Government Hacking Tools Are Now in Criminals' Hands (with Lorenzo Franceschi-Bicchierai)

0:00This stuff was probably used for really bad things. And I'm speculating, but I don't think this is a crazy theory. The Russian government maybe wanted to find out the position of some Ukrainian troops. They could have used this, and then they could have killed it.

0:16Hello, and welcome to the 404 Media Podcast, where we bring you unparalleled access to hidden worlds, both online and IRL. 404 Media is a journalist founded company and needs your support. To subscribe, go to 404media.co As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. And they get early access to our interview series too, like this episode. Gain access to that content at 404media.co This week, we're joined by Lorenzo Franceschi Bicari He is a writer from the technology website TechCrunch. I have known Lorenzo for years and years and years.

1:02Actually, all of us have at 404 Media. We all used to work with him at Motherboard, the technology section of Vice. And he really was an inspiration to me. I remember when he published an article about how the Italian government malware company hacking team was selling its government spyware to the drug enforcement administration and i was like wow you can figure this stuff out by looking in contracting records and all of that sort of thing and that got me very interested in the industry and me and lorenzo collaborated on a bunch of articles when we were both at motherboard including an investigation into the company called Azimuth Security, which you'll definitely hear about in the interview in a minute.

1:50But they sell, or rather sold, an array of hacking tools to Western government agencies. They were seen as the quote-unquote good guys in the industry, and that's why we covered them. But as this conversation shows, the company that came after Azimuth, it had something of a problem. A guy called Peter Williams, who sold a bunch of hacking technology to a Russian company. And it looks like that ended up in the hands of the Russian government and then later Chinese groups as well. There's some nuance there that you'll definitely hear in the episode, but I really, really hope you enjoy this conversation.

2:38All right, Lorenzo, welcome to the show. Thank you. Very excited to be here. Yeah, it's funny doing this with a friend. I just said that in another take that we started. But we will try to keep it as professional and rigid and on point as possible. No, obviously, we're just going to chat shit. We are professionals, yeah. We're going to talk about the O'Day industry for a while. So just to lay some groundwork, what is Trenchant? What is this company? Yeah, I think this is a good place to start. Trenchant is the heir, basically, of the two companies that we profiled, I guess, in 2017 or 18 at this point.

3:20Azimuth and Lynchpin Labs, they were sort of sister startups that developed zero days out of Australia, but they had offices in all the countries that are part of the Five Eyes, which is the intelligence alliance made by the English-speaking countries, Canada, Australia, New Zealand, the UK and the US. And shortly after we wrote about them, actually, they were sold to L3, a relatively large defense contractor, and they renamed Lynchpin Labs and Azimuth into this division called Transient. And I think it's fair to say that they are considered one of the best shops in terms of developing finding vulnerabilities, developing exploits, and because they're part of this U.S.-based defense contractor, they only sell to the Five Eyes.

4:09Yeah, I remember going or attempting to go to the London office of Linchpin Labs, because at the time, as you say, back in 2017, 2018, they were really, really secretive. And the industry sort of back then was, yes, it was coming out and you had like these big conferences where companies would sort of be a little more upfront with the idea that, hey, we buy zero days and we sell them to the government. And these guys were not like that. They were incredibly, not underground, that wouldn't be fair, but they kept themselves to themselves. So we managed to figure out, oh, these are like the best companies for selling zero days and not just the exploits, but the malware as well to Western governments.

4:57So basically no one had heard of at the time. Do you think that's why we wrote it? Yeah, I think at the time the market was different. The cybersecurity industry was a little bit different. I think at the time there were still people that didn't want to talk about the fact that they developed Zero Days. I don't remember when the first offensive con was organized. This is like a Berlin-based conference that essentially gathers Zero Day exploit makers, spyware makers. I think it was the first big one that was public. So yeah, at the time, Asimuth and Lynchpin Labs were great examples of where the market was.

