Stage win: FinFisher is bankrupt(ccc.de)
ccc.de
Stage win: FinFisher is bankrupt
https://www.ccc.de/en/updates/2022/etappensieg-finfisher-ist-pleite
105 comments
>It appears like they're just going through a "rebranding"
IIRC the new company name, Vilic(i)us, describes the position of a "slave overseer" of Roman times. Unfortunately, I cannot find the wikipedia entry for it anymore (possible clean-up job of the new company?).
Edit:
Found it... https://en.wikipedia.org/wiki/Vilicus
IIRC the new company name, Vilic(i)us, describes the position of a "slave overseer" of Roman times. Unfortunately, I cannot find the wikipedia entry for it anymore (possible clean-up job of the new company?).
Edit:
Found it... https://en.wikipedia.org/wiki/Vilicus
It seems a bit more complicated - there's a great post from netzpolitik [1] (in German, unfortunately) listing all the gory details.
Again, all of this came to light because of the hard and persistent work of a whole bunch of NGOs (GFF, netzpolitik, CCC and so on).
[1] https://netzpolitik.org/2022/nach-pfaendung-staatstrojaner-h...
Again, all of this came to light because of the hard and persistent work of a whole bunch of NGOs (GFF, netzpolitik, CCC and so on).
[1] https://netzpolitik.org/2022/nach-pfaendung-staatstrojaner-h...
Good source. It sounds a bit like they were destroying the evidence with that move then. Like throwing a match into a gasoline-doused crime scene.
https://netzpolitik.org/2022/nach-pfaendung-staatstrojaner-h... (German) reads like it is more than a rebranding. But there are certainly new entrepreneurs who will fill the gap
Meet your new entrepreneurs. Same as your old entrepreneurs.
Same shit, new package
> companies escaped seizure through insolvency
This is a strange arrangement that I guess most countries follow. Companies are legal entities, that can be sued and so on. But a company cannot go to jail (board members or stock owners don't typically go to jail either). These legal entities can also seize to exist (like in this example), and then there is nobody left to be held accountable... It seems like most countries treat companies better than humans.
This is a strange arrangement that I guess most countries follow. Companies are legal entities, that can be sued and so on. But a company cannot go to jail (board members or stock owners don't typically go to jail either). These legal entities can also seize to exist (like in this example), and then there is nobody left to be held accountable... It seems like most countries treat companies better than humans.
Big difference between board members and stockholders. Board members are liable to some extent stockholders almost never are, unless the business was specifically founded to facilitate crime. That's where the term Ultimate Beneficiary comes into play.
> Big difference between board members and stockholders.
Completely agree, but in small/medium size companies (no public stock etc), these are often the same people. In many cases it's completely obvious who (which humans) that have done something wrong, but since we still accept that the legal entity under which they operated no longer exists; you're stuck.
A problem where I live (Norway) has been that people register companies to build apartment buildings, then immediately dissolve the company once the apartments are sold. The people who buy those flats better pray that there is nothing wrong with them, as there is basically nowhere to turn if there is.
Completely agree, but in small/medium size companies (no public stock etc), these are often the same people. In many cases it's completely obvious who (which humans) that have done something wrong, but since we still accept that the legal entity under which they operated no longer exists; you're stuck.
A problem where I live (Norway) has been that people register companies to build apartment buildings, then immediately dissolve the company once the apartments are sold. The people who buy those flats better pray that there is nothing wrong with them, as there is basically nowhere to turn if there is.
In such cases, where it is totally clear that the people in charge of that business acted in bad faith I'm all for going after them in person. A good building company either insures against such risks or they create a warranty fund. An even worse example would be a builder going bankrupt during the building. This is one of the reasons I've never bought a new house, it either exists and you can sell it to me or you can try to sell it to someone else first but I'm not going to assume that kind of risk.
> acted in bad faith I'm all for going after them in person
I agree, but this should be standard procedure. Hiding behind these peculiar "legal entities" that cannot possibly be held accountable anyway, makes no sense.
