850-001 questions - Cloud Security 1.0 Updated: 2023

Chuck Randall was on the verge of unveiling an ambitious real estate deal he hoped would give his small Native American tribe a bigger cut of a potentially lucrative casino project.

A well-timed leak derailed it all.

In July of 2012, printed excerpts from Randall’s private emails were hand-distributed across the Shinnecock Nation’s square-mile reservation, a wooded peninsula hanging off the South Fork of Long Island.

The five-page pamphlets detailed secret negotiations between Randall, his tribal government allies and outside investors to wrest some of the profits from the tribe’s then-partner in the gambling deal.

They sparked an uproar. The pamphlets claimed Randall’s plan would sell out the tribe’s “LANDS, RESOURCES, and FUTURE REVENUES.” Within days, four of Randall’s allies were voted out of tribal government. Randall, who held no formal position with the tribe, was ordered to cease acting on its behalf.

Amid the upheaval, the Shinnecocks’ casino hopes faded. “We lost the biggest economic opportunity that has come to the tribe in forever,” Randall told Reuters. “My emails were weaponized.”

The scandal that roiled the Shinnecocks barely registered beyond the reservation. But it was part of a phenomenon that has drawn interest from law enforcement and intelligence agencies on both sides of the Atlantic.

Randall’s inbox was breached by a New Delhi-based information technology firm named Appin, whose sudden interference in the matters of a faraway tribe was part of a sprawling cyber-mercenary operation that extended across the world, a Reuters investigation found.

The Indian company hacked on an industrial scale, stealing data from political leaders, international executives, prominent attorneys and more. By the time of the Shinnecock scandal, Appin was a premier provider of cyberespionage services for private investigators working on behalf of big business, law firms and wealthy clients.

Unauthorized access to computer systems is a crime worldwide, including in India. Yet at least 17 pitch documents prepared for prospective business partners and reviewed by Reuters advertised Appin’s prowess in activities such as “ cyber spying,” “ email monitoring,” “ cyber warfare” and “ social engineering,” security lingo for manipulating people into revealing sensitive information. In one 2010 presentation, the company explicitly bragged about hacking businessmen on behalf of corporate clients.

Reuters previously named Appin in a story about Indian cyber mercenaries published last year. Other media outlets – including The New Yorker, Paris-based Intelligence Online, Swiss investigative program Rundschau and tech companies such as Alphabet-owned Google– have also reported on the firm’s activities.

This report paints the clearest picture yet of how Appin operated, detailing the world-spanning extent of its business, and international law enforcement’s abortive efforts to get a handle on it.

Run by a pair of brothers, Rajat and Anuj Khare, the company began as a small Indian educational startup. It went on to train a generation of spies for hire that are still in business today.

Several cyber defense training organizations in India carry the Appin name, the legacy of an old franchise model. But there’s no suggestion that those firms are involved in hacking.



The Indian company hacked on an industrial scale, stealing data from political leaders, international executives, sports figures and more.


 

Rajat Khare’s U.S. representative, the law firm Clare Locke, rejected any association between its client and the cyber-mercenary business. It said Khare “has never operated or supported, and certainly did not create, any illegal ‘hack for hire’ industry in India or anywhere else.”

In a series of letters sent to Reuters over the past year, Clare Locke said that “Mr. Khare has dedicated much of his career to the fields of information technology security – that is, cyber-defense and the prevention of illicit hacking.”

Clare Locke said that, under Khare’s tenure, Appin specialized in training thousands of students in cybersecurity, robotics and artificial intelligence, “never in illicit hacking.” The lawyers said Khare left Appin, in part, because rogue actors were operating under the company’s brand, and he wanted “to avoid the appearance of associations with people who were misusing the Appin name.”

The lawyers described media articles tying Khare to hacking as “false” or “fundamentally flawed.” As for the 2010 Appin presentation boasting of hacking services, they said Khare had never seen it before. “The document is a forgery or was doctored,” they said.

Clare Locke added that Khare could not be held responsible for Appin employees who went on to work as mercenary hackers, saying that doing so “would be akin to holding Harvard University responsible for the terrorist bombings carried out by its former student Ted Kaczynski,” referring to the former math prodigy known as the “Unabomber.”

A lawyer acting for Rajat’s brother, Anuj, said his client’s position was the same as the one laid out by Clare Locke.

