Marc Baier, 49, Ryan Adams, 34, and Daniel Gericke, 40, agreed to pay a cumulative US$1.7 million in penalties, the amount they earned while working for the UAE, to resolve charges of violating US export controls, computer fraud and illegal use of other people’s computer access.

The federal district court in Alexandria, Virginia, agreed to defer prosecution for three years in the complex case, which highlighted the global market of governments seeking highly trained computer security experts to spy on perceived enemies and threats.

The three defendants had worked in the US intelligence community, including the National Security Agency and in the military.

According to the Justice Department, they had worked for a US company providing cyber intelligence operations for the UAE government that met US regulations.

They then moved in 2016 to higher-paying jobs at a UAE government-linked company, identified in media reports as DarkMatter, where they began carrying out hacking jobs on designated targets, including servers inside the US.

One of those jobs gave them illicit access to “tens of millions” of smartphones and mobile devices, the justice department said.

The specific targets of the operation were not identified.

But media reports said the targets were both inside and outside the country, and the operation’s methods consisted largely of uploading malware and exploiting software and hardware vulnerabilities to break into and gain control of servers, phones and other digital equipment.

Aside from paying fines, the three men were stripped of US security clearances, banned from the US intelligence community and forbidden from hacking.

The US Federal Bureau of Investigation “will fully investigate individuals and companies that profit from illegal criminal cyber activity,” said FBI assistant director Bryan Vorndran in a statement.