A version of this story appeared in the daily Threat Status newsletter from The Washington Times. Click here to receive Threat Status delivered directly to your inbox each weekday.
A former Facebook employee who was imprisoned by the Iranian regime said he was forced to agree to spy on Westerners for Iran to secure his release. Behdad Esfahbod, who was detained in Tehran’s Evin Prison in January and left Facebook last month, said he chose not to spy and never informed the social media giant of his agreement with the Iranian government.
“By making this widely public, if they do anything to my family, I have the attention of the media and will start making it public because that’s how I think this is the better way to protect us,” Mr. Esfahbod told The Washington Times.
Technology companies, particularly social media sites such as Facebook, are becoming bigger targets for cyberattackers looking to cultivate insiders who can collect private information yielding governmental secrets or personally identifiable information such as passwords and accounts or for blackmail schemes.
As Twitter fell prey to a “coordinated social engineering attack” aimed at its employees this summer, Mr. Esfahbod, an Iranian Canadian software engineer, was preparing to leave Facebook. He said he decided to go public about his detainment to gain the upper hand against Iran’s government.
Facebook declined to comment on Mr. Esfahbod’s situation, as did the Iranian government, but foreign adversaries pressuring technology workers is not a new phenomenon.
“Tehran has a history of targeting Iranians abroad who are working in technical fields,” said Norman Roule, who was the national intelligence manager for Iran from November 2008 to September 2017. “Iranian intelligence services seek to steal advanced technology from the United States as well as to identify other Iranian nationals who are working in the high-tech industry for future targeting.”
Mr. Roule said informants who work at social media companies can provide information on Iranian opposition figures, their followers and their potential funding sources.
Mr. Esfahbod said the Iranians coerced him to agree to spy on activists working to create open internet and greater freedoms in Iran, including from such groups as United for Iran in Berkeley, California, the technology group ASL19, and Small Media in the United Kingdom. Tehran did not display an immediate interest in Mr. Esfahbod’s Facebook co-workers, he said.
The Iranians asked Mr. Esfahbod to inform on Mehdi Yahyanejad, co-founder of NetFreedom Pioneers in California, which works to bypass censorship and provide internet access to Iranians through satellite televisions.
Mr. Yahyanejad said he lives under constant threat and has not pressed Mr. Esfahbod for too many details about what the Iranians wanted to know. Mr. Yahyanejad said he has known Mr. Esfahbod for about 10 years and views him as courageous. He said he is concerned that other Iranians without Mr. Esfahbod’s socio-economic status may suffer worse fates.
“Part of the fact that he was able to expose these things is because his status, because he’s well-known, he’s well off,” Mr. Yahyanejad said. “I’m worried that there’s so many others who just can’t afford to do these things because they’re not at this position, even if they come out. Many people might hear about them, and they are just left at the discretion of the Iranian government, who are, of course, going to retaliate.”
Mr. Esfahbod said he was making a seven-figure salary working on text rendition at Facebook before he left in July, and he was well-known in the tech community. He worked at Google in Canada and in California from July 2010 to February 2019 before moving to Facebook in Seattle that month.
Mr. Esfahbod said he has made about 10 trips to and from Iran since 2015. Although he was previously stopped and questioned, this was the first time he was imprisoned.
He traveled to Iran four days after Iranian Maj. Gen. Qassem Soleimani was killed near Baghdad International Airport. The airstrike that killed him escalated tensions with the West.
On Jan. 8, about one week after Soleimani’s death, a Ukrainian commercial airliner crashed shortly after takeoff in Tehran. Mr. Esfahbod said he was arrested the next day. At the time, U.S. officials said Iranians shot down the plane. Tehran later admitted it had done so by accident.
To secure Mr. Esfahbod’s cooperation that month, the Iranians threatened to frame him for downing the plane, told him a family member would lose a job, and confiscated devices and extracted data from his digital accounts, Mr. Esfahbod said.
Documents reviewed by The Washington Times show Iran confiscated a laptop and cellphone as well as other personal belongings. Mr. Esfahbod said the Iranians downloaded data from his digital accounts and then showed him photos of himself with activists during a conference in San Francisco. He said they peppered him with questions about his connections and actions abroad.
After Mr. Esfahbod agreed to cooperate with Iran in exchange for his release, he said, he went to Portugal to reunite with his partner, who had warned him against traveling to Iran. Mr. Esfahbod returned to Seattle at the end of February, just as the coronavirus outbreak made in-person work virtually impossible.
Suffering from the trauma of his imprisonment and exacerbated by his bipolar disorder, Mr. Esfahbod said, he took medical leave from work and the self-isolation wrought by coronavirus shutdowns took its toll. He said he quit Facebook in July when he felt unable to work.
Mr. Esfahbod said he was never contacted by, nor did he attempt to reach, intelligence officials from the United States or Canada but was willing to cooperate if they wanted to reach him.
He made contact with reporters through James Gullis, an associate at public relations firm Kreab, who said he was assisting Mr. Esfahbod on behalf of Kreab’s client Iran International, a Persian-language media outlet based in London. Iran International’s director of programming is Hossein Rassam, a former chief political analyst at the British Embassy in Tehran, according to The Telegraph in London.
“We interviewed, or Iran International interviewed, Behdad and we knew that when Behdad decided to go public, it may pose a risk to his family’s safety or it could pose a risk to him given that [Iran’s Islamic Revolutionary Guard Corps] has quite a lot of content that they could use against him when they extracted it during his time in Evin Prison,” Mr. Gullis said. “And so we decided to support Behdad and draw attention toward what’s going on and what happened to him in Iran.”
• Guy Taylor contributed to this report.
• Ryan Lovelace can be reached at rlovelace@washingtontimes.com.
Please read our comment policy before commenting.