5:31You know, they were relatively public. Mark Dowd was a very well-known hacker. And he was the CEO of Azimuth. Yeah, the founder of Azimuth. People knew what he was doing, but he wasn't advertising it on Twitter. On Twitter, he was just another cybersecurity guy. And to answer your question more directly, yeah, that was the public interest in that story was, well, you heard about NSO Group, you heard about Hacking Team, but here's this other company that you probably have never heard of, and they're doing even more important work or even more impressive work. And since then, it's become much more normalized.

6:05Now, sometimes a source reaches out and says, hey, have you heard about this company? You should write about it. I'm like, well, why? The existence of a company that sells zero days is not interesting anymore. The story now is, and in part it's always been, but the story is like, what are they doing? Who are they selling to? Did they sell to the wrong people? Did they break any laws? Export laws now are a thing that's much more established, although not super effective. So yeah, now it's just more like, what are these companies doing? Who is behind them? Is there an interesting character behind them?

6:39Are they doing anything bad? But the mere existence of a company is not that interesting. And I think the conferences are a great example of that. There's Exacon, there's OffensiveCon, their talks are online. I mean, Apple's head of security research engineering, SEER team, whatever that acronym means, went to Exacon to give a keynote, and he finished it saying, please look at your conscience and what you're doing because if you don't know where your work ends and you're not sure that you're contributing to the good of the world, maybe you should do another job or maybe you should work for us, which was pretty crazy.

7:17I've heard, I think it was this conference, but I heard that talk from Apple made people cry. Not in a, oh, we're being insulted way, but in a inspirational way, people who then went and saw that talk, who really do believe in, you shouldn't sell offensively, you should sell defensively, you should help Apple and that sort of thing. But you mentioned that, yes, stories back then in 2017, and definitely now, as you say, it is much more about who these companies sell to. And as you said at the time, everyone heard of NSO Group, and they sell to various authoritarian regimes, and then loads of other companies, like Hacking Team as well, selling to Sudan, whatever.

7:58Azimuth and Lynchpin were interesting because they sold to Western democracies. And like, we'd never seen that before. So Azimuth and Lynchpin Labs are now Trenchant. They have this reputation for only selling to the, I'm going to say, quote unquote, good guys. Obviously, that has radically changed in lots of different ways. That was just sort of the sentiment at the start. And if you want to be more specific, yes, they sold to the Five Eyes Alliance. So they have that reputation. but something which you've done fantastic coverage of something happened which has now maybe not shattered that reputation but has like really really harmed it there is someone called peter williams who worked at trenchant an indictment is unsealed well actually you correct me if i'm wrong you knew this before the indictment so maybe you want to take it from there Yeah, so this must have been July or August.

8:54And somebody told me, hey, have you heard of this John Dugan or John something? Apparently, he sold zero days to people he shouldn't. He works a trenchant. He sold them to some bad guys. I'm not sure if it was North Korea or China or Russia. And I mean, my first reaction was, I don't believe you. I think this sounds crazy. But, you know, the sources that I had were relatively, they were credible. They were people I knew. And so I was like, all right, let's see if this is true. And the big problem at the beginning was that I didn't have the name. It was like John Dugan, John something. So you weren't sure, sort of thing.

9:33Yeah, I wasn't sure who this person was, other than the fact that apparently, allegedly, they were a transient. Then I got the name, and it was Peter Williams, which was good to have a name, but it was a very generic name. You know, a lot of people are called Peter Williams. I think what actually at the time made me more convinced that there was a story there was that there was a UK business records website that showed that he had just resigned from trenchant. This was like 13 of August, something like that, mid-August. And my sources were saying, well, he didn't just resign, he was basically fired because of this.

10:07And at some point, I heard sort of like a side quest. Somebody told me, well, actually, there was another story that involves Peter Williams, and it's that he tried to scapegoat one of his employees. At this point, what I heard was that this Peter Williams had stolen some zero days or some exploits, some malware from Transhunt and sold it to someone he should not have sold it. This other story was basically that at some point, Peter Williams tried to frame one of his employees and he launched an internal investigation. They eventually fired his employee. And the other interesting thing about this story was that the employee got a notification from Apple saying, we believe you have been a target of mercenary spyware.

