Inside the global hack-for-hire industry
In a quiet alcove of the opulent Leela Palace hotel in Delhi, two British corporate investigators were listening intently to a young Indian entrepreneur as he made a series of extraordinary confessions.
The 28-year-old computer specialist Tej Singh Rathore described his role as a player in a burgeoning criminal industry stealing secrets from people around the world. He had hacked more than 500 email accounts, mostly on behalf of his corporate intelligence clients.
He believed the smartly dressed British investigators were in India to employ a “hack-for-hire” organisation such as his own. In fact, they were undercover journalists infiltrating the illegal hacking industry.
Rathore paused briefly as guests in colourful saris swept past the trio’s table before confiding that he had broken into a number of email accounts on behalf of UK clients. In fact, he claimed, the majority of Britain’s private investigation firms employ Indian hackers.
“The British and the whole world … are using Indian hackers,” he said.
The use of the Indian underworld to break into email accounts and smartphones has become a practice that has been proliferating for years. British investigators have been able to commission “hack-for-hire” firms with little fear that they will be prosecuted for breaking the UK’s computer misuse laws.
An investigation by the Bureau of Investigative Journalism and the Sunday Times revealed the contents of a leaked database from inside one of the major “hack-for-hire” gangs. It shows the extent of illegal computer hacking across the City of London for corporate intelligence companies targeting British businesses, journalists and politicians.
But this gang is not the only one. The undercover reporters made contact with a series of Indian hackers who were secretly filmed speaking openly about their illicit work and their underground industry’s nefarious influence in Britain.
It is illegal to commission hacking from the UK, a crime punishable with a prison sentence of up to 10 years. There are similar laws in India, where unlawfully accessing a computer carries a jail sentence of up to three years.
But the hackers had no fear of being found out. One laughed when asked if any Indian hacker had been caught. “Not even a single [one],” he said.