7 ms·

>[NSO Group] claims to sell its spyware only to law enforcement agencies to track terrorists, criminals and drug lords >An NSO spokesman reiterated those restr

>[NSO Group] claims to sell its spyware only to law enforcement agencies to track terrorists, criminals and drug lords >An NSO spokesman reiterated those restrictions in a statement Thursday, and said the company had no knowledge of the tracking of health researchers and advocates inside Mexico >NSO executives point to technical safeguards that prevent clients from sharing its spy tools. Of the above only two can be true. My bet is they sell to anyone who can pay.

hxegon 10y ago
Unless someone circumvented the safeguards, but I don't really know enough to say how likely that is.
- colemannugent 10y ago
  I would imagine that if someone had the ability to defeat their safeguards they would have the ability to recreate the tools themselves. At this level, these tools are more weapons than software. All the client wants is an end, they could care less about the means.
  - marcoperaza 10y ago
    >I would imagine that if someone had the ability to defeat their safeguards they would have the ability to recreate the tools themselves. Why would you imagine that? People circumvent the DRM on Photoshop, Windows, and lots of other complex software all the time. They most certainly don't have the ability--time, money, expertise, and workforce--to recreate those products.
  - eecc 10y ago
    You're assuming the safeguard is not a startup nag screen asking whether you are a legally authorized user of the app. Something like those idiotic questionnaires you get to fill when flying to the USA
patsplat 10y ago
Not really. The client may not be sharing its spy tools but is very likely lying about how organizations are being classified as terrorists. This is about the law enforcement agency, not the arms dealer.
- tn13 10y ago
  Plenty of stories out there how completely normal individuals are targeted as terrorists. Example: http://www.mercurynews.com/2014/01/14/no-fly-list-challenged-stanford-student-wrongly-labeled-a-terrorist-judge-says/ http://www.mercurynews.com/2014/01/14/no-fly-list-challenged...
- ChuckMcM 10y ago
  Two most common misleading statements by law enforcement these days: 1) They were resisting arrest. 2) They are terrorists. Makes it hard to find cases where there are actual terrorists or people actually resisting arrest.
  - Natsu 10y ago
    It's not easy to tell who is who unless they investigate, so they end up investigating the innocent as well as the guilty. Take the inauguration, there were so many peaceful protesters, coupled with a few idiots who chose to be violent, like this guy, who was charged in a plot to attack people by dumping acid into a ventilation system at an inaugural party: https://mpdc.dc.gov/release/arrest-made-conspiracy-commit-assault https://mpdc.dc.gov/release/arrest-made-conspiracy-commit-as...
    - forgotmysn 10y ago
      I feel like that distinction isn't as hard as you're making it sound
      - Natsu 10y ago
        I'm sure there are what appear to be clear-cut cases, especially in retrospect. I'm also sure that all of our 99% accurate heuristics we use in daily life will fail spectacularly on some minority of cases when applied 100,000 times.
tn13 10y ago
> claims to sell its spyware only to law enforcement agencies to track terrorists, criminals and drug lords Once you sell how can you control where it is used ?
- TACIXAT 10y ago
  EULA, because everyone knows clicking I Agree is like taking a blood oath. That's actually an interesting problem, if a company licenses software to someone and they use it maliciously, can the parent company be held responsible in some way because it was licensed?
  - tn13 10y ago
    I am not sure if law enforcement agencies actually give a damn about EULA. They dont give a flying F about constitution and bill of rights on regular basis I find it hard to believe they actually give much damn about EULA especially when they are the only customer that company has.
  - staticautomatic 10y ago
    It's highly unlikely that the company could be sued because the EULA would almost certainly have an indemnity clause covering that scenario.
Someone1234 10y ago
Governments often classify protest groups as "terrorists." The UK government has spent millions investigating non-violent environmental groups for one example, using anti-terrorism funds, teams, and laws to do so. Companies asking the government to squish protestors is also extremely common all around the world. I mean in the US right now we have oil pipelines which primarily benefit private companies getting built by the Army Corps of Engineers using public money and protesters harassed & beaten by police. All to reduce an oil company's costs and/or increase their profit margins.
- gydfi 10y ago
  >Governments often classify protest groups as "terrorists." And many terrorist groups claim merely to be "protestors" so it's tricky.
- toomanybeersies 10y ago
  Isn't the land simply the property of the Army Corps of Engineers, and it's being built by a private company? The USACE is a weird organisation. It's part of the US army, but almost exclusively does domestic civil engineering and public works.
  - Retric 10y ago
    First, finding useful things to do with all those military people outside of wartime is a major issue especially when they need to suddenly stop doing that during a war. Second, a lot of civil infrastructure has military implications. EX: It's hard to make a dam you can't take out with explosives, but you can do a lot of things down stream to make destroying it less important. So, as a bonus it keeps the organization's skills up to date.
  - omegaworks 10y ago
    The land was illegally annexed by the government. The Sioux signed a treaty that was broken by the US, were offered money in compensation for the land, which they refused. That land abuts the reservation's surface water sources. Without it they have no water security, an asset they consider priceless. The ownership remains contentious.
Crosseye_Jack 10y ago
Maybe 2.5 of those are true >[NSO Group] claims to sell its spyware only to law enforcement agencies to track terrorists, criminals and drug lords >An NSO spokesman reiterated those restrictions in a statement Thursday, and said the company had no knowledge of the tracking of health researchers and advocates inside Mexico >NSO executives point to technical safeguards that prevent clients from sharing its spy tools. LE says to NSO that this infection will be used on a track terrorists, criminals and drug lords by ticking the "We will only send this to infect terrorists, criminals and drug lords" checkbox, NSO gen's the unique link that needs to be visited to infect the device and then either LE or NSO send the target the text. In other discovered 0days the servers the links where pointing to were in control of the group selling the hacks and no LE. My bet is a part of the "controls" they have inplace is not actually handing over the exploits, but offering an "exploit as a service". Ofcause that doesn't stop LE saying "Gen link for number X, number X belongs to a bad guy..." and number X being a device belonging to their own tech teams to reverse the exploit and then they create their own.
chatterbeak 10y ago
I have no reason not to believe NSO. I don't think they have anything to do with this. People here love to blame them for everything, even when its nothing but random speculation.
megablast 10y ago
> claims to sell its spyware only to law enforcement agencies to track terrorists, criminals and drug lords How would they even know, whether the people targeting are terrorists, crims or lords? That is a ridiculous statement. Maybe they have a form that governments must sign saying that the gov will only target those people, but it is a ridiculous statement.

