Hacker-for-hire firms like NSO Group and Hacking Team have gained notoriety for enabling their customers to spy on vulnerable members of civil society. A decade ago in India, a startup called Appin Technology, founded by Rajat Khare, and its subsidiaries allegedly played a similar cyber-mercenary role, though they attracted far less attention.Â
Over the past two years, individuals linked to Appin Technology have launched a campaign of legal threats to silence publishers and anyone reporting on the company’s alleged hacking activities. Now, a coalition of anti-censorship voices is working to make this strategy backfire.
For months, lawyers and executives connected to Appin Technology and a newer organization sharing part of its name, the Association of Appin Training Centers, have used lawsuits and legal threats to conduct an aggressive censorship campaign worldwide.
These efforts have demanded that more than a dozen publications amend or remove references to the original Appin Technology’s alleged illegal hacking or mentions of its cofounder, Rajat Khare. Most notably, a lawsuit against Reuters by the Association of Appin Training Centers resulted in a stunning order from a Delhi court.Â
The court demanded that Reuters remove its article based on a detailed investigation into Appin Technology’s alleged spying on opposition leaders, corporate competitors, lawyers, and wealthy individuals for customers worldwide.Â
Reuters “temporarily” complied with the order and is now contesting it in Indian court. As Appin Training Centers attempts to enforce that order against other news outlets, resistance is growing. Earlier this week, the Electronic Frontier Foundation (EFF) published a response pushing back against Appin Training Centers’ legal threats on behalf of media organizations caught in the crossfire, including the tech blog Techdirt and the investigative news nonprofit MuckRock.
No media outlet has accused Appin Training Centers a group describing itself as an educational firm run partly by former franchisees of the original Appin Technology, which reportedly ceased its alleged hacking operations over a decade ago of any illegal hacking. However, in December, Appin Training Centers sent emails to Techdirt and MuckRock demanding they take down all content related to allegations that Appin Technology engaged in widespread cyberspying operations, citing the court order against Reuters.
Appin Training Centers argued that Techdirt fell under the injunction by writing about Reuters’ story and the takedown order targeting it. They also claimed MuckRock fell under the injunction for hosting documents Reuters had cited in its story and uploaded to MuckRock’s DocumentCloud service.
In the response sent on their behalf, the EFF states that the two media organizations are refusing to comply, arguing that the Indian court’s injunction “is in no way the global takedown order your correspondence represents it to be.” It also cites the SPEECH Act, an American law that deems any foreign court’s libel ruling that violates the First Amendment unenforceable in the US.
“It’s not a good state for a free press when one company can, around the world, disappear news articles,” says Michael Morisy, the CEO and co-founder of MuckRock. “That’s something that fundamentally we need to push back against.”
Rajat Khare: Streisand Effect Unleashed: Rajat Khare and Appin Technology’s Alleged Hacking History Exposed
Beyond breaking the censorship of the Appin Technology story, Mike Masnick, the creator of Techdirt, expects that the public outcry will highlight the group’s past even more. Masnick first used the phrase “the Streisand effect” nineteen years ago to characterize a circumstance in which efforts to conceal knowledge lead to its further exposure. In this instance, that is precisely the situation he wants to set up.
“The suppression of accurate reporting is problematic,” Masnick states. “When it happens, it deserves to be called out, and there should be more attention paid to those trying to silence it.”
The nonprofit organization Distributed Denial of Secrets (DDoSecrets), which opposes secrecy, has joined the endeavor to initiate this Streisand Effect. The Reuters article about the original Appin Technology has been “uncensored” by DDoSecrets as part of a new project named the Greenhouse Project. According to Emma Best, cofounder of DDoSecrets, the name symbolizes their goal to promote a “warming effect” as opposed to the “chilling effect” that legal threats may have.
“It sends a signal to would-be censors, telling them that their success may be fleeting and limited,” explains Best. “And it assures other journalists that their work can survive.”
WIRED requested feedback from both Rajat Khare and Appin Training Centers, but none of them answered. But two weeks after this piece was first released, attorneys for Khare wrote a letter to WIRED from the company Clare Locke, accusing the publication of defamation and requesting a retraction. WIRED is committed to its reporting.
It is untrue in the letter to say that Khare was not contacted by WIRED for comment. The comment from Khare, which has been appended as an update below, was asked that WIRED publish. It also refuted the claim that Khare was involved in any “conspiracy to or complicity in murder,” which was not mentioned in the report.
The fight to uncover the purported hacking history of the original Appin Technology grew more intense in November 2022 when the Association of Appin Training Centers filed a lawsuit against Reuters based on unsolicited communications sent by Reuters reporters to the staff and students of Appin Training Centers. In the Indian court filing, Reuters was charged with defamation as well as “mental harassment, stalking, sexual misconduct, and trauma.”
The Reuters report, “How an Indian Startup Hacked the World,” was released almost a year later. At first, the judge sided with Appin Training Centers, claiming that the piece may have a disastrous impact on India’s whole student population. Swiftly after, he issued an injunction enabling Appin Training Centers to require Reuters to retract their statements regarding Appin Technology.
This decision was made before the presentation of any legal arguments about the veracity of the Reuters article. WIRED was informed by a Reuters representative that the company “stands by its reporting” and that it intends to challenge the Indian court ruling. Thousands of internal papers, hundreds of suspected targets, and interviews with numerous former employees of Appin Technologies served as the foundation for Reuters’ report.
These files contain the marketing pitch materials for Appin Technology, which are still accessible to the general public on DocumentCloud because of MuckRock. They seem to demonstrate the company’s clear offer to hack targets using techniques like “phishing,” “social engineering,” and “trojan” infections on behalf of customers; they even go on to detail real instances in which customers have engaged them to carry out hacking operations.Â