NSO Group CEO says law-abiding citizens have 'nothing to be afraid of'(appleinsider.com)
appleinsider.com
NSO Group CEO says law-abiding citizens have 'nothing to be afraid of'
https://appleinsider.com/articles/21/07/23/nso-group-ceo-says-law-abiding-citizens-have-nothing-to-be-afraid-of
86 comments
The Public: "How do you know if I'm law abiding or not?"
NSO: "We checked, you're clean"
The Public: "I plan to speak publicly about this violation of my privacy"
Local DA: "An investigation revealed some suspicious activity in your secretly subpoenaed browser history... 6 years ago..."
The Public: "Investigation? I didn't do anything wrong! Is this because I want to voice my objection to the current privacy laws?! This sounds an awful lot like parallel construction"
Local DA: "We are not at liberty to disclose the nature of the information we have on you as it contains information involving other active cases. You are under arrest."
NSO: "We checked, you're clean"
The Public: "I plan to speak publicly about this violation of my privacy"
Local DA: "An investigation revealed some suspicious activity in your secretly subpoenaed browser history... 6 years ago..."
The Public: "Investigation? I didn't do anything wrong! Is this because I want to voice my objection to the current privacy laws?! This sounds an awful lot like parallel construction"
Local DA: "We are not at liberty to disclose the nature of the information we have on you as it contains information involving other active cases. You are under arrest."
Glory to Arstotzka !
The automaker example is awful in this case. This is a drunk guy going into a car rental and asking to take it for a spin. NSO being the rental company says do you have cash? Drunk guy gives a pile of cash and rental company gives them a car to drive. Drunk driver kills someone. Is the car rental company liable? We just rent cars they say as a defense, but know they are selling to someone who is dangerous and isn't known for abiding by international (or perhaps western) norms of behavior.
You cannot have it both ways, if you're going to sell the software to awful regimes who target people like journalists, you're responsible for the outcomes. The fact they found it was used on Khashoggi family phones would seemingly implicate them in the murder of a journalist. Did they kill him? Probably not. But if their software is being used by governments who did kill him, then they contributed.
I hope they get criminally held responsible for assisting in the murder of Khashoggi if they are found guilty and we need laws and norms to catch up to a place where this kind of business is more restricted/limited.
You cannot have it both ways, if you're going to sell the software to awful regimes who target people like journalists, you're responsible for the outcomes. The fact they found it was used on Khashoggi family phones would seemingly implicate them in the murder of a journalist. Did they kill him? Probably not. But if their software is being used by governments who did kill him, then they contributed.
I hope they get criminally held responsible for assisting in the murder of Khashoggi if they are found guilty and we need laws and norms to catch up to a place where this kind of business is more restricted/limited.
> You cannot have it both ways, if you're going to sell the software to awful regimes who target people like journalists, you're responsible for the outcomes.
It's going to be hard to keep software out of the wrong hands. Perhaps it would be better to ensure everyone is using secure/encrypted/private communication and services.
The general population may need to organize this, despite selfish corporations and the politicians they fund.
It's going to be hard to keep software out of the wrong hands. Perhaps it would be better to ensure everyone is using secure/encrypted/private communication and services.
The general population may need to organize this, despite selfish corporations and the politicians they fund.
>It's going to be hard to keep software out of the wrong hands.
If your entire business model is to sell covert intrusive software to powerful entities, then the argument is irrelevant.
If your entire business model is to sell covert intrusive software to powerful entities, then the argument is irrelevant.
I don't think that I understand what you are saying.
In my comment I meant to say that keeping software out of the wrong hands was ultimately not possible, and thought it would be better the give people more secure and more private means to communicate (something like pinephone, tor, matrix, etc).
Your first clause seems to agree with the first half of what I said (can't stop bad software), but then you said it was irrelevant. Maybe irrelevant to NSO, as long as they can get away with it? Or irrelvant to something else I said?
(I'm not opposed to going after NSO, also. Power to the people. But it seems many governments care about our data more than they care about our votes.)
In my comment I meant to say that keeping software out of the wrong hands was ultimately not possible, and thought it would be better the give people more secure and more private means to communicate (something like pinephone, tor, matrix, etc).
Your first clause seems to agree with the first half of what I said (can't stop bad software), but then you said it was irrelevant. Maybe irrelevant to NSO, as long as they can get away with it? Or irrelvant to something else I said?
(I'm not opposed to going after NSO, also. Power to the people. But it seems many governments care about our data more than they care about our votes.)
Irrelevant to the argument as it pertains to NSO.
