A yearslong U.S. Justice Department investigation of a global hacking campaign that targeted prominent American climate activists took a turn in a London court this week amid an allegation that the hacking was ordered by a lobbying firm working for ExxonMobil. Both the lobbying firm and ExxonMobil have denied any awareness of or involvement with alleged hacking.
The hacking was allegedly commissioned by a Washington, D.C., lobbying firm, according to a lawyer representing the U.S. government. The firm, in turn, was allegedly working on behalf of one of the world's largest oil and gas companies, based in Texas, that wanted to discredit groups and individuals involved in climate litigation, according to the lawyer for the U.S. government. In court documents, the Justice Department does not name either company.
As part of its probe, the U.S. is trying to extradite an Israeli private investigator named Amit Forlit from the United Kingdom for allegedly orchestrating the hacking campaign. A lawyer for Forlit claimed in a court filing that the hacking operation her client is accused of leading "is alleged to have been commissioned by DCI Group, a lobbying firm representing ExxonMobil, one of the world's largest fossil fuel companies."
Forlit has previously denied ordering or paying for hacking.
The Justice Department did not immediately respond to a request for comment.
According to a source familiar with the U.S. probe who was not authorized to speak publicly, the U.S. has investigated DCI's possible role in the hacking. Reuters and The Wall Street Journal previously reported that the U.S. government has investigated DCI.
DCI lobbied for ExxonMobil for about a decade, according to federal lobbying records. NPR has not been able to confirm what, if any, links the Justice Department may have thought DCI had with the hacking campaign. NPR has not found any indications that the Justice Department has investigated ExxonMobil in relation to this case.
DCI and ExxonMobil declined to comment on the allegations made in the London hearing. Both companies referred NPR back to statements they had provided earlier in our investigation.
Craig Stevens, a partner at DCI, said in an email that no one at the firm has been questioned by the U.S. government as part of the hacking investigation. "Allegations of DCI's involvement with hacking supposedly occurring nearly a decade ago are false and unsubstantiated. We direct all our employees and consultants to comply with the law," Stevens said. "Meanwhile, radical anti-oil activists and their donors are peddling conspiracy theories to distract from their own anti-U.S. energy activities."
ExxonMobil spokesperson Elise Otten said in an emailed statement that the company "has not been involved in, nor are we aware of, any hacking activities. If there was any hacking involved, we condemn it in the strongest possible terms."
In a court document arguing for Forlit's extradition, the lawyer for the U.S. government described a sophisticated hacking operation that spanned continents. Forlit ran security companies that gathered information using various methods, including hiring "co-conspirators to hack into email accounts and devices," according to the court filing.
A lawyer representing the U.S. government revealed in the court filing that Forlit has been indicted in the U.S. on charges of conspiracy to commit computer hacking, conspiracy to commit wire fraud, and wire fraud, according to the court filing in London.
Climate activists who were targeted by hackers say the plot that U.S. officials have been trying to unravel was aimed at disrupting their efforts to fight climate change by pushing governments and society to slash the use of fossil fuels like oil and coal.
"It was undoubtedly designed to intimidate and scare advocates from continuing their work to hold these major oil companies accountable for the decades of deception that they're responsible for," says Lee Wasserman, director of the Rockefeller Family Fund and one of the hacking victims.
The fossil fuel industry faces dozens of lawsuits filed by states and localities accusing companies of misleading the public about the risks of climate change. The industry says that those lawsuits are meritless and politicized and that climate change is an issue that should be dealt with by Congress, not the courts.
The potential impact on civil society of hacking-for-hire operations is grave, according to cybersecurity and legal experts.
"Nothing is more powerful at chilling speech and encouraging self-censorship than the feeling that your entire digital world, which probably touches your whole world, could be invaded by people who mean you harm simply because of what you're doing at work," says John Scott-Railton, a senior researcher at the Citizen Lab, a cyber watchdog at the University of Toronto that analyzed the attacks. "Simply because you're concerned about rising sea levels."
The U.S. has said previously that ExxonMobil took advantage of leaked information
The U.S. hacking investigation became public in 2019 with the arrest in New York of a business associate of Forlit's named Aviram Azari. A former Israeli police officer and private investigator, Azari eventually pleaded guilty to conspiracy to commit computer hacking, wire fraud and aggravated identity theft.
The hackers Azari hired didn't target just American climate activists, according to federal prosecutors. They also attacked government officials in Africa, members of a Mexican political party and critics of a German company called Wirecard.
U.S. District Judge John Koeltl sentenced Azari in November 2023 to more than six years in prison and ordered him to forfeit more than $4.8 million that prosecutors allege he was paid for managing the hacking campaigns.
At Azari's sentencing, federal prosecutors did not say who they believed had hired Azari to target the climate activists. The Justice Department stated in a sentencing memo that ExxonMobil was the beneficiary of the information that the attacks revealed.
