Rajat Khare

Rajat Khare is an Indian entrepreneur and investor who co-founded Appin, a New Delhi-based technology company, in December 2003.^[1] Now based in Switzerland, he runs Boundary Holding, a Luxembourg-based venture capital firm, with his wife Shweta Khare.^[2]

Investigative reports by Reuters, The New Yorker, and SRF Investigativ found that Appin operated as a hack-for-hire company under Khare's co-directorship, stealing data from executives, politicians, and military officials worldwide.^[1][3][4] Criminal investigations in Switzerland, the Dominican Republic, and by the Federal Bureau of Investigation (FBI) linked Khare and Appin to hacking but did not result in charges against him.^[1][4] Through his U.S. law firm Clare Locke, Khare has denied any involvement, stating he "has never operated or supported, and certainly did not create, any illegal 'hack for hire' industry" and that his career has been dedicated to "cyber-defence and the prevention of illicit hacking."^[1][5]

Khare and entities associated with Appin have also pursued extensive legal action against media coverage of the company; Reporters Without Borders (RSF) described the effort as "an offensive on an unprecedented global scale."^[6] Khare's Swiss lawyer, Nicolas Capt, said his client took "legitimate legal action — civil and criminal — to protect his honour, which has been damaged by false accusations."^[6]

Khare co-founded Appin in December 2003 as a technology training startup; he was a 20-year-old computer science major at the time.^[1] By 2007, Appin had opened a digital security consultancy helping Indian organisations defend themselves online, which drew the attention of Indian intelligence agencies. The company established a subsidiary called Appin Software Security to conduct surveillance for the Indian government; by 2009, its clients included the Research and Analysis Wing (RAW), the Intelligence Bureau, and the Central Bureau of Investigation (CBI).^[1]

The New Yorker reported that in 2010, Khare personally sent bulk emails to private intelligence firms across Europe offering what he called "ethical hacking" services. An Appin slide presentation obtained by Reuters, which Khare's lawyers called "a forgery or was doctored",^[1] promised that the company could obtain "information that you imagine and also one that you didn't imagine" and explicitly described hacking businessmen on behalf of corporate clients.^[3][1]

In January 2012, a series of spear-phishing emails targeted Peter Hargitay, a Zurich-based FIFA insider and former adviser to FIFA President Sepp Blatter. An expert hired by the Hargitays traced the attack to a server near Zurich airport whose billing records listed Rajat Khare as the client. After the hack was detected, Khare called Peter Hargitay's son Stevie, saying he "wants to cooperate '100%'."^[1] (Khare's lawyers told Reuters he "does not know" the Hargitays.)^[1]

Khare's lawyers said he left Appin in December 2012, a move that "officially and immediately separated him from all Appin entities." Reuters found that Khare's signature appeared on Appin corporate filings dating to 2013 and 2014, and that shareholder data showed he maintained a stake for several years after that. Indian corporate records recorded his resignation as director only in 2016.^[1]

In 2016, Khare resigned as director of the company formerly known as Appin Technology and moved to Switzerland, where, SRF Investigativ reported, "he now presents himself as a renowned start-up investor."^[1][4] Together with his wife Shweta, he runs Boundary Holding, a Luxembourg-based venture capital firm.^[2]

Boundary Holding's portfolio has included Cerbair, a French anti-drone company; Cysec, which organised a bug bounty programme for the European Space Agency; and the big data geolocation firm Kido Dynamics.^[2] Intelligence Online reported in 2022 that Khare maintained close relations with Qatar and had helped portfolio companies win security contracts for the 2022 FIFA World Cup, describing him as having "industrialised the practice of hacking for hire."^[2]

Swiss prosecutors opened an investigation, nicknamed "Tandoori," into the hack of FIFA insider Peter Hargitay. In an email to the FBI, prosecutor Sandra Schweingruber wrote that the investigation had found that "the Indian company Appin Security Group as well as their CEO Rajat Khare are involved in this case."^[1] SRF Investigativ later reported that Schweingruber asked Khare whether he would be willing to answer questions; a lawyer informed her he would respond in writing, but the prosecutor never followed up.^[4] The investigation was closed in September 2020, with Schweingruber's successor Anna Carter citing "the lack of further promising investigative approaches."^[1]

In 2012, Dominican prosecutors formally accused newspaper publisher Jochi Gómez of working with Khare to hack emails. Prosecutors described Khare as part of an "international criminal network." The case was quashed on procedural grounds in 2013, a decision affirmed by the country's highest court in 2014. One of the judges involved dismissed the network characterisation as a "theory." Khare was never charged.^[1]

Law enforcement documents obtained by Reuters show that FBI official Dan Brady told the Swiss prosecutor that U.S. investigators looking into the hack of a Native American tribal member had linked multiple cases to a single "ultimate perpetrator": Appin. The files also revealed that the FBI told Swiss counterparts it had "a confidential human source who has the capacity to report on Appin Security matters."^[1] A former U.S. security official told Reuters that the FBI had tracked Khare's travel and communications.^[1] The FBI declined to answer questions about its investigation into Appin; Khare's lawyers called the suggestion that he had been investigated by the FBI "absurd".^[1]

Capt told SRF that Khare "has never been questioned by law enforcement authorities in any country" and "clearly denies all connections with any illegal activities whatsoever."^[4]

Khare has hired the U.S. defamation law firm Clare Locke LLP and Swiss lawyers Nicolas Capt and Sandrine Giroud to pursue legal action against media outlets reporting on Appin.^[6][5] RSF found that at least 15 media outlets had content modified or withdrawn following strategic lawsuits or legal notices from Khare or associated entities.^[6]

In November 2022, a lower court in Geneva ordered SRF Investigativ to provisionally remove Khare's name and photo from its investigative report.^[6] The New Yorker was sued in India by the Association of Appin Training Centers (AOATC) and separately in Switzerland by Khare; the magazine refused to comply, stating it "fully stands behind the piece."^[3][6] In December 2023, the AOATC obtained an injunction against Reuters from a Delhi district court, and Reuters temporarily removed its investigation. The injunction was vacated in October 2024, with the court noting "the plaintiff has not been able to show any prima facie case to make interference in the process of journalism."^[1][6][7]

The Electronic Frontier Foundation (EFF) responded on behalf of Techdirt and MuckRock, arguing that the Indian court order was unenforceable in U.S. courts under the First Amendment.^[8]

The AOATC, which describes itself as an entity supporting Appin franchise training centres, was created in 2022; during the lawsuit against Reuters, the Indian court questioned its legitimacy, noting that it was created after the events described in the Reuters article.^[6][5] Khare's lawyer Capt told RSF that his client "has no links with this association."^[6] Clare Locke has stated that the accusations against Khare are "categorically false" and "have been rejected by courts and regulatory bodies and debunked by experts."^[5]