8 ms·

Digital Violence: How the NSO Group Enables State Terror

169 points by T-A 5y ago

noduerme 5y ago
I'm not sure I understand. Were these Whatsapp and email accounts compromised because there was just a very high level of customization and tailoring in the phishing emails?
- ldarby 5y ago
  Where it says "the whatsapp hack" it's referring to this: https://www.theregister.com/2019/05/14/whatsapp_zero_day/ https://www.theregister.com/2019/05/14/whatsapp_zero_day/
teekert 5y ago
The story about the cam and mic being activated suggests some deeper hacking of Android and iOS themselves? I agree some more technical details would have been nice. Edit: Was meant as reply to noduerme
- rapsey 5y ago
  They use android/ios zero days. They have root on the system.
  - Ygg2 5y ago
    These are state actors, for all we know they might even have their own personal Android backdoor.
2Gkashmiri 5y ago
https://thenextweb.com/news/kashmirs-police-want-people-to-register-their-whatsapp-groups https://thenextweb.com/news/kashmirs-police-want-people-to-r... And more news like this. I have been told by a WhatsApp admin who runs a news group how the police took his mobile phone and returned it back after some time and he has been warned multiple times to not post any news critical to india. I believe they install this nso spyware or something similar on their phones so they get to know what is spreading and who is doing what.
- spinny 5y ago
  Your friend should consider that device compromised and get a new one
  - nix23 5y ago
    Not the freshest chip in the package eh?
    - 2Gkashmiri 5y ago
      it happens. i have people tell me "why not use a vpn". https://scroll.in/article/952355/vpn-for-terrorism-in-kashmir-youth-allege-their-phones-are-checked-by-the-army-for-masking-apps https://scroll.in/article/952355/vpn-for-terrorism-in-kashmi... https://www.reuters.com/article/us-india-kashmir-internet-idUSKBN20D0LT https://www.reuters.com/article/us-india-kashmir-internet-id... i have friends who have been pulled from a public bus, their phones checked and one guy was beaten for having a vpn app and another one was forced to show his whatsapp when they proceeded to beat him for having "incendiary content". basically photos and memes critical of government
      - baybal2 5y ago
        How active is the armed resistance in Srinagar today?
        2Gkashmiri 5y ago
        nah. its not even clear these days. people disappear and next time they are "killed in an encounter". https://thekashmirwalla.com/2021/07/in-kulgam-gunfight-family-says-son-killed-outside-home-wasnt-militant-police-denies/ https://thekashmirwalla.com/2021/07/in-kulgam-gunfight-famil... just a few days ago this kid was killed, heck his throat was first slit. the police say he joined militancy on 18th june but locals say he played cricket and scored runs on 28th of june so who knows. then you have multiple times when the army and the police was found to have conducted fake encounters where they killed innocent civilians in the name of getting prize money. few week ago there was the grenade attack in srinagar but that was immediately after the all party meeting with the drone attack that caused another stir.locals belive these are diversionary tactics.
izac 5y ago
The investigation on Forensic Architecture's page can be found here: https://forensic-architecture.org/investigation/digital-violence-how-the-nso-group-enables-state-terror/ https://forensic-architecture.org/investigation/digital-viol... The website features a platform for exploring over 1,000 "NSO-related activities, and demonstrates new connections and patterns between ‘digital violence’ using Pegasus and real-world violence directed at lawyers, activists, and other civil society figures": https://www.digitalviolence.org/#/explore https://www.digitalviolence.org/#/explore
- sloshnmosh 5y ago
  No kidding. I’m not enabling JavaScript to view some random website. Especially if it mentions NSO Grouo!
  - aritmo 5y ago
    You realize that 1) the website is critical to the NSO group, and 2) you can have more than one separate/independent browser session on your computer to browser stuff on your computer?
    - sloshnmosh 5y ago
      That is exactly how watering-hole websites work, they create a site critical of the attacker.
      - atoav 5y ago
        Forensic architecture is known for years to make visually fancy stuff (e.g. the films and exhibitions which they show for roughly the past decade in the art context throughout Europe, for example at the last Documenta). For them to develope a website that uses a lot of javascript is somewhat ironic, but not surprising.
lapinot 5y ago
Is it me or this website is unusable with slightly restrictive javascript policies? My fans start screaming, i'm getting disfunctional menus at the bottom and a scroller at the top. I deactivated decentraleyes and umatrix, only thing is ublock and my restrictive firefox base profile.
- willvarfar 5y ago
  So I’m not sure what I’m supposed to be seeing on my iPhone but all I get is black background and the hint of fancy animation effects that I’m not following. Is there a transcript or something?
- bborud 5y ago
  You are not alone. I gave up after a while thinking «this is probably worth reading - too bad the publishers chose to make it so hard to read”. This is kind of stupid.
