They needed the decryption key to be available to the web application because they had modified it to silently decrypt the data coming back from the db so that

They needed the decryption key to be available to the web application because they had modified it to silently decrypt the data coming back from the db so that no one would catch on to their ruse until they'd encrypted enough data to be damaging.