US-Emirati Scandal: Three US Ex-intelligence Officials Admit to Hacking for UAE

Three former US intelligence agents admitted in a Virginia court on Tuesday to taking part in a United Arab Emirates (UAE) hacking operation aimed at enemies and rivals of the Gulf nation.

Marc Baier, 49, Ryan Adams, 34, and Daniel Gericke, 40, agreed to pay a cumulative $1.7m in penalties, the amount they earned while working for the UAE, to resolve charges of violating US export controls, computer fraud and illegal use of other people’s computer access.

The federal district court in Alexandria, Virginia agreed to defer prosecution for three years in the complex case, which highlighted the global market of government’s seeking highly trained computer security experts to spy on perceived enemies and threats.

Baier, Adams and Gericke were part of a clandestine unit named Project Raven, first reported by Reuters, which hacked into the accounts of human rights activists, journalists and rival governments at the behest of the UAE’s monarchy.

The three defendants had previously worked in the US intelligence community, including the National Security Agency and in the military.

According to the justice department, they had originally worked for a US company providing cyber intelligence operations for the UAE government that met US regulations.

The men then moved in 2016 to higher-paying jobs at a UAE government-linked company, identified in media reports as DarkMatter, where they began carrying out hacking jobs on designated targets, including servers inside the US.

Media reports said the targets were both inside and outside the country, and the operation’s methods consisted largely of uploading malware and exploiting software and hardware vulnerabilities to break into and gain control of servers, phones and other digital equipment.

The former programme operatives said they believed they were following the law because superiors promised them the US government had approved the work.

Baier, Adams and Gericke admitted to deploying a sophisticated cyberweapon called “Karma” that allowed the UAE to hack into Apple iPhones without requiring a target to click on malicious links, according to court papers.

Karma allowed users to access tens of millions of devices and qualified as an intelligence gathering system under federal export control rules.

Source: Agencies