Tech
Inside the story of the US defense contractor who leaked hacking tools to Russia
A veteran cybersecurity executive who prosecutors said “betrayed” the United States will spend at least the next seven years behind bars, after pleading guilty to stealing and selling hacking and surveillance tools to a Russian firm.
Peter Williams, a former executive at U.S. defense contractor L3Harris, was sentenced on Tuesday to 87 months in prison for leaking his former company’s trade secrets in exchange for $1.3 million in crypto between 2022 and 2025. Williams sold the exploits to Operation Zero, which the U.S. government calls “one of the world’s most nefarious exploit brokers.”
The successful conviction of Williams follows one of the most high-profile leaks of sensitive Western-made hacking tools in recent years. Even now that the case is over, there are still unanswered questions.
Williams, a 39-year-old Australian citizen who resided in Washington, D.C., was the general manager of Trenchant, the division of L3Harris that develops hacking and surveillance tools for the U.S. government and its closest global intelligence partners. Prosecutors say Williams took advantage of having “full access” to the company’s secure networks to download the hacking tools onto a portable hard drive, and later to his computer. Williams contacted Operation Zero under a pseudonym though, so it’s unclear if Operation Zero ever knew Williams’ real identity.
Trenchant is a crew of hackers and bug hunters who dig deep into other popular software made by companies like Google and Apple, identify flaws in those millions of lines of code, then devise techniques to turn those flaws into workable exploits that can be used to reliably hack into those products. These tools are typically called zero-day exploits because they take advantage of software flaws unknown to its developer, which can be worth millions of dollars.
The U.S. Department of Justice alleged that the hacking tools Williams sold could have allowed whoever used them to “potentially access millions of computers and devices around the world.”
For the past few months, I have been talking to sources and reporting on Williams’ story before news broke that he had been arrested. But what I had heard was patchwork and at times conflicting. I had heard someone had been arrested, but given the secret nature of the work involved in exploit development, proving it would be challenging.
Contact Us
Do you have more information about this case, and the alleged leak of Trenchant hacking tools? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or by email.
When I first heard of Williams, I wasn’t clear that I had even gotten his name right. At that point, his story was a rumor, moving through the hush-hush grapevine of zero-day exploit developers, sellers, and people with ties to the intelligence community.
I heard that maybe he was called John, or perhaps Duggan? Or all the different ways you can spell that in English.
Some of the first rumors I heard were contradictory. Apparently he stole zero-days from Trenchant, and maybe he sold them to Russia, or perhaps another enemy of the United States and its allies, like North Korea or China?
It took weeks just to confirm that there was indeed someone who even fit that description. (It turned out that Williams’ middle name is John, and Doogie is his nickname in hacker circles.)
Then, as the weeks of reporting rolled on, things started to become much clearer.
The Russian connection
As I first revealed in October, Trenchant fired an employee after Williams, who was still at the time head of Trenchant, accused the employee of stealing and leaking Chrome zero-days. The story was even more intriguing because the employee told me that after he was fired, Apple notified him that someone had targeted his personal iPhone.
What I learned was just the tip of the iceberg. I had heard more from my sources, but we were still piecing parts of the story together.
Soon after, prosecutors made their first formal accusation against a man named Peter Williams for stealing trade secrets, which first surfaced in the U.S. public court system. In that first court document, prosecutors confirmed that the buyer of these trade secrets was a buyer in Russia.
However, there was no explicit reference to L3Harris nor Trenchant, nor the fact that the trade secrets that Williams stole were zero-days. Crucially, we still couldn’t confirm for certain that it was the same Peter Williams, who we thought would have access to highly sensitive exploits as Trenchant’s boss, and not some terrible case of mistaken identity.
We still weren’t there.
On a hunch and with nothing to lose, we contacted the Department of Justice to ask if they would confirm that the person in the document was in fact Peter Williams, the former boss of L3Harris Trenchant. A spokesperson confirmed.
Finally, the story was out. A week later, Williams pleaded guilty.
When I first heard of his story, while I trusted my sources, I remained skeptical. Why would someone like Williams do what the rumors claimed? But he did, and did so for money, prosecutors allege, which Williams then used to buy a house, jewelry, and luxury watches.
It was a remarkable fall from grace for Williams, once seen as an accomplished and brilliant hacker, and especially for someone who previously worked at Australia’s top foreign spy agency and served in the country’s military.
