monica Witt defected to Iran in 2013, according to the indictment, and remains at large.

Posted: Feb 13, 2019 1:34 PM
Updated: Feb 13, 2019 2:15 PM


The US has charged a former Air Force intelligence specialist with spying for Iran, according to an indictment unsealed in federal court Wednesday.

Monica Witt, who was also a former counterintelligence officer for the Air Force Office of Special Investigations, defected to Iran in 2013, according to the indictment, and remains at large.

DOJ alleges that Witt was targeted and recruited by Iran, and that after she defected, she allegedly revealed to Iran the existence of a 'highly classified intelligence collection program' and the identify of a US intelligence officer, 'thereby risking the life of this individual,' Assistant Attorney General John Demers said Wednesday.

'It is a sad day for America when one of its citizens betrays our country,' Demers told reporters. 'It is sadder still when this person, as a member of the American armed forces, previously invoked the aid of God to bear true faith and allegiance to the Constitution of the United States and to defend her country against foreign enemies. Monica Witt is alleged to have done just this.'

From around January 2012 to around May 2015, in Iran and elsewhere outside the US, Witt conspired with Iranians to provide 'documents and information relating to the national defense of the United States, with the intent and reason to believe that the same would be used to the injury of the United States and to the advantage of Iran,' the indictment reads.

Witt, 39, also 'created target packages for use by Iran' against US government agents and counterintelligence officers, the indictment alleges.

Iranian government officials provided Witt with 'goods and services, including housing and computer equipment,' in order to facilitate her work on behalf of the government of Iran after her defection, the indictment said.

The indictment also charges four Iranians with conspiracy, attempts to commit computer intrusion and aggravated identity theft as part of a 2014 - 2015 effort to target 'through and other cyber-enabled means, at least eight US government agents, all of whom at one time worked or interacted with Monica Witt,' Demers said.

'Cyber conspirators'

The Iranians, whom the indictment calls the 'cyber conspirators' worked on behalf of the Iranian Revolutionary Guard Corps, the powerful branch of the military founded by Ayatollah Khomeini after Iran's 1979 revolution.

Demers told reporters today that Witt allegedly worked with Iran to research and 'create target packages' that 'enabled the Government of Iran to identify, track, and neutralize US counterintelligence agents.'

Using phishing emails and fake Facebook accounts created in the name of one of Witt's former colleagues, these Iranian agents sent friend requests to some of her other former colleagues. Their goal was to lure them into clicking on malware links that 'would have provided the Cyber Conspirators with covert, persistent access' to the target's computer and any associated network, the indictment said.

Another phishing effort involved sending Witt's former colleagues messages containing a link that appeared to be to an international news outlet and a short note asking if the article was about the recipient. If clicked, the link would lead to a page controlled by the 'Cyber Conspirators.'

Frustrated with 'Iranian suspicion'

The indictment gives the barest sketch of Witt's path from Air Force special agent to alleged traitor, but it reproduces email messages that show she considered approaching Russia as well. 'I am starting to get frustrated at the level of Iranian suspicion,' she wrote at one point to her Iranian contact.

Witt was sworn in as a special agent around August 1997 and continuously held the position until in or around March 2008, when she became a government contractor for the intelligence community until about August 2010, according to the indictment.

She was trained in the Persian language Farsi and granted access to top-secret and 'sensitive compartmented' national defense information that included the United States' foreign intelligence and counter intelligence operations and the true names of its intelligence agents and its sources overseas.

From 2003 and 2008, Witt's work involved counterintelligence assignments that took her to the Middle East. The indictment doesn't specify the countries where Witt was assigned to work, but it lays out some of her contacts with Iran in recent years, including her email exchanges with a dual American-Iranian citizen, identified only as 'Individual A.'

Described as a 'spotter and assessor,' Individual A worked for the IRGC to identify people who may have access to intelligence and counterintelligence and determine their potential value as sources.