> This is one of the reasons I've never bought a new house
Same here, although the house I did buy was 160 years old; which also comes with its own set of problems :-)
I agree, but this should be standard procedure. Hiding behind these peculiar "legal entities" that cannot possibly be held accountable anyway, makes no sense.
> This is one of the reasons I've never bought a new house
Same here, although the house I did buy was 160 years old; which also comes with its own set of problems :-)
> although the house I did buy was 160 years old; which also comes with its own set of problems
Hehe, been there done that. In fact, doing that, right now I'm fixing a window frame that had 'a small spot of rot', by the time it was done half the frame had been removed, incredible how bad wood can be under nicely looking paint. Insect paradise underneath there.
Hehe, been there done that. In fact, doing that, right now I'm fixing a window frame that had 'a small spot of rot', by the time it was done half the frame had been removed, incredible how bad wood can be under nicely looking paint. Insect paradise underneath there.
> 'a small spot of rot'
is similar to "a small spot of rust" I guess, there is no such thing :-)
Fascinating to see how these old tree constructions are made. I still find it hard to comprehend that a few bricks and some timber logs are all that separates me from living directly on the dirt like a cave man..
is similar to "a small spot of rust" I guess, there is no such thing :-)
Fascinating to see how these old tree constructions are made. I still find it hard to comprehend that a few bricks and some timber logs are all that separates me from living directly on the dirt like a cave man..
That's one of my dreams still, to build a post-and-beam house from scratch. But I'm getting older and it may well be that such ambitious projects are now out of reach for me.
> to build a post-and-beam house from scratch
Sound like fun, and you shouldn't let age stop you from doing that. Instead you should adjust your dream to building a smaller post-and-beam house. It's not back breaking work if it's a small house; our inner cave men wants to work with timber for some reason.
Sound like fun, and you shouldn't let age stop you from doing that. Instead you should adjust your dream to building a smaller post-and-beam house. It's not back breaking work if it's a small house; our inner cave men wants to work with timber for some reason.
Here in the UK, most new builds come with 10 years of buildings insurance. That's good, because I've heard horror stories about the quality of new builds.
I imagine the insurance premiums are quite high, to guard against such 'fly by night' operations.
I imagine the insurance premiums are quite high, to guard against such 'fly by night' operations.
> The people who buy those flats better pray that there is nothing wrong with them, as there is basically nowhere to turn if there is
This is also the case if you buy from a human.
This is also the case if you buy from a human.
That's not strictly speaking true. If the human was aware of what was wrong with it prior to the sale and did not inform you then you can typically file a claim against them in court ('hidden defect'). You still have to prove that you did what a normal buyer would do in terms of research but malice on the part of the seller is something that is actionable.
> This is also the case if you buy from a human.
This used to be the case here in Norway until 2021 as well, but now it's illegal to slap the old "sold-as-it-is" clause at the end of the contract.
You can still sell horrible stuff of course, but you have to say that it's horrible, in the listing :-)
This used to be the case here in Norway until 2021 as well, but now it's illegal to slap the old "sold-as-it-is" clause at the end of the contract.
You can still sell horrible stuff of course, but you have to say that it's horrible, in the listing :-)
Most countries also stop criminal & civil proceedings if the human in question ceases to exist
But ceasing to exist and dying are similar yet also different concepts.
A company can cease to exist on a whim, yet be reborn the next minute under a different name, with the same "genes", the same "information", because the actual living, breathing people behind it, just move on.
A company can cease to exist on a whim, yet be reborn the next minute under a different name, with the same "genes", the same "information", because the actual living, breathing people behind it, just move on.
> ceases to exist
Exactly, you cannot just change name and buy a mustache like these companies basically can.
Exactly, you cannot just change name and buy a mustache like these companies basically can.
Yes, but creating a company does not require 18 years compared to raising adult human. So this can be throw away entities.
They don't though?
They'd follow through if person a profited from fraud,then died and inherited that money to a third person.
