RSF investigation: the Indian cyber-security giant silencing media outlets worldwide

Rajat Khare is ready to move mountains to avoid association with Appin, the cybersecurity training centre he co-founded in 2003. And for good reason: the New Delhi-based company has been accused of selling less-than-ethical hacking services, according to well-researched journalistic investigations from prominent publications, including the US magazine The New Yorker and the British news agency Reuters.

Since 2022, articles, newsletters and podcasts from at least 15 different media outlets have been modified or withdrawn as a result of the notices and legal charges brought forth by Khare or the Association of Appin Training Centers (AOATC), an obscure entity claiming to defend Appin’s interests and reputation. The magnitude of these gag lawsuits — known as strategic lawsuits against public participation (SLAPPs) — is unprecedented.

“If it becomes known that a powerful person can use the Indian court to strike down articles all over the world, everybody will do it. So it's a big deal [...] and if they succeed, they'll do it everywhere,” said a source familiar with Khare’s tactics, speaking on condition of anonymity. The source expressed deep concern about the potential consequences of the intimidating letters and prosecutions brought by Appin and its wealthy co-founder against media outlets.

Pursued by Indian courts

Reuters tops the list of victims of Khare’s legal teams. The British news agency had to wait ten months for a New Delhi district court to reverse, on appeal, a prior decision ordering it to take down an investigation titled “How an Indian start-up hacked the world”. Working with hundreds of interviews and thousands of authenticated and verified documents, Reuters found that Appin had grown from a startup "to a hack-for-hire powerhouse that stole secrets from executives, politicians, military officials and wealthy elites around the globe." A lawsuit brought by the AOATC accused Reuters of tarnishing Appin’s reputation.

The New Yorker is another prominent victim. The AOATC brought a libel suit against the US magazine over its exclusive investigation into India’s hacking-for-hire industry. The investigation mentions Appin and recounts how Khare offered “ethical hacking” services to several European private intelligence firms.

"The New Yorker fully stands behind the piece, which is an accurate and fair account on a matter of legitimate public interest. We will continue to defend the right to publish important reporting without fear or favor,” a spokesperson for the magazine told RSF. The article is still online and accessible to everyone – which is not always the case for other media outlets attacked by Khare or the AOATC.

The domino effect

Several journalists who investigated Appin told RSF that the ten-month-long suspension of the Reuters report sent a very negative signal to investigative reporters — to the point where journalists preferred to either take down or heavily modify their coverage of the Reuters story. For example, the Indian news site The Wire said it “edited” its own story on 18 December 2023. However, when comparing the updated version with the original, RSF found that The Wire had deleted information from Reuters about Khare and Appin.

Some media have even censored themselves before publication — which has not always sufficed. In February 2024, the American podcast Behind The Bastards dedicated two episodes to Rajat Khare without mentioning his name in the title of the episodes. “We'll see how long these episodes stay up," said one of the hosts at the beginning of the first episode. One week later, the episodes disappeared from podcasting platforms: Behind The Bastards had received a letter threatening legal action, according to a source close to the case who wishes to remain anonymous. 

An impressive list of victims 

Khare had already used these tactics against Switzerland’s public television channel, Schweizer Radio und Fernsehen (SRF), in November 2022. SRF was ordered to provisionally remove Khare’s name and photo from an investigative piece by a lower court in Geneva.

When contacted by RSF, SRF only made broad comments about the case: “Generally speaking, it can be said that lawsuits and threats of lawsuits are being filed in an attempt to prevent SRF from reporting.” Meanwhile, one of Khare’s Swiss lawyers, Nicolas Capt, told RSF that “In Switzerland and elsewhere, my client has taken legitimate legal action — civil and criminal — to protect his honour, which has been damaged by false accusations.” Capt added that Khare “does not intend to comment on these legal proceedings.”

In the course of this investigation, RSF discovered that the relentless Khare has also tried to sue The New Yorker in Switzerland, in addition to the lawsuit against the magazine in India brought by the AOATC.

The mysterious “X.X.”

When the Swiss media outlet Gotham City began taking an interest in the subject in 2022, it was well aware of the risks involved. “When we learned of his existence, he had already sued media outlets [...] and he had won against the Swiss public broadcaster,” said Gotham City’s editor-in-chief François Pilet. “In this kind of case, we don’t really want to be next in line. What’s more, his lawyers had made it clear to us in advance that they would sue if we published his name.” In the two investigative articles published by Gotham City, the Indian entrepreneur is therefore referred to as “X.X.”

