Peter Williams ordered to pay $10M for selling hacking tools

On Wednesday, a judge ordered Peter Williams, the 39-year-old former general manager of Trenchant, to pay $10 million in restitution—a court-ordered payment to compensate for loss—to his former employer, L3Harris. This new penalty comes on top of a previous restitution order of $1.3 million. The ruling follows his theft of trade secrets from Trenchant, a division of L3Harris that develops spyware and hacking tools, for which he was sentenced to more than seven years in prison.

Williams managed Trenchant until last year, when he was arrested and accused of stealing trade secrets. Williams stole seven trade secrets—almost certainly cyber exploits—from Trenchant and sold them to Operation Zero. Williams made $1.3 million from the sale of these secrets, which he used to purchase luxury watches, a home near Washington, D.C., and family vacations. The U.S. government, in its role as prosecutors, described Operation Zero as “one of the world’s most nefarious exploit brokers.” According to Operation Zero, the Russian firm acts as a broker that works exclusively with the Russian government and local companies. Trenchant suffered losses of up to $35 million due to the theft. Williams also tried to frame one of his employees for the theft.

The stolen tools were developed by Trenchant, a division of L3Harris. The U.S. government and its allies in the Five Eyes—an intelligence alliance of five nations including the United States, Australia, Canada, New Zealand, and the United Kingdom—rely on such cyber capabilities. U.S. prosecutors stated that Williams betrayed the United States and its allies by providing tools that could have been used to hack millions of computers and devices around the world. After Williams sold the hacking tools, some of them ended up being used by Russian government spies in Ukraine and Chinese cybercriminals. Former L3Harris employees recognized the stolen code in cybersecurity research published by Google, which identified the stolen tools after investigating the cyberattacks in which they were deployed.

Why it matters

This case underscores the severe risks of insider threats within the defense and intelligence supply chain, particularly when sensitive cyber exploits are leaked to foreign adversaries.