With companies it just ends there and then
With companies it just ends there and then
Probably a simple "flip". Companies in Germany do that often when they want to move overseas. The reason is that the Finanzamt (IRS) will tax any assets you move abroad. That can be a large problem for companies that e.g. get US funding. I know of a case where a financially successful German startup got funded by YC and needed to reincorporate in the US. If they had done it via the official route the Finanzamt would have used the YC valuation as a basis for calculating the taxes and the company would've needed to pay a seven-figure amount. They circumvented this by bankrupting the company and buying out the assets instead, which was then tax-free. I strongly suspect this is a similar move by FinFisher.
Exactly. People assume bankruptcy of a company is like a human dying but it’s not at all - the exact company and people involved can continue to exist through a bankruptcy just with new owners.
But corporations are people?
> But corporations are people?
People don't die when they go bankrupt.
People don't die when they go bankrupt.
The may be a "legal person" depending on the circumstances
They will continue under a new name and description.
The success to this day is not remarkable.
That software has not stopped criminals like Olaf Scholz and his buddies, nor has it protect a mayor of a city that was killed in his own house.
So, its useless and unethical to think to automate prosecution.
Too many false-positives and a bad success rate is not and can not be the goal to break basic rights.
The real criminals are not the weed dealers next door and not the dumb neo-fascists, they gather everyday in the parlaments with their shady double income, their wrongdoings and promises broken every day.
For what that software has brough revenue, the victims of the flood this summer, would enjoy golden handrails and faucets in their newly built homes.
>they gather everyday in the parlaments with their shady double income, their wrongdoings and promises broken every day
You can add Ursula v.d.L. to that list.
I lost faith in all EU governments to do anything for the people.
You can add Ursula v.d.L. to that list.
I lost faith in all EU governments to do anything for the people.
Ultimate power corrupts ultimately...
okay, there are always exceptions to that rule, like e.g. Emperor Marcus Aurelius
okay, there are always exceptions to that rule, like e.g. Emperor Marcus Aurelius
Anyone remember when democracy actually meant that the representatives of the people were chosen among the ordinary people themselves? While now we elect members of the elite to act as our representatives and we're shocked when we find out they actually represent the elite, instead of us, and are entangled in very complex and shady forms of corruption, bribery, tax evasion, insider trading and cronyism?
Who could have expected that? /s It's like sheep electing flock leaders among a pack of wolves. When will we stop doing that?
Who could have expected that? /s It's like sheep electing flock leaders among a pack of wolves. When will we stop doing that?
What did von der Leyen do?
https://en.wikipedia.org/wiki/Ursula_von_der_Leyen#%22Consul...
Just the tip of the iceberg
And what made her unpopular initially: https://en.wikipedia.org/wiki/Ursula_von_der_Leyen#Blocking_...
> [...] creating the necessary infrastructure for extensive censorship of websites deemed illegal by the BKA.
Just the tip of the iceberg
And what made her unpopular initially: https://en.wikipedia.org/wiki/Ursula_von_der_Leyen#Blocking_...
> [...] creating the necessary infrastructure for extensive censorship of websites deemed illegal by the BKA.
> … advocated the initiation of a mandatory blockage of child pornography on the Internet through service providers via a block list maintained by the Federal Criminal Police Office of Germany (BKA), thus creating the necessary infrastructure for extensive censorship of websites deemed illegal by the BKA.
For full context.
For full context.
Just google "von der Leyen McKinsey"
>criminals like Olaf Scholz and his buddies
Seriously?
Seriously?
It is suspected that he is involved with the Cum-Ex scandal, but to what extent remains unknown.
He made very questionable (non-)statements in that regard though.
sdoering(4)
> That software has not stopped criminals like...
Oh look, $method didn't stop $crimes where it is not relevant. Not surprising.
> The real criminals are not the weed dealers next door and not the dumb neo-fascists, they gather everyday in the parlaments with their shady double income, their wrongdoings and promises broken every day.