10:49Just briefly on that, maybe, because you've covered those notifications a lot, and they're also quite recent, in that Apple will now notify users of its products that they suspect have been targeted by government spyware. What's the deal sort of there? What's happening there? Yeah, this is a huge development in the last few years. What Apple is doing essentially is, yeah, when they detect some sort of a spyware campaign, They investigate, and when they determine that it was an NSO group or one of these companies, they send notifications to the people they believe were targeted. And, well, first of all, this shows you how much Apple can see from a device, which I think is good.

11:29You know, I don't want Apple to tell me if they believe I've been hacked. You know, people on the other side of the fence, meaning, you know, the Citizen Labs of the world, the Access Nows of the world, say that this has really changed the game. You know, back 10 years ago, these people, these researchers needed, you know, a random Ethiopian journalist, so to speak, you know, like somebody that they didn't even know to reach out to them saying, hey, I think I've been hacked. And that's like, you know, that doesn't scale. It's very hard to do that kind of work. Now people receive these notifications.

11:57Apple actually tells them, please go to Access Now. They can help you. And that has led to so many investigations and has led to even investigations that we don't know about. So Citizen Lab doesn't write about all the investigations that they do, maybe because the victim doesn't want to, maybe because they, I don't know, it's not that interesting to be a public story. Same with AppNest International. But yeah, in the last few years, because of these notifications, we've heard of so many, so many cases. And we don't know how many notifications Apple sends, but we can get an idea by the fact that they say they send to more than 150 countries.

12:33And usually they do in batches. So if somebody receives a notification, it means that likely they're part of a group. You know, maybe they're like Catalan politicians and Spain has targeted them or Hungarian journalists and something like that. So yeah, so this trenchant employee had gotten one of these notifications and it was kind of unclear why, although now in hindsight, we can imagine. Yeah, it's like a complicated wrinkle to the story. So you have this person inside trenchant, Peter Williams, who you're hearing about that, well, they've stolen malware and maybe they've given it to the bad guys and they're trying to cover it up by blaming this other employee at the company.

13:14What do you do with that information and what do you publish before we get to the next bit? Yeah, so once we could confirm the case of the scapegoat, so to speak, we reported that story. And honestly, at that point, it was kind of a strategy. We didn't have the other story. We had the name, but we had no concrete information. There was no indictment. I heard this from multiple sources, but you can't write an article saying Peter Williams from Trenchant committed a crime based on anonymous sources. Like you're going to get sued, rightfully so. So we published the story and actually, and this is my fault, I'm not super diligent about checking court records.

13:49So I hadn't checked for a while. And again, one of the challenges was that, you know, there's a lot of Peter Williamses. So after I published the story, I think the same day or maybe the next morning, I go to PACER. I check and there's a, there it is, a very recent case involving a Peter Williams. I go, there's like a, it's not an indictment. It was a very short document. It identified this Peter Williams, didn't say where he worked. It said he worked at company one or company A. And it said that he had stolen eight trade secrets. So there was no reference to Trenchon. There was no reference to L3 Harris.

14:23Didn't say what the trade secrets were. I was pretty sure it was him. But again, there's a lot of Peter Williamses. So that was very frustrating. Also, because at that point, I had reached out to pretty much everyone who could know, you know, DOJ, FBI, the Australian Signals Intelligence, embassies. I reached out to everyone. Nobody answered. But the document was there. It was sitting there. And at that point, I knew that other people, other journalists were going to see it. Right. And yeah, then a week later, more or less, we reached out again to DOJ. And this time, DOJ was like, yeah, on background, blah, blah, blah.

14:54This is him. This is a L3 Harris employee. So, on background, DOJ confirmed that, yes, the Peter Williams you're talking about from Trenchant is the one and the same Peter Williams in this court record, which is just saying sort of vaguely he allegedly stole a trade sequence or whatever. Yeah, now that I think about it, I think actually that document, the most interesting detail was that I think they said that he sold to a Russian buyer. And that was definitely the most interesting part of that document, even though we didn't know who that Peter Williams was. But once we confirmed that that was Peter Williams, we knew that it sold to Russia, which is pretty bad on its own.

