Three former US intelligence operatives have admitted to breaking US laws by carrying out hacking operations for the United Arab Emirates.
US prosecutors said the men had agreed to pay $1.7m (£1.2m) to resolve charges of computer fraud, access device fraud and violating export controls.
They worked for an unnamed UAE-based firm and allegedly hacked into servers, computers and phones around the world.
There was no immediate comment from the men or Emirati officials.
Earlier this year, the UAE was accused of using malware from the Israeli company NSO Group to spy on journalists, dissidents and rival governments.
The former intelligence officers – US citizens Marc Baier and Ryan Adams, as well as former US citizen Daniel Gericke – initially worked for a US company that provided cyber services to a UAE government agency in accordance with the International Traffic in Arms Regulations, according to the US Justice Department (ITAR).
Companies must obtain pre-approval from the US government before disclosing information about a hacking operation, and they must agree not to target US citizens, permanent residents, or US entities.
According to the justice department, the three men joined the UAE-based company as senior managers in 2016 and began carrying out hacking operations for the benefit of the UAE government without obtaining the necessary US licences.
They allegedly oversaw the development of two similar sophisticated “zero-click” computer hacking and intelligence gathering systems – “Karma” and “Karma 2” – that could compromise a device without any action by the target and allowed users to access tens of millions of devices made by an unidentified US technology company over the next three years.
According to the Justice Department, the company’s employees used the systems to illegally obtain and use credentials for online accounts issued by US companies, as well as to gain unauthorised access to computers and mobile phones around the world, including in the US.
“Hackers-for-hire and those who otherwise support such illegal activities should fully expect to be prosecuted,” said Acting Assistant Attorney General Mark Lesko of the Justice Department’s National Security Division.
According to the Justice Department, the charges were filed against the three men under a deferred prosecution agreement that requires them to pay financial penalties, sever ties with UAE intelligence or law enforcement agencies, and never seek a US security clearance again.