9 ms·

Governments Turn to Commercial Spyware to Intimidate Dissidents

160 points by hvo 10y ago

ccvannorman 10y ago
But if we outlaw spyware, only outlaws will utilize spyware!
- arca_vorago 10y ago
  Edit: op explained his intentions in comment below.
  - ccvannorman 10y ago
    Apparently my point was too obtuse. What I am trying to say is that most surveillance is done legally, or just outside the lines enough to be forgiven by the blue line (in whatever country). My presumption is that the populous (us) _should be voting for spying like this to simply be illegal_, which is a topic that hardly ever comes up. Let me try again: Spying from government to its citizens should be flatly illegal, and until we demand as much, we are failing our own democratic system and sliding per notch into turnkey totalitarianism.* *not intended as hyperbole -- we are a long way from it, but the notches are undeniable
    - justratsinacoat 10y ago
      A solid point; would that more people thought like you. One minor grammar-nazi nitpick, though: "populous" is an adjective describing the size of a population; "populace" is a noun describing the population itself.
    - arca_vorago 10y ago
      Hey, I really appreciate the elaboration, and I think I am in agreement with you on this point. I have to admit perhaps it was a bit over the top because I thought you were sarcastically using the pro rights gun statement and somehow trying to apply it to this topic.
    - alanwatts 10y ago
      Relying simply on voting and politicians to solve the problem of mass surveillance is just passing the buck. The problem is more technical than political. It is a problem of internet architecture and design which must be addressed from within by technologists. Currently, only a handful of ISPs and Internet Gatekeepers (i.e. Google, Facebook) have ultimate control over the majority of information flow. If all you have to do is tap a few wires at key choke points (i.e. Room 641a) or hack into a server at FB or Google to own billions of users then that is like marching rank and file into machine gun fire on a global scale.
- maerF0x0 10y ago
  This argument seems the same as the firearms argument. ie If we outlaw firearms then only criminals (and police) will have firearms.
geomark 10y ago
The Middle East gets the headlines on this topic. But it's happening other places, too. https://news.ycombinator.com/item?id=11801325 https://news.ycombinator.com/item?id=11801325
- deleted 10y ago
  [deleted]
- ilaksh 10y ago
  But _of course_ nothing like that ever happens in the United States or any of our close allies. Because this country is the exception to everything bad that has happened in _other_ countries and nothing that bad could ever be done by our government. We don't have dissidents in the US. We just have freedom and truth all the way through that we sometimes need to carefully spread to other countries.
zby 10y ago
I guess this is not a surprise to anyone here. The techniques are well known and cheap. Now the question is - what can we do? We probably cannot get privacy back when there are internet connected sensors everywhere. The data is there and governments will find a way to get it. On the other hand it seems that for some time the world power have been becoming more and more fragile and limited: http://moisesnaim.com/books/the-end-of-power/ http://moisesnaim.com/books/the-end-of-power/. Has the tide turned now? Or maybe we are heading back to some kind of village life - where everyone knows about everyone so there are no such imbalances as we have today?
- JoeAltmaier 10y ago
  Yes something like that. Because once sensors are connected everywhere, it isn't the government that you have to worry about. Because everybody will be able to get the data. And it will be used ruthlessly by individuals for personal gain. At least with the government, you have some hope that it will be regulated and reined in. Not so with the mafia etc.
- walrus01 10y ago
  What can we do? Get activist types to stop using Windows. That removes about 99% of the attack surface. I'd like to see the UAE successfully remote root a desktop running debian-testing amd64 and an xorg/xfce desktop. Yes, there's myriad security problems with Firefox and other things.... But every single state-paid RAT tool ivr seen is targeted at Windows. education is important too. If you can successfully trick people into running a binary you gave them with sudo (or the equivalent) all bets are off.
whyagaindavid 10y ago
do people developing such spyware ever read hn? May be time to bring a ethics promise to software development!
- MasterScrat 10y ago
  Don't most schools have a code of moral conduct to sign before graduation?
  - pascalmemories 10y ago
    That's the beauty of paper - it allows anything to be put on it but does absolutely nothing to actually make you do whatever you promised. Those promises are, quite literally, not worth the paper they are written on. If a Government (or TLA or whoever in power) wants some Evil Thing, a piece of paper from somewhere promising not to do Evil Things will not be a hindrance to either asking [or, depending on where, compelling] you to take part. If you have the option to decline, they will keep asking people (and increasing the financial reward) until someone agrees.
  - esbranson 10y ago
    Why would that matter?
  - krapp 10y ago
    Wouldn't many programmers object to being coerced into signing a "code of moral conduct" to begin with?
    - chillingeffect 10y ago
      Without a broader background, programmers don't all understand the implications of their actions... Doctors are generally quite proud to be take part in the Hippocratic oath which connects their actions to something much larger thsn themselves
- forgottenpass 10y ago
  do people developing such spyware ever read hn? May be time to bring a ethics promise to software development! I think the field of software, writ large, is already too morally bankrupt for any system of ethics to take hold. People have a hard time seeing the evil in their products, and their possible unintended uses. Or they do, and don't think it's bad enough to forgo getting paid for it. Even if you don't agree with the reasons, it's not hard to imagine what developers at Fin Fisher or Hacking Team told themselves to sleep well at night. Easy example: they might think they're doing a moral positive by focusing on the use cases of western governments in taking down organized crime. So forget about the Hacking Teams of the world. Look closer to home. We're wrestling control over computing systems further and further out of the end user's grasp, monitoring them more pervasively, and processing that data like never before. We're building digital toys to fill people's leisure time up with digital junk food in hopes of monetizing them. And if the dollars don't come quick enough, we turn to "gamification" (read: psychological manipulation). Sure, there is a difference of scale. But it's not a difference in kind. We may think it should be legal to insult the Emirate rulers. But that doesn't matter. The point is, they thought they were justified. Just like we think we're justified. All the way down to highlighting false choices so we can tell ourselves the victims did it to themselves.