This report on Appin draws on thousands of company emails as well as financial records, presentations, photos and instant messages from the firm. Reporters also reviewed case files from American, Norwegian, Dominican and Swiss law enforcement, and interviewed dozens of former Appin employees and hundreds of victims of India-based hackers. Reuters gathered the material – which spans 2005 until earlier this year – from ex-employees, clients and security professionals who’ve studied the company.

Reuters verified the authenticity of the Appin communications with 15 people, including private investigators who commissioned hacks and ex-Appin hackers themselves. The news agency also asked U.S. cybersecurity firm SentinelOne to review the material for signs that it had been digitally altered. The firm said it found none.

“We assess the emails to be accurately represented and verifiably associated with the Appin organization,” SentinelOne researcher Tom Hegel said.

Though Khare’s lawyers say Appin “focused on teaching cybersecurity and cyber-defense,” company communications seen by Reuters detailed the creation of an arsenal of hacking tools, including malicious code and websites. Hegel and two other U.S.-based researchers – one from cybersecurity firm Mandiant, the other from Symantec – all working independently, were able to match that infrastructure to publicly known cyberespionage campaigns.

“It all lines up perfectly,” Hegel said.

Over the last decade, Google saw hackers linked to Appin target tens of thousands of email accounts on its service alone, according to Shane Huntley, who leads the California company’s cyber threat intelligence team.

“These groups worked very high volumes, to the point that we actually had to expand our systems and procedures to work out how to track them,” Huntley said.

The original Appin has now largely disappeared from public view, but its impact is still felt today. Copycat firms led by Appin alumni continue to target thousands, according to court records and cybersecurity industry reporting.

“They were groundbreaking,” Google’s Huntley said. “If you look at the companies at the moment who are picking up the baton, many of them are led by ex-employees” of Appin.

‘Get me result ASAP!!!’

Private eyes have been hiring hackers to do their dirty work since the dawn of the internet. Former clients say Appin’s central innovation was turning the cloak-and-dagger market into something more like an e-commerce platform for spy services.

The mercenaries marketed a digital dashboard with a menu of options for breaking into inboxes, including sending fake, booby-trapped job opportunities, bogus bribe offers and risqué messages with subject lines like “My Sister’s Hot Friend.”

Customers would log in to a discreet site – once dubbed “My Commando” – and ask Appin to break into emails, computers or phones. Users could follow the spies’ progress as if they were tracking a delivery, eventually receiving instructions to download their victim’s data from digital dead drops, according to logs of the system reviewed by Reuters.

“It was the best-organized system that I have ever seen,” said Jochi Gómez, a former news publisher in the Dominican Republic. Gómez told Reuters that in 2011 he paid Appin $5,000 to $10,000 a month to spy on the Caribbean nation’s elite and mine the material for stories for his now-defunct digital newspaper, El Siglo 21.

Reuters reviewed more than a year’s worth of activity from Appin’s “My Commando” system. The logs showed that Gómez was one of 70 clients, mostly private investigators, from the United States, Britain, Switzerland and beyond who sought Appin’s help in hacking hundreds of targets.

Some of these marks were high-society figures, including a top New York art dealer and a French diamond heiress, according to the logs. Others were less prominent, like a New Jersey landscape architect suspected of having an affair.

Several detectives used the service frequently, among them Israeli private eye Aviram Halevi, who tasked the spies with going after at least three dozen people via the system.

“There is a returning customer who needs the following addresses cracked ASAP,” the logs show Halevi telling the hackers in August 2011.

Reuters previously reported that Halevi, a former lieutenant colonel in the Israeli Defense Forces, hired Appin to spy on a litigant in a lawsuit in Israel on behalf of a client on the opposing side of the case. Halevi did not respond to questions about his ties to the hackers.

Another big user of My Commando was Israeli private detective Tamir Mor, who used the service around the same time to order hacks on more than 40 targets, the logs show. Among them were the late Russian oligarch Boris Berezovsky and Malaysian politician Mohamed Azmin Ali.

“Please get me result ASAP!!!” Mor wrote on the My Commando chat feature after providing Appin with details about two members of Berezovsky’s legal team in December 2011, the logs show.

Reuters could not establish Mor’s motives for targeting Berezovsky and Azmin, whether he succeeded in hacking either of them, or on whose behalf he was working. Mor did not respond to requests for comment.

Azmin, a former cabinet minister, was a prominent opposition leader at the time of the hack attempts. He and his former party didn’t respond to messages seeking comment.

