L3Harris Hacking Tool Theft: Ex-Exec Ordered to Pay $10M

Key Takeaways

• Peter Williams must pay $10 million in restitution on top of $1.3 million already owed to L3Harris
• Williams sold seven trade secrets to Operation Zero, a Russian broker working exclusively with the Russian government
• L3Harris claims losses of up to $35 million from the theft of cyber exploits and surveillance technology

The $10 Million Restitution Order

A judge on Wednesday ordered Peter Williams, the former head of L3Harris's hacking and surveillance division, to pay $10 million in restitution to his former employer. This comes on top of the $1.3 million he had already been ordered to pay. Williams is serving more than seven years in prison after pleading guilty to stealing classified cyber exploits and selling them to a Russian broker.

Williams, a 39-year-old Australian citizen, ran Trenchant until last year. The division develops advanced spyware and hacking tools for the US government and Five Eyes allies. Those allies include Australia, Canada, New Zealand, and the United Kingdom. Veteran cybersecurity reporter Kim Zetter first reported the new restitution order in her newsletter.

What Williams Stole and Who He Sold It To

Prosecutors accused Williams of stealing seven unspecified trade secrets from Trenchant. These were almost certainly cyber exploits, which is code that hijacks software vulnerabilities, and surveillance technology. He then sold them to Operation Zero, a Russian firm that acts as a broker buying and selling hacking tools.

Operation Zero says it works exclusively with the Russian government and local Russian companies. US prosecutors called it "one of the world's most nefarious" exploit brokers. Williams made $1.3 million from the sales. He spent the money on luxury watches, a house near Washington DC, and family vacations.

“[Williams] betrayed the United States and its allies”

— US prosecutors

Trenchant's Origins and Role in Intelligence

Trenchant was born from L3Harris's acquisition of two sister startups. The division sells exclusively to the US government and the Five Eyes intelligence alliance, a coalition of five English-speaking nations that share classified intelligence. Williams had previously worked in one of Australia's intelligence agencies before joining the private sector.

The case represents one of the worst leaks of advanced hacking tools in US history and in the history of its closest allies. The tools Williams stole were designed to exploit software vulnerabilities in targets of interest to Western intelligence agencies. In Russian hands, those same exploits could be used against Western systems or to identify and patch Russian vulnerabilities.

The Broader Exploit Market

Exploit brokers like Operation Zero occupy a grey market in cybersecurity. They buy vulnerabilities and hacking tools from researchers and insiders, then resell them to governments. Western brokers sell to NATO allies. Russian and Chinese brokers sell to their respective governments. The prices can reach millions of dollars for a single zero-day exploit.

Williams's case shows the insider threat remains one of the hardest problems in cybersecurity. He had legitimate access to Trenchant's most sensitive tools as the division's general manager. No firewall stops someone who is supposed to be there.

What Happens Next

Williams's lawyers did not respond to requests for comment. He will continue serving his seven-plus year sentence while the restitution order takes effect. L3Harris claimed $35 million in losses to prosecutors. Whether they will recover even a fraction of that remains unclear.

The case will likely prompt reviews of insider access controls at other defense contractors. When someone with Williams's access decides to sell secrets, the damage is done before anyone notices.

Frequently Asked Questions

Who is Peter Williams and what did he do?

Peter Williams was the general manager of Trenchant, L3Harris's hacking and surveillance division. He stole seven trade secrets, including cyber exploits and surveillance tools, and sold them to Operation Zero, a Russian broker, for $1.3 million.

What is Operation Zero?

Operation Zero is a Russian firm that acts as a broker for hacking tools. It says it works exclusively with the Russian government and local Russian companies. US prosecutors called it one of the world's most nefarious exploit brokers.

What is the Five Eyes intelligence alliance?

Five Eyes is a coalition of five English-speaking nations that share classified intelligence: the United States, Australia, Canada, New Zealand, and the United Kingdom. Trenchant sold its hacking tools exclusively to these governments.

How much does Williams owe in total?

Williams must pay $11.3 million in total: $10 million ordered this week plus $1.3 million previously ordered. L3Harris claims actual losses of up to $35 million.

What sentence is Williams serving?

Williams pleaded guilty and was sentenced to more than seven years in federal prison for stealing and selling the classified hacking tools.

Source: TechCrunch / Lorenzo Franceschi-Bicchierai