7 ms·
How Spy Tech Firms Let Governments See Everything on a Smartphone
- jiqiren 10y agoSickening. This company doesn't seem to have even a basic moral compass. Even when their tools are being used against human rights workers or journalist they have no qualms.
- andrei_says_ 10y agoThis is the disturbing thing about corporations, profit is their moral compass. It takes people with power in the corporate structure to contradict that default.
- dantheman 10y agoNo this is the thing about anything involving people, as soon as you have a group -- the moral . Governments have done horrible things. Researchers have done horrible things. Religious Groups have done horrible things. NonProfits have done horrible things. It's not about profits.
- damptowel 10y agoIt's about motivations, or, in bad cases, necessity. About necessities (like not going bankrupt, or feeding a hungry tribe by claiming the land of your neighbor, etc) I'm not sure much can be done. But I do think it's about profits when it comes to corporations. Shareholders are often relatively passive and in it for the money, they aren't "mission driven" (being the best at one thing in your industry, spearheading a new way of transportation, etc). Their field or artisanship isn't their motivation, the profit is. When you're designing a new engine, you might decide to use 10% more expensive parts to make it 20% more fuel efficient, but this additional cost might result in 10% lower sales, so the board decides against it since exhaust is just an externality. If those people were considered with ecology they might consider a lower rate of profit but instead take pride in the fact that they're helping humanity combat global warming while maintaining the standard of living. It's easier to rationalize away "bad things" when making money is at the top of your value scale. I think it resembles the individualism of our age, people used to be more aware that they were a cog in the machinery of history, no one thinks like that anymore, it's all "be the best you can be" rather than "be the best we can be".
- deleted 10y ago[deleted]
- hackuser 10y ago> It's easier to rationalize away "bad things" when making money is at the top of your value scale. I agree. The purist free market ideology, for lack of a better term (or maybe Objectivism?), is a convenient justification for not dealing with difficult issues. 'The ideology says I can/should only care about money, so I don't need to worry about all that.' If only life were so simple that we could rely on an ideology.
- deleted 10y ago[deleted]
- imtringued 10y agoMaking profit is a good moral compass than not having any. This way corporations only care about how they can make money with the data. They don't care about the data itself which means it's only going to be used for things such as advertising or optimizing the user experience to increase profits. If they can't make money with spying on you then they won't spy at all. A government might not have a moral compass at all. They may start mass surveillance with good intentions like fighting terrorism but when should they stop? Since they have already invested into mass surveillance why stop at terrorism? Why not use it to fight crime in general? Why not use it to enforce every law imaginable? Since we now have data ranging back several years into the past why not use it retroactively enfore laws?
- Chronic9q 10y ago> Even when their tools are being used against human rights workers or journalist they have no qualms. And why should they? If you don't agree with their moral compass, then don't invest or support them. By laws of nature, they will eventually die away if it is unsustainable. However, I'd wager it is highly sustainable hence their continued existence. This has happened throughout all of human history.
- Sone7 10y agoYour logic is terribly wrong. Part, or most, of what makes the use of these tools against human rights workers and journalists unsustainable is the outrage by us. Try applying your same logic to people who murder journalists in order to maintain a deceptive narrative. Should we avoid having any qualms about that too?
- EliRivers 10y agoSo we should let bad things happen if someone can build a business out of it? This is, sadly, a not uncommon view around here; if the "free market" wills it, is it right.
- venomsnake 10y agoI think they are highly moral - they deliver, honor their contracts, have very good support and have very good reputation. They also follow the laws of their land. What UAE sovereign does in its own territory is his own business. It is not the other parties' job to interfere in its internal dealings.
- pipio21 10y agoWhy should they have moral compasses? Like it will make any difference. There are people in the military that will go to church and then invade a country like Lybia or Syria for their oil or gas while believing they are doing good for humanity. We need less moral compasses and more accountancy, checks and balances of the people in power. It should never be about self control, but controls in the institutions.
- 3pt14159 10y agoIt will make a difference. The world is the way it is because of what people believe and how they act. The more people that eschew evil the less people that get damaged. That being said, recovery software I'd put at a neutral on the good - evil spectrum. Like guns, the impact is negative only in the wrong hands.
- damptowel 10y agoWhenever I read articles like this these days, I just throw my hands in the air and sigh, thinking about how tainted IT has become. Any tech can be weaponized, but the scale of it feels utterly demoralizing to me. What's the way out? Become less connected? Go back to fixed function hardware? Is there even a way out without shedding layers of abstraction? Is there even a way out at all, or is this our new brave new world?
- IANAD 10y ago> Go back to fixed function hardware? Battlestar Galactica phones? No, but I think we will eventually go to peer-based mesh networks with smarter clients. The reasons are: 1. Mobile devices keep getting faster and have more memory- they aren't and shouldn't be dumbed-down clients peddled by telecom companies to get them to buy their services. 2. People don't want to pay for things they shouldn't have to, like interconnectivity, if there are enough devices for everyone to pull off the network without help.
- zer0gravity 10y agoI suppose there will be a class of people, probably techies/hackers, that will build/use technologies that will protect their privacy. I wish there were communities similar to the one around linux do develop these technologies. However, we can't think about anything digital nowadays without factoring in AI, the problem is that once you do that, things become quite unpredictable... For certain, there will be a fight, on one side governments ans control structures trying to increase their control, and on the other regular citizens trying to live the way they once did.. althogh.. that may already be impossible..
- wepple 10y agoTo play devils advocate: who's not to say that these tools weren't sold under the pretense of being used against criminals, only to have them turned at humans rights activists instead? For the record, I do not believe that at all. But it hasn't been ruled out.