The order to hack Berezovsky came while the tycoon was in the middle of a British court battle against fellow oligarch Roman Abramovich over the sale of a Russian oil company. The multibillion dollar case ended in a decisive defeat for Berezovsky. The 67-year-old was found dead at his suburban English home the following year.

Mark Hastings, one of the Berezovsky lawyers mentioned in the My Commando logs, said he was not aware that he had been in Appin’s crosshairs, but that he was “not entirely surprised.”

“It is an open secret that lawyers are often targeted by hackers in major commercial litigations,” said Hastings, now with the London firm Quillon Law.

Abramovich’s representatives said the tycoon had no dealings with or knowledge of Mor or Appin, and that he had never engaged with hackers or hacked material of any kind.

Many of Appin’s clients signed into My Commando using their real names. A prolific customer who didn’t was someone using the alias “Jim H.”

Jim H assigned the Appin hackers more than 30 targets in 2011 and 2012, including a Rwandan dissident and the wife of another wealthy Russian who was in the middle of a divorce, the logs show.

Among Jim H’s most sensitive requests: hacking Kristi Rogers, wife of Representative Mike Rogers, then-Chairman of the U.S. House Intelligence Committee. The Michigan Republican served in Congress from 2001 until his retirement in 2015; he’s currently running for U.S. Senate.

Back in 2012, Kristi Rogers was an executive at Aegis, a London-based security company. Jim H told the hackers that Aegis competed with his client, another security contractor called Global Security, an apparent reference to Virginia-based Global Integrated Security.

Cracking Rogers’ corporate email was a “top priority,” Jim H told the hackers. He claimed that her company was trying to undermine Global’s bid for a $480 million U.S. Army Corps of Engineers contract to provide security for Afghanistan’s reconstruction.

Jim H said he needed dirt on Aegis to sully its reputation, and he suggested a way to trick Rogers into opening a malicious link.

“You could send an invitation to an event organised by the Rotary Club or a gala dinner,” he wrote, according to the logs.

Shortly thereafter, Appin reported back that it had successfully broken into Aegis’ network.

Reuters could not verify whether Rogers’ account was ultimately compromised. Global eventually won the contract.

Rogers, who left Aegis in late 2012, told Reuters she was outraged to learn of the hacking operation.

“It gives me goosebumps right now,” she said. “It angers me that people are so cavalier with other people’s reputations and their lives.”

Reuters was unable to determine Jim H’s identity or whether he was telling the truth when he said Global was his client. Messages sent to Jim H’s old email account were returned as undeliverable.

Global Integrated Security’s website is inoperative, and corporate records show its Virginia branch is inactive. Damian Perl, the founder of Britain’s Global Strategies Group – Global Integrated Security’s former parent company – “vehemently” denies any allegations of wrongdoing, his family office said in a statement.

The Army Corps of Engineers confirmed that Aegis had protested Global’s contract, but said it could offer no further comment. Canadian security company GardaWorld, which acquired Aegis in 2015, said it had no information on the incident.

The My Commando logs also shine new light on the Shinnecock casino scandal. In January 2012, a New York private eye named Steven Santarpia ordered the hack of tribal member Chuck Randall, whose leaked emails sparked chaos.

Within days, an Appin hacker reported to Santarpia that he had hit pay dirt, according to the logs: “We got success in investigating Chuck@shinnecock.org.”

“Excellent,” Santarpia replied.

Santarpia didn’t respond to repeated messages sent by Reuters over several months, and he declined comment when a reporter approached him outside his Long Island home.

Operations like Jim H’s or Santarpia’s were aimed at only three or four email accounts at a time. But Appin had greater capabilities.

Gómez, the Dominican publisher, ordered break-in attempts aimed at the email accounts of more than 200 high-profile Dominicans, the logs show. Among them was an account belonging to then-President Leonel Fernández, a frequent target of Gómez’s reporting.

Gómez’s hacking requests preceded several stories alleging government corruption that his paper published before it was raided by Dominican authorities in February 2012. Gómez eventually shut it down amidst mounting official scrutiny of the hacking.

“I was very active in requesting emails,” he told Reuters, adding that those days are firmly “in my past.”

Fernández did not return messages seeking comment.

Lawyers for Rajat Khare said he “does not know” Gómez, Santarpia, Mor or Halevi and “has no knowledge” of the My Commando dashboard “or anything similar.”

The ability to target heads of state was an improbable amount of power for a company that only a few years earlier had been teaching college kids to code.