hxegon 10y ago

Unless someone circumvented the safeguards, but I don't really know enough to say how likely that is.

colemannugent 10y ago
I would imagine that if someone had the ability to defeat their safeguards they would have the ability to recreate the tools themselves. At this level, these tools are more weapons than software. All the client wants is an end, they could care less about the means.
- marcoperaza 10y ago
  >I would imagine that if someone had the ability to defeat their safeguards they would have the ability to recreate the tools themselves. Why would you imagine that? People circumvent the DRM on Photoshop, Windows, and lots of other complex software all the time. They most certainly don't have the ability--time, money, expertise, and workforce--to recreate those products.
- eecc 10y ago
  You're assuming the safeguard is not a startup nag screen asking whether you are a legally authorized user of the app. Something like those idiotic questionnaires you get to fill when flying to the USA

patsplat 10y ago

Not really. The client may not be sharing its spy tools but is very likely lying about how organizations are being classified as terrorists. This is about the law enforcement agency, not the arms dealer.

tn13 10y ago
Plenty of stories out there how completely normal individuals are targeted as terrorists. Example: http://www.mercurynews.com/2014/01/14/no-fly-list-challenged-stanford-student-wrongly-labeled-a-terrorist-judge-says/ http://www.mercurynews.com/2014/01/14/no-fly-list-challenged...
ChuckMcM 10y ago
Two most common misleading statements by law enforcement these days: 1) They were resisting arrest. 2) They are terrorists. Makes it hard to find cases where there are actual terrorists or people actually resisting arrest.
- Natsu 10y ago
  It's not easy to tell who is who unless they investigate, so they end up investigating the innocent as well as the guilty. Take the inauguration, there were so many peaceful protesters, coupled with a few idiots who chose to be violent, like this guy, who was charged in a plot to attack people by dumping acid into a ventilation system at an inaugural party: https://mpdc.dc.gov/release/arrest-made-conspiracy-commit-assault https://mpdc.dc.gov/release/arrest-made-conspiracy-commit-as...
  - forgotmysn 10y ago
    I feel like that distinction isn't as hard as you're making it sound
    - Natsu 10y ago
      I'm sure there are what appear to be clear-cut cases, especially in retrospect. I'm also sure that all of our 99% accurate heuristics we use in daily life will fail spectacularly on some minority of cases when applied 100,000 times.