- jiqiren 10y agoThe article included the response of direct questions to said company about these violations. They refused to say it was wrong or violated their internal ethics policy. Additionally, they just repeated no laws were broken. There is no playing devils advocate here. They clearly don't care about what happened in Mexico or middle-east.
- feelix 10y agoI wrote some really effective data recovery software a decade ago. Before I knew it governments around the world were buying it up in droves. I then got pushed (not by the governments, but by my partner at the company I had) to write a special forensics edition, that does a byte-by-byte scan of the source disk rather than a block-by-block scan, which would extract embedded files out of a hard disk and basically ensure that nothing would be missed. That code eventually got a big fancy "forensics" UI wrapped around it with a bunch of other functionality such as logging the process, and it got sold for $1k / copy. It would sell upwards of 80 copies at a time in a single batch. It was very profitable (though I personally did not see much of that profit). I always felt very uneasy about it and I stopped developing that line of software even though at this point I could get ~50% of the profit if I were to continue it. I had no idea what it was actually being used for all of the time and I had no way to find out. I do know however that some of the time it was used for good, to catch people distributing child pornography and so forth, however I don't know what percentage of the time it was used for that kind of thing, and I'm also aware that that is the justification that is used for a lot of surveillance. Philosophically I believe in counter-survelliance more than surveillance, because I'm pro privacy and pro citizen empowerment rather than the other way around, I think the balance of power has gotten out of whack as this article nicely illustrates.
- imaginenore 10y agoYou shouldn't feel bad. If something like that is technically possible, and there's a demand, someone will write that code. The only two ways to fight it (that I can think of) are: 1) Make it technically impossible (open firmware, open hardware) 2) Make it illegal There's of course a third way - not give a crap, and just let them watch you.
- deleted 10y ago[deleted]
- jacquesm 10y ago> If something like that is technically possible, and there's a demand, someone will write that code. That isn't necessarily true, though it's an easy fig leaf to hide behind when you're doing something that is unique and that helps the dark side. I've heard it said by people that were actively developing malware and spam software.
- bojo 10y agoThe moral issue aside, I can't even begin to fathom how their software would even work. How do you stealth install software to a random phone out in the wild? Social engineering, or purely technical?
- urza 10y agoI dont know about other devices, but it is possible to remotely and silently install software to android. You need your google account password for that, but I suppose they have some 0days for that..
- c22 10y agoYou compel the cellco to load it through a backdoor in the baseband processor?
- nyolfen 10y agoiirc, the method they got caught using was an unsolicited sms with a link to a page with a mobile safari/webkit 0day that silently installed a jailbreak
- McKayDavis 10y agoThe linked NYTimes article references 3 exploits dubbed the "Trident Exploit Chain" that are detailed in an excellent Lookout / Citizen Lab writeup [1] discussed on HN 8 days ago [2]. The target is sent an SMS containing a link to site that triggers the explot chain to remotely jailbreak the phone and clandestinely install the monitoring software. Ahmed Mansoor, a UAE journalist, was recently targeted with one of these SMS messages and was immediately suspicious. Instead of clicking the link he contacted Citizen Lab researchers who connected it back to NSO group. [1] https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ https://citizenlab.org/2016/08/million-dollar-dissident-ipho... [2] https://news.ycombinator.com/item?id=12360662 https://news.ycombinator.com/item?id=12360662
- SturgeonsLaw 10y agoAnyone else think it's a bit of a joke that a $1M+ bug still relies on the user clicking a phishing sms to work?
- urza 10y agoWe need protection against governments. They are the mafia of today's world.
- lifeisstillgood 10y agoIronically studies of mafia show that they win by providing government services to those without. Anarchy is desirable by no one and when government a not reach then we turn to any strongman to bring order and predictability - it is the essential definition of government. Don't blame governments for being mafia, blame us for not forcing them to behave. We need a public debate on the meaning of privacy and the ownership of personal computing.
- indymike 10y agoThere is a school of thought in political science that government is simply the big, legitimate mafia.
- cryoshon 10y ago(responding to the school of thought you are referencing) "might makes right" school of political realism never made sense for me in a domestic context. the relationship of the state to the citizen at the citizen's birth is completely one directional: the state provides infrastructure, security, and economic activity while expecting nothing in return until much later in a person's life-- and if the person doesn't ever proffer anything in return to the state, that doesn't guarantee violence against the individual, nor exclusion from services. if the platonic form of a state were that it has to be a mafia of sorts reliant on the threat of physical force, it'd quickly go extinct for lack of younger replacements. can't have the young replacing the old if they never make it to middle age due to a lack of investment and all. that being said, the current governments of the west do have plenty of similarities with the various mafias... but in my opinion the issue of runaway government is a failure mode resulting from particular circumstances rather than a problem of government in the abstract.
- hackuser 10y ago
- gggggggg 10y agoI you were high profile it would be a good reason for a dumb phone or a lesser known smartphone.
- praptak 10y agoLesser known is actually worse. Less work by the community on removing security holes vs an attacker who can concentrate efforts. Not that it matters - high profile should not use any kind of phone for anything serious.
- applecore 10y agoThe most secure option would be not to carry a mobile phone at all. Otherwise, iOS is probably the most secure mobile operating system, simply based on the price of remote exploits: a remote exploit for iOS is worth several times more ($500K-1M) than the equivalent one for Android ($100K-200K).
- awqrre 10y agothat seems like a small difference in cost for high value data...
- wepple 10y agodumb phones generally don't have the capability to do end-to-end crypto or full disk encryption and other desirable things.
- soufron 10y agoIs it me, or is the NYT suggesting that they have been victims of this Pegasus system?