A look at India's hacking-for-hire industry, which has a tacit alliance with the government and is unusually brazen, with firms publicly touting their services
David D. Kirkpatrick / New Yorker :
Context & Ripple Effects
Kirkpatrick's New Yorker piece is the third major look at India's hack-for-hire sector in three years. The arc began with [[a:954547|Reuters' exposure of an obscure Indian firm that spied on more than 10,000 email accounts over seven years]], then widened through investigations of [[a:980372|a scheme running since 2013 to obtain documents inside legal cases at over 100 US and European organizations]] and of the industry's global corporate-intelligence clientele targeting businesses, journalists, and politicians.
What the New Yorker adds is the two traits prior reporting only implied: firms here publicly advertise their services rather than hiding behind broker chains, and the industry operates under a tacit alliance with the Indian government. That combination — openness plus official tolerance — is what distinguishes India's market from the covert mercenary model documented elsewhere.
First-order effects
- Corporate intelligence brokers and their end clients — law firms, due-diligence shops, corporates in US and Europe — can source intrusions openly from Indian vendors, while journalists, politicians, and activists remain the standing target set identified across the investigations.
- Public touting removes the deniability layer: buyers no longer need intermediaries to find capability, which lowers the cost of commissioning attacks against the litigation and deal targets documented since 2013.
Second-order effects
- Each successive exposure — the 10,000-account operation, the legal-cases scheme — pressures Western corporate clients to route demand through less attributable channels, shifting the market toward quieter brokers even as Indian firms advertise.
- Rival hack-for-hire hubs compete for the same corporate-intelligence contracts, and India's visible state tolerance becomes a selling point: vendors operating with tacit official cover can promise persistence that fully clandestine rivals cannot.
Third-order effects
- A tacit state-vendor alliance points toward commercial hacking functioning as deniable statecraft — governments gaining offensive reach through private firms whose marketing provides plausible separation, a structure investigators keep exposing faster than states abandon it.
- If brazen, state-tolerated markets become the norm, the burden of control falls on attribution journalism and client-side defenses in target countries, since neither vendor-side regulation nor export-control regimes apply to an industry that advertises.
The trend: Commercial hack-for-hire is consolidating into an officially tolerated extension of state intelligence in India, with investigative reporting serving as the primary external check on the trade.