Thanks for clarifying.
> Perhaps it would be better to ensure everyone is using secure/encrypted/private communication and services.
Isn't NSO's whole shtick their software can get into and read everything from even the latest iPhones ( and probably Androids, I've only seen it stated for iOS though)? What good is a secure/encrypted service when the device you access it from is hacked and sends everything to the hacker?
Isn't NSO's whole shtick their software can get into and read everything from even the latest iPhones ( and probably Androids, I've only seen it stated for iOS though)? What good is a secure/encrypted service when the device you access it from is hacked and sends everything to the hacker?
That's true, there's a lot of exposure on the typical iPhone or Android device, lots of installed apps, lots of collected metadata.
I was kind of picturing people en-masse becoming upset with this stuff, and having real/better/open tools available for them when that happens - stuff like a slick pinephone running mastadon over matrix over tor, or something, etc.
I guess I threw that comment out there because it seemed like going after the metadata seller that crossed a line leaves all the other metadata sellers in business, and free to push the line further along. I was thinking it would better to address the root cause - giving people better security and privacy.
I was kind of picturing people en-masse becoming upset with this stuff, and having real/better/open tools available for them when that happens - stuff like a slick pinephone running mastadon over matrix over tor, or something, etc.
I guess I threw that comment out there because it seemed like going after the metadata seller that crossed a line leaves all the other metadata sellers in business, and free to push the line further along. I was thinking it would better to address the root cause - giving people better security and privacy.
We need both. It's not a binary choice.
We shouldn't enable companies to sell cyber weapons to regimes who use them against innocent people. You can debate where that line is all you want, using it to murder journalists in other countries who are critical of your regime is across that line wherever you may draw it.
We also should encourage better privacy and security to protect everyone's communications and data.
We shouldn't enable companies to sell cyber weapons to regimes who use them against innocent people. You can debate where that line is all you want, using it to murder journalists in other countries who are critical of your regime is across that line wherever you may draw it.
We also should encourage better privacy and security to protect everyone's communications and data.
Where do we end up? Anyone who sells a knife is charged for any murder committed with that brand of knife. Does that mean anyone buying a knife has to sign a form releasing the company from legal issues that may arise?
Most knives are not intended to harm or kill, they just happen to be used for that case sometimes; you can make the same argument for a large stick wielded by someone with the intent to kill. Handguns however have one purpose: to kill someone (aside: saying "but wait they can be used in gun ranges" kinda proves that point). They were explicitly produced for this purpose. Ideally gun manufacturers would be held accountable for their production; unfortunately they are not, and gun companies just throw up their hands and say "well this gun was legally sold so I can't help you". Likewise, if you produce and sell a piece of software whose main goal is to infiltrate personal devices, especially in a targeted manner, then you are ideally liable for outcomes regardless of who applies your software. NSO is giving the exact same response as those gun companies.
NSO would argue that the software in question is only intended for use against terrorists and criminals. Gun companies argue that they’re not designed to take human life. Who draws the line on when a company is lying about the intended purpose of products? You?
Unfortunately those that draw that line in reality are the same people who want encryption banned for consumers but not government agencies because it prevents the sharing of child pornography and terrorism make that decision. Are they right? Is that the only argument that matters?
I would argue that a more apt comparison is to selling assassinations, rather than guns. While most laws prohibit that, governments and powerful entities engage in that. Anyway, this comparison makes no sense from many different perspectives.
> Where do we end up? Anyone who sells a knife is charged for any murder committed with that brand of knife.
We could split the difference and just assign liability for the ones done by serial murderers and people who show up asking for knives that are good for murdering. Knowing that your product is going to be used for some purpose and providing it anyway makes you an accomplice.
We could split the difference and just assign liability for the ones done by serial murderers and people who show up asking for knives that are good for murdering. Knowing that your product is going to be used for some purpose and providing it anyway makes you an accomplice.
A better example would be a specially designed knife for bringing undetected onto an airplane.
A knife has plenty of valid uses beyond being able to kill someone. Malware doesn’t.
I don't have to be personally afraid of NSO's products being used to target me to believe that them being used to suppress dissident journalists and humans rights advocates makes the world a worse place.
> "The people that are not criminals, not the Bin Ladens of the world— there's nothing to be afraid of. They can absolutely trust on the security and privacy of their Google and Apple devices," Hulio said.
So is he saying that journalists are the Bin Ladens of the world?
So is he saying that journalists are the Bin Ladens of the world?