15:32And that was before we knew actually what happened, which is even worse. And we'll talk about that now. So that court record comes out, you're building up the reporting, you know, the usual cybersecurity press start looking at this as well. But then we get more information. So what does he do? Because he's convicted that, right? So what did Peter Williams do? Yeah, I think a few days after the document, more documents dropped and there was even a hearing that I did not attend, but Patrick O 'Neill attended it from Bloomberg. And between the core documents, the new core documents and the hearing, we started finding out exactly what happened.

16:04And what happened was even worse than what I heard. essentially what the DOJ was alleging and then he admitted to so that's what he did is that at some point in 2000 around 2022 when he was already I think he was already the general manager at so essentially the head of the whole hacking unit he started taking some trade secrets which in this case were vulnerabilities exploits maybe even you know full-fledged products that you could just plug in and deploy. And he sneakily put them on USB sticks, took them out of the offices. I think he took them out of both the office in Sydney and in the US in DC.

16:44So he was doing this like systematically over three years. At some point, the FBI got wind of something, that something was happening at Trenchon, that some secrets were getting out. We'd love to know how they came across that? Yeah, that's not clear from the court documents. And it would be great to know. So the FBI finds out, they go to Trenchant, and they actually go to him and say, hey, we would like to ask you some questions. I think at this point, they didn't know it was him or they didn't even suspect. But, you know, he's the general manager. He's the person to ask and to ask for collaboration.

17:18Because at this point, maybe Trenchant got hacked. Maybe he got hacked or somebody got hacked and these things were getting stolen by China or Russia. So the FBI approaches Peter Williams, he collaborates, and that's when we get to the scapegoat. This is like March of last year, more or less a year ago. Transchant opens an internal investigation, they end up firing this guy, but the FBI is still asking questions. And in the summer of last year, they go back to Peter Williams and say, we know it was you.

17:56I don't think people talk enough about how messy it is to actually run an online business, or at least how messy it can be. You start with a simple idea and suddenly you've got one tool for your website, another for payments, something else for email, another thing for analytics, and none of them really talk to each other. It gets chaotic really fast. That's why Shopify exists. Shopify is the commerce platform behind millions of businesses worldwide and about 10 % of all e-commerce in the US, from huge brands to people just starting from scratch to 404 Media's merch store. Instead of juggling a bunch of different tools, Shopify brings everything into one place.

18:32You can build your store with ready-to-use templates that actually look good, manage inventory, process payments, track analytics, all from one dashboard. And when it comes to actually getting customers, Shopify makes that easier too. You can run email and social campaigns right from the platform. So you're not duct taping together 5 different services, and it feels like they all talk to Shopify. If you ever get stuck, they've got 24-7 support, which is huge when you're trying to figure things out on your own. Shopify just simplifies everything so you can focus on actually growing your business instead of managing tools.

19:03Start your business today with the industry's best business partner, Shopify, and start hearing... Sign up for your$1 per month trial today at shopify.com.media. Go to shopify.com slash media. That's shopify.com slash media. This episode is sponsored by BetterHelp. You know, financial stress can really affect you more than you're thinking. Maybe you're pushing it down. It's tax season. No one wants to deal with it. No one wants to face it. Look, I get it. You know, I've been a contract employee for almost my entire career. Brief stints with W-2s. no one understands the stress of tax season more than me.

19:46But if you're worried about it and it's hitting you on an emotional level, that's normal. And sometimes we just need the right kind of support. And that's where BetterHelp comes in. So, you know, BetterHelp is this place where you can get quality therapists that work according to a strict code of conduct, and they are fully licensed in the United States. BetterHelp does internal matching work for you so you can focus on therapy. A short questionnaire helps identify your needs and preferences, and then their 12-plus years of experience and industry-leading match fulfillment rate kicks in, and that means typically you've got the right person the first time.