Approaching infinity

Rajat Khare was a 20-year-old computer science major when he and his friends came up with the idea for Appin over chicken pizza at a Domino’s in New Delhi.

It was December 2003. Khare had joined his high school buddies to catch up and bemoan the state of India’s universities, which they thought weren’t preparing students for the professional world. When one suggested organizing technology training workshops to supplement undergraduates’ education, people present at the meal said Khare jumped on the idea.

“Let’s give the students what they want,” he quoted himself telling the group in a book on entrepreneurship he co-wrote years later. “Let’s start something that will not only change their lives, but our lives too … forever.”

After the Domino’s meeting, Khare and his friends came up with the name Appin – short for “Approaching infinity” – and launched their first classes on computer programming.

It was the right idea at the right time. India’s IT outsourcing boom had created voracious demand for tech talent. Appin franchises would soon sprout across India, offering not just programming lessons but also courses on robotics and cybersecurity, nicknamed “ethical hacking.”

By 2005, the company had an office in western New Delhi. Rajat had been joined by his older brother, Anuj, a motivational speaker who returned to India after a stint running a startup in Texas. As other members of the Domino’s group stepped away, the Khare brothers took charge of the fast-growing firm.

The cybersecurity classes proved especially popular. By 2007, Appin opened a digital security consultancy helping Indian organizations protect themselves online, according to a draft pitch deck intended for potential investors.

That soon drew the attention of Indian government officials who were still feeling their way through intelligence work in the internet age. To help the officials break into computers and emails, Appin set up a team of hackers out of a subsidiary called Appin Software Security Pvt. Ltd., also known as the Appin Security Group, according to a former executive, company communications, an ex-senior Indian intelligence figure and promotional documents seen by Reuters.

The spying was a secret within the wider company. Some early Appin employees signed nondisclosure agreements before being shipped off to military-controlled safe houses where they worked out of sight from their colleagues, according to another former executive familiar with the matter and three hackers who spent time in the safe houses.

One of the hackers recalled being only 22 years old when he broke into the inboxes of Khalistani separatists – Sikh militants fighting to carve an independent homeland out of India’s Punjab province – and delivering the trove to his handlers.

“It was the experience of a lifetime,” he said, recalling how proud he was to be contributing to India’s national security.

One of Appin’s primary targets was Pakistan, according to interviews with former insiders, company emails, and stolen passwords and key logs of Pakistani officials reviewed by Reuters. The hackers created fake dating websites designed to ensnare Pakistani military officers, two of the insiders said.

Another early mission, dubbed Operation Rainbow, involved penetrating Chinese military computers and stealing information about missiles and radar, according to an undated Appin memo. The memo said the company’s hackers compromised several Chinese officials; Reuters was unable to confirm the alleged intrusions independently.

Those early operations led to more contracts.

Soon Appin was working with the Research & Analysis Wing (RAW), India’s external intelligence service; and the Intelligence Bureau, the country’s domestic spy agency, according to the two former executives, one former Appin hacker and a former senior Indian intelligence official.

Detailed messages from Reuters seeking comment from the Intelligence Bureau and RAW, sent via India’s Ministry of Home Affairs and its Cabinet Secretariat, respectively, were not returned. India’s Ministry of Defense did not return messages about the hacking. The Pakistani foreign affairs ministry did not return messages. China’s foreign ministry said in a statement that it was unaware of the hacking activity.

By 2008, Appin was claiming it offered a “one stop interception solution” for government clients, according to one company presentation.

Company executives marketed software for the analysis of call record data– the who, what, when of phone calls monitored by spy agencies and law enforcement – and discussed the importation of Israeli cell phone interception devices, Appin emails show.

In 2009, Appin boasted to prospective customers that it was serving India’s military, its Ministry of Home Affairs, and the Central Bureau of Investigation (CBI), an Indian agency roughly equivalent to America’s Federal Bureau of Investigation (FBI), emails show.

Appin’s solutions “are being used by various elite intelligence agencies in government to monitor hostile people,” one pitch claimed.

The CBI and Ministry of Home Affairs didn’t return detailed messages seeking comment.

Company revenues in the fiscal year ending in 2009 were estimated at nearly $1 million, with profit after tax pegged at about $170,000, according to the draft pitch deck aimed at potential investors. The deck projected that figure would multiply almost tenfold over the next 36 months.

