Yesterday, Gregory Allen Justice, a former Boeing engineer, who tried to sell satellite information to undercover agents he believed were Russian spies, was sentenced to five years in jail. I reported on the case previously here, noting that Justice was playing spy to get money for an online girlfriend (who had catfished him with sexy photos of another woman and to whom he was sending gifts, such as charcoal grills, from Amazon). Justice, who admitted he was under the spell of  the TV show “The Americans,” Jason Bourne and James Bond (and had even taken online spy courses), demonstrated his intimate knowledge of spy craft when he gave a receipt to the fake spies for the money they paid him after he made his first drop. Seriously. Worst spy ever. He might as well have posted pictures of the drop on Facebook — oh wait, that wouldn’t have been a problem because Russian spies apparently can post on Facebook without anyone noticing.

ABOVE: Nima Golestaneh

---

In January 2016 the United States and Iran engaged in a prisoner swap. None of the freed prisoners returned to Iran, instead they all chose to remain in the United States, including Nima Golestaneh, the only Iranian national in the group. (The remainder were dual U.S.-Iranian citizens). Golestaneh, who had been nabbed in, and extradited from, Turkey, had been convicted of a scheme to hack into Arrow Tech in Vermont and send its ITAR-controlled software back to Iran.

Now we have a pretty good idea why he may have been selected for a pardon and why he decided that going back to Iran might not have been such a good idea. Yesterday, two Iranians, Mohammed Ajily and Mohammed Rezakhah were added by OFAC to the Specially Designated Nationals and Blocked Persons List (the “SDN List”) and the Department of Justice announced that an indictment against the two had been unsealed. The indictment reveals that Ajily and Rezakhah were Golestaneh’s co-conspirators in the hacking scheme, and it seems certain that Golestaneh made a deal and dropped the dime on Ajily and Rezakhah.

Both Ajily and Rezakhah are currently in Iran and probably have no current plans to visit Disneyland or anywhere else outside Iran. It’s also safe to assume that Golestaneh would not be welcomed with open arms should he turn up in Iran. In fact, that would be an instance of going from the frying pan (a U.S. jail) into the fire (an Iranian one).

The indictment details Golestaneh’s role in the hacking conspiracy. Apparently his job was to procure servers in Canada and the Netherlands. These enabled Rezakhah to download the Arrow Tech software without using an IP address from Iran, which likely would have been blocked by Arrow Tech. The software would not run without a hardware dongle from Arrow Tech, and Arrow Tech informed foreign customers that they would need an export license to obtain the dongle. That dongle not doubt contained the digital key needed to decrypt the program and allow it to run. It looks like Rezakhah hacked into Arrow Tech’s servers to obtain the digital key needed to decrypt the program.

Of course, it’s not just Rezakhah who has a problem in this scenario. If in fact, if Arrow Tech allowed foreign download of ITAR-controlled encrypted software without a license, that was arguably problematic. DDTC has taken the position that items are exported even if encrypted. And, if there is support for that position by DDTC, it can be found in this case, which demonstrates that there is always some possibility that the encryption will be broken. (It now appears that Arrow Tech distributes the software only by optical media and not by download). One has to wonder if the failure of DDTC to adopt rules like those adopted by BIS which exempt encrypted items from the definition of export is, at least in part, the result of what happened in this case.

One other thing bears noting here, namely, the most amusing irrelevant statement ever put in a criminal indictment. For some reason, the indictment notes that Ajily, Rezakhah’s co-conspirator “received certificates of appreciation for his work from several of the Iranian government and military entities.”   Seriously, he got certificates he could frame and hang on his office wall.  Awesome.  That was a clear violation of the law that forbids receiving certificates of appreciation from Iran.  I have to imagine that this factoid comes from Golestaneh who, when he was singing to the DOJ, said something on the order of  “Ajily got certificates and all I got was this lousy jumpsuit.”

The affidavit in support of the criminal complaint filed against Gregory Allen Justice for passing allegedly export-controlled data to an undercover FBI agent is a lurid potboiler, a train wreck that you can’t stop watching, a bizarre mashup of David Lynch and Austin Powers. Worse, you don’t know whether to laugh at the defendant, feel sorry for him or recoil in horror.

The tawdry affair starts with Justice, with an extremely ill, housebound wife, getting “catfished” by a woman who aroused his interests by sending him pictures, allegedly of herself, but in fact pictures of an Eastern European model. Justice, in hopes of replacing his sickly wife with a trophy wife, started sending “Chay” (the catfisher’s nom de doom or screen name) boxes of cash and gifts from Amazon including a $900 iPhone, a flat panel television, a charcoal grill and other goodies. Soon Justice was short of cash and, apparently enamored with James Bond, Jason Bourne and the be-wigged Russian spies on the television series The Americans (honestly, I’m not making that up) decided to become a Russian spy and sell everything he could lay his hands on about the satellites made by his employer.

Being a real-life spy is much harder than being one on TV or in the movies, and Justice screwed things up before he even got started. In November 2015, he stuck a thumb drive in his computer. Game over. This set off alarm bells at his employer and everything he did on his computer after that was monitored, recorded, saved, analyzed and handed over to the feds in a neat box with a pretty bow on top. As a result, the closest Justice ever got to a real Russian was when he stood in line at Starbucks behind a guy (from Kansas) reading Tolstoy.

In January his car was surreptitiously searched, and a handwritten note with the address of the Russian Embassy in Washington, DC, was found. One month later an undercover agent, pretending to be a Russian spy, called Justice and negotiated the purchase of documents and information from Justice. For the next three months, there were numerous phone calls and five in-person meetings between Justice and the undercover agent posing as a Russian spy. You can’t help but wonder if the sting stretched out so long because the FBI was having fun with this guy. He was low hanging fruit who liked to discuss recent episodes of The Americans and express his admiration of James Bond and Jason Bourne.

None of this was necessary because he signed a receipt for the money he was given by the undercover agent for the first drop of documents. Yes, you read that right. He signed a receipt for the money. Seriously. I’m not even a spy, nor have I pretended to be one, in my spare time, on TV, or otherwise, and even I know that you don’t sign receipts for the money that the Russkies pay you for spying.

Above and beyond all this, the affidavit says that Justice asked the fake spy to help him buy drugs that, it appeared, he planned on using to get his wife out of the way and close the deal with “Chay.” And he was also apparently supplementing his spy payments by dealing GHB, a controlled substance, on the side.

The real question, of course, in this: how much time and money was spent in building the case against a guy who makes Austin Powers look like Albert Einstein and who, apparently, never sold any documents to anyone other than the FBI? I’m sure that the FBI relished all the giggling over war stories that this case would yield but, frankly, I would imagine there are better uses of investigative time, money and resources. The minute he signed that first receipt, it was time to break out the cuffs.