What happened to the stolen exploits?
We still don’t know specifically which exploits and hacking tools Williams stole and sold. Trenchant estimated a loss of $35 million, per court documents. But Williams’ lawyers said the stolen tools were not classified as a government secret.
We can glean some insight based on the circumstances of the case.
Given that the Justice Department said the stolen tools could be used to hack “millions of computers and devices,” it’s likely the tools refer to zero-days in popular consumer software, such as Android devices, Apple’s iPhones and iPads, and web browsers.
There is some evidence pointing in their direction. During a hearing last year, prosecutors read out loud a post published on X by Operation Zero, according to independent cybersecurity reporter Kim Zetter, who attended the hearing.
“Due to high demand on the market, we’re increasing payouts for top-tier mobile exploits,” read the post, which specifically mentioned Android and iOS. “As always, the end user is a non-NATO country.”
Operation Zero offers millions of dollars for details of security vulnerabilities in Android devices and iPhones, messaging apps like Telegram, as well as other kinds of software, such as Microsoft Windows, and hardware vendors, such as several brands of servers and routers.
Operation Zero claims to work with the Russian government. At the time Williams sold the exploits to the Russian broker, Putin’s full-scale invasion of Ukraine was already underway.
On the same day that Williams was sentenced, the U.S. Treasury announced it had imposed sanctions against Operation Zero and its founder Sergey Zelenyuk, calling the company a national security threat. This was the government’s first confirmation that Williams had sold the exploits to Operation Zero.
In its statement, the Treasury said the broker “sold those stolen tools to at least one unauthorized user.” At this point we don’t know who this user is. The user could be a foreign intelligence service, or it could be a ransomware gang, given that the Treasury also sanctioned Oleg Vyacheslavovich Kucherov, an alleged member of the Trickbot gang, who also allegedly worked with Operation Zero.
In a court document, prosecutors said that L3Harris was able to figure out that “an unauthorized vendor was selling a component” of one of the stolen trade secrets “by comparing company-specific vendor data found on a stolen component that matched.”
Prosecutors also said that Williams “recognized code he wrote and sold” to Operation Zero “being utilized by a South Korean broker,” further suggesting that both L3Harris and prosecutors know which tools were stolen and sold to Operation Zero.
Another unanswered question is: Did anyone, either the U.S. government or L3Harris, alert Apple, Google, or whichever tech company’s products were affected by the zero-day flaws, now that the exploits had leaked?
Any company or developer would want to know that someone could have used (or could still use) a zero-day against their users and customers so that they can patch the flaws as soon as possible. And at this point, the zero-days are of no use for L3Harris and its government customers.
When I asked Apple and Google, neither company responded to my inquiries. L3Harris did not respond either.
Who hacked the scapegoat, and why?
Then there’s the mystery of the scapegoat, who was fired after Williams accused him of stealing and leaking code.
At sentencing, Justice Department prosecutors confirmed that the employee was fired, saying Williams “stood idly by while another employee of the company was essentially blamed for [his] own conduct.” In response, Williams’ attorney rebuffed prosecutors, claiming that the former employee “was fired for misconduct,” citing claims of dual-employment and improper handling of the company’s intellectual property.
According to a court document submitted by Williams’ lawyers, as part of the L3Harris internal investigation, the company placed the employee on leave, seized his devices, transferred them to the U.S., and “offered them to the FBI.”
When reached for comment, an unnamed FBI spokesperson said the bureau had nothing to add apart from the Justice Department’s press release.
After being fired, that employee, whom we identified with the alias Jay Gibson, received a notification from Apple that his personal iPhone was targeted “with a mercenary spyware attack.”
Apple sends these notifications to users it thinks were the target of attacks using tools like those made by NSO Group or Intellexa.
Who tried to hack Gibson? He received the notification on March 5, 2025, more than six months after the FBI investigation had begun. The FBI “regularly interacted with [Williams] in late 2024 through the summer of 2025,” according to a court document.
Given the nature of the leaked tools, it is plausible that the FBI, or perhaps even a U.S. intelligence agency, targeted Gibson as part of the investigation into Williams’ leaks. But we just don’t know, and there’s a chance that neither the public, nor Gibson, will ever find out.
