Peter Williams, the former general manager of L3Harris’s Trenchant division, has admitted to selling stolen zero-day exploits and surveillance software to a Russian broker, according to the U.S. Department of Justice. The stolen technology, taken over three years from L3Harris, was meant exclusively for use by the U.S. government and its Five Eyes intelligence allies.
Williams, a 39-year-old Australian resident of Washington, D.C., exploited his access to Trenchant’s secure network to pilfer sensitive cyber-exploit components. Trenchant, which develops spyware and zero-day vulnerabilities, supplies these tools to governments in Australia, Canada, New Zealand, the United States, and the United Kingdom. Trenchant was formed after L3Harris acquired two Australian startups specializing in zero-day exploits in 2019. Read the press release here
The DOJ revealed that Williams entered contracts with a Russian reseller known to supply exploits to the Russian government, receiving millions in cryptocurrency payments for the stolen tools and ongoing support. Prosecutors estimate the theft cost Trenchant over $35 million.
U.S. Attorney Jeanine Pirro described the broker as emblematic of “the next wave of international arms dealers,” while Assistant Attorney General John A. Eisenberg condemned Williams for jeopardizing national security for personal profit.
Williams pleaded guilty to two counts of stealing trade secrets and faces up to 10 years in prison for each. He is currently under house arrest and is set to be sentenced in January 2026. Known in the industry as “Doogie,” Williams previously worked for the Australian Signals Directorate, the country’s top signals intelligence agency.
Earlier reports revealed internal turmoil at Trenchant, including the firing of a developer accused of stealing Chrome zero-days—a claim supported by colleagues who pointed out the fired employee only worked on iOS vulnerabilities and denied any wrongdoing.
L3Harris has declined to comment on the case, and Williams’s attorneys have not responded to requests for comment. This breach underscores ongoing challenges in securing highly sensitive cyberweapons within defense contractors.