Weed dealers given the current legislation are commiting a crime. One of the biggest gifts to the lack of prosecution of higher politicians are the infighting between smaller "liberal" parties. And their general naivity
Are the people that are opposed to this happy when adversaries have hacked Germany?
You're free to protest at the nearest Extinction Even protest and pretend the "green's" anti-nuclear push has nothing to do with the latest events
btw "criminals like him (O.S.)"? sounds like either an AfD apologist or Linke supporter.
Oh look, $method didn't stop $crimes where it is not relevant. Not surprising.
> The real criminals are not the weed dealers next door and not the dumb neo-fascists, they gather everyday in the parlaments with their shady double income, their wrongdoings and promises broken every day.
Weed dealers given the current legislation are commiting a crime. One of the biggest gifts to the lack of prosecution of higher politicians are the infighting between smaller "liberal" parties. And their general naivity
Are the people that are opposed to this happy when adversaries have hacked Germany?
You're free to protest at the nearest Extinction Even protest and pretend the "green's" anti-nuclear push has nothing to do with the latest events
btw "criminals like him (O.S.)"? sounds like either an AfD apologist or Linke supporter.
I guess that's a justified case for Schadenfreude ...
But on a more serious note, the battle for transparency and accountability (and ultimately democratic resilience) relies a lot on the hard work by many, many NGOs (many of those listed towards the end of the article, such as the wonderful Citizen Lab from U of Toronto).
I find it scary that such important monitorial tasks are left to underfunded volunteers which may go away at any second. Well, the same applies to journalists to a certain degree ... In both cases, we need to care more about sustainable funding of these institutions.
But on a more serious note, the battle for transparency and accountability (and ultimately democratic resilience) relies a lot on the hard work by many, many NGOs (many of those listed towards the end of the article, such as the wonderful Citizen Lab from U of Toronto).
I find it scary that such important monitorial tasks are left to underfunded volunteers which may go away at any second. Well, the same applies to journalists to a certain degree ... In both cases, we need to care more about sustainable funding of these institutions.
On the other hand, we need to strike a balance between "sustainable funding" (be it government or corporate) and true independence.
That the CCC thanks Microsoft ... hell is freezing in multiple places ;)
I didn't know about this company before, but a cursory search suggests they were only based in Germany, not used by the German government. Title is misleading, especially as it is not the original title of the article, and Germany has in fact prosecuted them.
That said, good riddance. We desperately need accountability for malware coming from state actors.
That said, good riddance. We desperately need accountability for malware coming from state actors.
You might have missed this statement in the article:
> German authorities were of course also customers of the company
Though I don't think that's what the title was implying, I think it means German "nationality" rather than German "state-owned".
> German authorities were of course also customers of the company
Though I don't think that's what the title was implying, I think it means German "nationality" rather than German "state-owned".
You are right about this claim, but the only thing I could find to substantiate it is a 2013 article in which leaked documents suggests German federal police wanted to use it [1]. It is still incorrect to suggest this is a German state spyware, although of course you are right about the ambiguity here.
[1] https://netzpolitik.org/2013/secret-government-document-reve...
[1] https://netzpolitik.org/2013/secret-government-document-reve...
why do we even tolerate malware companies
1) Because most people are blissfully unaware of these companies
2) Because a large portion of people who are not in 1) support it, because they believe it is used to spy on the bad guys™ and never consider that these tools have already been abused in the past and will be abused in the future.
2) Because a large portion of people who are not in 1) support it, because they believe it is used to spy on the bad guys™ and never consider that these tools have already been abused in the past and will be abused in the future.
Why do we tolerate personal data brokerage companies?
to avoid to have to ask for support in that area when your country is being invaded by another country maybe? https://www.theguardian.com/world/2022/mar/23/israel-ukraine...
seems like we have a whole international alliance for mutual defense assurance
? Allied states have provided intelligence support and tools to each other for centuries without needing companies to do that for them. The internet didn't change that, greed and regulatory capture did.
For the same reason we tolerate any armament company : we need them.
Malware isn't bad, like guns, it depends on the one using it. There are legit uses, e.g. governments or simulations of real attacks.
