Hacking Team: inside job?
Italian police are said to be investigating whether a group of six ex-employees were behind the breach on the cyber-intrusion experts. However it is clear that there were severe rifts within Hacking Team&nbsp;from at least two years ago, with a number of the initial founders being sidelined as the business shifted from defensive products to clearly offensive products. This shift lead Anonymous to physically invade the offices in protest, and in Feb 2014 there was an embarassing expos&eacute; by CitizenLab showing that HT's offensive products had been used by the Ethiopian authorities against independent journalists. &nbsp;Some suggest that the claims of sabotage by ex-employees may well be a revenge claim by the management, who only days ago were claiming that it was a highly sophisticated attack by a nation-state.
Italian prosecutors have begun a criminal investigation of six former employees of the embattled company Hacking Team, according to a Reuters' report citing anonymous sources.

Hacking Team was hacked two weeks ago and had its data published all over the Internet. The leaked cache includes hundreds of gigabytes of company e-mails as well as some of its source code; the police allegedly suspect the involvement of former company insiders.

According to Reuters, the new criminal inquiry is in addition to the fact that the before the hack, several former employees were being privately accused of allegedly violating their contracts and using secrets to benefit competitors.

"I've read in the press that I'm being sued, I have also read the conversation between Vincenzetti and his lawyers about suing me," former senior developer Guido Landi told Ars Monday morning. "That's all I know for now."

It remains unclear if Landi and other former employees interviewed for this piece are the ones being targeted by Italian investigators, but they believe they are. Landi added he planned to meet with the Milan public prosecutor this week.

"Hacking Team believes several former employees are in violation of the employment agreements in that they used their knowledge of the company and proprietary information to compete against Hacking Team," Eric Rabe, company spokesman, told Ars by e-mail on Sunday. "However, this is a personnel matter and the company has no further comment."

Tear down this wall

How did things get to this point? Ask Alberto Pelliccione, who joined Hacking Team in late 2007. He first came to Hacking Team for the money. In 2007, he said he was going through a financial "black period" and needed to help his family.

"[When I joined], they were only doing [penetration testing], they were only a defensive unit—the offensive unit had only existed for three months, it was brand new," Pelliccione told Ars.

That changed, however, and Hacking Team’s income soon skewed heavily toward offensive products.

"The environment at the beginning was really nice, it was a startup," Pelliccione noted. "After the first sales came in, the first bad guys were put in jail, it was nice, it was rewarding. Things changed when the customer base started to enlarge."

Pelliccione said that things really started to change for Hacking Team in 2012. That was both the first crisis for the company (a critical article published in August on Slate) as well as the beginning of the company’s expanded sales. Pelliccione, who by that time was in charge of mobile R&D, said that the company began to put up more and more internal walls. He said the exploitation team eventually became separated from the R&D development team.

Advertisement

"We had no idea what they were working on," Pelliccione continued. "We almost didn't have access. They really compartmentalized everything. That was really the moment that I stopped working there. What was the point of making so many secrets? There was a guy developing exploits for the mobile platform and I had no idea that he was working on exploits for my platform. It was normal to do that. I don't like that! We weren’t even talking any more."

In December 2012, Vincenzetti hired Rabe, a PR veteran from Bell Atlantic and Verizon, to become the public face of the company. (After Hacking Team was hacked two weeks ago, Rabe was flown out immediately to the company’s headquarters in Milan—where he has remained ever since.) In an e-mail written at the time of his hiring, Rabe talked about the challenges facing the company:

Being in a business such as HT's poses significant public relations challenges. Many in the general public lack a clear understanding of technology and may be fearful of it. At the same time they also do not understand how technology can be abused and misused and how technologies such as those you create are an important safeguard. Our effort will be to position HT as it deserves to be know [sic]: as a leader in one of the most sophisticated areas of technology and in the lawful intercept field providing leading edge solutions to government agencies who in turn use HT tools to keep their citizens safe.

By 2013, new deals were signed with government agencies all over the world in places like Thailand, Bahrain, Mexico, and Mongolia. Controversy over the company's clients continued to escalate. In early November 2013, some Anonymous protestors even broke into the Hacking Team offices.

"And from that point, they started to have physical security, there were cameras in the entrance and you needed a badge," Pelliccione said. "Before that you didn't need it except a padlock and a key to get into the office."

He called the then-management at Hacking Team "oppressive."

"I think that part of the reason was to avoid generating debates and discussions internally of who the customers were," Pelliccione continued. "That's the way I interpreted it when I was there. We shifted from a really open environment to a really closed environment. They started more making groups. There was a group called FAE (Field Application Engineers): they created this group and they were in charge of pre-sales and post-sales process. At some point they became completely separated from us. We didn't know what sales were in progress. They were five stories above us. Before, we were together, talking—this talking thing was really dis-incentivized."

On February 12, 2014 Hacking Team got another wave of attention in the media thanks to an analysis by Citizen Lab, a well-known research group at the University of Toronto. The lab showed how Hacking Team software had been used to target an Ethiopian journalist for surveillance. According to Pelliccione, as the employees began to read those reports, the company began cracking further from within.

Advertisement

"There were debates [within the company] and this is my opinion probably they decided to keep us away from the customer line so we couldn't complain," he said.

At that point Pelliccione decided that he’d had enough; eights days later he announced to his colleagues that he was departing to found his startup in Malta. The company, Reaqta, describes itself as offering "cyber threat in-depth defense, continuous response, and data exfiltration prevention."

Vincenzetti was quite irritated. In an e-mail to investors, the CEO assured them that "nothing like this had ever happened before."

Unpredictable

In February 2015, Serge Woon, a company technician based in Singapore who primarily was in charge of "pre-sales" and installations to Asian clients, left Hacking Team to join Pelliccione’s startup. Within two weeks Hacking Team was already in touch with lawyers in Singapore, plotting to sue Woon for breach of contract. The company later sued Woon in Singapore.

Alex Velasco, who held a similar sales position in Washington, DC, was fired by Hacking Team after accusations of conflict of interest and breach of contract. Velasco was sued in a Milan court in March 2015 and he has been subpoenaed in the United States. Since leaving Hacking Team, Velasco also joined Reaqta.

"Of course it’s up for debate, and it sounds like revenge than more a breach of anything," Woon told Ars. "We have to wait to see how the proceedings turn out, but as of now I cannot comment on the details of the proceedings."

Woon now has same job he did before, only this time for Reaqta. The new outfit is arguably a competitor to Hacking Team, but he and his colleagues don’t see it that way.

"The point is that [the lawsuit] could turn out either way," he said. "But as far as I see it’s not something—we didn’t do anything wrong. Certainly not stealing data, that’s out of the question. The motivation is laughable. Why would we want to steal any data? We’re doing something defensive so we don’t aim to counter [Hacking Team's] Galileo or [Remote Control System] specifically because it doesn’t make sense in an economical point of view, the market is just too small.

"What they sell, they’re selling a needle in a haystack—we’re targeting the haystack rather than the needle," he continued. "If you know how Reaqta works, we do behavioral analysis, There’s not specific or proprietary information that we use for malware, it is generic and it is across the board."

Woon doesn't feel sorry for all the chaos facing Hacking Team in light of the recent breach (and why would he, given the potential lawsuit). He sees it instead as a bit of welcomed transparency, "The hack just brings more light into what the company is doing."

Regardless of any ill-will or standing as a new competitor, the ex-Hacking Team employees now at Reaqta aren't sure their former company will survive this most recent hurdle.

"I would be amazed—they're full of surprises, so you never know," Pelliccione said with a laugh.