Updated to clarify 22nd paragraph attributing the tools’ lack of classification to Williams’ lawyers.
Tech
Waymo to begin testing in Chicago and Charlotte
Waymo is bringing its robotaxis to Chicago and Charlotte as part of its push to continue scaling autonomous vehicles, the company said Wednesday.
Starting today, Waymo will begin manual mapping and early data collection to lay the groundwork for operations in those cities. Waymo usually enters a new city by first conducting months of manual driving and mapping to understand local road conditions, traffic patterns, and edge cases before gradually introducing autonomous testing and eventually fully driverless operations.
While Charlotte — with its suburban-style layout and mild weather — may be an easier use case, Chicago’s harsh winters, heavy traffic, and dense urban complexity would be more of a challenge for Waymo. Operating there successfully would strengthen Waymo’s case that its system is nationally scalable. It also gives Waymo another shot at a northern city after New York dropped a proposal that would have allowed commercial robotaxi pilots in parts of the state.
The news comes the same week Waymo began offering commercial driverless operations in Dallas, Houston, San Antonio, and Orlando, bringing its total city count to 10.
Aside from Chicago and Charlotte, Waymo is also testing and planning to launch in Denver, London, and Washington, D.C., among other cities. The Alphabet-owned autonomous vehicle company earlier this month clinched $16 billion in funding to expand internationally.
Tech
The public opposition to AI infrastructure is heating up
Across the country, discontent has exploded over the ever-growing glut of server farms that have accompanied the AI boom. Anger has grown so loud that it’s begun to shift legislative agendas. Some states and communities are mulling temporary bans on new data center development altogether. Earlier this month, New York joined the club, with a bold new proposal to halt the local cloud build-out in its tracks.
A new bill in New York State would impose a three-year moratorium on the issuance of new permits for data center construction throughout the state, while local regulators are given a chance to study the environmental and economic impacts the industry is having on communities. The bill’s co-authors, state senator Liz Krueger and Assemblymember Anna Kelles, have called the legislation the “strongest” introduced in the country.
While no statewide moratoriums have passed so far, local bans are proliferating fast. Several weeks before Krueger and Kelles introduced their bill, the New Orleans City Council passed a moratorium, pausing all new data center construction in the city for one year. In early January, Madison, Wisconsin, passed a similar law after protests erupted over regional tech projects.
Similar policies have also passed in droves of communities throughout construction hot spots like Georgia and Michigan, as well as in many other regions throughout the country.
Environmental activists have long taken aim at data centers, but the more recent concerns have come from high-level lawmakers, drawing on populist anger at the tech industry broadly. In conservative Florida, for instance, Gov. Ron DeSantis recently announced an AI “bill of rights” that gives local communities the right to limit new data center construction.
In liberal Vermont, U.S. Senator Bernie Sanders has suggested a nationwide moratorium. And in Arizona, where the political milieu is decidedly mixed, Gov. Katie Hobbs recently said she supported pulling the industry’s tax incentives. Politicians have even begun to fight over the topics, with the governor of Mississippi taking shots at Sanders online over his moratorium proposal.
The political resistance is coming just as tech companies commit more and more money to building out infrastructure. The four biggest spenders — Amazon, Google, Meta, and Microsoft — plan to spend a whopping $650 billion in capital expenditures over the next year, the vast majority of it going to data center build-outs. Even more spending is planned in the following years, as the companies race to secure as much compute capacity as possible.
Techcrunch event
Boston, MA
|
June 9, 2026
But the speed and scale of those projects has made them increasingly unpopular, according to recent polling. A recent Echelon Insights poll found 46% of respondents would oppose plans to build a data center in their community, compared with 35% in support. A different poll from Politico found that, while there is considerable concern about the facilities, many voters don’t have much of an opinion either way — making it possible for public sentiment to be swayed in either direction.
The industry is already spending big to attempt to change those numbers — at least in the regions where it matters. In January, the Financial Times reported that some of the industry’s biggest data center operators were planning a “lobbying blitz,” with plans to “boost spending on targeted advertising and engagement” aimed at the communities where they build.
Tech companies are also making real concessions, like the planned Rate Payer Protection Pledge that would make them responsible for supplying power to any new AI data centers. But it’s not clear those measures will be enough to bring the public around.