Do we actually have any cases of governments using malware for good?
Guns aren't a great comparison because the use can (and usually is) wholly defensive or acts as a deterrent -- i.e if you are known to be armed then you'd be left alone.
Malware on the other hand is almost exclusively offensive and governments around the world almost exclusively use it for nefarious reasons (i.e NSO Group's clientele and published usages).
Guns aren't a great comparison because the use can (and usually is) wholly defensive or acts as a deterrent -- i.e if you are known to be armed then you'd be left alone.
Malware on the other hand is almost exclusively offensive and governments around the world almost exclusively use it for nefarious reasons (i.e NSO Group's clientele and published usages).
Also, when you use a gun against someone, be it to threat or injure, you can’t do it without making the person aware that you used this weapon against them.
Well looks like it play a role in the defense strategy from the Ukraine https://www.nytimes.com/2022/03/23/us/politics/pegasus-israe...
So maybe until now we didn't see a country with cyber in their strategy being invaded by another?
So maybe until now we didn't see a country with cyber in their strategy being invaded by another?
Ukraine hasn't acquired NSO Group's software (based on your article) and ultimately it's a seriously corrupt country -- the most corrupt in Europe -- and globally ranks below El Salvador, Brazil, Turkey and even Cuba. Just because it's currently facing an invasion doesn't mean the malware won't be used for nefarious purposes: i.e Ukrainian elites targeting other Ukrainians or the sitting Ukrainian government targeting opposition political parties. During conflicts we often see governments and elites from those countries trying to siphon as much as they can.
Just to drive the point: at the same time that they first requested the software (2014) the country was the biggest arms dealer for the Syrian civil war[0]. A large part of the arms they received after what happened in Crimea ended up making its way to countries like Syria[1] and it's likely a driving reason behind why the country was so ill-equipped with the current conflict. There is little doubt that the physical arms will eventually be sold off after this conflict is over, and with malware that can be copied quite easily it's likely it will be sold the moment it's acquired to any bidder that puts their hand up.
[0] https://qz.com/211603/how-ukrainian-arms-dealing-connects-to...
[1] https://www.reuters.com/article/us-ukraine-crisis-arms-insig...
Just to drive the point: at the same time that they first requested the software (2014) the country was the biggest arms dealer for the Syrian civil war[0]. A large part of the arms they received after what happened in Crimea ended up making its way to countries like Syria[1] and it's likely a driving reason behind why the country was so ill-equipped with the current conflict. There is little doubt that the physical arms will eventually be sold off after this conflict is over, and with malware that can be copied quite easily it's likely it will be sold the moment it's acquired to any bidder that puts their hand up.
[0] https://qz.com/211603/how-ukrainian-arms-dealing-connects-to...
[1] https://www.reuters.com/article/us-ukraine-crisis-arms-insig...
Ukraines military has changed drastically since the war that started in 2014. They have made many changes, moving away from the old Soviet style system and to a more western system for the military along with upping military pay and training. I also don't think that Ukraines military is overly 'ill-equipped' but its more that its fighting an army much bigger then itself, and one so incompetent that its going through ATGM's and MANPAD's so fast that its literally impossible to keep up.
> the most corrupt in Europe
As ranked by countries and institutions in countries that rank themselves lower no doubt.
As ranked by countries and institutions in countries that rank themselves lower no doubt.
> governments around the world almost exclusively use it for nefarious reasons
Oh sure, I agree. But that's bad governments not bad lines of code.
Oh sure, I agree. But that's bad governments not bad lines of code.
So we need good governments, with their own malware, to fight the bad ones? Is that where this logic is going?
Nope? If the reason stated is terror, that seems like a legit reason to me.
Look I see that there is more evil than good done with this stuff, but it's not the stuffs fault.
Look I see that there is more evil than good done with this stuff, but it's not the stuffs fault.
