Three former U.S. intelligence officers have admitted to hacking operations in the United Arab Emirates and working under the violation of U.S. export laws. Reuters reported that the men provided sophisticated intelligence technologies to a U.A.E.-based company that were used to spy on enemies via computers and mobile phones. For three years the men worked under the clandestine unit, Project Raven, where they deployed cyberweapons “Karma” and “Karma 2.” These technologies allowed for the hacking of devices like Apple iPhones without requiring any action by the target.
The former intelligence officers — Marc Baier, Ryan Adams, and Daniel Gericke — entered a deferred prosecution agreement with the federal government where they have agreed to pay $1.7 million to resolve charges and sever any ties with U.A.E. intelligence. Mark Lesko, Acting Assistant Attorney General of the Justice Department’s National Security Division, quoted in NPR that: “Hackers-for-hire and those who otherwise support such activities in violation of U.S. law should fully expect to be prosecuted for their criminal conduct.”
The men provided support for what is known as “zero-click remote exploits,” meaning that the hacking required no action by the target such as interacting with unwarranted advertisements. The major concern is that this permits governments to conduct invasive surveillance. According to the Justice Department, they were able to illegally obtain credentials for online accounts and gain unauthorized access to computers and mobile phones. Channing D. Phillips, the acting U.S. attorney of the District of Columbia, stated that these offensive cyber capabilities undermine privacy and security worldwide.
Ex-officer Baier had initially worked for the National Security Agency unit that carries out advanced offensive cyber operations. Adams and Gericke served in the military and in the intelligence community. Prosecutors stated that the former officers had then worked for a U.S. company that provided cyber services to the U.A.E. government before being offered a lucrative job opportunity by DarkMatter as senior managers in 2016. According to the Justice Department, this action requires pre-approval by the U.S. government and the abiding of U.S. export laws. Despite being repeatedly told by their former company to comply with these, the men did not obtain the required licences to conduct these activities, nor the necessary approval.
This is not the first crime of its kind: there is an existing trend for intelligence or cyber experts to work for foreign companies as they often offer significantly higher pay grades. These opportunities are then attractive for those with cyber and intelligence skill sets even if it requires criminal conduct. This issue is pressing as certain technologies in the hands of foreign governments allow for spying and surveillance of people around the globe.
Assistant Director Bryan Vorndran of the FBI’s Cyber Division said in a statement, “This is a clear message to anybody, including former U.S. government employees, who had considered using cyberspace to leverage export-controlled information for the benefit of a foreign government or a foreign commercial company… there is risk, and there will be consequences.” If the men comply with the three year agreement with the Justice Department, then the criminal prosecution will be dropped.