I think their business is ethically dubious but there's an outsize degree of outrage compared to companies like weapons manufacturers. It's the same thing. They make extremely dangerous tools and sell them to governments who can optionally use them for good, evil or a bit of both. You can certainly criticize them for their role in the death of Jamal Khashoggi for example. But he only died because the government of Saudi Arabia wanted him dead. They've also had no trouble acquiring fighter jets they've used to kill thousands of Yemenis.
Please dont forget that the war machine now kills people based off phone metadata. That should shift your perspective a touch.
Yeah but it's like 0.001% of the people killed by conventional means. We're only flipping out because it's new. It's not like the Minneapolis police needed George Floyd's phone metadata or encrypted chats. Or that Russia was picking targets in Crimea with it. Arguably fear of spying has caused more deaths than actual spying if anti-vaxxers are being honest.
The CEO comes of as a callous idiot here. That being said, the obsession with NSO is a bit much given that the real culprits are governments. Yes, NSO is supplying a nasty tool to authoritarian governments when it should not but I don’t see anyone vociferously fretting over NSO showing an ounce of concern for the billions in financing and in actual weapons of war being sold, or the material support of these same authoritarian governments by the U.S., Britain, France, Germany, etc., etc.
France, for example, has officially done a lot more to prop up Saudi Arabia and its cruelty than NSO ever has or will.
The hypocrisy is astounding.
France, for example, has officially done a lot more to prop up Saudi Arabia and its cruelty than NSO ever has or will.
The hypocrisy is astounding.
"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
- Benjamin Franklin
Without commenting are the article itself:
1. This quote is frequently taken out of context to mean something very different from its original intent.
2. More importantly, we give up a little "Liberty" for a little "Safety" all the time, it's basically a primary purpose for any government. I mean, should I be able to cruise down the highway at 120 MPH as I'm snorting a line of coke? Liberty-vs-safety tradeoffs are nearly all the tough calls in government.
1. This quote is frequently taken out of context to mean something very different from its original intent.
2. More importantly, we give up a little "Liberty" for a little "Safety" all the time, it's basically a primary purpose for any government. I mean, should I be able to cruise down the highway at 120 MPH as I'm snorting a line of coke? Liberty-vs-safety tradeoffs are nearly all the tough calls in government.
His point is still essentially the same, even if the roles have reversed a bit. Replace Penn family with today's government, and the governor with a citizen about to give up his rights. The governor was going to give up the people's right to tax the Penn family in exchange for a one time payment. The governor would be making a short term sacrifice to help those dying on the frontier at the long term expense of the people. That is more or less how most people use the quote today.
That being said, I don't think most would consider driving 120 mph while snorting coke an essential liberty. The OP makes a much more reasonable point which you refuse to address.
That being said, I don't think most would consider driving 120 mph while snorting coke an essential liberty. The OP makes a much more reasonable point which you refuse to address.
This particular quote includes two adjectives which I'm not seeing on all occasions it is brought up: "essential Liberty" and "temporary Safety". Operating a vehicle under influence and in an unsafe manner does not fall under "essential" in my view.
The phrase says "essential liberty" not "a little Liberty".
I mean, "essential" really is in the eye of the beholder, which makes the whole point moot, especially as this quote is often brought up in cases where the "essential-ness" of what is being curtailed is highly debatable.
This isn't an academic argument, either. Just look at the gun debate in the US. Many argue that any curtailment of the right to bear arms, from a pistol to a bazooka, is an infringement of essential liberty. Many others strongly disagree that the right of individuals to own high-powered firearms is an essential liberty.
This isn't an academic argument, either. Just look at the gun debate in the US. Many argue that any curtailment of the right to bear arms, from a pistol to a bazooka, is an infringement of essential liberty. Many others strongly disagree that the right of individuals to own high-powered firearms is an essential liberty.
Of course it's in the eye of the beholder. The quote is just one man's subjective opinion. It's a pretty way of stating one person's opinion as to the relative importance of essential liberty and safety which many people agree with.
It's a matter for debate what liberties are essential and different people believe different things.
It's a matter for debate what liberties are essential and different people believe different things.
Legitimacy of any government, monopoly on voice by any government is defended on such grounds: different varieties of social contract theorists. As one of the replies suggest, you are picking on "little", whereas the parent poster mentions "essential".
Even “essential” liberties were infringed on from the very beginning, and maintained until now. Defamation and free speech being a common example.
>cruise down the highway at 120 MPH
Your example is not one of "liberty", at most can be one of "licence", and surely not of "essential liberty".
Your example is not one of "liberty", at most can be one of "licence", and surely not of "essential liberty".