'u were well trained'

The indictment quotes one exchange on or about October 17, 2012, when Individual A wrote to Witt saying, 'should i thank the sec of defense . . u were well trained.'

Witt replies, 'LOL thank the sec of defense? For me? Well, I loved the work, and I am endeavoring to put the training I received to good use instead of evil. Thanks for giving me the opportunity.'

The indictment also details her travel to Iran in February 2012, where she took part in a 'Hollywoodism' conference, an IRGC-sponsored event aimed at condemning US moral standards and promoting anti-US propaganda.

Witt also appeared in one or more videos, in which she was identified as a US veteran and made comments critical of the US government, knowing the videos would be broadcast on Iranian TV. That same month, the ceremony marking Witt's conversion to Islam was broadcast on Iranian television.

In May 2012, the FBI warned Witt that she was a target for recruitment by Iranian intelligence services. Witt responded that if she ever returned to Iran, she would refuse to provide any information about her work. The next month, Individual A traveled to the US and hired Witt to work as an assistant on an 'anti-American propaganda film' that was later aired in Iran.

'Better luck with Russia'

In February 2013, Witt traveled again to Iran for another 'Hollywoodism' conference, made more videos critical of the US government and met with members of the IRGC, telling them she wanted to emigrate to Iran, the indictment said.

'If all else fails, I just may go public with a program and do like Snowden :)' Witt wrote to Individual A on June 23. On or about June 30, 2013, Witt wrote again to Individual A and said that she had gone to the Iranian embassy in Kabul, Afghanistan, and 'told all.'

'They are going to get back to me on if they can help me very soon before I leave' Witt continued. 'I told them I am down to little choices and will be traveling to other areas to request assistance.'

Individual A wrote back on July 1, telling Witt that they had been 'talking to people until about 2 in the morning about your case. I have several different channels working on it, but to be honest with one of them, he said they got suspicious that on one hand, you said u had no money and on the other hand u r going from country to country.'

Later that day, Witt replied, ':( Grrr...........No matter what, they are just going to be suspicious, right? . . . I just hope I have better luck with Russia at this point. I am starting to get frustrated at the level of Iranian suspicion.'

Two days later, on July 3, 2013, Witt wrote that, 'I think I can slip into Russia quietly if they help me and then I can contact wikileaks from there without disclosing my location.'

'MONICA ARE YOU THERE????'

At the end of the month, on or about July 30, 2013, Individual A wrote, 'MONICA ARE YOU THERE????. . .The name of the [Iranian] ambassador is Mr. Shehr Doost. His mobile is 009929 196[xxxxx]. Right now he is not in Dushanbe, but you are to call him at 7pm and then go and see him. When you call him on the phone just say that you are the one who is suppose (sic) to see him today for a visa and that's it.'

Witt wrote back: 'Okay. Quick update. They are giving me money to head to Dubai. I will wait to get the approval there and get it from the embassy in Dubai. They are so kind...even taking me to the airport.'

On or about August 25, 2013, Witt sent Individual A an email titled 'My Bio and Job History' that included a typewritten narrative of Witt's bona fides and 'conversion narrative,' as well as a chronological listing of her work history and a copy of her 'Certificate of Release or Discharge From Active Duty.'

Just nine minutes later, Individual A forwarded Witt's email and its attachments, without comment, to an email address associated with Iran.

Between July 2013 and on or about August 28, 2013, Witt spent time conducting multiple searches on Facebook for the names of her former fellow counterintelligence agents, including those targeted by the cyber conspirators, according to the indictment.

On or about August 28, 2013, Witt sent Individual A an email saying that she was about to board her flight from Dubai to Tehran -- her defection was underway.

Punctuating her message with a smiley face emoji, she wrote, 'I'm signing off and heading out! Coming home.'

Indiana Coronavirus Cases

Data is updated nightly.