JustUhThought 10y ago
Do other HN readers find themselves on the receiving end of ridicule by their fam & friends for taking this privacy stuff seriously? I'm constantly being told I'm unreasonably worried, borderline tin-hat wearing paranoid, for being concerned by the surveillance capabilities built into our modern consumer electronics which are available to governments and business alike. But if someone my parents know have their identity stolen by stealing credit card bills and applications from their mailbox and then find themselves on the hook for $30,000 in fraudulent charges, well then it's all my parents talk about for the next 2 days. That I understand the technology and they do not, seems to keep them from taking the issue seriously.
- mtgx 10y ago
  In a way, it's for the same reason people don't think EVs or solar power will dominate. They look too much at what is currently happening or has happened in the (recent) past, and think that's how things will always be. The HN types tend to be more informed about what's currently possible with technology and have a better understanding of where this can lead to in the future. "Normal" people don't have that going for them, so for them it's "strange" that you would say such things.
  - rdiddly 10y ago
    Not a good example, because the actual barriers to EVs and solar power are that they depend too _much_ on what's happening now, i.e. existing fossil-fuel-powered industrial infrastructure.
- jon_richards 10y ago
  Yup. I told some people about Facebook's silent background audio and the CIA's fake phone shutdowns. I felt like I was telling them about government mind control programs.
  - nyolfen 10y ago
    >CIA's fake phone shutdowns Can you expand on this?
jcoffland 10y ago
"In many cases these tools are able to circumvent security measures like encryption." To me this quote from the article, with out any qualification is just fear mongering. People need to know that strong crypto, when implemented correctly does work. I recently tried to get a number of my friends to install Signal on their phones. I was quite surprised that most of them, even the technically minded ones, refused to install it. Their reasons ranged from not trusting the software to worrying that using it would draw government attention. And this in California. Encrypted SMS, email and phone calls should have been standard tech from the beginning. Everyone should use crypto in their day-to-day lives, not because they have something to hide, but so that free speech and privacy are protected.
- alanwatts 10y ago
  >People need to know that strong crypto, when implemented correctly does work. *Assuming the end points have 0 vulnerabilities, which is the elephant in the room.
- roywiggins 10y ago
  Strong crypto doesn't help at all if you have the sort of spyware discussed in the article installed on your computer. It knows everything you do.
- djrogers 10y ago
  What good is strong crypto if your endpoint is compromised? If I can take screenshots and keystroke logs of you in Signal, all the crypto in the world won't help. That's the kind of spyware this article is talking about - full endpoint compromise.
  - jcoffland 10y ago
    Of course, but just because my car could get stolen in my garage does not mean I'm not going to lock it when I go downtown. Strong crypto can protect your data while it's in transit and people should use it, try to break it and make it better.
- rsync 10y ago
Dwolb 10y ago
My friend worked for / with the government on city surveilance for a short stint after his time with the army. He described an example of his work as follows: An activism group was meeting in a city center and was to walk to another part of the city for a demonstration. My friend's team had video surveilance feeds all over the city to track the activism group as they walked from their meeting place to the demonstration. As the group began to walk, my friend's team was able to delay the group with Don't Walk signals. The delay was long enough for a police barricade to permanently get in the activism group's way and stop the demonstration for the day. I may have some of the details wrong or his recount may not have fully been 100% honest, but it feels as this situation is very achievable with current technology. The most worrying piece of this story is the activists are not being confronted with a human who can talk to them. They're being thwarted by a faceless group without the chance ever discuss their reasons for demonstrating. The government in this situation was able to get what they wanted in the near term, but at the expense of frustration of their citizens in the long term.
- dTal 10y ago
  In that particular story, I'd say the level of centralised power evidenced by the ability to manipulate individual traffic signals is as frightening as the quantity of information fed into it. That's not just surveillance, that's top-down control of the functioning of a city.
  - tdkl 10y ago
    From technological standpoint it's not that big of a deal. But from civil rights it's horrible, if it was a reported demonstration and the demonstrators were calm.
  - sliverstorm 10y ago
    Modern traffic systems are managed by a centralized hub these days. For example of why, suppose a major accident on a major road. The system can adjust light patterns to help route traffic around the accident, keeping the roads operating as sanely as possible.
kosherkowboy 10y ago
Compounding this injustice is the fact that the executors of this surveillance are private contractors, not a wing of the government. What's worse, these cyber mercenaries, such as Hacking Team, are contracted out by the individual ruling families of the Emirates. The abundance of technology is making the blending of sovereign and personal power extraordinarily dangerous. The voice of the demos is totally absent from all of this. Which is why modern autocracies are more dangerous than they ever have been. Bereft of popular sovereignty, nations stand poised to allow powerful individuals to agglomerate a huge arsenal for the holding and maintaining of power. We in America need to do a better job of exercising whatever power we have in order to forestall the creeping technologically based grip on our freedoms.

