US lawmakers urge Commerce Department sanctions on three Indian hack-for-hire firms

Bipartisan call for sanctions

A group of US lawmakers from both parties is pressing the Commerce Department to blacklist three India-based companies it accuses of running a mercenary hacking operation against Americans. According to TechCrunch, Democratic Senators Ron Wyden of Oregon and Sheldon Whitehouse of Rhode Island joined Republican Congressman Pat Harrigan in a letter sent Wednesday to Commerce Secretary Howard Lutnick.

The letter asks Lutnick to place BellTroX, CyberRoot, and Sunkissed Organic Farms — a company that previously operated under the name Appin — on the department's entity list. Inclusion on the list effectively stops US firms from transacting with a named company, cutting it off from technology it needs to function, such as software licenses and cloud infrastructure.

A decade of alleged attacks

In the letter, which was shared with TechCrunch, the lawmakers say the three companies have spent more than ten years conducting cyberattacks and targeted espionage against Americans, business owners, and their attorneys in order to influence active lawsuits. They allege that data was stolen from thousands of Americans in the process.

The request builds on years of media investigations into the hack-for-hire trade, in which attackers are paid to break into the email accounts and devices of executives, politicians, and military officials to gain an advantage in legal disputes. TechCrunch notes that separate reporting by The New Yorker and the Citizen Lab, a digital investigations unit, has documented espionage activity by BellTroX and CyberRoot.

Censorship through foreign courts

The lawmakers also accuse the firms of waging what the letter calls an "aggressive censorship campaign" meant to keep the public from learning about their alleged operations. They argue that this lets foreign entities use foreign courts to hide cyber threats from Americans and undermines fundamental constitutional rights.

Appin's history illustrates the pattern. The company once obtained a worldwide court order in India that forced Reuters to remove its reporting on the firm while the news outlet appealed. The page carried a notice saying Reuters stood by its story, and the order was later lifted and the article republished. The Electronic Frontier Foundation separately defended two news organizations, Techdirt and the MuckRock Foundation, against legal threats following what it described as an attempt by Appin to wipe out coverage of its involvement in mercenary hacking.

The Qatar connection

The letter states that the companies "operated at the behest of the Qatari government" and says their targets included a former senior Republican lawmaker. Earlier reporting tied Appin to a campaign of cyberattacks against FIFA officials, reportedly directed by Qatar in connection with its plans to host the 2022 World Cup.

Responses to the allegations were thin. TechCrunch reports that the Qatari government's representative in Washington did not reply to a request for comment, nor did CyberRoot or a director of Sunkissed Organic Farms, and BellTroX could not be reached. It also remains unclear whether the Commerce Department will act on the request, as a department spokesperson did not respond to the outlet.

Why it matters

Entity-list sanctions are among the sharper tools Washington has against private hacking firms: rather than pursuing individual prosecutions, the government can choke off a company's access to American software and cloud services. If Commerce complies, it would mark a notable escalation in how the US treats the commercial spy industry, placing hired hackers in the same category as sanctioned adversaries.

The letter also puts legislative weight behind press-freedom concerns. The alleged use of foreign courts to scrub American reporting raises questions about how easily litigation abroad can suppress information the US public would otherwise see. And for businesses and law firms, it signals that litigation-related espionage is now a formal policy concern in Washington rather than a niche security story.