  - tacon 5y ago
    Agreed, very counterproductive to their mission. I was able to get the site functioning with uMatrix still operating by using the vertical three dot menu and disabling referer spoofing. Even then it wasn't clear how to get to the content, since all that shows is a huge map with a timeline of events.
- izac 5y ago
  Apologies for this — the website features some pretty heavy WebGL visualizations. I've pushed an updated version with more aggressive code-splitting and a <noscript /> version of the website. If you'd like, try it out and let me know if it works any better.
motohagiography 5y ago
Have said before that the economics for companies like NSO are favorable because countries and regimes with resource wealth, who do not need to maintain a sophisticated civil service to stay in power, need the technical capability that such a platform provides. Companies like this provide that. It's a domestic spy agency as a service. Awful? Absolutely, but I'd argue these objections reduce to "interception capabilities for me and not for thee," as western domestic spy agencies can just send a fax to your telco and get the same access. That is, the U.S. doesn't need NSO because it has the FISA stamp pad. I'm very much a privacy advocate who has in one way or another worked closely to the key surveillance issues of the day for years, and so to defend NSO at all feels absurd, but the devil must be given his due. Sure, NSO and the former HackingTeam and even Stratfor were great activist targets, but from the perspective of a state or a regime who buys an NSO-like service, N-GO's are just another foreign funded operator fighting a proxy war for policy leverege on behalf of their home governments and companies. They aren't secular colonial missionaries, (or perhaps, that's precisely what they are) they're running a playbook[1]. It's hard to separate NSO from Israeli policy because of how close their industry and military are linked, but I also think the objections to Israel's involvement itself reduce to how it is the last new free and independent nation state in a time where the nation state as thing itself is being wound up by the very class of academics/NGO's who militate against Israel's sovereignty. The academic/NGO anti-Israel thing has a lot of old entrenched anti-semitism, but the most reliable filter to identify what bothers them about Israel's involvement in this platform is NGOs are motivated by academic anti-sovereignty. These spy agencies as a service like NSO provide sovereignty to unfavorable countries, and Israel benefits strategically from preserving the sovereignty of nation states, no matter how repugnant. That's a painful steelman argument to make on behalf of the very abusive surveillance I have worked personally in my career to prevent, but when I see what amounts to selective privacy astroturfing using artists I like as propaganda mascots, the whole thing leaves a bad taste. The skepticism I had with the university affiliated project that first uncovered Pegasus was they seemed really interested in foreign abuses but had not done anything on domestic surveillance issues, or even investigated those countries' influence on their own, which made them a para-governmental org using the cover of a loosely academic NGO to play spy games. To me the whole enterprise is seedy. [1] https://www.amazon.com/Dictatorship-Democracy-Gene-Sharp/dp/1846688396 https://www.amazon.com/Dictatorship-Democracy-Gene-Sharp/dp/...
astronautjones 5y ago
Is this Snowden narrating?
- tpmx 5y ago
  Yes. https://forensic-architecture.org/investigation/digital-violence-how-the-nso-group-enables-state-terror/ https://forensic-architecture.org/investigation/digital-viol... ... along with video investigations narrated by Edward Snowden ...
  - 0xdeadb00f 5y ago
    > Data Sonification: Brian Eno Huh, that's quite a pleasant surprise
jeroenhd 5y ago
I couldn't read the article because I can only see a loading bar. This is the sad state of the web today
- Metacelsus 5y ago
  Same here.
- izac 5y ago
  Not sure why that is although, admittedly, I've had little time to do much in the way of cross-browser testing. The website features some pretty heavy WebGL visualizations. I've pushed an updated version with more aggressive code-splitting and a <noscript /> version of the website. If you'd like, try it out and let me know if it works any better.
  - jeroenhd 5y ago
    Yes, everything is working like a charm now. Thank you for the effort and thank you for the update!
sloshnmosh 5y ago
I uploaded the url to “urlscan(.)io” and it STILL doesn’t load. I’m examining the scripts now. However, there is a blob of JavaScript that doesn’t load into urlscan. Highly suspect. Is this some watering hole?
- bopbeepboop 5y ago
  I appreciate you examining this. I refused to click the link, seeing all the comments about a JS heavy website that was making fans spin, talking about NSO. Checking the WHOIS shows a 2 week old domain owned by a masked entity. - - - Registry Expiration: 2022-06-14 10:48:17 UTC Updated: 2021-06-15 23:38:22 UTC Created: 2021-06-14 10:48:17 UTC Name: Contact Privacy Inc. Customer 0161891249
stevehawk 5y ago
why is this guy whispering through the entire video. if i turn it up so i can hear him then all is the other people are on blast

