A group of US climate change activists is closely monitoring a US lawsuit that could reveal who hired hackers to target their inboxes a decade ago.
In 2015, a series of explosive media reports revealed that ExxonMobil scientists had determined as early as 1982 that the extraction and burning of fossil fuels was causing the climate crisis, but Exxon continued to fund climate change denial campaigns anyway. The report prompted the attorney general to investigate the company.
In 2016, when a group of climate change activists tried to hold Exxon accountable for climate deception, they found themselves the target of a flood of phishing emails. Kurt Davis, founder of the Center for Climate Research, an organization that monitors the fossil fuel industry, received more than 80 phishing emails, including one impersonating a colleague of his who shared a Dropbox document titled “ExxonMobil (confidential).docx.” A Justice Department investigation ultimately confirmed the successful hacking of more than 100 victims, including groups critical of Exxon.
The details of who directed the hacking operation have long been a mystery. But this spring, the extradition and arraignment of Israeli private investigator Amit Forlit in a US federal court in New York shocked the US climate community. Foritt now faces hacking and wire fraud charges, court documents allege. The hack was ordered by a company representing Exxon itself.
ExxonMobil Baytown Refinery in Baytown, Texas. Photo: Brandon Bell/Getty Images
Forlit could face up to 45 years in prison, and his lawyer cited a then-sealed Justice Department indictment and named his alleged client for the first time in a motion challenging extradition from Britain. “The hack was allegedly commissioned by DCI Group, a lobbying firm representing ExxonMobil, one of the world’s largest fossil fuel companies.”
A newly unsealed indictment by the U.S. Attorney’s Office in New York alleges that a lobbying firm working on behalf of the oil giant matching Exxon’s description hired Forritt to carry out a project that included hacking climate change activists. Separately, Reuters reported that the FBI is investigating lobbying firm DCI Group, which has a long-standing relationship with Exxon, over the hacking operation. (Exxon is a major client of DCI Group, spending more than $3 million on lobbying efforts, including $320,000 in 2015 when the hack was allegedly commissioned, according to public documents released by the political finance tracking organization Open Secret.)
DCI Group and Exxon deny any involvement. Neither company has been accused of wrongdoing by U.S. authorities. ExxonMobil did not respond to a request for comment, but the company previously said it was “not involved in, nor are we aware of, any hacking activity. If hacking was involved, we condemn it in the strongest possible terms.” The company said it acknowledges that “climate change is real and our entire business is dedicated to reducing emissions.”
“We continue to instruct all of our employees and consultants to comply with the law,” Craig Stevens, partner at DCI Group, said in an email. He added that his company “has been told by the government that neither the DCI nor its employees are under investigation,” and that they had “no knowledge or understanding” of the alleged hacking activity. “Any insinuation to the contrary is completely false and baseless,” he wrote.
Mr. Forlitt has pleaded not guilty. He declined to comment to the Guardian through his lawyer.
Forlit’s extradition is the culmination of years of effort by the Department of Justice. In 2018, the Justice Department was alerted to phishing attacks targeting climate change activists and others and began gathering evidence of a coordinated scheme.
It revealed correspondence showing that a group of anonymous co-conspirators emailed Israeli private investigator Abiram Azhari, suggesting that “we could make some money if we worked together” and inviting him to a business meeting in India. The group then used phishing attacks to successfully hack into the email accounts of various targets in the United States. Based on this evidence, federal agents arrested Azari at John F. Kennedy International Airport in September 2019 while he was on his way to Disneyland with his family. He was charged with managing a hacking project and pleaded not guilty. (Mr. Azari’s lawyer did not respond to a request for comment.)
Climate activists protest on the first day of the ExxonMobil trial outside the New York State Supreme Court building on October 22, 2019. Photo: Angela Weiss/AFP/Getty Images
After languishing in a New York prison for years awaiting trial, Azhari pleaded guilty to hacking charges in 2022, but denied knowing his client. Sentencing documents reveal that he played a key role in carrying out a massive hacking campaign that targeted thousands of people around the world, extending far beyond hacking Exxon’s critics, and that his clients paid him more than $4.8 million over nearly five years to gather information and manage phishing campaigns. He directed hackers, including Indian groups, to target specific victims’ online accounts.
A Justice Department investigation confirmed the successful hacking of more than 100 of Azhari’s victims, including critics of Exxon. Some of the hacked documents stolen from the online accounts of climate change advocacy groups were leaked to the media and included in Exxon’s court filings contesting the state attorney general’s general investigation, according to the government’s ruling memo.