Federal prosecutors asserted in the Azari sentencing memo that information stolen from climate activists was leaked to the media, resulting in news stories that "appeared designed to undermine" state climate investigations of ExxonMobil. The company's lawyers used the news stories in court as part of their defense against the state investigations, prosecutors said.
ExxonMobil said in a statement at the time that it had done nothing wrong. "ExxonMobil has no knowledge of Azari nor have we been involved in any hacking activities," the company said.
The sentencing memo in Azari's case noted a private email among climate activists that surfaced in the media in 2016. The email described plans for a closed-door meeting in New York among leading climate activists, including writer and organizer Bill McKibben and Peter Frumhoff, then the chief climate scientist at the Union of Concerned Scientists, a watchdog and research group. The meeting's goal, according to the email, was to sharpen attacks on ExxonMobil and convince the public that the company is a "corrupt institution" that pushed the world toward "climate chaos and grave harm." It also raised the prospect of legal action through state attorneys general and the Justice Department.
ExxonMobil and some Republican lawmakers cited the document as they tried to fight off state climate investigations, saying activists and prosecutors colluded to advance a political agenda.
Lawyer for U.S. government described a sophisticated hacking campaign
Azari was sent to a federal prison in New Jersey in 2023. Five months later, Forlit was arrested in London. The Justice Department has been working through British lawyers to have Forlit extradited to the U.S. to face criminal prosecution "arising from a 'hacking-for-hire' scheme," court documents show.
One of Forlit's clients from 2013 to 2018 was an unnamed "D.C. Lobbying Firm," the court filing says. That firm "acted on behalf of one of the world's largest oil and gas corporations, centred in Irving, Texas," the document says. The company, in particular, wanted to discredit people and organizations engaged in climate change litigation against it, a lawyer for the U.S. wrote. Until mid-2023, ExxonMobil was headquartered in Irving, Texas.
A lawyer representing the U.S. alleged that the lobbying firm gave Forlit targets to hack. The lawyer said there's a "strong circumstantial case" that Forlit gave the list of at least 128 targets to Azari, who then hired hackers in India.
Forlit and Azari both referred to the operation as "Fox Hunt," the lawyer for the U.S. said in the London court filing. The hacking obtained "non-public documents which were provided to the oil and gas company and published as part of a media campaign to undermine the integrity of civil investigations," according to the filing.
D.C.-based firm lobbied for ExxonMobil for about a decade
DCI, the public affairs firm that Forlit's lawyer said her client allegedly worked for, has a long history working for the fossil fuel industry.
The firm worked for a nonprofit that supports the U.S. coal industry. And one of DCI's executives was identified as a spokesman for a group that backed the controversial Dakota Access oil pipeline.
In the early 2000s, ExxonMobil provided funding for a website DCI published called Tech Central Station, which the Union of Concerned Scientists called a "hybrid of quasi-journalism and lobbying." And from 2005 until early 2016, ExxonMobil paid DCI around $3 million to lobby the federal government, according to lobbying disclosures.
The lawyer for the U.S. government said in an extradition statement that the hacking operation started in late 2015. At that time, the oil and gas industry was facing a mounting backlash. Stories by investigative journalists in 2015 revealed that ExxonMobil's own scientists warned top executives about dire risks from climate change as early as the 1970s. Despite those warnings, the oil company went on to lead a decades-long campaign to sow public confusion about global warming. Activists seized on the reports, popularizing the hashtag #ExxonKnew to argue that ExxonMobil knew about human-caused climate change despite denying it publicly.
In Washington, D.C., Democrats urged the Justice Department to investigate whether ExxonMobil misled the public about climate change. And a group of state attorneys general banded together to find "creative ways to enforce laws being flouted by the fossil fuel industry and their allies," New York's attorney general said in early 2016.
Since then, dozens of lawsuits have been filed in the U.S. against ExxonMobil and other fossil fuel corporations, largely by Democratic-led states and towns. They allege the industry misled the public for decades about the dangers of burning fossil fuels, the primary cause of climate change. The lawsuits seek damages to help communities cope with climate risks and damages.
Victims say finding out who ordered the hacking is crucial
Forlit's lawyer, Rachel Scott, focused on the litigation against ExxonMobil in her opening arguments in London. She said the U.S. is trying to prosecute Forlit in part "to advance the politically-motivated cause of pursuing ExxonMobil."
The U.S. government is not part of the climate lawsuits filed by states and localities.
It has been years since the climate activists were targeted by hackers, but finding out who directed and paid for the operation is still vital, says Matt Pawa, an environmental lawyer and hacking victim.
It's important "for the purposes of deterrence," Pawa says, "so that this is not done again."
Copyright 2025 NPR