7 ms·

Government Spyware Targets Mexican Journalists and Their Families

187 points by growlix 9y ago

charred_toast 9y ago
Of course it does. These days, just imagine the most insidious and nightmarish overreach and wait a few weeks. 2017 is looking like a benchmark year in this regard.
- xenihn 9y ago
  Save us, Vitalik.
urubujj 9y ago
Are they really so surprised that their promise to only survey criminals is broken?
iliketosleep 9y ago
The company that makes the software "says it sells the tool exclusively to governments" as though they're trying to take a moral stand and say "we only see it to the good guys". When in fact they sell to governments that are highly oppressive and corrupt. It's a farce.
- flipp3r 9y ago
  Same shit as with Hacking Team.. They're Israeli's who also sell to the UAE. Lol.
  - dsl 9y ago
    This is usually referred to as fourth party intelligence. Say Russia compromises a high ranking ISIS member. The United States could compromise the infrastructure used by the Russians, and collect all the same intelligence. Not only have they gained knowledge about ISIS, they also strategically have a picture into what Russia actually knows.
  - qeternity 9y ago
    > They're Israeli's who also sell to the UAE. *Italians
    - flipp3r 9y ago
      What I meant is the people mentioned in the article who sell the software, are based in Israel.
- deleted 9y ago
  [deleted]
- dsl 9y ago
  We need to avoid the slippery slope of blaming the tools. There are open source and commercial solutions that implement much of the same functionality. If you blame the tools Hacking Team or NSO or whomever, disappears into the oblivion, and two more spawn to take their place. Meanwhile we build a popular opinion that these things are dangerous and need to be restricted or regulated. Software ends up as the new "burglary tools." We need to shame the people that would have used any means available to the same ends.
  - dmix 9y ago
    Having up to date Android and iOS zero days plus the rootkit / RAT software is not something you can get open source or find easily commercially. There's a reason this company is charging hundreds of thousands of dollars to target only 10s of phones... I wouldn't downplay the gatekeeper aspect of these companies and the technical investment it takes for non technical governments to do this stuff. But generally I agree that attempting to control it via the tools is a bad idea or merely putting the blame on the tools is missing the bigger picture. Plus limiting zero day sales will only harm legitimate security research and encourage unrealistic pen testing. Mexico's government is the primary issue here. They have a serious human rights abuse issue at various layers of government. But that said if we're going to try to protect these people from abusive government tactics, since it happens in secrecy and their 'self-regulation' totally fails to stop abuse (even in the US), then there is some value on pushing back against these more sophisticated companies that sell the high end tools that are harder to detect. Since it is a niche market at the moment and a niche expensive skillset... Unlike guns in the US that will be everywhere regardless of gun control, since it's the biggest gun exporter and gun ownership rate in the world, we can hold these companies to a higher degree of responsibility. Eventually though it will have to come down to holding the governments responsible and pushing back by protecting our software. The fact NSO has publicly said they will continue to sell to Mexico despite the clear evidence here that they are not following their stated policy of only targeting cartels, criminals, and terrorists... Then clearly they are shady as hell and their stated policy is bullshit. NSO is hardly without fault here. Unlike the AK47 analogy used in this article which are sold once and then the manufacturer loses control of how its used, this exploitation software needs to be updated with new zero days, new RAT software for new iOS/Android versions, and support/training staff. NSO has chosen to continue offering these services so they are just as much liable as far as I'm concerned.
- exelius 9y ago
  Also consider that the Mexican government and "cartels" have a lot of overlap. Local governments and municipal police departments in particular.
  - 2_listerine_pls 9y ago
    I would add some state governments too.
