11 ms·

Edward Snowden calls for spyware trade ban amid Pegasus revelations

340 points by georgecmu 5y ago

skarz 5y ago
I would like to point out that this kind of tech isn't only used by state sponsored operations. https://www.bbc.com/news/technology-50166147 https://www.bbc.com/news/technology-50166147 Lone wolf creepers or quasi legal harassment companies have access to similar tools. https://www.nefariousjobsmain.com/the-works https://www.nefariousjobsmain.com/the-works https://www.vice.com/en/article/ppmpe8/a-revenge-for-hire-business-exists-in-san-francisco https://www.vice.com/en/article/ppmpe8/a-revenge-for-hire-bu... Although of course the state sponsored aspect of this is very real too, and the greatest threat.
- AlexAndScripts 5y ago
  That is entirely disgusting. Destroying a life for money. That that's a possibility...
  - blooalien 5y ago
    That's what happens when people are trained from birth that money is always more important than anything else.
    - andrei_says_ 5y ago
      And to see being rich as an indicator of merit.
      - blooalien 5y ago
        Sad but true.
- squarefoot 5y ago
  > Lone wolf creepers or quasi legal harassment companies have access to similar tools. I would take that for granted, as I do with any government, including mine. But thinking that you're more likely to be kept under surveillance by the same government -no matter the color- you fund with your taxes, than some private or foreign entity, makes this even more revolting. Makes one think if nationalism was invented as a tool to throw smoke in the eyes and minds of people so that they can't see their rulers for what they really are.
  - cinquemb 5y ago
    The collusion of leaders wrt to their personal business interests can make states seem like protection rackets…
- lupire 5y ago
  How is parler kicked off its hosting but a site plainly advertising criminal acts for hire is up and has a US domain name?
  - ipspam 5y ago
    Hatred of anything not progressive, and especially of conservatives.
  - SMAAART 5y ago
    What "criminal acts" are you specifically talking about?
  - brokenmachine 5y ago
    Nobody wants to deal with parler, and that's their prerogative. Free market and all that. What criminal acts?
  - snypher 5y ago
    I'd guess because it's total cosplay. Edit: "Severe psychological warning, this package is only available for use on clients over 30 years of age." ...because a 26 year old can't handle getting a dildo in the mail?
- cinquemb 5y ago
  Cheaper than ever for anyone to spy on anyone else, esp with the social media skinner boxes out there with hardware frontends. Getting cheaper by the day…
beebeepka 5y ago
Trade ban... Every single government uses such tools. The ones that don't likely have bigger problems such as sustenance, lack of electricity, etc. What people should be looking at is the crazy amount of Israeli presence in the so called cyber security sector. I can think of a few such companies that literally spy and track hundreds of thousands of people all over the world. The government is using their services and therefore lets them whatever they want. I know a few guys working for such companies. No longer friends with them. Works foriteral evil. No better than military types
- newacct583 5y ago
  > What people should be looking at is the crazy amount of Israeli presence in the so called cyber security sector. Limiting the ability of nations to export this kind of capability as a product for other entities to use is precisely what "trade ban" would do. You're right that a trade ban won't affect the ability of nations to develop and deploy their own spyware, but most of the targets in the Pegasus dump seem to be of people peripheral to smaller governments that don't have this kind of capability themselves (which is exactly why they buy it!).
  - anothernewdude 5y ago
    Nations that want to do this will do it, and trade bans won't stop them. Or even discourage them. It's like banning arms sales to countries like Saudi Arabia. All it does is push them towards China or Russia. Banning this stuff just leads to consolidated power blocs of nasty regimes.
    - newacct583 5y ago
      > Nations that want to do this will do it, and trade bans won't stop them. Again, that's experimentally false. Saudi and Mexico didn't develop their own home-grown spyware. They bought an Israeli product instead. This stuff is harder than you think.
      - throwaway33432 5y ago
runningmike 5y ago
20 years ago I discovered antivirus software did not detect spyware by design. So never ever trust software that is not FOSS. Use Foss with reproducible builds to be a bit more safe against these by design created weaknesses.
- blooalien 5y ago
  Sadly, most people when hearing this will prefer to argue to the death to support their "choice" of ${favorite giant corporate product} and try to tell you "you're just being paranoid". We live in a world where a great many people will accept the most outlandish conspiracy theories as undeniable fact with little to no supporting evidence, but when you try to warn them about real and verifiable concerns, it doesn't matter how much proof there is… You're automatically wrong in their eyes. What's more terrifying than that? Some of those people hold positions of great power in this world.
