Does hiring a high-profile hacker help your business or jeopardize it?
It’s a question now facing ExpressVPN after the company’s CIO, Daniel Gericke, assisted the United Arab Emirates pull off a cyberspying campaign that targeted people across the globe.
The news risks shaking trust in the popular VPN provider especially after Edward Snowden urged users to drop ExpressVPN. However, the company isn’t about to sever ties with Gericke. Instead, ExpressVPN is doubling-down on why it’s keeping him onboard.
“Some may ask: How could we willingly invite someone with Daniel’s past into our midst? For us, the answer is clear: We are protecting our customers,” the company wrote in a blog post.
“The best goalkeepers are the ones trained by the best strikers,” the company added. “Someone steeped and seasoned in offense, as Daniel is, can offer insights into defense that are difficult, if not impossible, to come by elsewhere.”
It’s true that cybersecurity companies often hire former NSA operatives, military officers, and FBI agents. Even so, Gericke’s past has been setting off alarm bells because he helped the UAE develop powerful hacking tools that allegedly targeted activists, political rivals, and even Americans. Such spying runs counter to the whole promise of a VPN, which is designed to prevent companies and governments from spying on your internet activities.
On Thursday, ExpressVPN acknowledged that the news regarding Gericke has prompted users to question its commitment to privacy. “To be completely clear, as much as we value Daniel’s expertise and how it has helped us to protect customers, we do not condone Project Raven (The codename for the UAE hacking team),” the company said. ”The surveillance it represents is completely antithetical to our mission.”
Still, ExpressVPN defended keeping Gericke on as an employee, citing his 20 years in the cybersecurity industry, which includes work at the US military. “Since Daniel joined us, he has performed exactly the function that we hired him to do: He has consistently and continuously strengthened and reinforced the systems that allow us to deliver privacy and security to millions of people,” the company said.
ExpressVPN is also pushing back on suggestions that Gericke may be secretly undermining security at the VPN provider. The company hired Gericke in December 2019, fully aware of his career as a UAE contractor. Gericke also ceased contracting with the UAE once he was brought onboard. Nevertheless, ExpressVPN says it has numerous safeguards in place to prevent tampering and monitoring of customer activities.
“We don’t log what our customers do with our service, we have put many systems and processes in place to make sure it stays that way, and it is exceedingly unlikely for any single person to be able to change that,” the company added.
But because talk is cheap, ExpressVPN says it’s going to increase the number of third-party audits for the company’s VPN service to prove its technology remains secure. “This is just a first step, and we will continue to strive to earn your trust,” it added.
However, the attempts to restore trust may not win over everyone. This week, ExpressVPN also revealed it’s selling itself to Kape Technologies, which was once criticized for spreading adware. It’s since reinvented itself as a security company that also owns the VPNs Private Internet Access and Cyberghost VPN.
The news of the merger prompted a rival VPN provider, Mullvad, to chime in. “Mullvad VPN is here to stay, and we are not interested in ever selling it,” the VPN service wrote in a blog post on Thursday. “We started building this organization in the summer of 2008 for idealistic reasons, and we are still idealists who think privacy is fundamental to a civilized society.”