    - 3131s 9y ago
      From what I've heard, there are extensive connections between the Sinaloa cartel and the Mexican federal government too. The cartels laundered over a billion dollars one year through the state-owned oil company Pemex, for example. It's even been alleged [0] by ex-cartel leaders that the US government props up the Sinaloa cartel with weapons and other material support, since in general the Sinaloa cartel tends to be less outrageously brutal toward civilians than for instance Los Zetas (whose founders unsurprisingly studied at the infamous School of the Americas [1]). [0] http://www.businessinsider.com/the-us-government-and-the-sinaloa-cartel-2014-1 http://www.businessinsider.com/the-us-government-and-the-sin... [1] https://en.wikipedia.org/wiki/Western_Hemisphere_Institute_for_Security_Cooperation https://en.wikipedia.org/wiki/Western_Hemisphere_Institute_f...
- onli 9y ago
  Meanwhile, Germany sends automatic weapons to Mexico. Of course only to the good guys. The police that was involved in the killing in Iguala (the missing 43) was equipped with them. There is evil, and there is more evil.
- throwaway91111 9y ago
  ...not to mention any definition of "good guys" tends to fade at scale. When you're selling to governments it will either leak or be used directly for anti-humanitarian ends. I mean just look at the recent NSA leak. It's the same "conspiracy" patterns we've seen for ages. Hell, the best kept secrets in front of the western world remain the secret cults of rome. Those sonsofbitches knew how to hype a secret. Probably not possible with the internet!
Allower 9y ago
STOP linking to NYT
EternalData 9y ago
Governments amplified by technology and unconstrained by law are the largest threat to human liberty I can think of.
- ignoramceisblis 9y ago
  How about any organization (distinct group of humans)?
  - lowpro 9y ago
    Governments are distinctly different than most other organizations, primarily because they can force you to do something you don't want to do. Corporations can't do this (unless there is a monopoly on a needed utility (water company, etc). Even cartels and gangs are terrible because they act as a government in small/local areas, but have incredibly unfair punishments when people don't comply. Governments are ultimately far more dangerous than almost any other organization.
    - ignoramceisblis 9y ago
      I know what you mean. I don't suppose you think differently, but in general: I think it's worth reminding ourselves that "a government" is made up of multiple people, which may be largely influenced by distinct cliques, whether or not those cliques are within the government. It may be the case that real danger lies predominantly within those cliques.
cpach 9y ago
Alternative link in case there is someone bothered by the NYT paywall: http://abcnews.go.com/Technology/wireStory/report-mexican-journalists-activists-targeted-spyware-48135826 http://abcnews.go.com/Technology/wireStory/report-mexican-jo...
armandososa 9y ago
Important note: while in other countries the information acquired via this hacking could be used to blackmail or imprison their targets, in Mexico they are just shot dead.
- pavement 9y ago
  Worse still, sometimes merely being shot dead is preferable to other circumstances surrounding such murders.
Puts 9y ago
We are heading into an interesting future. The NSO Groups biggest owner Francisco Partners has both Software and Semiconductor companies in its portfolio, like Dell Software. Should I be worried about the firmware in my Dell computer? When everything becomes entangled like this it's impossible to know who to trust. And in the end it doesn't really matter what intent you have if people don't trust you.
- fictioncircle 9y ago
  Buy parts and run your own firewall/dns setup to drop anything odd. Its honestly the only way to be "sure" if worry about a manufacturer doing that sort of thing. It won't be perfect but the odds of someone targeting you for hardware spyware is prettttttttty low. And most manufacturers of comp enthusiast parts know its suicide to do it mass-market like that.
caf 9y ago
Starting as early as March, they began targeting Ms. Aristegui’s then-16-year-old son, Emilio, who was living in the United States at the time. I wish the New York Times had asked the US Government for a response to this allegation in particular.

