A bipartisan group of U.S. lawmakers asked the Commerce Department to add BellTroX, CyberRoot and Sunkissed Organic Farms, formerly known as Appin, to its Entity List, accusing them of carrying out cyberespionage operations targeting Americans and using stolen data to influence legal cases. The department has not yet announced a decision on the request.
A bipartisan group of Democratic and Republican U.S. lawmakers asked to place three Indian companies accused of carrying out mercenary cyberattacks on the U.S. Commerce Department’s Entity List. The request targets BellTroX, CyberRoot and Sunkissed Organic Farms, which previously operated under the name Appin.
Democratic Sens. Ron Wyden of Oregon and Sheldon Whitehouse of Rhode Island, along with Republican Rep. Pat Harrigan of North Carolina, sent a letter to Commerce Secretary Howard Lutnick on Wednesday. The lawmakers urged the department to use the Entity List to restrict U.S. companies’ dealings with the three companies.
What Does the Entity List Mean?
Placement on the list effectively prevents or severely restricts U.S. companies from conducting transactions with the listed entity. It can also limit the entity’s access to essential technologies, such as software licenses and cloud infrastructure. But the letter is a policy request, not a decision to impose sanctions; it remains unclear whether the Commerce Department will approve it.
The lawmakers said the three companies had carried out cyberattacks and espionage operations targeting Americans, business owners and lawyers for more than a decade. According to the letter, the stolen information was used to influence ongoing litigation, and the companies were also accused of participating in a pressure and obfuscation campaign intended to limit the publication of information about their alleged activities.
Background of the Allegations
The request follows reports and journalistic investigations documenting the mercenary hacking industry, in which clients pay attackers to break into the email accounts and private devices of executives, lawmakers and military officials in order to gain an advantage in legal disputes or influence their outcomes.
Appin previously obtained a worldwide court order from an Indian court that temporarily forced Reuters to remove a report about the company, before the order was lifted and the report republished. The Electronic Frontier Foundation also said it defended Techdirt and MuckRock Foundation against legal threats connected to what it described as a campaign of intimidation and censorship.
The lawmakers’ letter included an allegation that mercenary hacking companies operated at the request of the Qatari government, and that their targets included a former U.S. Republican lawmaker. Previous reports linked Appin to a hacking campaign targeting FIFA officials, which was said to have been directed by Qatar to protect plans to host the 2022 World Cup. The Qatari government and the companies involved did not respond to requests for comment before publication of the report.
Why Does This Request Matter?
The request moves the issue from the realm of reports and investigations into a potential government process that could impose economic and technological restrictions on mercenary hacking providers. If the Commerce Department approves it, the direct impact would be on the targeted companies’ ability to use U.S. services and technologies, but the decision itself, the scope of any restrictions and whether the allegations will be formally substantiated remain open questions.