There's the rub. What is a "license", what is a "liberty", and what is an "essential liberty". People disagree on this.
(Sorry for the delay, UncleMeat)
While debatability is normal, that in this context of liberty the point of discrimination is "how and how much one's action affects others" - akin to the dialectic between "freedom to vs freedom from" - should be a trivial point, and at the same time is evidently something not clear in many.
Categorizing "speedracing under an influence" is not a hard exercise.
Edit: I am also seeing - and in the past 18 months the evidence has boomed -, a widespread inability towards the judgement of "why this policy", both in the affected public and the issuing power, including monstrous faults deviating from straight reasoning and display of shallow arguing (not even any more explainable by electorate positioning). I have seen a boost in lack of judgement. This is very ghastly - it is a return to the famed quality/quantity of discrimination in times of witch-hunting.
While debatability is normal, that in this context of liberty the point of discrimination is "how and how much one's action affects others" - akin to the dialectic between "freedom to vs freedom from" - should be a trivial point, and at the same time is evidently something not clear in many.
Categorizing "speedracing under an influence" is not a hard exercise.
Edit: I am also seeing - and in the past 18 months the evidence has boomed -, a widespread inability towards the judgement of "why this policy", both in the affected public and the issuing power, including monstrous faults deviating from straight reasoning and display of shallow arguing (not even any more explainable by electorate positioning). I have seen a boost in lack of judgement. This is very ghastly - it is a return to the famed quality/quantity of discrimination in times of witch-hunting.
All of civilization is a balance between safety and liberty. It's an agreement to limit certain activities and standardize their consequences.
Inequitable societies will prioritize the safety & liberty of some groups above others. People also have different ideas on where the balance should be (well, excluding anarchists) but that is merely a matter of degree, not kind.
Of course that oversimplifies things, but this over used & out of context quote ignores that fundamental fact of any minimally organized group of people.
Inequitable societies will prioritize the safety & liberty of some groups above others. People also have different ideas on where the balance should be (well, excluding anarchists) but that is merely a matter of degree, not kind.
Of course that oversimplifies things, but this over used & out of context quote ignores that fundamental fact of any minimally organized group of people.
In defence of the quote, it did mention trading essential liberty for a little security. Implying a bad trade.
I agree with what you say about these decisions being made as a society, and there being disagreements.
I would like to point out that you may misunderstand anarchists. Anarchists understand disagreement over such trade-offs better than most, and work harder than most for compromise and census. Anarchists are fine with large political structures and rules, as long as they are not forced upon anyone. Anarchists prioritize not forcing anything on others [0].
An anarchist might refer to what they have been doing in Switzerland for the last 150 years as a great example of bottom-up direct democracy in action [1], which is basically what political anarchy is. Currently a country of 8.5 million people, Switzerland is split into 26 cantons (they divide into more when needed). Each canton has its own constitution and parliament (averaging ~330k people each). Cantons are divided into municipalities (some large, like Zurich, and some small, with only 2-3k people). A big part of their political culture and the structure of their government is that what can be done locally is done locally, and the people are in charge. People can petition for a vote to not only create new laws and amendments, but to have laws they don't like removed.
Many of the problems in the U.S. are due to the fact that the federal government was never meant to be as involved in our lives as it is (10th amendment, powers default to the states) and was not designed to be responsive to the people (technically states vote for president, not people). So now there are 330 million of us arguing about more and more stuff. Even worse we allow rich people and corporations to fund politicians (which is illegal in most civilized countries), to the detriment of most people. The U.S. needs less plutocracy (rule by the rich) and more democracy (rule by the people).
Sorry, this has been on my mind lately. I just learned about how much anarchists are into democracy, and about Switzerland's democracy.
[0] https://en.wikipedia.org/wiki/Anarchists (refer to first sentence)
[1] https://wolf-linder.ch/wp-content/uploads/2010/11/Swiss-poli... (page 4 shows how powers are divided)
I agree with what you say about these decisions being made as a society, and there being disagreements.
I would like to point out that you may misunderstand anarchists. Anarchists understand disagreement over such trade-offs better than most, and work harder than most for compromise and census. Anarchists are fine with large political structures and rules, as long as they are not forced upon anyone. Anarchists prioritize not forcing anything on others [0].