Dan Diorio, of the Data Center Coalition, argued, in a conversation with TechCrunch, that data centers should appeal to smaller communities because they provide revenue without straining those communities’ limited resources. If the incentives are cut off and companies decide not to build in those places, the revenue also won’t be there. “That’s where statewide policy considerations come in,” he said. “Are you going to limit communities in which these businesses could be a significant benefit for them?”
The logic behind pressing pause
In general, data center moratoriums are meant to give communities breathing room while policymakers study the potential costs and benefits of allowing such facilities to be built in their communities. The rate of construction in some states has accelerated at such a pace that communities are unsure of how the industry will impact them in the long run.
Justin Flagg, director of communications and environmental policy for Sen. Krueger’s office, told TechCrunch that the legislation was driven, in part, by what he called the energy affordability crisis in New York. Said crisis has troubled both rate payers and politicians.
A group of 30 state lawmakers recently called upon the state’s governor, Kathy Hochul, to declare an “energy state of emergency” in New York due to rate increases. While there are a diversity of factors at work in driving up energy prices, there’s a consensus that the growth in data centers is making the problem worse, not better.
“There’s broad discontent being expressed about energy prices,” Flagg said. “We certainly hear that constantly from our constituents, whose electric and gas rates are going up.” He added that local pushback was also being driven by environmental concerns — which he described as the “water impact and the noise and the local infrastructure impact as well.”
In response to those grid concerns, major tech companies — including Microsoft, Google, Meta, and OpenAI — have promised to pay for their additions to the electrical grid in the communities where they operate, often installing behind-the-meter power sources paired with the new data centers.
The Washington Post recently reported that Silicon Valley is increasingly looking to build its own private electrical supply — a kind of “shadow grid” — that can be used to operate the power-consumptive properties that are now fueling the AI industry. The strategy involves standing up massive new private power sources instead of relying on the public grid.
One example of this practice comes from xAI, Elon Musk’s AI startup, which — at the site of its massive data center in Memphis, Tennessee, known as “Colossus” — built a series of methane gas turbines that have been accused of polluting the local community.
The company’s efforts have already run into significant trouble. xAI had reportedly told local officials that, due to a legal loophole, the turbines were exempt from air-quality permits. In January, the Environmental Protection Agency ruled that Musk’s company was not exempt from the permits, making their previous operation illegal. Environmental activists, decrying the facility’s discharge of “smog-forming pollution, soot, and hazardous chemicals,” announced earlier this month that they planned to sue the company over it. Musk’s facility has since permitted its turbines.
As the xAI example illustrates, if the “shadow grid” strategy purports to solve one problem (public grid overload), it threatens to create a host of new ones — with environmental activists and local communities alike expressing concern for how the new facilities could spew pollution into people’s backyards.
At the federal level, the Trump administration — which has made AI one of its top priorities — has also sought to characterize the industry as responsible stewards of the communities in which they build. Indeed, Trump officials have floated a hypothetical policy to force AI companies to internalize the costs of their additions to local electrical grids, although the details on this policy remain vague.
Debate over taxes
For years, communities have incentivized data center development through tax breaks. Last summer, an analysis by CNBC found that 42 states throughout the U.S. either have no sales tax or provide full or partial sales tax exemptions to tech firms. Of that number, some 16 states publicly reported how much they had awarded to companies through tax breaks. The forfeited revenue amounted to some $6 billion over a period of five years, the outlet wrote.
Now, however, more and more states are thinking about turning off the spigot. In Georgia, for instance, a variety of bills were recently introduced that would crack down on the industry’s benefits. State senator Matt Brass, who has introduced a bill that would nix the server sales tax exemption, told TechCrunch that he doesn’t think tech companies need the extra money, nor does he think dispensing with the benefit will dissuade them from doing business in the state. “In Georgia, if you compare us to other states, our property taxes are low, our property values are low, our overall tax burden is low,” Brass said. “So, you know, our overall business climate is good. That should be the attraction.”
Brass, who chairs the state’s rules committee, told TechCrunch that he expects there to be significant support for his policy. A similar piece of legislation passed the Georgia legislature in 2024, but it was vetoed by the governor. Brass added that, were the exemption to be done away with, he believes it could generate hundreds of millions of dollars for the state.