187 points by growlix 9y ago

Of course it does. These days, just imagine the most insidious and nightmarish overreach and wait a few weeks. 2017 is looking like a benchmark year in this regard.

xenihn 9y ago
Save us, Vitalik.

urubujj 9y ago

Are they really so surprised that their promise to only survey criminals is broken?

iliketosleep 9y ago

The company that makes the software "says it sells the tool exclusively to governments" as though they're trying to take a moral stand and say "we only see it to the good guys". When in fact they sell to governments that are highly oppressive and corrupt. It's a farce.

flipp3r 9y ago
Same shit as with Hacking Team.. They're Israeli's who also sell to the UAE. Lol.
- dsl 9y ago
  This is usually referred to as fourth party intelligence. Say Russia compromises a high ranking ISIS member. The United States could compromise the infrastructure used by the Russians, and collect all the same intelligence. Not only have they gained knowledge about ISIS, they also strategically have a picture into what Russia actually knows.
- qeternity 9y ago
  > They're Israeli's who also sell to the UAE. *Italians
  - flipp3r 9y ago
    What I meant is the people mentioned in the article who sell the software, are based in Israel.
deleted 9y ago
[deleted]
dsl 9y ago
We need to avoid the slippery slope of blaming the tools. There are open source and commercial solutions that implement much of the same functionality. If you blame the tools Hacking Team or NSO or whomever, disappears into the oblivion, and two more spawn to take their place. Meanwhile we build a popular opinion that these things are dangerous and need to be restricted or regulated. Software ends up as the new "burglary tools." We need to shame the people that would have used any means available to the same ends.
- dmix 9y ago
  Having up to date Android and iOS zero days plus the rootkit / RAT software is not something you can get open source or find easily commercially. There's a reason this company is charging hundreds of thousands of dollars to target only 10s of phones... I wouldn't downplay the gatekeeper aspect of these companies and the technical investment it takes for non technical governments to do this stuff. But generally I agree that attempting to control it via the tools is a bad idea or merely putting the blame on the tools is missing the bigger picture. Plus limiting zero day sales will only harm legitimate security research and encourage unrealistic pen testing. Mexico's government is the primary issue here. They have a serious human rights abuse issue at various layers of government. But that said if we're going to try to protect these people from abusive government tactics, since it happens in secrecy and their 'self-regulation' totally fails to stop abuse (even in the US), then there is some value on pushing back against these more sophisticated companies that sell the high end tools that are harder to detect. Since it is a niche market at the moment and a niche expensive skillset... Unlike guns in the US that will be everywhere regardless of gun control, since it's the biggest gun exporter and gun ownership rate in the world, we can hold these companies to a higher degree of responsibility. Eventually though it will have to come down to holding the governments responsible and pushing back by protecting our software. The fact NSO has publicly said they will continue to sell to Mexico despite the clear evidence here that they are not following their stated policy of only targeting cartels, criminals, and terrorists... Then clearly they are shady as hell and their stated policy is bullshit. NSO is hardly without fault here. Unlike the AK47 analogy used in this article which are sold once and then the manufacturer loses control of how its used, this exploitation software needs to be updated with new zero days, new RAT software for new iOS/Android versions, and support/training staff. NSO has chosen to continue offering these services so they are just as much liable as far as I'm concerned.
exelius 9y ago
Also consider that the Mexican government and "cartels" have a lot of overlap. Local governments and municipal police departments in particular.
- 2_listerine_pls 9y ago
  I would add some state governments too.
  - 3131s 9y ago
    From what I've heard, there are extensive connections between the Sinaloa cartel and the Mexican federal government too. The cartels laundered over a billion dollars one year through the state-owned oil company Pemex, for example. It's even been alleged [0] by ex-cartel leaders that the US government props up the Sinaloa cartel with weapons and other material support, since in general the Sinaloa cartel tends to be less outrageously brutal toward civilians than for instance Los Zetas (whose founders unsurprisingly studied at the infamous School of the Americas [1]). [0] http://www.businessinsider.com/the-us-government-and-the-sinaloa-cartel-2014-1 http://www.businessinsider.com/the-us-government-and-the-sin... [1] https://en.wikipedia.org/wiki/Western_Hemisphere_Institute_for_Security_Cooperation https://en.wikipedia.org/wiki/Western_Hemisphere_Institute_f...
onli 9y ago
Meanwhile, Germany sends automatic weapons to Mexico. Of course only to the good guys. The police that was involved in the killing in Iguala (the missing 43) was equipped with them. There is evil, and there is more evil.
throwaway91111 9y ago
...not to mention any definition of "good guys" tends to fade at scale. When you're selling to governments it will either leak or be used directly for anti-humanitarian ends. I mean just look at the recent NSA leak. It's the same "conspiracy" patterns we've seen for ages. Hell, the best kept secrets in front of the western world remain the secret cults of rome. Those sonsofbitches knew how to hype a secret. Probably not possible with the internet!

Allower 9y ago

STOP linking to NYT

EternalData 9y ago

Governments amplified by technology and unconstrained by law are the largest threat to human liberty I can think of.

ignoramceisblis 9y ago
How about any organization (distinct group of humans)?
- lowpro 9y ago
  Governments are distinctly different than most other organizations, primarily because they can force you to do something you don't want to do. Corporations can't do this (unless there is a monopoly on a needed utility (water company, etc). Even cartels and gangs are terrible because they act as a government in small/local areas, but have incredibly unfair punishments when people don't comply. Governments are ultimately far more dangerous than almost any other organization.
  - ignoramceisblis 9y ago
    I know what you mean. I don't suppose you think differently, but in general: I think it's worth reminding ourselves that "a government" is made up of multiple people, which may be largely influenced by distinct cliques, whether or not those cliques are within the government. It may be the case that real danger lies predominantly within those cliques.

cpach 9y ago

Alternative link in case there is someone bothered by the NYT paywall: http://abcnews.go.com/Technology/wireStory/report-mexican-journalists-activists-targeted-spyware-48135826 http://abcnews.go.com/Technology/wireStory/report-mexican-jo...

armandososa 9y ago

Important note: while in other countries the information acquired via this hacking could be used to blackmail or imprison their targets, in Mexico they are just shot dead.

pavement 9y ago
Worse still, sometimes merely being shot dead is preferable to other circumstances surrounding such murders.

Puts 9y ago

We are heading into an interesting future. The NSO Groups biggest owner Francisco Partners has both Software and Semiconductor companies in its portfolio, like Dell Software. Should I be worried about the firmware in my Dell computer? When everything becomes entangled like this it's impossible to know who to trust. And in the end it doesn't really matter what intent you have if people don't trust you.

fictioncircle 9y ago
Buy parts and run your own firewall/dns setup to drop anything odd. Its honestly the only way to be "sure" if worry about a manufacturer doing that sort of thing. It won't be perfect but the odds of someone targeting you for hardware spyware is prettttttttty low. And most manufacturers of comp enthusiast parts know its suicide to do it mass-market like that.

caf 9y ago

Starting as early as March, they began targeting Ms. Aristegui’s then-16-year-old son, Emilio, who was living in the United States at the time. I wish the New York Times had asked the US Government for a response to this allegation in particular.