But Appin had hit a speed bump. The two former executives, one of the former hackers, and the former Indian intelligence official said the company earned extra money by quietly taking material it hacked for one Indian agency and reselling it to another. This double dipping was eventually discovered, the people said, and several enraged spy agency clients canceled their contracts with Appin.

With intelligence work drying up, Appin pivoted to the private sector, the sources said.

‘Fucking with the wrong people’

The influx of Western clients brought new revenue – and new risk.

American and Swiss law enforcement documents, including emails and investigative reports reviewed by Reuters, reveal how Appin got caught hacking as it fulfilled its customers’ orders.

An early example was the compromise of prominent Zurich-based communications consultant Peter Hargitay, who had served as an advisor to Australia’s football federation. He and his filmmaker son Stevie detected the intrusion and filed a Swiss criminal complaint.

Within weeks, an expert they hired traced the hack to a server near the Zurich airport, according to the law enforcement documents. Billing records tied to the server listed Rajat Khare as the client.

Father and son had come off a failed bid to bring the 2022 FIFA World Cup to Australia and were in no mood to let the hack slide, according to emails provided by an independent source.

In a March 2012 message to his father, Stevie said he had spoken on the phone with an Appin employee who was clearly rattled by the exchange. “I told him in no uncertain terms that they are fucking with the wrong people,” Stevie wrote.

Rajat Khare called Stevie the same day to try to smooth things over, saying he “wants to cooperate ‘100%,’” Stevie wrote. The emails show that an Appin employee later told Stevie the hack was ordered by a U.S. private investigator; contact fell off as the Hargitays pushed for more information about who was ultimately behind the spying.

“We don’t know who his client was,” Peter Hargitay said.

Khare’s lawyers told Reuters he “does not know” the Hargitays.

A few months later, Appin was implicated in another incident, this time in India. Cybersecurity consultant K. K. Mookhey told a conference near New Delhi that he had tied an attempted hack against one of his clients to the firm. In a report published in 2013, Mookhey wrote that the link to Appin was “not concrete.” But he told Reuters he had been “overcautious” in choosing those words and that the evidence, including Appin documentation inadvertently left on the hackers’ servers, made it obvious they were involved.

“The link was actually pretty clear,” he said.

Appin’s name had popped up earlier that year in Norway. In February 2013, technicians at telecommunications company Telenor discovered that hackers had stolen as many as 66,000 emails from the company’s chief executive, two personal assistants and a senior lawyer at the firm, according to Norwegian law enforcement documents reviewed by Reuters.

Three months later, Oslo-based cybersecurity firm Norman Shark – which had launched its own independent investigation into the Telenor hack – publicly linked the intrusion to Appin.

Norman Shark stopped short of directly blaming the company, saying only that “there seems to be some connection” between Appin and the Telenor hackers. One of the report’s coauthors, security researcher Jonathan Camp, told Reuters that Norman Shark had softened the report’s language to avoid legal trouble. Camp said he and his colleagues privately were confident that Appin was behind the hacking, citing an unusually large number of digital clues pointing to the company, including multiple malicious websites registered under the Appin name.

“There was no doubt in our minds,” he said.

California-based tech firm Broadcom, which absorbed Norman Shark following a series of acquisitions, did not respond to requests seeking comment. Telenor confirmed it had been the victim of “industrial espionage,” which it reported to police at the time. It declined further comment. The motive behind the hacking has never been made public.

Appin denied all wrongdoing in the wake of Camp’s report, and the Khares’ lawyers still insist the research didn’t implicate the company. Nevertheless, Appin came under increasing scrutiny in the years that followed.

Norway was one of at least four countries – along with the United States, Switzerland and the Dominican Republic – that had opened investigations into Appin. Some began comparing notes.

In an undated written exchange reviewed by Reuters, FBI official Dan Brady told Swiss prosecutor Sandra Schweingruber that U.S. officials looking into the hack of the Shinnecock tribe on Long Island had “accumulated a fair amount of data identifying other victims.”

Schweingruber declined to comment for this story. Reuters was unable to reach Brady. The FBI declined to answer a list of questions about its investigation into Appin.

In his note to Schweingruber, Brady said “the link in our respective cases is that I believe we have the same ultimate perpetrator.”

Then he added, in parentheses: “Appin.”

Lost leads, lasting pain

The multinational investigations into Appin each carried on for years before petering out.

Jochi Gómez, the Dominican newspaper publisher, was formally accused of working with Rajat Khare to hack emails following the 2012 raid on his publication.

