ExpressVPN may be one of the most popular VPN options available, but some are calling for users to abandon it as its integrity is now in question.

The US intelligence community was rocked by accusations that former operatives had turned mercenary-for-hire, working for the UAE to surveil the regime’s critics. Code-named “Project Raven,” the operatives’ efforts were not restricted within the UAE. Instead, Project Raven included surveillance of the regime’s critics around the world, including the US. The targets included activist and journalists.

This revelation has roped in ExpressVPN, as one of those former intelligence operatives working as part of Project Raven included the company’s Chief Information Officer, Daniel Gericke. Some concluded that ExpressVPN was not aware of Gericke’s past when they hired him, but the company has said they were aware of that past — and hired him anyway.

The news has not gone over well with the company’s critics or customers. In fact, Gizmodo has gone so far as to say customers should look for other options.

ExpressVPN acknowledged how much it knew about Gericke’s past in a statement:

When we hired Daniel in December 2019, we knew his background: 20 years in cybersecurity, first with the U.S. military and various government contractors, then with a U.S. company providing counter-terrorism intelligence services to the U.S. and its ally, the U.A.E., and finally with a U.A.E. company doing the same work. We did not know the details of any classified activities, nor of any investigation prior to its resolution this month.

The investigation ExpressVPN mentions is one led by US prosecutors. A deal was reached in which the defendants, including Gericke, were able to avoid jail time in exchange for fines, cooperation and certain employment restrictions.

ExpressVPN goes on to explain why it hired Gericke:

To do that job effectively—to do it, as we believe, better than anyone else in our industry—requires harnessing all the firepower of our adversaries. The best goalkeepers are the ones trained by the best strikers. Someone steeped and seasoned in offense, as Daniel is, can offer insights into defense that are difficult, if not impossible, to come by elsewhere. That’s why there is a well-established precedent of companies in cybersecurity hiring talent from military or intelligence backgrounds.

The company says its decision ultimately paid off:

Since Daniel joined us, he has performed exactly the function that we hired him to do: He has consistently and continuously strengthened and reinforced the systems that allow us to deliver privacy and security to millions of people.

Even if ExpressVPN was not aware of an active investigation into Gericke, it’s hard to imagine the company couldn’t see potential issues if they were aware of his past as they say they were.