In Ohio, a similar policy battle is currently playing out. A group of Democratic lawmakers recently introduced legislation that would — like in Georgia — move to nix the state’s sales tax exemption. A similar policy was introduced last year, but — like in Georgia — it was defeated by the state’s governor, Mike DeWine.
“The most ridiculous tax break on the books currently is for data centers,” one of the bill’s supporting lawmakers, state Sen. Kent Smith, recently said. “That tax break needs to end, for the benefit of everyone who’s got an electric bill.”
At the same time, there are still plenty of lawmakers who support the server sales tax exemption. In Colorado, state representative Alex Valdez recently introduced a bill that would enshrine data centers’ loophole for the next 20 years. Valdez told TechCrunch that the exemption is merely a carrot to get tech companies in the door. Once they set up a base of operations in the state, they become a source of passive revenue that inevitably boomerangs back to benefit the communities in which they operate, he said.
Tech
Kalshi fined a MrBeast editor for insider trading on markets related to the YouTube star
An editor for YouTube’s most popular creator, MrBeast, has been accused by the predictions market Kalshi of insider trading on the platform.
After an investigation, Kalshi said it “found reasonable cause” to believe that this editor, Artem Kaptur, had used non-public, insider information about MrBeast videos to inform his betting on matters involving the MrBeast YouTube channel.
Prediction markets like Kalshi and competitor Polymarket allow users to place bets on a wide variety of future events, like who will win a political election, how many albums a certain musician will sell in a week, or when the sequel to a popular film will be announced.
Kalshi did not disclose the specific bets that Kaptur placed about MrBeast, but some markets on the platform allow users to bet on what words the creator will say during an upcoming video — private information that a video editor could feasibly influence. Kalshi users can also trade on when MrBeast will get married, or when his company, Beast Industries, will announce an IPO.
A Beast Industries spokesperson told TechCrunch that the company does not tolerate this behavior, and that this stance extends to company employees, as well as contestants on MrBeast’s Amazon Prime show “Beast Games.” Contestants are also made aware that their knowledge of confidential information precludes them from participating in related prediction markets.
“With regard to this particular matter, we’ve already initiated an independent investigation as part of our overall ongoing efforts to ensure the integrity of our workplace and trust with our global audiences,” the spokesperson told TechCrunch. “We welcome Kalshi — and hopefully others in the space — also taking this issue seriously, but it only works if they are willing to communicate their findings, so we’re hopeful they’ll be more open to that in the future.”
Kalshi says that Kaptur traded around $4,000 on YouTube streaming markets in August and September 2025. He made a $5,397.58 profit, prompting Kalshi to fine him for that amount, plus a $15,000 penalty. Kalshi also banned Kaptur for two years. The company said in its blog post that it will donate the fine to a consumer education nonprofit.
Techcrunch event
Boston, MA
|
June 9, 2026
Kalshi also fined Kyle Langford, a candidate for political office in California, who traded about $200 on his own candidacy, then posted about it on social media.
The markets on platforms like Kalshi and Polymarket are so vast that it’s challenging to ensure that the users trading on them are not using private knowledge to their advantage, which is against the rules. When it comes to securities like stocks, similar behavior is punishable by up to 20 years in federal prison.
The potential for these markets to be manipulated has drawn attention among U.S. lawmakers.
Last month, one Polymarket user suspiciously bet $32,000 that Venezuelan President Nicolás Maduro would be removed from power by the end of January — just hours later, the U.S. military captured Maduro, earning that user a $400,000 payout.
In response, Representative Ritchie Torres (D-NY) proposed legislation that would make it illegal for government employees to trade on prediction markets related to government policy, government actions, or political outcomes.
Kalshi CEO Tarek Mansour said in a Linkedin post last month that he supports the bill, since Kalshi already adheres to the rules it would enforce. He claimed that alleged insider trading cases are not occurring on U.S.-based platforms (both Kalshi and Polymarket are based in the U.S.).
“This American bill only applies to regulated, American companies and not to unregulated, non-American companies, which is where the alleged issues are occurring,” Mansour wrote. “Prediction markets, like any industry, are not a monolith: there are important distinctions that matter.”
Updated, 2/25/25, 3:45 p.m. ET with comment from Beast Industries.
Sharks resume push to end playoff drought by facing Flames
NASCAR revamps format for first All-Star Race at Dover