But the case never went to trial; it was quashed on procedural grounds in 2013, a decision reaffirmed by the country’s highest court the following year. Dominican prosecutors described Khare as a member of Gómez’s “international criminal network.” But one of the judges involved dismissed the idea as a “theory.” Khare was never charged in the matter.

Dominican judiciary officials didn’t return messages seeking comment about the case.

Speaking to Reuters a decade later, Gómez acknowledged hiring Khare for surveillance, saying he had been hunting for evidence of corruption.

“I did it for journalism,” Gómez said. “Is it lawful or not? That’s another story.”

Norway’s investigation into the Telenor hack led to four internet protocol addresses in New Delhi, according to the law enforcement files reviewed by Reuters. In an undated email sent to the FBI, the Swiss prosecutor Schweingruber said the Norwegians had gone further still. “Their investigation leads also to Appin,” she wrote.

That inquiry similarly ran aground. A spokesperson for Norway’s National Criminal Investigation Service confirmed to Reuters that the case was closed in June 2016 “taking into consideration the chances of obtaining further evidence and information through further investigation.”

Swiss authorities also implicated Appin in the case of PR consultant Peter Hargitay, according to the files.

In her email to the FBI, Schweingruber said the Swiss investigation  – nicknamed “Tandoori” – had found that “the Indian company Appin Security Group as well as their CEO Rajat Khare are involved in this case.”

Yet the files show Swiss authorities rebuffed the Hargitays’ request to have Khare quizzed about the hack. In a message to the Hargitays sent in September 2020, Schweingruber’s successor, Anna Carter, said she was discontinuing the case “due to the lack of further promising investigative approaches.”

Swiss prosecutors confirmed that the investigation was closed, but wouldn’t elaborate. Peter Hargitay told Reuters that the prosecutors’ decision “remains a mystery to us to this day.”



“You can do this from across the world. The penalties and the laws have to catch up.”


 

Former U.S. cybercrime prosecutor Mark Califano told Reuters that cracking international hacking cases is “really very hard.” But he said it was still “very disconcerting” that Appin’s hackers were “so successful in evading law enforcement despite apparently significant effort to try to track them down – and some very good evidence.”

Rajat Khare’s lawyers said their client had never been charged with hacking “by any police, investigative, regulatory, or charging authority.”

Reuters was unable to establish whether Appin was ever investigated in its native India.

K. K. Mookhey, the cybersecurity consultant whose client was targeted by Appin, said he alerted India’s cyber response agency, CERT-In, in 2013, but never heard back. CERT-In did not respond to requests for comment.

Rajat Khare has come to the attention of the Indian government on a separate matter: A 2021 complaint filed with the country’s Central Bureau of Investigation accused Khare of being one of at least eight people who embezzled roughly 8.06 billion rupees ($97 million) lent to the Indian education company Educomp, where he had previously served as a director. There is no indication that the case is related to hacking.

The complaint was filed by a senior official at the country’s biggest lender, the State Bank of India. Reuters could not determine the case’s status. The State Bank, the CBI and Educomp did not respond to requests for comment. Khare’s lawyers said he had been “cleared” by Educomp’s management. They didn’t provide evidence and said they could not offer details on the CBI probe.

U.S. intelligence agencies have known about Appin’s capabilities for more than a decade, according to three former American security officials and law enforcement documents reviewed by Reuters.

The National Security Agency (NSA), which spies on foreigners for the U.S. government, began surveilling the company after watching it hack “high value” Pakistani officials around 2009, one of the sources said. An NSA spokesperson declined to comment.

Another former U.S. security official said Rajat Khare was of such interest that the FBI tracked his travel and communications. The law enforcement case files also show that the FBI told its Swiss counterparts that it had “a confidential human source who has the capacity to report on Appin Security matters.”

Rajat Khare’s lawyers said the notion that he had been investigated by the FBI or any other such law enforcement body was “absurd.”

The bureau’s investigation into the Appin hack that sparked turmoil within the Shinnecock Nation did yield two convictions.

The first came in 2016, when a Shinnecock tribal official named Karen Hunter pleaded guilty at a federal court in the Long Island town of Islip to unlawfully accessing the email account of her fellow Shinnecock tribal member Chuck Randall.

The court filings, which were partially sealed, show that Hunter got probation. It was not until several years later that Steven Santarpia, the private eye, said he had been hired by Hunter to carry out the job.

