4 ms·

This might be an unpopular opinion, but I think it's fine if Facebook refrains from sending (attempted) breach notifications if the breaching entity involved is

This might be an unpopular opinion, but I think it's fine if Facebook refrains from sending (attempted) breach notifications if the breaching entity involved is considered to be in good standing with the global community and if there's a valid court order sent to Facebook. Then the relevant law enforcement agencies can just tell Facebook "hey, please don't warn [X future-mass murder suspect] about anything", and they can comply with a clean conscience. I think people should have a right to privacy, and I think law enforcement agencies should have a right to monitor potential near-future massacre-committers on a limited and singly-targeted basis. Dragnet surveillance is very different from surveiling a single individual for a specific and dire reason. Now, if they never sent Facebook a signed court order related to this matter, then it's entirely the agency's fault. So, in my opinion, the issue here is the choice of contractor (and the agency apparently not sending Facebook a court order??); NSO has so many ethical issues (specifically that they're a hired gun that'll fire no matter the wielder or their intent) that Facebook has a moral obligation to send these warnings. Pick someone who actually aligns with your goals, agencies. A firm you could actually theoretically work for yourself and still sleep peacefully at night. And if you can't get one, then do it yourself.

JumpCrisscross 7y ago
> if the breaching entity involved is considered to be in good standing with the global community and if there's a valid court order. How is Facebook supposed to determine this? All they know is X was breached by an NSO Group tool. Nobody presented Facebook with a warrant. Nobody even told them who is doing the breaching. It could be the French or the FBI or the Saudis, or a terrorist cell.
- meowface 7y ago
  Right, that's why I brought up the issue about the lack of warrant/court order. The agency involved are idiots and should have completely expected this if they didn't send Facebook a court order. (I've now edited my post to make that clearer.) I'm just trying to argue that, I think, in a grand theoretical sense, this sort of behavior is not necessarily unethical of law enforcement agencies if they send a signed court order and work with an ethical contractor instead of NSO or Black Cube or whoever.
  - deleted 7y ago
    [deleted]
harimau777 7y ago
Are there any agencies that are in good standing? The ones that I'm aware of (FBI, CIA) have a history of abusing their power.
- meowface 7y ago
  I was referring to the private intelligence and/or hacking contractors of the world, like NSO, Hacking Team, FinFisher's company, etc. But yes, as far as I'm aware, none of the currently existing ones have any ethical standards at all. May be some decades until that changes (maybe in the form of a startup that tries to go a somewhat different route).
gruez 7y ago
>This might be an unpopular opinion, but I think it's fine if Facebook refrains from sending (attempted) breach notifications [...] if there's a valid court order sent to Facebook So... a gag order? The reason why they didn't send facebook one is simple: they didn't expect to get caught. If tech companies start getting proactive about warning their users, I'd expect gag orders to be SOP when hiring cyber mercenaries.
- meowface 7y ago
  That's a good point. This is their fault for not sending an order. If this suspect were to have committed a real attack that resulted in deaths, the blood would be on law enforcement's hands more than Facebook's.
netsharc 7y ago
I mean, if the story is about an Ughyur dissident escaping the Chinese police, the response in many people's minds would probably be quite different. Obviously it also depends how someone views the FBI vs Chinese police (personally I think the FBI still has good souls in them, but the Chinese police is probably mostly an oppresing arm of the communist party)
brlewis 7y ago
Here is evidence that agents of the Saudi government were in good standing with at least one significant member of the global community: https://www.whitehouse.gov/briefings-statements/statement-president-donald-j-trump-standing-saudi-arabia/ https://www.whitehouse.gov/briefings-statements/statement-pr... Here is evidence that they used Pegasus to find and kill a dissident: https://en.wikipedia.org/wiki/Jamal_Khashoggi https://en.wikipedia.org/wiki/Jamal_Khashoggi
- meowface 7y ago
  Right, by "in good standing" I mean a rigorous definition far beyond and far wider than an endorsement from the US.
  - radu_floricica 7y ago
    The right move here is to update on evidence, not move the goalposts.
    - meowface 7y ago
      What do you mean? As I said, I consider NSO to not remotely be "in good standing with the global community", and clearly many countries and people strongly share that view. I maintain that even in light of two particular governments supporting them. It'd only be moving the goalposts if I had said "with some fraction of the global community". I clearly meant the entire global community, not just one or a few countries. Obviously at least some countries support this, else NSO would get no business and would not exist; some governments supporting and procuring them is the whole problem in the first place. So pointing to a few countries supporting NSO doesn't really provide any counter-argument: it emphasizes my point that there needs to be globe-level coordination here. Perhaps you could remove certain rogue countries like North Korea from the consensus list, but it would otherwise need to be a global consensus. UN officials have also expressed their concern with their ethics, and the UN is probably as close as you can get to representatives of the global community (even if it's not at all perfect). Facebook could look to the UN's positions as a starting point, for example (and perhaps that's exactly what they did here and maybe is part of their legal grounds for why they consider NSO to be a bad actor). If it were the case that every country and regulatory body in the world collectively decided that this kind of thing is ok, then yes, I'd need to change my criteria. I was just saying if an intelligence contractor (in the same domain as NSO) is universally in good standing with the global community and a court order is sent, I think it's ok. I am not aware of any currently existing ones which are in good universal global standing, so this will probably only ever apply in many years or decades.

