Three former US intelligence and military officers have admitted working as mercenaries for the United Arab Emirates (UAE) and carrying out sophisticated hacking operations targeting victims in America.
The charges against them are published amid growing concerns that foreign states may be compromising US security by recruiting intelligence personnel to bolster their own capabilities.
The men, named as Marc Baier, Ryan Adams, and Daniel Gericke in an unsealed court document, were accused of breaking computer crime laws and export controls and have agreed to pay more than $1.6m (£1.1m) as part of a deferred prosecution agreement.
According to the court document, after leaving US government employment, the three men worked for an American company that provided licensed services to the UAE.
But in January 2016, “after receiving an offer for higher compensation and an expanded budget”, the men left this company and joined a new one called Dark Matter based in the gulf state.
The clandestine unit helped the UAE spy on human rights activists, journalists, and rival governments, according to Reuters, which reported on the clandestine unit called Project Maven before these charges were made public.
While working for the UAE business, which did not have an export licence to receive hacking technology from the US, the men developed “two similar ‘zero-click’ computer hacking and intelligence gathering systems” that were used to target victims in America.
“Today’s announcement shines a light on the unlawful activity of three former members of the US intelligence community and military,” said Steven D’Antuono of the FBI’s Washington Field Office.
“These individuals chose to ignore warnings and to leverage their years of experience to support and enhance a foreign government’s offensive cyber operations.
“These charges and the associated penalties make clear that the FBI will continue to investigate such violations.”
Bryan Vorndran, of the FBI’s cyber division, added: “This is a clear message to anybody, including former US government employees, who had considered using cyberspace to leverage export-controlled information for the benefit of a foreign government or a foreign commercial company – there is risk, and there will be consequences.”
As part of the deferred prosecution, Baier, Adams, and Gericke must cooperate with the Department of Justice’s investigation.
They have agreed to pay $750,000 (£542,000), $600,000 (£430,000), and $335,000 (£242,000) respectively over the next three years – funds which they are prohibited from being reimbursed for by the UAE.
They have also received a lifetime ban on receiving any security clearances, as well as from being employed as hackers or by “certain UAE organisations”.