An anarchist might refer to what they have been doing in Switzerland for the last 150 years as a great example of bottom-up direct democracy in action [1], which is basically what political anarchy is. Currently a country of 8.5 million people, Switzerland is split into 26 cantons (they divide into more when needed). Each canton has its own constitution and parliament (averaging ~330k people each). Cantons are divided into municipalities (some large, like Zurich, and some small, with only 2-3k people). A big part of their political culture and the structure of their government is that what can be done locally is done locally, and the people are in charge. People can petition for a vote to not only create new laws and amendments, but to have laws they don't like removed.
Many of the problems in the U.S. are due to the fact that the federal government was never meant to be as involved in our lives as it is (10th amendment, powers default to the states) and was not designed to be responsive to the people (technically states vote for president, not people). So now there are 330 million of us arguing about more and more stuff. Even worse we allow rich people and corporations to fund politicians (which is illegal in most civilized countries), to the detriment of most people. The U.S. needs less plutocracy (rule by the rich) and more democracy (rule by the people).
Sorry, this has been on my mind lately. I just learned about how much anarchists are into democracy, and about Switzerland's democracy.
[0] https://en.wikipedia.org/wiki/Anarchists (refer to first sentence)
[1] https://wolf-linder.ch/wp-content/uploads/2010/11/Swiss-poli... (page 4 shows how powers are divided)
Anarchists prioritize not forcing anything on others
That's pretty much what I meant. Bottom up democracy is one thing, but if people can opt-out of the results of that democratic process then things can fall apart, and an inability to opt out goes against anarchist principals:
Does everyone in a Canton agree? If not, it's rules are still imposed unwillingly on some. Aren't there still rules imposed upon the entire population that each Canton must observe?
Although I admit that was oversimplifying in my prior comment when I characterized anarchism as simply one thing. There are multiple schools of thought, and I suppose that not all of them reject all aspects of the "social contract". They do, however, exist at the extreme end of the balance I mentioned.
That's pretty much what I meant. Bottom up democracy is one thing, but if people can opt-out of the results of that democratic process then things can fall apart, and an inability to opt out goes against anarchist principals:
Does everyone in a Canton agree? If not, it's rules are still imposed unwillingly on some. Aren't there still rules imposed upon the entire population that each Canton must observe?
Although I admit that was oversimplifying in my prior comment when I characterized anarchism as simply one thing. There are multiple schools of thought, and I suppose that not all of them reject all aspects of the "social contract". They do, however, exist at the extreme end of the balance I mentioned.
I'm going to ramble a bit, interesting conversation...
> Bottom up democracy is one thing, but if people can opt-out of the results of that democratic process then things can fall apart, and an inability to opt out goes against anarchist principals?
> Does everyone in a Canton agree? If not, it's rules are still imposed unwillingly on some.
What exactly falls apart? If half the people want to go left, and the other half right, is there something wrong letting them each do their own different thing? Is it so important to be united at scale that people should be forced into something they don't want to do?
It is my understanding that when power originates with the people then municipalities, cantons/states, and federal governments only are invested with powers if enough people in those structures agree. Ideally consensus - nobody vehemently opposed. Otherwise the smaller groups retain their independence. Along these lines the Swiss have the ability to repeal laws via petition/referendum. Like you said before, societies need to figure out for themselves the details of how they handle these things.
The Swiss legislate their social programs at the canton level, each an average size of .3 million people. If you have a problem you can knock on the door of your representative, each answering to a couple thousand people. You might even know that person already.
Compare that to the U.S. where most social programs are legislated at the federal level, involving 330 million people, one representative per 500k+ people. Look at the disaster that is health care in this country, written by industry lobbyists, overriding several new and interesting state plans, passed just barely by one senator who died before the bill was finished, almost repealed by the same margin several years later, still fought over and still a mess.
I don't understand why many in the U.S. think we have to do things at the federal level when the Swiss do the same things in cantons that are the size of U.S. counties or mid-size cities.
There are things the Swiss do at a federal level, like foreign affairs, national highways, nuclear power, etc. I don't know how flexible they are, but if a canton didn't want to participate wouldn't it make sense that the non-participating canton doesn't get the benefits - no federal defence, no highway, or none of the nuclear energy? Is that necessarily a problem? But they agree these are things worth cooperating on, and they do.
David Graeber (democracy/anarchy) and Lepold Khor (bigness problems) influenced my thinking on a lot of this.
> Bottom up democracy is one thing, but if people can opt-out of the results of that democratic process then things can fall apart, and an inability to opt out goes against anarchist principals?
> Does everyone in a Canton agree? If not, it's rules are still imposed unwillingly on some.
What exactly falls apart? If half the people want to go left, and the other half right, is there something wrong letting them each do their own different thing? Is it so important to be united at scale that people should be forced into something they don't want to do?
