Monica Elfriede Witt, a former Air Force Office of Special Investigations special agent, has been indicted on federal charges and is now on the FBI's Most Wanted list. FBI courtesy photos.
A federal grand jury has indicted a former Air Force Office of Special Investigations special agent on charges of “delivering national defense information” to Iran, the Department of Justice announced Wednesday.
The Feb. 8 indictment includes a warrant for the arrest of 39-year-old Monica Elfriede Witt, who reportedly defected to Iran in 2013, according to a Justice Department release.
The indictment accuses Witt of helping Iranian intelligence target her former American colleagues from the Intelligence Community and disclosing the code name and classified mission of a Defense Department Special Access Program for which she had served as a civilian desk officer, the release said. This project “housed classified information, including details of ongoing counterintelligence operations,” sources’ real names, “and the identities of US agents” who helped recruit them, according to the 27-page, unsealed indictment.
According to her FBI Most Wanted list webpage, the Texas native lives in Iran, speaks Farsi—which her indictment notes she learned at the US Defense Language Institute—and also goes by the aliases of “Fatemah Zahra” and “Narges Witt.”
“It is a sad day for America when one of its citizens betrays our country,” John Demers, the assistant attorney general for national security, said in a Wednesday speech in Washington. “It is sadder still when this person, as a member of the American armed forces, previously invoked the aid of God to bear true faith and allegiance to the Constitution of the United States and to defend her country against foreign enemies. Monica Witt is alleged to have done just this.”
The FBI’s Washington Field Office is playing point on Witt’s investigation, with help from AFOSI, the release said.
Witt served on Active Duty from December 1997 to June 2008 as an airborne crypto linguist and an AFOSI special agent, an Air Force spokeswoman told Air Force Magazine.
From May 1999 until November 2003, she took part in multiple classified, international signals-intelligence missions before receiving her AFOSI assignment around November 2003, according to the indictment. There, she was a special agent tasked with working on criminal investigations and counterintelligence. The latter part of her job description sent her to the Middle East to perform “classified operations.” She worked with AFOSI until around March 2008, according to the indictment.
She left the Air Force as a special agent. Her last duty station was the 2nd Field Investigations Squadron at JB Andrews, Md. She was the recipient of an Air Medal, three Air Force Commendation Medals, and three Aerial Achievement Medals, according to the Air Force.
She then worked as a defense contractor for AFOSI from March 2008 until August 2010, where she focused on the DOD Special Access Program.
Witt held a Top Secret/SCI security clearance from the time she first enlisted in the Air Force until the end of her career as a DOD contractor in August 2010, according to the indictment.
Witt went to Iran in 2012 to attend a conference sponsored by the Iranian Revolutionary Guard Corps, which condemned “American moral standards” and advocated for “anti-US propaganda,” according to the DOJ release.
She went back to Iran the next summer after “subsequent interactions and communications” with an unnamed individual holding dual US-Iranian citizenship, according to the release. After she arrived, Iranian officials gave her a place to live and provided her with computer equipment.
She proceeded to give one of those officials classified intelligence, in addition to researching her former colleagues and using her findings to assemble so-called “target packages” on them.
The release says the Iranian co-conspirators who are also named in the indictment undertook a cyber campaign against “Witt’s former workers and colleagues” in the US and abroad, starting “in late 2014.” Their efforts reportedly included malware use, targeted email phishing attacks, and a fake Facebook account that used information and photos stolen from the individual’s real Facebook profile.