JumpCrisscross 7y ago

> if the breaching entity involved is considered to be in good standing with the global community and if there's a valid court order. How is Facebook supposed to determine this? All they know is X was breached by an NSO Group tool. Nobody presented Facebook with a warrant. Nobody even told them who is doing the breaching. It could be the French or the FBI or the Saudis, or a terrorist cell.

meowface 7y ago
Right, that's why I brought up the issue about the lack of warrant/court order. The agency involved are idiots and should have completely expected this if they didn't send Facebook a court order. (I've now edited my post to make that clearer.) I'm just trying to argue that, I think, in a grand theoretical sense, this sort of behavior is not necessarily unethical of law enforcement agencies if they send a signed court order and work with an ethical contractor instead of NSO or Black Cube or whoever.
- deleted 7y ago
  [deleted]

harimau777 7y ago

Are there any agencies that are in good standing? The ones that I'm aware of (FBI, CIA) have a history of abusing their power.

meowface 7y ago
I was referring to the private intelligence and/or hacking contractors of the world, like NSO, Hacking Team, FinFisher's company, etc. But yes, as far as I'm aware, none of the currently existing ones have any ethical standards at all. May be some decades until that changes (maybe in the form of a startup that tries to go a somewhat different route).

gruez 7y ago

>This might be an unpopular opinion, but I think it's fine if Facebook refrains from sending (attempted) breach notifications [...] if there's a valid court order sent to Facebook So... a gag order? The reason why they didn't send facebook one is simple: they didn't expect to get caught. If tech companies start getting proactive about warning their users, I'd expect gag orders to be SOP when hiring cyber mercenaries.

meowface 7y ago
That's a good point. This is their fault for not sending an order. If this suspect were to have committed a real attack that resulted in deaths, the blood would be on law enforcement's hands more than Facebook's.

netsharc 7y ago

I mean, if the story is about an Ughyur dissident escaping the Chinese police, the response in many people's minds would probably be quite different. Obviously it also depends how someone views the FBI vs Chinese police (personally I think the FBI still has good souls in them, but the Chinese police is probably mostly an oppresing arm of the communist party)

brlewis 7y ago

Here is evidence that agents of the Saudi government were in good standing with at least one significant member of the global community: https://www.whitehouse.gov/briefings-statements/statement-president-donald-j-trump-standing-saudi-arabia/ https://www.whitehouse.gov/briefings-statements/statement-pr... Here is evidence that they used Pegasus to find and kill a dissident: https://en.wikipedia.org/wiki/Jamal_Khashoggi https://en.wikipedia.org/wiki/Jamal_Khashoggi

meowface 7y ago
Right, by "in good standing" I mean a rigorous definition far beyond and far wider than an endorsement from the US.
- radu_floricica 7y ago
  The right move here is to update on evidence, not move the goalposts.
  - meowface 7y ago
    What do you mean? As I said, I consider NSO to not remotely be "in good standing with the global community", and clearly many countries and people strongly share that view. I maintain that even in light of two particular governments supporting them. It'd only be moving the goalposts if I had said "with some fraction of the global community". I clearly meant the entire global community, not just one or a few countries. Obviously at least some countries support this, else NSO would get no business and would not exist; some governments supporting and procuring them is the whole problem in the first place. So pointing to a few countries supporting NSO doesn't really provide any counter-argument: it emphasizes my point that there needs to be globe-level coordination here. Perhaps you could remove certain rogue countries like North Korea from the consensus list, but it would otherwise need to be a global consensus. UN officials have also expressed their concern with their ethics, and the UN is probably as close as you can get to representatives of the global community (even if it's not at all perfect). Facebook could look to the UN's positions as a starting point, for example (and perhaps that's exactly what they did here and maybe is part of their legal grounds for why they consider NSO to be a bad actor). If it were the case that every country and regulatory body in the world collectively decided that this kind of thing is ok, then yes, I'd need to change my criteria. I was just saying if an intelligence contractor (in the same domain as NSO) is universally in good standing with the global community and a court order is sent, I think it's ok. I am not aware of any currently existing ones which are in good universal global standing, so this will probably only ever apply in many years or decades.