169 points by T-A 5y ago

I'm not sure I understand. Were these Whatsapp and email accounts compromised because there was just a very high level of customization and tailoring in the phishing emails?

ldarby 5y ago
Where it says "the whatsapp hack" it's referring to this: https://www.theregister.com/2019/05/14/whatsapp_zero_day/ https://www.theregister.com/2019/05/14/whatsapp_zero_day/

teekert 5y ago

The story about the cam and mic being activated suggests some deeper hacking of Android and iOS themselves? I agree some more technical details would have been nice. Edit: Was meant as reply to noduerme

rapsey 5y ago
They use android/ios zero days. They have root on the system.
- Ygg2 5y ago
  These are state actors, for all we know they might even have their own personal Android backdoor.

2Gkashmiri 5y ago

https://thenextweb.com/news/kashmirs-police-want-people-to-register-their-whatsapp-groups https://thenextweb.com/news/kashmirs-police-want-people-to-r... And more news like this. I have been told by a WhatsApp admin who runs a news group how the police took his mobile phone and returned it back after some time and he has been warned multiple times to not post any news critical to india. I believe they install this nso spyware or something similar on their phones so they get to know what is spreading and who is doing what.

spinny 5y ago
Your friend should consider that device compromised and get a new one
- nix23 5y ago
  Not the freshest chip in the package eh?
  - 2Gkashmiri 5y ago
    it happens. i have people tell me "why not use a vpn". https://scroll.in/article/952355/vpn-for-terrorism-in-kashmir-youth-allege-their-phones-are-checked-by-the-army-for-masking-apps https://scroll.in/article/952355/vpn-for-terrorism-in-kashmi... https://www.reuters.com/article/us-india-kashmir-internet-idUSKBN20D0LT https://www.reuters.com/article/us-india-kashmir-internet-id... i have friends who have been pulled from a public bus, their phones checked and one guy was beaten for having a vpn app and another one was forced to show his whatsapp when they proceeded to beat him for having "incendiary content". basically photos and memes critical of government
    - baybal2 5y ago
      How active is the armed resistance in Srinagar today?
      - 2Gkashmiri 5y ago
        nah. its not even clear these days. people disappear and next time they are "killed in an encounter". https://thekashmirwalla.com/2021/07/in-kulgam-gunfight-family-says-son-killed-outside-home-wasnt-militant-police-denies/ https://thekashmirwalla.com/2021/07/in-kulgam-gunfight-famil... just a few days ago this kid was killed, heck his throat was first slit. the police say he joined militancy on 18th june but locals say he played cricket and scored runs on 28th of june so who knows. then you have multiple times when the army and the police was found to have conducted fake encounters where they killed innocent civilians in the name of getting prize money. few week ago there was the grenade attack in srinagar but that was immediately after the all party meeting with the drone attack that caused another stir.locals belive these are diversionary tactics.

izac 5y ago

The investigation on Forensic Architecture's page can be found here: https://forensic-architecture.org/investigation/digital-violence-how-the-nso-group-enables-state-terror/ https://forensic-architecture.org/investigation/digital-viol... The website features a platform for exploring over 1,000 "NSO-related activities, and demonstrates new connections and patterns between ‘digital violence’ using Pegasus and real-world violence directed at lawyers, activists, and other civil society figures": https://www.digitalviolence.org/#/explore https://www.digitalviolence.org/#/explore

sloshnmosh 5y ago
No kidding. I’m not enabling JavaScript to view some random website. Especially if it mentions NSO Grouo!
- aritmo 5y ago
  You realize that 1) the website is critical to the NSO group, and 2) you can have more than one separate/independent browser session on your computer to browser stuff on your computer?
  - sloshnmosh 5y ago
    That is exactly how watering-hole websites work, they create a site critical of the attacker.
    - atoav 5y ago
      Forensic architecture is known for years to make visually fancy stuff (e.g. the films and exhibitions which they show for roughly the past decade in the art context throughout Europe, for example at the last Documenta). For them to develope a website that uses a lot of javascript is somewhat ironic, but not surprising.

lapinot 5y ago

Is it me or this website is unusable with slightly restrictive javascript policies? My fans start screaming, i'm getting disfunctional menus at the bottom and a scroller at the top. I deactivated decentraleyes and umatrix, only thing is ublock and my restrictive firefox base profile.