160 points by hvo 10y ago

ccvannorman 10y ago

But if we outlaw spyware, only outlaws will utilize spyware!

arca_vorago 10y ago
Edit: op explained his intentions in comment below.
- ccvannorman 10y ago
  Apparently my point was too obtuse. What I am trying to say is that most surveillance is done legally, or just outside the lines enough to be forgiven by the blue line (in whatever country). My presumption is that the populous (us) _should be voting for spying like this to simply be illegal_, which is a topic that hardly ever comes up. Let me try again: Spying from government to its citizens should be flatly illegal, and until we demand as much, we are failing our own democratic system and sliding per notch into turnkey totalitarianism.* *not intended as hyperbole -- we are a long way from it, but the notches are undeniable
  - justratsinacoat 10y ago
    A solid point; would that more people thought like you. One minor grammar-nazi nitpick, though: "populous" is an adjective describing the size of a population; "populace" is a noun describing the population itself.
  - arca_vorago 10y ago
    Hey, I really appreciate the elaboration, and I think I am in agreement with you on this point. I have to admit perhaps it was a bit over the top because I thought you were sarcastically using the pro rights gun statement and somehow trying to apply it to this topic.
  - alanwatts 10y ago
    Relying simply on voting and politicians to solve the problem of mass surveillance is just passing the buck. The problem is more technical than political. It is a problem of internet architecture and design which must be addressed from within by technologists. Currently, only a handful of ISPs and Internet Gatekeepers (i.e. Google, Facebook) have ultimate control over the majority of information flow. If all you have to do is tap a few wires at key choke points (i.e. Room 641a) or hack into a server at FB or Google to own billions of users then that is like marching rank and file into machine gun fire on a global scale.
maerF0x0 10y ago
This argument seems the same as the firearms argument. ie If we outlaw firearms then only criminals (and police) will have firearms.