The thing is that "terror" is an extremely vaguely defined concept, in the US there are at least 8 different, and recognized, definitions for it [0]
Nor are there usually any efficient checks&balances in place to make sure these tools are actually only used for their originally declared purpose.
That's why the mass-surveillance creep, since the Patriot Act, has been very real and for the most part completely unchecked, FISA court just rubber-stamping anything that comes their way.
In that context I'd rather see resources put towards fixing vulnerabilities, instead of leaving them open so they can be exploited by intelligence and police agencies. This approach would also prevent much more "evil" than hoping how the "good Big Brother" will not abuse his power and instead solely use the same vulnerabilities to stop the "evil" guys.
[0] https://en.wikipedia.org/wiki/Definition_of_terrorism#United...
Nor are there usually any efficient checks&balances in place to make sure these tools are actually only used for their originally declared purpose.
That's why the mass-surveillance creep, since the Patriot Act, has been very real and for the most part completely unchecked, FISA court just rubber-stamping anything that comes their way.
In that context I'd rather see resources put towards fixing vulnerabilities, instead of leaving them open so they can be exploited by intelligence and police agencies. This approach would also prevent much more "evil" than hoping how the "good Big Brother" will not abuse his power and instead solely use the same vulnerabilities to stop the "evil" guys.
[0] https://en.wikipedia.org/wiki/Definition_of_terrorism#United...
Instead of writing a malware exploiting a bug to simulate an attack to defend against the exploit, you could have just fixed the damn thing in the first place.
> There are legit uses, e.g. governments
I'm astonished that there are so many people here that are willing to defend government use of malware.
Malware is software deliberately designed to cause devices to malfunction. Since when is it legitimate for any government to deliberately break the property of a private citizen who hasn't been convicted of any offence, without at least a court order?
I'm astonished that there are so many people here that are willing to defend government use of malware.
Malware is software deliberately designed to cause devices to malfunction. Since when is it legitimate for any government to deliberately break the property of a private citizen who hasn't been convicted of any offence, without at least a court order?
It's called malware, because it IS bad.
I think nukes are a better analogy than guns. There's legitimate reasons why you might want your government to develop and own them, but there's no good reason that it should be legal for private companies or individuals to sell or buy them.
DocTomoe(4)
Because this company was the developer of the "Staatstrojaner" malware government agencies used to hack into computer systems to investigate crimes. I think the original use case was just terrorism but I'm pretty sure it's been used against other crimes as well.
As to why the German public tolerate it: because there wasn't sufficient pushback and the government doesn't care about a few protests as most people will eventually forget about it and move on.
As to why the German public tolerate it: because there wasn't sufficient pushback and the government doesn't care about a few protests as most people will eventually forget about it and move on.
> I think the original use case was just terrorism but I'm pretty sure it's been used against other crimes as well.
As with every dystopic "anti-terror" measurement, this is correct.
As with every dystopic "anti-terror" measurement, this is correct.
This is somehow such a difficult thing for people to grasp. "Yes the government gained the power to reach into our bank accounts, but it was for a good reason. I'm sure neither this nor any future government will ever abuse that power or mislay information they now have access to."
Seems to me like the government should internally own their malware rather than tolerate a company that presumably sells to other governments or private entities. Mine was a rhetorical question of course.
We have private companies designing and building weapons. There are laws regarding who it can be sold to or where it can be exported.
I believe malware is in the same category.
Sometimes (frequently) you want an arms-length/plausibly-deniable relationship so that government can do edgy/illegal stuff but duck the blowback if it all goes pear-shaped or gets exposed to the sanitising light of day. See also extraordinary rendition.
You mean like a state owned enterprise? That would go against decades of free market ideology. Even if we had somehow ended up with a state owned malware development organization it would probably have been privatized by now.
Are you joking? Many states do this. E.g. in the UK they had a massive hiring binge for cyber a few years ago. They will also buy from third parties. That's not ideology (the free market can't really be deemed an ideology), that's just not succumbing to an (actual) ideology that says the state must own everything.
