I have also heard of companies hiring "former" bad guys to help out with security. This could be a good thing for companies to keep things secure.
I believe this is a tough decision which any organization must take very seriously. Choosing to expose your computing environment, defenses, and people to ‘former’ bad guys may not be a sensible proposition as there is no guarantee they have completely given up their misguided ways or may relapse in the future. If they do return to the dark side, they will do so with good insights to your environment and your systems may be fresh in their mind when they are choosing targets.
The primary benefit such people offer is the contextual knowledge they possess in identifying exploitable areas in your defenses. Additionally, they can prioritize such cracks in your armor, according to the highest likelihood attackers would target first. This is very valuable and more importantly, actionable field intelligence.
That said, the key is the output, which can also be derived from ‘white hat’ security professionals whom have never been ‘bad guys’. I believe it is a much better proposition to trust persons who have the right skills AND proven to be morally/ethically strong. I have yet to see a situation where choosing someone with flexible ethical judgment is better than going with someone of equal talent and an untarnished reputation. It might cost a little more, but well worth the investment.
These security systems are actually distracting me from my work - I allways have an uneasy feeling of being all wathed over. I don't like such trends anymore.