This did not prevent Khare’s lawyers from ordering Gotham City to modify its reporting. “The content and tone of your article are deliberately sensationalist and include many factual and erroneous confusions and shortcuts,” wrote Sandrine Giroud, one of Khare’s Swiss lawyers, in a letter seen by RSF. She added that Gotham City’s description of Khare was “inaccurate” and that “the facts presented target him and easily allow for his identification.” When contacted by RSF, Giroud responded, “My client has asserted his rights, in Switzerland and abroad, in order to defend himself against unfounded accusations made against him, as any unjustly accused individual would.” She added that Khare “does not wish to comment on the initiated proceedings and is leaving it to the courts.”

Despite the potential consequences, Gotham City, like The New Yorker, decided to continue publishing. According to our investigation, at least four other media outlets and public interest organisations have also refused to give in to these threats. In Canada, Ronald Deibert, the director of Citizen Lab – a laboratory that specialises in analysing cases involving online surveillance, cybersecurity and human rights – has made it clear that he will not comply with the AOATC’s takedown demands.

The next victim of these gag suits may be French: Intelligence Online, an outlet that covers news in the intelligence sector, has often taken an interest in Khare and Appin. In a letter to Gotham City, Giroud confirmed that the French site is the subject of “right-of-reply and defamation proceedings in France,” without giving any further details. Intelligence Online’s editor-in-chief Pierre Gastineau confirmed the existence of a legal complaint.

Khare’s strategy is impressively ambitious, as he went so far as to hire Clare Locke LLP, a US law firm that specialises in defamation cases against print, broadcast, and online media outlets. Clare Locke contacted major American outlets demanding they take down content about Khare’s international censorship campaign, such as this article by the tech and science magazine Wired. 

AOATC: an opaque organisation

Many media outlets, including The New Yorker and Reuters, have been contacted or sued by the AOATC, even though this entity is not mentioned in their investigations. The AOATC seems to systematically contact and sue media outlets that discuss Appin and Khare, even though the organisation presents itself as an “autonomous body” that supports and manages training centres operating under the Appin franchise.

On 3 October 2024, during the lawsuit against Reuters, even the Indian judicial system questioned the legitimacy of AOATC’s complaint, pointing out that it was only created in 2022 and would therefore not be concerned by the claims made in the Reuters article, which reported on events that took place several years prior. RSF reached out to the AOATC several times, in particular about its links with Khare, but it did not respond to our interview requests. However, his lawyer, Capt, said Khare “has no links with this association.”

Online cleansing

In addition to the letters and complaints, other tactics have also been used to protect Khare’s online reputation. Gotham City reported that an Intelligence Online article was the subject of an abusive takedown request under the Digital Millennium Copyright Act (DMCA), the US digital copyright law. After being copied onto an Indian website and backdated, the original article was flagged as a copy in an attempt to have it removed. This is not the first time this US law has been misused to censor reliable journalism; RSF has reported on the topic before.

Although Khare and the AOATC seem determined to suppress all investigations into Appin, the Indian cyber-entrepreneur maintains a strong online presence. The first page of results from a Google search of “Rajat Khare” included several posts portraying him in a much more favourable light, such as this article posted on the open publishing platform Medium. RSF discovered a slew of similar posts, some in the form of posts or op-eds under the entrepreneur's byline. 

But most of this content was authored by accounts with generic names accompanied by photos created by artificial intelligence, each one commenting on posts by the others. A biography of Rajat Khare has been commented on and liked 300 times by only six profiles, five of which post content about Khare. One of the Medium accounts displays the same profile photo as a different author on the platform Vocal Media, and both write solely about Khare.

RSF tracked down one of the authors of the articles praising Khare. He recognised having written his content “with the help of Chat GPT,” but did not wish to explain why he used a pseudonym. When asked about his motives and whether he had any links with Khare, he replied that he had written the articles for personal reasons, enigmatically adding, “Not everything is in my hand.” 

Profiles with user names referring directly to Khare, such as “RajatKhareLuxembourg” and “RajatKhareInvestor1”, were posting these types of articles on Medium as far back as 2022, praising Khare’s career as a tech entrepreneur and his skills as an investor in a clear attempt to flood the Internet with this content and drown out the troublesome investigations.

Is Khare behind all these flattering articles, which – unlike the journalistic investigations – do not appear to have been subjected to hostile litigation? When contacted through his lawyer, Khare did not respond to our interview requests and declined to comment on these admiring posts "by third parties,” about which he claims “to know nothing.”

If you have any information on this subject, contact us at appin-investigation[at]rsfsecure.org.