> the free market can't really be deemed an ideology
The free market isn't an ideology much like money isn't an ideology. Putting the free market in charge of certain aspects of society however is very much an ideological decision, though. Ideology doesn't stop being ideology just because you agree with it (although there are certainly plenty of political candidates throughout history who claim to not adhere to any ideologies). For example anarchists are somewhat open to market economies while state communists usually advocate for central planning and libertarians are strongly in favor of free market maximalism, believing that for a free market to work at its best it needs to be free of all regulations (tho usually still maintaing some rule of law to prevent a real world equivalent of EVE Online's corporate warfare).
I'm not saying privatization is good or bad, I'm just saying that the underlying ideology of the past decades in Germany has been that we should privatize as much as possible and where privatization is not possible we should at least reproduce a free market system as closely as possible (e.g. we have multiple competing public healthcare providers despite having strict regulations that mean they all provide very similar levels of care).
> Many states do this.
We do have people in government agencies "doing cyber". We just don't have a government owned software development department developing malware for government agencies to use, just like we don't have a government owned weapons manufacturing department developing weapons for the police and military.
We do have the government owning shares (even majority shares) in private (or rather publicly traded) companies though. But often these are in privatized branches of the government (e.g. Deutsche Bahn) or companies that are naturally monopolistic. Buying out a private software development company would go against the spirit of the free market as it would eliminate competition.
The free market isn't an ideology much like money isn't an ideology. Putting the free market in charge of certain aspects of society however is very much an ideological decision, though. Ideology doesn't stop being ideology just because you agree with it (although there are certainly plenty of political candidates throughout history who claim to not adhere to any ideologies). For example anarchists are somewhat open to market economies while state communists usually advocate for central planning and libertarians are strongly in favor of free market maximalism, believing that for a free market to work at its best it needs to be free of all regulations (tho usually still maintaing some rule of law to prevent a real world equivalent of EVE Online's corporate warfare).
I'm not saying privatization is good or bad, I'm just saying that the underlying ideology of the past decades in Germany has been that we should privatize as much as possible and where privatization is not possible we should at least reproduce a free market system as closely as possible (e.g. we have multiple competing public healthcare providers despite having strict regulations that mean they all provide very similar levels of care).
> Many states do this.
We do have people in government agencies "doing cyber". We just don't have a government owned software development department developing malware for government agencies to use, just like we don't have a government owned weapons manufacturing department developing weapons for the police and military.
We do have the government owning shares (even majority shares) in private (or rather publicly traded) companies though. But often these are in privatized branches of the government (e.g. Deutsche Bahn) or companies that are naturally monopolistic. Buying out a private software development company would go against the spirit of the free market as it would eliminate competition.
At least in the US, there are caps on how much you can pay an internal employee that generally do not pay for a top-tier researcher who’d develop malware like this. Instead you would pay some contractor a much higher rate that they could pass some portion of to their own researchers.
That would require the state to attract (and compensate) IT talent. As far as I know, they are trying..
> I think the original use case was just terrorism but I'm pretty sure it's been used against other crimes as well.
This kind of stuff is always justified with "terrorism, pedophilia and organized crime", but once its in place it's usually overwhelmingly applied to much pettier crimes.
This kind of stuff is always justified with "terrorism, pedophilia and organized crime", but once its in place it's usually overwhelmingly applied to much pettier crimes.
It's usually CSAM or child sexual abuse in general, not pedophilia, but yes.
For example Internet censorship (I believe in the form of IP bans but I'm not sure how they're meant to be implemented exactly) was originally justified with the necessity of blocking CSAM in jurisdictions that are out of reach of Germany and the EU but recently there were moves to ban the pornsite XHamster because it provided an insufficient age check to visitors (although with similar sites it's usually nothing more than a popup to the effect of "Are you old enough to view porn? Y/N"), which while still boiling down to "think of the children" isn't exactly the kind of thing von der Leyen originally described when shooting down criticism of the proposed law.