tn13 10y ago

> claims to sell its spyware only to law enforcement agencies to track terrorists, criminals and drug lords Once you sell how can you control where it is used ?

TACIXAT 10y ago
EULA, because everyone knows clicking I Agree is like taking a blood oath. That's actually an interesting problem, if a company licenses software to someone and they use it maliciously, can the parent company be held responsible in some way because it was licensed?
- tn13 10y ago
  I am not sure if law enforcement agencies actually give a damn about EULA. They dont give a flying F about constitution and bill of rights on regular basis I find it hard to believe they actually give much damn about EULA especially when they are the only customer that company has.
- staticautomatic 10y ago
  It's highly unlikely that the company could be sued because the EULA would almost certainly have an indemnity clause covering that scenario.

Someone1234 10y ago

Governments often classify protest groups as "terrorists." The UK government has spent millions investigating non-violent environmental groups for one example, using anti-terrorism funds, teams, and laws to do so. Companies asking the government to squish protestors is also extremely common all around the world. I mean in the US right now we have oil pipelines which primarily benefit private companies getting built by the Army Corps of Engineers using public money and protesters harassed & beaten by police. All to reduce an oil company's costs and/or increase their profit margins.

gydfi 10y ago
>Governments often classify protest groups as "terrorists." And many terrorist groups claim merely to be "protestors" so it's tricky.
toomanybeersies 10y ago
Isn't the land simply the property of the Army Corps of Engineers, and it's being built by a private company? The USACE is a weird organisation. It's part of the US army, but almost exclusively does domestic civil engineering and public works.
- Retric 10y ago
  First, finding useful things to do with all those military people outside of wartime is a major issue especially when they need to suddenly stop doing that during a war. Second, a lot of civil infrastructure has military implications. EX: It's hard to make a dam you can't take out with explosives, but you can do a lot of things down stream to make destroying it less important. So, as a bonus it keeps the organization's skills up to date.
- omegaworks 10y ago
  The land was illegally annexed by the government. The Sioux signed a treaty that was broken by the US, were offered money in compensation for the land, which they refused. That land abuts the reservation's surface water sources. Without it they have no water security, an asset they consider priceless. The ownership remains contentious.

Crosseye_Jack 10y ago

Maybe 2.5 of those are true >[NSO Group] claims to sell its spyware only to law enforcement agencies to track terrorists, criminals and drug lords >An NSO spokesman reiterated those restrictions in a statement Thursday, and said the company had no knowledge of the tracking of health researchers and advocates inside Mexico >NSO executives point to technical safeguards that prevent clients from sharing its spy tools. LE says to NSO that this infection will be used on a track terrorists, criminals and drug lords by ticking the "We will only send this to infect terrorists, criminals and drug lords" checkbox, NSO gen's the unique link that needs to be visited to infect the device and then either LE or NSO send the target the text. In other discovered 0days the servers the links where pointing to were in control of the group selling the hacks and no LE. My bet is a part of the "controls" they have inplace is not actually handing over the exploits, but offering an "exploit as a service". Ofcause that doesn't stop LE saying "Gen link for number X, number X belongs to a bad guy..." and number X being a device belonging to their own tech teams to reverse the exploit and then they create their own.

chatterbeak 10y ago

I have no reason not to believe NSO. I don't think they have anything to do with this. People here love to blame them for everything, even when its nothing but random speculation.

megablast 10y ago

> claims to sell its spyware only to law enforcement agencies to track terrorists, criminals and drug lords How would they even know, whether the people targeting are terrorists, crims or lords? That is a ridiculous statement. Maybe they have a form that governments must sign saying that the gov will only target those people, but it is a ridiculous statement.