geomark 10y ago

The Middle East gets the headlines on this topic. But it's happening other places, too. https://news.ycombinator.com/item?id=11801325 https://news.ycombinator.com/item?id=11801325

deleted 10y ago
[deleted]
ilaksh 10y ago
But _of course_ nothing like that ever happens in the United States or any of our close allies. Because this country is the exception to everything bad that has happened in _other_ countries and nothing that bad could ever be done by our government. We don't have dissidents in the US. We just have freedom and truth all the way through that we sometimes need to carefully spread to other countries.

zby 10y ago

I guess this is not a surprise to anyone here. The techniques are well known and cheap. Now the question is - what can we do? We probably cannot get privacy back when there are internet connected sensors everywhere. The data is there and governments will find a way to get it. On the other hand it seems that for some time the world power have been becoming more and more fragile and limited: http://moisesnaim.com/books/the-end-of-power/ http://moisesnaim.com/books/the-end-of-power/. Has the tide turned now? Or maybe we are heading back to some kind of village life - where everyone knows about everyone so there are no such imbalances as we have today?

JoeAltmaier 10y ago
Yes something like that. Because once sensors are connected everywhere, it isn't the government that you have to worry about. Because everybody will be able to get the data. And it will be used ruthlessly by individuals for personal gain. At least with the government, you have some hope that it will be regulated and reined in. Not so with the mafia etc.
walrus01 10y ago
What can we do? Get activist types to stop using Windows. That removes about 99% of the attack surface. I'd like to see the UAE successfully remote root a desktop running debian-testing amd64 and an xorg/xfce desktop. Yes, there's myriad security problems with Firefox and other things.... But every single state-paid RAT tool ivr seen is targeted at Windows. education is important too. If you can successfully trick people into running a binary you gave them with sudo (or the equivalent) all bets are off.

whyagaindavid 10y ago

do people developing such spyware ever read hn? May be time to bring a ethics promise to software development!

MasterScrat 10y ago
Don't most schools have a code of moral conduct to sign before graduation?
- pascalmemories 10y ago
  That's the beauty of paper - it allows anything to be put on it but does absolutely nothing to actually make you do whatever you promised. Those promises are, quite literally, not worth the paper they are written on. If a Government (or TLA or whoever in power) wants some Evil Thing, a piece of paper from somewhere promising not to do Evil Things will not be a hindrance to either asking [or, depending on where, compelling] you to take part. If you have the option to decline, they will keep asking people (and increasing the financial reward) until someone agrees.
- esbranson 10y ago
  Why would that matter?
- krapp 10y ago
  Wouldn't many programmers object to being coerced into signing a "code of moral conduct" to begin with?
  - chillingeffect 10y ago
    Without a broader background, programmers don't all understand the implications of their actions... Doctors are generally quite proud to be take part in the Hippocratic oath which connects their actions to something much larger thsn themselves
forgottenpass 10y ago
do people developing such spyware ever read hn? May be time to bring a ethics promise to software development! I think the field of software, writ large, is already too morally bankrupt for any system of ethics to take hold. People have a hard time seeing the evil in their products, and their possible unintended uses. Or they do, and don't think it's bad enough to forgo getting paid for it. Even if you don't agree with the reasons, it's not hard to imagine what developers at Fin Fisher or Hacking Team told themselves to sleep well at night. Easy example: they might think they're doing a moral positive by focusing on the use cases of western governments in taking down organized crime. So forget about the Hacking Teams of the world. Look closer to home. We're wrestling control over computing systems further and further out of the end user's grasp, monitoring them more pervasively, and processing that data like never before. We're building digital toys to fill people's leisure time up with digital junk food in hopes of monetizing them. And if the dollars don't come quick enough, we turn to "gamification" (read: psychological manipulation). Sure, there is a difference of scale. But it's not a difference in kind. We may think it should be legal to insult the Emirate rulers. But that doesn't matter. The point is, they thought they were justified. Just like we think we're justified. All the way down to highlighting false choices so we can tell ourselves the victims did it to themselves.