For example Internet censorship (I believe in the form of IP bans but I'm not sure how they're meant to be implemented exactly) was originally justified with the necessity of blocking CSAM in jurisdictions that are out of reach of Germany and the EU but recently there were moves to ban the pornsite XHamster because it provided an insufficient age check to visitors (although with similar sites it's usually nothing more than a popup to the effect of "Are you old enough to view porn? Y/N"), which while still boiling down to "think of the children" isn't exactly the kind of thing von der Leyen originally described when shooting down criticism of the proposed law.
[deleted]
I will be interested to see how this interacts with the Ampel Koalition's desire to add more restrictions on state-sponsored hacking (search term, "Staatstrojaner" [1]). The current government coalition contract includes "increasing controls" and "higher thresholds" for their use (my translation), which would signal a shift in German federal policy _at least slightly_ away from state-sponsored hacking, which was very favored by the previous government.
It's probably also worth mentioning that these Staatstrojaner haven't really demonstrated effectiveness. It's an extremely common refrain on the Netzpolitik scene here that we would all be much, much better served if the government were compelled to responsibly disclose the bugs used in these tools to the companies producing the software, instead of trying to keep them quiet in order to weaponize them. But I suspect this argument is basically preaching to the choir at HN. For German speakers, I would highly recommend following both Netzpolitik and Lage der Nation; the former is self-explanatory but the latter also frequently talks about digital policy in Germany.
Edit: a clarifying point here, as far as I understand, FinFisher is *not* a state-owned company (that would be big news!), but rather a normal GmbH (like an LLC) that develops and sells Staatstrojaner. As such I think the line in the title ("German State Malware Company") strikes me as inaccurate in both English and a hypothetical German->English translation.
[1] https://netzpolitik.org/2021/koalitionsvertrag-das-plant-die...
----
Side note, I know metacommentary isn't typically considered entirely kosher on HN, but some threads I'm seeing pretty high up in the discussion here are really not meeting the quality standards I would expect from HN. Calling the current German chancellor Scholz a "criminal" with "buddies", and a follow-up thread that can be summed up as "I think the EU is so corrupt that it only looks after its own politicians" -- all of this with absolutely no evidence -- is so frustratingly hyperbolic and reductionist that it has me (in all seriousness) wondering what level of exposure HN has to state-level disinformation actors.
It's probably also worth mentioning that these Staatstrojaner haven't really demonstrated effectiveness. It's an extremely common refrain on the Netzpolitik scene here that we would all be much, much better served if the government were compelled to responsibly disclose the bugs used in these tools to the companies producing the software, instead of trying to keep them quiet in order to weaponize them. But I suspect this argument is basically preaching to the choir at HN. For German speakers, I would highly recommend following both Netzpolitik and Lage der Nation; the former is self-explanatory but the latter also frequently talks about digital policy in Germany.
Edit: a clarifying point here, as far as I understand, FinFisher is *not* a state-owned company (that would be big news!), but rather a normal GmbH (like an LLC) that develops and sells Staatstrojaner. As such I think the line in the title ("German State Malware Company") strikes me as inaccurate in both English and a hypothetical German->English translation.
[1] https://netzpolitik.org/2021/koalitionsvertrag-das-plant-die...
----
Side note, I know metacommentary isn't typically considered entirely kosher on HN, but some threads I'm seeing pretty high up in the discussion here are really not meeting the quality standards I would expect from HN. Calling the current German chancellor Scholz a "criminal" with "buddies", and a follow-up thread that can be summed up as "I think the EU is so corrupt that it only looks after its own politicians" -- all of this with absolutely no evidence -- is so frustratingly hyperbolic and reductionist that it has me (in all seriousness) wondering what level of exposure HN has to state-level disinformation actors.
Good! Phineas Fisher will be pleased ;)
[deleted](1)
https://mobile.twitter.com/Pingu/status/1469314222349852675
Quote from the OP article:
> the public prosecutor's office wanted to secure the assets potentially obtained from an unlawful act by means of an asset freeze in order to be able to confiscate them if necessary. The group of companies escaped seizure through insolvency
So you know what's going on.