willvarfar 5y ago
So I’m not sure what I’m supposed to be seeing on my iPhone but all I get is black background and the hint of fancy animation effects that I’m not following. Is there a transcript or something?
bborud 5y ago
You are not alone. I gave up after a while thinking «this is probably worth reading - too bad the publishers chose to make it so hard to read”. This is kind of stupid.
- tacon 5y ago
  Agreed, very counterproductive to their mission. I was able to get the site functioning with uMatrix still operating by using the vertical three dot menu and disabling referer spoofing. Even then it wasn't clear how to get to the content, since all that shows is a huge map with a timeline of events.
izac 5y ago
Apologies for this — the website features some pretty heavy WebGL visualizations. I've pushed an updated version with more aggressive code-splitting and a <noscript /> version of the website. If you'd like, try it out and let me know if it works any better.

motohagiography 5y ago

Have said before that the economics for companies like NSO are favorable because countries and regimes with resource wealth, who do not need to maintain a sophisticated civil service to stay in power, need the technical capability that such a platform provides. Companies like this provide that. It's a domestic spy agency as a service. Awful? Absolutely, but I'd argue these objections reduce to "interception capabilities for me and not for thee," as western domestic spy agencies can just send a fax to your telco and get the same access. That is, the U.S. doesn't need NSO because it has the FISA stamp pad. I'm very much a privacy advocate who has in one way or another worked closely to the key surveillance issues of the day for years, and so to defend NSO at all feels absurd, but the devil must be given his due. Sure, NSO and the former HackingTeam and even Stratfor were great activist targets, but from the perspective of a state or a regime who buys an NSO-like service, N-GO's are just another foreign funded operator fighting a proxy war for policy leverege on behalf of their home governments and companies. They aren't secular colonial missionaries, (or perhaps, that's precisely what they are) they're running a playbook[1]. It's hard to separate NSO from Israeli policy because of how close their industry and military are linked, but I also think the objections to Israel's involvement itself reduce to how it is the last new free and independent nation state in a time where the nation state as thing itself is being wound up by the very class of academics/NGO's who militate against Israel's sovereignty. The academic/NGO anti-Israel thing has a lot of old entrenched anti-semitism, but the most reliable filter to identify what bothers them about Israel's involvement in this platform is NGOs are motivated by academic anti-sovereignty. These spy agencies as a service like NSO provide sovereignty to unfavorable countries, and Israel benefits strategically from preserving the sovereignty of nation states, no matter how repugnant. That's a painful steelman argument to make on behalf of the very abusive surveillance I have worked personally in my career to prevent, but when I see what amounts to selective privacy astroturfing using artists I like as propaganda mascots, the whole thing leaves a bad taste. The skepticism I had with the university affiliated project that first uncovered Pegasus was they seemed really interested in foreign abuses but had not done anything on domestic surveillance issues, or even investigated those countries' influence on their own, which made them a para-governmental org using the cover of a loosely academic NGO to play spy games. To me the whole enterprise is seedy. [1] https://www.amazon.com/Dictatorship-Democracy-Gene-Sharp/dp/1846688396 https://www.amazon.com/Dictatorship-Democracy-Gene-Sharp/dp/...

astronautjones 5y ago

Is this Snowden narrating?

tpmx 5y ago
Yes. https://forensic-architecture.org/investigation/digital-violence-how-the-nso-group-enables-state-terror/ https://forensic-architecture.org/investigation/digital-viol... ... along with video investigations narrated by Edward Snowden ...
- 0xdeadb00f 5y ago
  > Data Sonification: Brian Eno Huh, that's quite a pleasant surprise

jeroenhd 5y ago

I couldn't read the article because I can only see a loading bar. This is the sad state of the web today

Metacelsus 5y ago
Same here.
izac 5y ago
Not sure why that is although, admittedly, I've had little time to do much in the way of cross-browser testing. The website features some pretty heavy WebGL visualizations. I've pushed an updated version with more aggressive code-splitting and a <noscript /> version of the website. If you'd like, try it out and let me know if it works any better.
- jeroenhd 5y ago
  Yes, everything is working like a charm now. Thank you for the effort and thank you for the update!

sloshnmosh 5y ago

I uploaded the url to “urlscan(.)io” and it STILL doesn’t load. I’m examining the scripts now. However, there is a blob of JavaScript that doesn’t load into urlscan. Highly suspect. Is this some watering hole?

bopbeepboop 5y ago
I appreciate you examining this. I refused to click the link, seeing all the comments about a JS heavy website that was making fans spin, talking about NSO. Checking the WHOIS shows a 2 week old domain owned by a masked entity. - - - Registry Expiration: 2022-06-14 10:48:17 UTC Updated: 2021-06-15 23:38:22 UTC Created: 2021-06-14 10:48:17 UTC Name: Contact Privacy Inc. Customer 0161891249

stevehawk 5y ago

why is this guy whispering through the entire video. if i turn it up so i can hear him then all is the other people are on blast