20:29But if they don't work out, you get somebody else. No harm, no foul. And you can do it at any time based on their tailored recommendations. so if you're feeling that strain this month as i am you know get some better help when life feels overwhelming therapy can help sign up and get 10 off at betterhelp.com slash 404 media that's b-e-t-t-e-r h-e-l-p.com slash four zero four m-e-d-i-a

21:11And at that point, Peter Williams realizes there's nothing else he can do but confess and collaborate and hope for, you know, maybe a deal or a more lenient sentence. So, yeah, he admits that actually it was him. He stole a bunch of trade secrets. He gets indicted for eight, but my guess is that he may have stolen more. I don't know if the FBI didn't have enough evidence or 8 was enough to get the sentence that they wanted we also don't know exactly what these 8-rate secrets are we guess that they were vulnerabilities or even exploits we don't know for what products we can get an idea of what they were from some language in both press release and some core documents where the DOJ says that this could have been used to hack millions of people around the world So we're probably talking about iPhone, O'Day's, Android, Chrome, Windows.

22:06So essentially systems that are widely used. These were not like router exploits. So yeah, Peter Williams confesses, the core documents become public, and some more details come out, and some of them are very interesting. For example, who did he sell to? At the beginning, it was like Russian buyer. Turns out this Russian buyer was a company called Operation Zero. And when they launched, they did kind of a stunt. You know, they said, we're looking for Zero Days for iPhones and Android, and we're willing to pay$20 million. Which is a big figure at the time. It's still a big figure, but it was like a big attention-seeking stunt.

22:41Were they willing to pay that? Maybe. Yeah, I don't know, but they said it. Yeah, I think the context here is that it's already the, you know, the Ukraine invasion is fully, you know, fully ongoing. Russia is like more isolated than ever. and essentially I think their rationale was we need to really offer a lot of money because the researchers that may sell to us are maybe not as many as before because there's sanctions, you're not allowed to sell to companies in Russia anything, so you need to really incentivize people to do something that potentially will get them in trouble which is what happened with Peter Williams and I think actually the dates of when Peter Williams reached out are around the time when Operation Zero announced this.

23:23So he was he probably saw the news and realized, well, that sounds like somebody I could go to. Speaking of money, he made 1.3 million, something like that. So he didn't make 20, but he made some sort of financial benefit. But Trench and later estimated a loss of 35 million. I guess that's like their value of the tooling. And then Peter Williams made just over a million, which he then used to buy what, like luxury watches? and that sort of thing? Yeah, some luxury watches. Some watch people realized that some of them were fake. Oh, that's good. Some vacations. A big house outside of Washington, D.C.

24:05But yeah, the numbers are interesting because, yeah, as you say, like you didn't get 20 million. But, you know, that's maybe because you didn't have the full chain. And, you know, that's something we can get into. But, you know, these days to hack an iPhone or even an Android phone, you need like multiple vulnerabilities and you need to essentially make them all work together. It's like a multi-step process. And the 20 million or the highest rewards these days are for something that works end-to-end. They call it end-to-end, an end-to-end exploit or an end-to-end chain or whatever. So essentially something that you can press a button and it goes from targeting you to now I can see everything on your phone.

24:42But for that, you need multiple products. So it's possible that Peter Williams only sold a few where it maybe was only able to steal some of that, a piece here, a piece there. Maybe something was from Chrome, maybe something was for iOS. So for some reason, it didn't get paid as much as maybe you would have thought. I think the estimated loss, we need to look at it a little bit skeptically in the sense that I think they probably also counting, you know, the time, the development time that they need to essentially find new vulnerabilities. So I don't know if like they were worth 35 million, But it's possible that they were close.

25:19Yeah. It requires whole teams of people. Like back when I was covering this more, that could be a team of like 4, 5, 6, up to like 10 people just focused on an iOS chain or something like that. And as you say, if you want to hack an iPhone, let's say it's a browser vulnerability or something, you go to a malicious website and it hacks your iPhone. You're going to need a Safari exploit. You're going to need something to get out of the sandbox of Safari. You're going to need something to get persistence on the iPhone, which as far as I can remember is kind of non-existent nowadays, where if you just turn off your iPhone and reboot it, like they can't get persistence basically, right?