A veteran cybersecurity executive who prosecutors said “betrayed” the United States will spend at least the next seven years behind bars, after pleading guilty to stealing and selling hacking and surveillance tools to a Russian firm. Peter Williams, a former executive at U.S. defense contractor L3Harris, was sentenced on Tuesday to 87 months in prison for leaking his former company’s trade secrets in exchange for <head>.3 million in crypto between 2022 and 2025. Williams sold the exploits to Operation Zero, which the U.S. government calls “one of the world’s most nefarious exploit brokers.” The successful conviction of Williams follows one of the most high-profile leaks of sensitive Western-made hacking tools in recent years. Even now that the case is over, there are still unanswered questions. Williams, a 39-year-old Australian citizen who resided in Washington, D.C., was the general manager of Trenchant, the division of L3Harris that develops hacking and surveillance tools for the U.S. government and its closest global intelligence partners. Prosecutors say Williams took advantage of having “full access” to the company’s secure networks to download the hacking tools onto a portable hard drive, and later to his computer. Williams contacted Operation Zero under a pseudonym though, so it’s unclear if Operation Zero ever knew Williams’ real identity. Trenchant is a crew of hackers and bug hunters who dig deep into other popular software made by companies like Google and Apple, identify flaws in those millions of lines of code, then devise techniques to turn those flaws into workable exploits that can be used to reliably hack into those products. These tools are typically called zero-day exploits because they take advantage of software flaws unknown to its developer, which can be worth millions of dollars. The U.S. Department of Justice alleged that the hacking tools Williams sold could have allowed whoever used them to “potentially access millions of computers and devices around the world.” For the past few months, I have been talking to sources and reporting on Williams’ story before news broke that he had been arrested. But what I had heard was patchwork and at times conflicting. I had heard someone had been arrested, but given the secret nature of the work involved in exploit development, proving it would be challenging. Contact Us Do you have more information about this case, and the alleged leak of Trenchant hacking tools? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or by email. When I first heard of Williams, I wasn’t clear that I had even gotten his name right. At that point, his story was a rumor, moving through the hush-hush grapevine of zero-day exploit developers, sellers, and people with ties to the intelligence community. I heard that maybe he was called John, or perhaps Duggan? Or all the different ways you can spell that in English. Some of the first rumors I heard were contradictory. Apparently he stole zero-days from Trenchant, and maybe he sold them to Russia, or perhaps another enemy of the United States and its allies, like North Korea or China? It took weeks just to confirm that there was indeed someone who even fit that description. (It turned out that Williams’ middle name is John, and Doogie is his nickname in hacker circles.) Then, as the weeks of reporting rolled on, things started to become much clearer. The Russian connection As I first revealed in October, Trenchant fired an employee after Williams, who was still at the time head of Trenchant, accused the employee of stealing and leaking Chrome zero-days. The story was even more intriguing because the employee told me that after he was fired, Apple notified him that someone had targeted his personal iPhone. What I learned was just the tip of the iceberg. I had heard more from my sources, but we were still piecing parts of the story together. Soon after, prosecutors made their first formal accusation against a man named Peter Williams for stealing trade secrets, which first surfaced in the U.S. public court system. In that first court document, prosecutors confirmed that the buyer of these trade secrets was a buyer in Russia. However, there was no explicit reference to L3Harris nor Trenchant, nor the fact that the trade secrets that Williams stole were zero-days. Crucially, we still couldn’t confirm for certain that it was the same Peter Williams, who we thought would have access to highly sensitive exploits as Trenchant’s boss, and not some terrible case of mistaken identity. We still weren’t there. On a hunch and with nothing to lose, we contacted the Department of Justice to ask if they would confirm that the person in the document was in fact Peter Williams, the former boss of L3Harris Trenchant. A spokesperson confirmed.