After Azhari’s verdict, climate change activists wondered who directed the hacking operation. Then, in April, the U.S. indictment was released, revealing interesting new details. It claimed that Mr. Forlit was the “leader of a sprawling cybercrime enterprise” through an Israeli-based intelligence gathering company, and that his actions involved co-conspirators in the United States, Britain, Israel and India. The indictment says the operation targeting climate change activists was carried out on behalf of a client “one of the world’s largest oil and gas companies headquartered in Irving, Texas.” (When first indicted in 2022, ExxonMobil was the only major global oil company headquartered in Irving, Texas.)
The indictment described the charges using codes rather than the names of specific people or companies, but the names were clear to anyone who had read the British court filings that led to Forlit’s extradition. The indictment sets out a chain of events linking Fouritt and Azari to a “lobbying company” (alleged in the UK filing as DCI Group), which in turn linked to that lobbying company’s “customer” (alleged in the UK filing as ExxonMobil). According to the indictment, in October 2015, the client asked the lobbying firm to help him respond to a civil investigation he was facing related to climate change.
According to the indictment, the president of a lobbying firm approached Foritt about a project aimed at people working on climate and environmental issues. In a memo to Forritt, the school principal laid out plans for “how to conduct research on bad guys.” The principal sent a memo to Foritt with a cover email that read, “This is what I gave to my client yesterday.” The memo cited “recent attacks by left-wing groups over climate change” and “opportunities for ‘attacks'” against its client, an Irving, Texas, oil and gas company.
February 19, 2022, advertisement for Abiram Hawk, the former home of private investigator Abiram Azari, in Haifa, Israel. Photographer: Raphael Sutter/Reuters
Prosecutors allege that Forlit then emailed the president a proposal for a climate change project with a monthly budget of $125,000 and outlined how his company would collect information for clients to use in lobbying and legal proceedings. Forrit then allegedly entered into a deal with Azari and others, who hired the hacker.
The indictment alleges that hackers successfully compromised the accounts of climate change advocacy groups in 2016 and 2017. The indictment alleges that the stolen materials were sent through Azari and Forlit to the president of a lobbying firm and ultimately used in lobbying efforts and in filing climate change lawsuits for clients. From 2014 to 2017, Forritt’s company is said to have earned $7 million from climate change hacking work and other work.
A decade after a mass phishing attack, victims are now poring over unsealed indictments and trying to piece together the identities and motives of their attackers. Although a government investigation confirmed that 100 victims were successfully hacked, Forrit’s indictment focuses on five anonymous victims.
In 2016, Jennifer Cunningham was a partner at public relations firm SKDK Knickerbocker and a policy consultant to the New York State Attorney General. She was involved in climate litigation and recalled receiving a phishing email that she believed was an attempt to obtain information about litigation strategy.
In an interview with the Guardian, she said that the hackers were initially unsuccessful. “I remember one couple I avoided at the really last minute because it (looked like) coming from a co-worker,” she said. Her office turned over the phishing emails to federal prosecutors.
But after reviewing Forlit’s indictment, she was pretty sure she knew she was among them. “Wait – am I Victim 3?” she wrote in a text message. “If that’s the case, I think they were successful in hacking, which I didn’t know.” He hopes the lawsuit will reveal more details, including interactions between the companies and the hackers.
Lee Wasserman, director and secretary of the Rockefeller Family Foundation, has reason to believe he is Victim 5. They received a letter from the Justice Department saying they were victims of the scheme, but the government did not confirm with them whether they had been successfully hacked.
People protest against ExxonMobil before the start of the trial outside the New York State Supreme Court building on October 22, 2019. Photo: VIEW Press/Corbis/Getty Images
Wasserman believes he was targeted because he supported a Columbia Journalism School investigation published in the Los Angeles Times into Exxon’s knowledge of climate change. He also met with the New York State Attorney General to discuss Exxon. “We believe the actions of Exxon and its allies were the most significant corporate deception in history,” Wasserman said.
However, he added that the phishing attempts had a chilling effect on their accountability efforts. They switched from email to phone calls, and Wasserman sometimes found herself whispering, wondering if someone had eavesdropped on her office or home. He wondered if a car might be lurking outside and chasing him and his co-workers.
Wasserman hopes the court will find out how the idea came about, who led the operation and who paid for it. “We’re all sitting on the edge of our seats waiting to see if it’s going to be heard in court,” he said.
Curt Davis, who continues to monitor Exxon, hopes the Fawlit incident will shed light on whether the oil giant was involved in the hacking. “None of that has been proven yet. So advancing that story and that evidence is very important to me personally and to many of the people who were attacked by this operation 10 years ago,” he said. “This is personal because I really don’t like bullies, liars, and cheaters.”
