A former CIA operative who admitted to hacking American computers on behalf of a foreign government now serves as chief technology officer at ExpressVPN, and the company's own employees are asking how that happened. According to interviews and internal records, Dan Gericke disclosed his past work for the United Arab Emirates as part of a deferred prosecution agreement with the US Justice Department last week, a revelation that unsettled many at the privacy company where he now holds a senior post.
What has drawn particular scrutiny is not just the disclosure itself, but the timeline. ExpressVPN has said it was already aware of Gericke's history as a mercenary hacker when it continued to expand his responsibilities, eventually naming him CTO in August, even as a federal investigation into his conduct was reportedly nearing its end. For a company whose entire business rests on convincing users it will protect their data from surveillance, the optics are difficult to avoid; readers weighing VPN providers for reasons tied to digital trust and transparency can find the broader landscape of options covered here. covered here
The case against Gericke and two other former US intelligence officers centered on their work for a UAE cyber unit known as Project Raven, which reportedly targeted dissidents, journalists, and officials, including Americans, using tools developed partly from US government expertise. Under the agreement, the three paid financial penalties and accepted restrictions on future sensitive employment, a resolution that avoided criminal prosecution but left a public record of their activities.
Why Trust Matters So Much for VPN Providers
Virtual private networks exist to create an encrypted tunnel between a user's device and the internet, shielding browsing activity from internet service providers, network snoops, and, in theory, government surveillance. That promise only holds if the company running the service is itself trustworthy. Unlike many security tools, a VPN provider sits in a privileged position: it can, technically, see unencrypted traffic passing through its own servers before it is routed onward. Users are asked to extend considerable trust based on no-logging policies, independent audits, and the integrity of leadership - precisely the qualities now in question at ExpressVPN.
A Question That Would Not Go Away
During a regular employee question-and-answer session held last Friday, staff pushed the issue to the top of the agenda, with more than 40 workers voting to elevate a pointed question about Gericke's hiring. One employee asked how the company could reconcile keeping him on staff with the values it claims to represent, calling his past actions impossible to dismiss as minor lapses. A second highly supported question concerned the same matter, according to a person with access to the session's records who shared them with Reuters. ExpressVPN has characterized the discussion as part of its standard monthly dialogue between management and staff, though the volume of support behind the questions suggests discomfort runs deeper than a routine exchange.
Ownership, Oversight, and the Road Ahead
The controversy also lands amid ExpressVPN's acquisition by Kape Technologies, a British-Israeli digital security firm, adding another layer of scrutiny to a company already facing questions about governance. For an industry built on reassurance rather than visible proof, incidents like this test whether marketing promises about privacy can withstand the personal histories of the executives entrusted to uphold them. Users evaluating VPN services going forward may increasingly weigh corporate leadership and accountability as heavily as encryption standards or server locations.