It is my understanding that when power originates with the people then municipalities, cantons/states, and federal governments only are invested with powers if enough people in those structures agree. Ideally consensus - nobody vehemently opposed. Otherwise the smaller groups retain their independence. Along these lines the Swiss have the ability to repeal laws via petition/referendum. Like you said before, societies need to figure out for themselves the details of how they handle these things.
The Swiss legislate their social programs at the canton level, each an average size of .3 million people. If you have a problem you can knock on the door of your representative, each answering to a couple thousand people. You might even know that person already.
Compare that to the U.S. where most social programs are legislated at the federal level, involving 330 million people, one representative per 500k+ people. Look at the disaster that is health care in this country, written by industry lobbyists, overriding several new and interesting state plans, passed just barely by one senator who died before the bill was finished, almost repealed by the same margin several years later, still fought over and still a mess.
I don't understand why many in the U.S. think we have to do things at the federal level when the Swiss do the same things in cantons that are the size of U.S. counties or mid-size cities.
There are things the Swiss do at a federal level, like foreign affairs, national highways, nuclear power, etc. I don't know how flexible they are, but if a canton didn't want to participate wouldn't it make sense that the non-participating canton doesn't get the benefits - no federal defence, no highway, or none of the nuclear energy? Is that necessarily a problem? But they agree these are things worth cooperating on, and they do.
David Graeber (democracy/anarchy) and Lepold Khor (bigness problems) influenced my thinking on a lot of this.
I modify this instead to, "An increase in Justice leads to a decrease in Freedom; and an increase in Freedom leads to a decrease in Justice."
I really hope this will age like the LifeLock CEO's "I can publish my social security number because LifeLock will protect me" statement, and someone will demonstrate what the CEO has to fear by installing something like the NSO spying toolkit on his devices and publishing the findings.
Which law should we abide by then? Didn't he sell his spyware all over the world?
Number of adults alive on earth who have never infringed on some statute somewhere: 0.
Especially true in nations where the legal system is captured by special interests and routinely weaponised to suppress dissent, coerce minorities, and perpetuate disparities. Which is to say, of course, every nation.
Ergo, you (we) should all be afraid.
Especially true in nations where the legal system is captured by special interests and routinely weaponised to suppress dissent, coerce minorities, and perpetuate disparities. Which is to say, of course, every nation.
Ergo, you (we) should all be afraid.
Every community or country has people who has no moral compass, and will sell anything to anyone as long as they don't end up in prison over it. It's getting clearer and clearer that the NSO management team is this type of people. Israel needs to have a look at fixing their laws.
I'm hard pressed to see that it's in Israel's interest having their industry assisting Marocco spying on the French, or Saudi killing dissident.
I think it’s a bad assumption that most governments would see this as something needing fixing. Even with the current public blowback this will probably just “go away”.
I thought the entire point of the complaint is that it's being used to target journalists and people not breaking any laws.
I'm more interested in the "how" of this. Are these intentional backdoors, and what qualifies this group to be privy to the information flows to exploit them? What sort of connections do they have? Are these backdoors/bugs in the baseband or are they in userspace?
If it's not an intentional backdoor, do they just have vastly superior technical ability? How did they hire such a talented pool of people, able to consistently find remotely exploitable 0days in every major smartphone brand? This group isn't new, they've been around for over a decade doing this. I doubt they've monetized a single exploit for 10 years. They're adapting.
If I had to bet, I'd bet on the former, but I'm curious what everyone else thinks. It just seems unreasonable to me that there exists such a talented pool of exploiters, all aggregated in the same place, able to consistently find 0days that nobody else seems to be able to find.
If it's not an intentional backdoor, do they just have vastly superior technical ability? How did they hire such a talented pool of people, able to consistently find remotely exploitable 0days in every major smartphone brand? This group isn't new, they've been around for over a decade doing this. I doubt they've monetized a single exploit for 10 years. They're adapting.
If I had to bet, I'd bet on the former, but I'm curious what everyone else thinks. It just seems unreasonable to me that there exists such a talented pool of exploiters, all aggregated in the same place, able to consistently find 0days that nobody else seems to be able to find.
My own take is that some exploits initially fall through the cracks in a social way when being triaged or getting somewhat inadequate fixes.
It becomes harder to go back and correct the initial triage. At the same time, some people in the company might be connected to their governments and help that bug stay in the grey zone probably not for the NSO group but maybe for the NSA. (Of course this only applies if the exploit is one the government identified and decided to use offensively and doesn't think is being used in the wild.)