Confirmed Cases: 45952

Reported Deaths: 2650
CountyConfirmedDeaths
Marion11387679
Lake4872240
Elkhart308543
Allen2677114
St. Joseph184965
Cass16369
Hamilton1484100
Hendricks136699
Johnson1235118
Porter68537
Madison64363
Tippecanoe6408
Clark62244
Bartholomew57844
Howard54356
LaPorte53925
Kosciusko4952
LaGrange4596
Jackson4553
Noble44728
Vanderburgh4306
Hancock42935
Delaware42648
Boone42242
Shelby41625
Marshall4123
Floyd36344
Morgan32031
Montgomery28720
Grant28526
Clinton2792
Dubois2606
White25810
Monroe25628
Decatur24632
Henry23515
Lawrence23124
Vigo2248
Harrison20822
Dearborn20422
Warrick20129
Greene18431
Miami1802
Jennings16911
Putnam1658
DeKalb1594
Scott1547
Daviess13916
Orange13323
Wayne1286
Franklin1248
Steuben1232
Perry1209
Ripley1127
Carroll1092
Jasper1092
Wabash1072
Fayette967
Newton9510
Whitley814
Randolph764
Starke733
Huntington702
Wells681
Jay670
Fulton661
Jefferson651
Washington641
Pulaski631
Knox620
Clay594
Rush573
Benton480
Adams451
Owen451
Gibson442
Sullivan441
Brown381
Blackford372
Posey350
Spencer311
Tipton301
Crawford290
Fountain292
Switzerland250
Martin220
Parke220
Ohio140
Warren141
Union130
Vermillion130
Pike80
Unassigned0194

Ohio Coronavirus Cases

Data is updated nightly.

Confirmed Cases: 52865

Reported Deaths: 2876
CountyConfirmedDeaths
Franklin9338407
Cuyahoga7013366
Hamilton5224198
Marion273138
Lucas2628302
Pickaway217641
Summit1969206
Montgomery178426
Mahoning1752228
Butler144844
Columbiana120960
Stark1052112
Lorain96267
Trumbull86362
Warren75721
Clark7399
Belmont53421
Delaware51815
Tuscarawas51510
Fairfield50316
Medina49132
Lake44316
Miami44231
Ashtabula42144
Portage41858
Licking41611
Geauga39042
Wood38451
Clermont3566
Wayne35452
Richland3185
Allen29740
Mercer2728
Darke23625
Erie22922
Greene2229
Holmes2043
Madison1888
Huron1772
Crawford1357
Ottawa13023
Washington12720
Sandusky12213
Morrow1151
Putnam11516
Hardin11312
Ross1092
Auglaize993
Monroe8617
Coshocton811
Jefferson802
Union801
Hancock761
Hocking767
Muskingum731
Preble661
Lawrence650
Williams652
Clinton620
Guernsey603
Shelby594
Logan581
Wyandot584
Fulton570
Ashland551
Brown531
Carroll513
Defiance483
Fayette460
Highland431
Knox391
Champaign381
Athens371
Scioto360
Seneca332
Perry301
Henry290
Van Wert270
Paulding230
Vinton222
Adams211
Pike200
Jackson170
Gallia141
Harrison121
Meigs110
Noble110
Morgan90
Unassigned00
Fort Wayne
Few Clouds
88° wxIcon
Hi: 91° Lo: 66°
Feels Like: 88°
Angola
Few Clouds
84° wxIcon
Hi: 90° Lo: 66°
Feels Like: 85°
Huntington
Few Clouds
85° wxIcon
Hi: 89° Lo: 64°
Feels Like: 85°
Decatur
Scattered Clouds
86° wxIcon
Hi: 90° Lo: 66°
Feels Like: 86°
Van Wert
Scattered Clouds
86° wxIcon
Hi: 91° Lo: 66°
Feels Like: 86°
Hot Thursday
WFFT Radar
WFFT Temperatures
WFFT National

Community Events