Bipartisan lawmakers seek US ban on hack-for-hire firms

A bipartisan group of U.S. lawmakers has asked the government to ban several hack-for-hire firms — companies that carry out cyberattacks on behalf of paying clients — accusing them of targeting Americans and abusing foreign courts to silence U.S. reporting on their activities. Democratic senators Ron Wyden of Oregon and Sheldon Whitehouse of Rhode Island, along with Republican congressman Pat Harrigan of North Carolina, sent a letter Wednesday to Commerce Secretary Howard Lutnick urging him to add three Indian companies — BellTroX, CyberRoot, and Sunkissed Organic Farms (formerly known as Appin) — to the department’s economic sanctions “entity list,” which would bar U.S. businesses from transacting with them and restrict their access to critical technology such as software licenses and cloud infrastructure.

The lawmakers say the three firms have for more than a decade conducted cyberattacks and targeted espionage against Americans, business owners, and their lawyers to “manipulate ongoing litigation,” and accuse them of stealing data from thousands of Americans through an “aggressive censorship campaign” meant to suppress public awareness of their alleged activities. “This coordinated effort effectively allows foreign entities to use foreign courts to keep the American public in the dark about cyber threats to their own country and undermines the fundamental constitutional rights of U.S. citizens,” the lawmakers wrote. It’s unclear whether Commerce will add the companies to the list; a spokesperson didn’t respond to a request for comment.

The letter follows extensive reporting on the hack-for-hire industry documenting how hackers are paid to break into the inboxes and devices of executives, lawmakers, and military officials to gain advantage in lawsuits or influence their outcomes. Appin previously secured a global court order from an Indian court forcing Reuters to temporarily take down its reporting on the company while Reuters appealed; the order was later lifted and the report republished.

The lawmakers’ letter says the firms operated at the behest of the Qatari government and that their targets included a former senior Republican lawmaker. Appin has previously been linked to a campaign of cyberattacks against FIFA officials that reporting says was directed by Qatar to protect its 2022 World Cup hosting plans. Representatives of the three firms and the Qatari government did not respond to requests for comment.

Why it matters

The push tests whether Washington will treat foreign hack-for-hire operations as a national-security threat worth sanctioning, rather than a private legal dispute between hackers and their targets.