Now when you are examining images as a company updates them, you are reviewing what's notable in the fixes in the very least to know how to attack older OSes. You might happen to have the perspective that understands how the triage was wrong. With enough bugs like this it is inevitable that sometimes you will if you can afford to analyze every fix.
It becomes harder to go back and correct the initial triage. At the same time, some people in the company might be connected to their governments and help that bug stay in the grey zone probably not for the NSO group but maybe for the NSA. (Of course this only applies if the exploit is one the government identified and decided to use offensively and doesn't think is being used in the wild.)
Now when you are examining images as a company updates them, you are reviewing what's notable in the fixes in the very least to know how to attack older OSes. You might happen to have the perspective that understands how the triage was wrong. With enough bugs like this it is inevitable that sometimes you will if you can afford to analyze every fix.
Doesn't the NSO group have a PR department? Because PR should tell him to shut the f*k up for (quite) a while.
So... is he afraid of someone pirating his exploit and using it against him? If he isn't, then he's stupid.
Because that's entirely possible.
There is no such thing as a NOBUS (NObody But US) exploit. Someone else will find it - either your network will get hacked and someone will use the exploit. This is how Wannacry happened. A bunch of NSA-NOBUS exploits got leaked and sold off to people who built a ransomware tool with them. How the leak happens doesn't matter, what matters is the fact that the leak will happen. The only ethical thing to do is to disclose so that the exploit can get fixed.
Because that's entirely possible.
There is no such thing as a NOBUS (NObody But US) exploit. Someone else will find it - either your network will get hacked and someone will use the exploit. This is how Wannacry happened. A bunch of NSA-NOBUS exploits got leaked and sold off to people who built a ransomware tool with them. How the leak happens doesn't matter, what matters is the fact that the leak will happen. The only ethical thing to do is to disclose so that the exploit can get fixed.
NSO is not the problem, secrecy and lack of public awareness are the problem. This scandal is good because it's shining light on the power that governments can wield in the shadows which most people are unaware of.
The solution is to keep shining light and putting pressure on technology makers to improve security, end-to-end encryption, and keeping the power in the hands of individual users. The pressure piece is critical since the natural business incentives to centralize and collect more data make us more vulnerable to centralized surveillance and compromise.
The solution is to keep shining light and putting pressure on technology makers to improve security, end-to-end encryption, and keeping the power in the hands of individual users. The pressure piece is critical since the natural business incentives to centralize and collect more data make us more vulnerable to centralized surveillance and compromise.
It is stupendously difficult to make vuln-free software to the level where actors like NSO are unable to produce exploits. In many ways, we don't even really know how to do it, especially if you as a vendor don't write literally your entire stack. The folks at Google and Apple can rewrite everything in memory safe languages and use the absolute state of the art in static analysis and still fail because some Qualcomm chip in the bluetooth stack has a vuln or because of some side-channel exploit that works around the assumptions of any formalism.
NSO are selling weapons to authoritarian governments who use those weapons to identify and either jail or murder people they don't like. That's bad. End of story.
NSO are selling weapons to authoritarian governments who use those weapons to identify and either jail or murder people they don't like. That's bad. End of story.
The "afraid of" or fear is bad framing. Plenty of (justified) distrust and privacy concerns do not fall into this rhetoric. Not yours to view and judge != it's hidden with bad intent.
This is a distraction. Autocrats make law that lets them do as they please. The reality is that this software was designed and sold to repress protest and democracy movements, both directly and by creating a climate of fear and paranoia around them.
1) the 'nothing to be afraid of' statement is just PR, and nothing else, so not going to dig into that.
2) government has and will always use whatever tools exist, trust Pegasus is 1 out of many...
3) from a realistic standpoint it is up to 'Apple' is anyone to fix this issue from a technical standpoint, there will always be security holes and tools to take advantage of them. Shaming the toolmaker does little.
4) the real solution is the people have to control the government, only in those scenarios can you put 'ethical' constraints on this kinda thing... Those who are in countries where the people don't control the government really have no recourse
2) government has and will always use whatever tools exist, trust Pegasus is 1 out of many...
3) from a realistic standpoint it is up to 'Apple' is anyone to fix this issue from a technical standpoint, there will always be security holes and tools to take advantage of them. Shaming the toolmaker does little.
4) the real solution is the people have to control the government, only in those scenarios can you put 'ethical' constraints on this kinda thing... Those who are in countries where the people don't control the government really have no recourse
> there will always be security holes and tools to take advantage of them. Shaming the toolmaker does little.