JustUhThought 10y ago

Do other HN readers find themselves on the receiving end of ridicule by their fam & friends for taking this privacy stuff seriously? I'm constantly being told I'm unreasonably worried, borderline tin-hat wearing paranoid, for being concerned by the surveillance capabilities built into our modern consumer electronics which are available to governments and business alike. But if someone my parents know have their identity stolen by stealing credit card bills and applications from their mailbox and then find themselves on the hook for $30,000 in fraudulent charges, well then it's all my parents talk about for the next 2 days. That I understand the technology and they do not, seems to keep them from taking the issue seriously.

mtgx 10y ago
In a way, it's for the same reason people don't think EVs or solar power will dominate. They look too much at what is currently happening or has happened in the (recent) past, and think that's how things will always be. The HN types tend to be more informed about what's currently possible with technology and have a better understanding of where this can lead to in the future. "Normal" people don't have that going for them, so for them it's "strange" that you would say such things.
- rdiddly 10y ago
  Not a good example, because the actual barriers to EVs and solar power are that they depend too _much_ on what's happening now, i.e. existing fossil-fuel-powered industrial infrastructure.
jon_richards 10y ago
Yup. I told some people about Facebook's silent background audio and the CIA's fake phone shutdowns. I felt like I was telling them about government mind control programs.
- nyolfen 10y ago
  >CIA's fake phone shutdowns Can you expand on this?

jcoffland 10y ago

"In many cases these tools are able to circumvent security measures like encryption." To me this quote from the article, with out any qualification is just fear mongering. People need to know that strong crypto, when implemented correctly does work. I recently tried to get a number of my friends to install Signal on their phones. I was quite surprised that most of them, even the technically minded ones, refused to install it. Their reasons ranged from not trusting the software to worrying that using it would draw government attention. And this in California. Encrypted SMS, email and phone calls should have been standard tech from the beginning. Everyone should use crypto in their day-to-day lives, not because they have something to hide, but so that free speech and privacy are protected.

alanwatts 10y ago
>People need to know that strong crypto, when implemented correctly does work. *Assuming the end points have 0 vulnerabilities, which is the elephant in the room.
roywiggins 10y ago
Strong crypto doesn't help at all if you have the sort of spyware discussed in the article installed on your computer. It knows everything you do.
djrogers 10y ago
What good is strong crypto if your endpoint is compromised? If I can take screenshots and keystroke logs of you in Signal, all the crypto in the world won't help. That's the kind of spyware this article is talking about - full endpoint compromise.
- jcoffland 10y ago
  Of course, but just because my car could get stolen in my garage does not mean I'm not going to lock it when I go downtown. Strong crypto can protect your data while it's in transit and people should use it, try to break it and make it better.
rsync 10y ago

Dwolb 10y ago

My friend worked for / with the government on city surveilance for a short stint after his time with the army. He described an example of his work as follows: An activism group was meeting in a city center and was to walk to another part of the city for a demonstration. My friend's team had video surveilance feeds all over the city to track the activism group as they walked from their meeting place to the demonstration. As the group began to walk, my friend's team was able to delay the group with Don't Walk signals. The delay was long enough for a police barricade to permanently get in the activism group's way and stop the demonstration for the day. I may have some of the details wrong or his recount may not have fully been 100% honest, but it feels as this situation is very achievable with current technology. The most worrying piece of this story is the activists are not being confronted with a human who can talk to them. They're being thwarted by a faceless group without the chance ever discuss their reasons for demonstrating. The government in this situation was able to get what they wanted in the near term, but at the expense of frustration of their citizens in the long term.

dTal 10y ago
In that particular story, I'd say the level of centralised power evidenced by the ability to manipulate individual traffic signals is as frightening as the quantity of information fed into it. That's not just surveillance, that's top-down control of the functioning of a city.
- tdkl 10y ago
  From technological standpoint it's not that big of a deal. But from civil rights it's horrible, if it was a reported demonstration and the demonstrators were calm.
- sliverstorm 10y ago
  Modern traffic systems are managed by a centralized hub these days. For example of why, suppose a major accident on a major road. The system can adjust light patterns to help route traffic around the accident, keeping the roads operating as sanely as possible.

kosherkowboy 10y ago

Compounding this injustice is the fact that the executors of this surveillance are private contractors, not a wing of the government. What's worse, these cyber mercenaries, such as Hacking Team, are contracted out by the individual ruling families of the Emirates. The abundance of technology is making the blending of sovereign and personal power extraordinarily dangerous. The voice of the demos is totally absent from all of this. Which is why modern autocracies are more dangerous than they ever have been. Bereft of popular sovereignty, nations stand poised to allow powerful individuals to agglomerate a huge arsenal for the holding and maintaining of power. We in America need to do a better job of exercising whatever power we have in order to forestall the creeping technologically based grip on our freedoms.