Azari’s targets included a global array of financial companies and government officials, in addition to the climate activists. Prosecutors said he took in $4.8 million for his work between 2014 and 2019. But only one of his clients — a now-defunct German financial technology company — has been publicly identified.

Cyber specialists say the other entities that hired Azari might not ever face prosecution, even if he reveals his clients. It’s not a crime to hire a private investigator, and few companies would put in writing that an investigator should conduct illegal hacking on their behalf.

“Even if he says he was hired by dot, dot, dot, that doesn’t mean the company that hired him was legally liable,” said Vahid Behzadan, an assistant professor in computer and data science at the University of New Haven. “They can always claim that the private investigator has taken it on his own to go down the illegal hacking path.”

Behzadan said it’s increasingly common for corporations to hire investigators to research competitors.

But a request for background information “does not necessarily include an explicit request for illegal hacking,” he said.