And there'll always be ways and weapons to rob banks and kill the clerks,
so selling weapons to bank robbers is fine then, as per that logic
> Those who are in countries where the people don't control the government really have no recourse
They can arrange protests and other things and try to long term change the country to a democracy. And that gets harder and more dangerous, when NSO and others help the dictators track down dissidents.
And there'll always be ways and weapons to rob banks and kill the clerks,
so selling weapons to bank robbers is fine then, as per that logic
> Those who are in countries where the people don't control the government really have no recourse
They can arrange protests and other things and try to long term change the country to a democracy. And that gets harder and more dangerous, when NSO and others help the dictators track down dissidents.
Doesn’t sound very law abiding to me to circumvent courts and procedure to install such spying tools.
[deleted]
Excellent, if that's the case then there is nothing of my business he need know of.
What about laws that are unjust? Should we accept blanket surveillance and the disruption of social movements? Why should we accept a unidirectional concentration of power into a tiny number of hands?
just curious how many anti-NSO group people use amazon ring devices and are just ok with that cause those devices do enough bad things (still many use them)? In the same spirit I think we should start putting pressure on Boeing, Lockheed Martin and other companies because they literally produce mass distraction tools that do way more harm than NSO made tools. IMHO tools that NSO builds can do good and bad depending on what hands control those tools. I am not sure though how exactly NSO can control what its customers do.
Ah looking back on Project Mayhem, perhaps the antisec crowd was right-
https://youtu.be/xDyBIpqZcNI
https://youtu.be/xDyBIpqZcNI
Those guys think we are afraid of them. I wish their private information or those of their families get in the wrong hands, so they can understand what's at stake
>law-abiding citizens have 'nothing to be afraid of'
Though what if they laws are unreasonable? Which quite a few are in dictatorships.
Though what if they laws are unreasonable? Which quite a few are in dictatorships.
If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.
-- Cardinal Richelieu
-- Cardinal Richelieu
Does HE have anything to be afraid of?
No, and that's why they're so transparent about their work.
Maybe now he does…
Yeah in some parts there's no law... law-abiding has no meaning.
Sounds like they're in denial then.
"If You’ve Got Nothing to Hide, You’ve Got Nothing to Fear"
-Eric Schmidt
-Eric Schmidt
Anyone who wears clothes has something to hide.
[deleted]
According to which country's laws?
I thought posting satire on HN was frowned upon.
Irony on HN (especially against the HN crowd) is also frowned upon.
For example, A company that didn't use Kubernetes [0] had their blog knocked down and the HN crowd was jubilant over the matter to recommend them to use K8s for a blog. It's not even their main service offering.
Then 48 hours later [1], major parts of the internet using Akamai went down and the company that previously was 'the joke' was still up. All I suggested was for Akamai to use K8s as well. [2]
I turned the joke on them and got downvoted due to the irony of the situation. Look at the comments in [0] and [1] and you can see the strength of [2] humiliating their short lived victory parade.
[0] https://news.ycombinator.com/item?id=27893482
[1] https://news.ycombinator.com/item?id=27920665
[2] https://news.ycombinator.com/item?id=27920792
For example, A company that didn't use Kubernetes [0] had their blog knocked down and the HN crowd was jubilant over the matter to recommend them to use K8s for a blog. It's not even their main service offering.
Then 48 hours later [1], major parts of the internet using Akamai went down and the company that previously was 'the joke' was still up. All I suggested was for Akamai to use K8s as well. [2]
I turned the joke on them and got downvoted due to the irony of the situation. Look at the comments in [0] and [1] and you can see the strength of [2] humiliating their short lived victory parade.
[0] https://news.ycombinator.com/item?id=27893482
[1] https://news.ycombinator.com/item?id=27920665
[2] https://news.ycombinator.com/item?id=27920792
It's funny to see people with thousands of karma pretend that there is a universal "HN crowd" that shares all opinions in all threads, but that they are of course not part of... That's just not how it works.
Somewhat ironic is that people seem to abhor the surveillance state and authoritarianism but the moment the culprit becomes social media there is an instant emotional reaction to the opposite:
https://news.ycombinator.com/item?id=27941805
https://news.ycombinator.com/item?id=27941805
‘If You’re Not a Criminal, Don’t Be Afraid’– NSO CEO says - https://news.ycombinator.com/item?id=27920055 - July 2021 (48 comments)
Submitters: "Please submit the original source. If a post reports on something found on another site, submit the latter."
https://news.ycombinator.com/newsguidelines.html