Santarpia was the second to be convicted. He received probation from the same court in Islip in 2020 after pleading guilty to a single count of computer hacking, saying in an affidavit reviewed by Reuters that he hired Appin to carry out the email heist. Most of the filings in that case, which mask his identity, remain secret. No public mention of Appin was made in either his or Hunter’s prosecution.

Hunter did not return repeated messages from Reuters seeking comment. A reporter who visited Shinnecock Nation territory in an effort to interview her was intercepted by the tribe’s chairman, Bryan Polite, and ordered off the reservation. Polite said in an email that the tribe’s governing body was not interested in commenting.

Randall said he was baffled by the U.S. government’s lack of action against Appin.

“You can do this from across the world,” he said. “The penalties and the laws have to catch up.”

‘Godfather for all hackers’

Appin’s legacy still lingers more than a decade after the Shinnecock hack.

Its web presence faded in the months following the publication of the Norman Shark report in 2013, internet archives show. Eight former employees say their old managers told them to delete references to Appin from their public profiles.

Its former holding company, Appin Technology, changed its name three times, finally settling on Sunkissed Organic Farms in 2017, records filed with India’s Ministry of Corporate Affairs show. Its subsidiaries also underwent rebrandings: Appin Software Security, the arm which billed private eyes for the hacking work, became Adaptive Control Security Global Corporate, or ACSG, in 2015.

Rajat Khare’s lawyers say he left Appin Technology in December 2012, a move that “officially and immediately separated him from all Appin entities.” They produced two letters they said showed those resignations.

Yet Khare’s signature is on several Appin corporate filings dating to 2013 and 2014; and shareholder data shows he maintained a stake in Appin Technology for several years past 2012. According to Indian corporate records, Khare – who is now a Switzerland-based investor – resigned as director of the company once known as Appin Technology only in 2016.

His family still controlled the companies as recently as last year. Rajat’s brother, Anuj, and their father, Vijay Kumar, are majority owners of Sunkissed Organic Farms, which in turn owns ACSG and at least two other firms founded under the Appin name, according to the latest available financial data disclosed to the corporate affairs ministry.

In an exchange of messages over WhatsApp this week, ACSG company secretary Deepak Kumar confirmed that his firm was once known as Appin and described Rajat Khare as the corporate group’s “owner.” The following day, he said he would no longer reply to questions.

Anuj Khare’s lawyer, Kumar & Kumar Advocates, said questions about his client’s financial dealings were “not relevant.” The Khare brothers’ father, Vijay Kumar, did not return repeated messages seeking comment.

On its website, ACSG describes itself as a critical infrastructure protection company that caters to government clients. Employee resumes posted to job sites say the company carries out “lawful interception” and “offensive security,” industry terms for digital surveillance work.

More than 50 current and former ACSG employees reached by Reuters either did not respond or declined to comment, saying their work was confidential.

Reuters found at least half a dozen other hack-for-hire firms in India that have adopted Appin’s business model of serving private investigators and corporate lawyers. Some have run into trouble with American tech companies or been named in U.S. lawsuits.

Last year, Facebook and Instagram owner Meta Platforms identified CyberRoot Risk Advisory, a firm created by Appin alumni, as a mercenary spy company that used bogus accounts to trick people into clicking malicious links.

In October 2022, CyberRoot and BellTroX InfoTech Services, another firm founded by a former Appin employee, were accused of hacking former Wall Street Journal reporter Jay Solomon and one of his key sources, according to lawsuits filed last year by each of the men in federal court, one in Washington, the other in New York. Solomon later settled his Washington case on undisclosed terms; the New York lawsuit filed by his source is ongoing.

In June 2022, Google researchers linked hack-for-hire activity to another Indian company named Rebsec Solutions, which Google said “openly advertises corporate espionage.”

Rebsec’s founder, Vishavdeep Singh, told Reuters he had worked for Appin and BellTroX but was never involved in hacking, and that Rebsec merely taught cybersecurity courses.

CyberRoot said in a public statement issued last year that it “has never engaged in illegal activities.” It declined further comment. Attempts to reach BellTroX’s founder, Sumit Gupta, have been unsuccessful.

In his last known interview, speaking with Reuters in 2020, Gupta claimed he was not personally involved in cyberespionage. But he did acknowledge the outsized role that his former employer played in shaping the industry.

“Appin is the godfather for all the hackers,” he said.