  - TaylorAlexander 5y ago
    We've got to get to them before microsoft and google do. Teach Linux in schools and about the importance of FLOSS. In my school in California it was all windows in the 1990's and 2000's.
    - blooalien 5y ago
      > In my school in California it was all windows in the 1990's and 2000's. Yeah, it was that way even before that. Microsoft and Apple got into a "donation war" tryin'a get their corporate garbage into schools back when I was a kid. Looks like Microsoft largely won that war. Hard to fight multiple generations deep corporate brainwashing.
      - TaylorAlexander 5y ago
        Ah yes, the efficiency of the free market. Where companies with deep pockets get kids hooked on their product early so they can abuse them for the rest of their lives. In these cases I think administrative oversight of broad and long term benefits to society is important, rather than the more narrow decision of "this choice will benefit next year's budget". Early offers by Microsoft were in a way a trap that kept schools and students paying for decades.
ttctciyf 5y ago
It continues to strike me as a little odd that (AFAIK) there's no mention in The Guardian's reporting of this story of the parallel technology[1] sold by Gamma Group[2] and licensed for export by UK to several suspect regimes[3]. Extensive (40G) information on this was leaked via reddit in August 2014[4], and the leaker noted[5]: > I assumed the hacking would be the hard part and once I got the data it would just kinda go viral on it's own or something. But it turn's out without any media access or idea how that shit works, getting people to notice or care is actually kind of hard. ------ 1: "FinSpy Mobile. Version 4.4, released in of Q4 2012, has the ability to collect data through Skype across iOS, Blackberry, Android, and Windows Mobile platforms . An updated Version 4.5, released in Q1 2013, included the ability to target emails, calendars and keylogging of Windows Phones, and an updated ability to collect data through the camera of a Blackberry or iOS phone." - https://privacyinternational.org/blog/1522/six-things-we-know-latest-finfisher-documents https://privacyinternational.org/blog/1522/six-things-we-kno... (2014) 2: https://en.wikipedia.org/wiki/Gamma_Group https://en.wikipedia.org/wiki/Gamma_Group 3: https://www.independent.co.uk/news/uk/politics/uk-spyware-wiretaps-saudi-arabia-china-bahrain-uae-human-rights-a9613206.html https://www.independent.co.uk/news/uk/politics/uk-spyware-wi... 4: https://privacyinternational.org/blog/1522/six-things-we-know-latest-finfisher-documents https://privacyinternational.org/blog/1522/six-things-we-kno... 5: https://www.reddit.com/r/Anarchism/comments/2cjlop/gamma_international_leaked/ https://www.reddit.com/r/Anarchism/comments/2cjlop/gamma_int...
- ozymandias12 5y ago
  NSO gets the mic because its the biggest commercial name, there are several other companies that fly under the radar with similar technologies. I like what some other user proposed here: military grade classification. Tada. Now sanctions apply to both sellers and users of this crap.
  - ttctciyf 5y ago
    I think there is a licensing procedure in the UK and Germany (Gamma Group) and Israel (NSO), and lip-service to the idea that it's forbidden to sell to repressive regimes, already. The big deal with the NSO story is the 50K target names, I think, and it is a big deal, but you'd expect in a supposedly oppositional paper like the Grauniad, that there'd be some mention of the current UK government's spotty record in this very department, and a sense of the history of the abuse of this technology. I'd have a hard time believing that any of this is news to the journalists reporting the story.
xbar 5y ago
Classifying such technology as military weapons would begin to address a number of international and national concerns with for-sale-malware (aka spyware). The use of such military weapons by civilians (or civilian police) against civilians become more obviously ban-able.
- Goety 5y ago
  Enforcement here would probably be centered on adding additional sentencing time or punishment for misuse. That said we have near zero ability to enforce this at the moment.
- milderworkacc 5y ago
  While I agree that the trade in these tools is reprehensible, I worry about creating a new class of software that is prohibited to possess or trade in. It wasn't so long ago that strong encryption was labelled a 'dual use technology', and moving it across national borders was non-trivial. How long will it take for pentesting tools and end-to-end encryption to be labelled 'military weapons' under such a scheme?
  - xbar 5y ago
    I worry, too. Regulators do hatchet jobs when it comes to software law. But slippery slopes aside, it's pretty clear that selling tools to take over phones en masse is a bad deal for free societies. Here's what we will find next: military and political leaders' phones have also already been compromised by NSO Group tools. I feel confident it has happened at a higher rate than among journalists. Imagine both your favorite and your most hated political firebrands: how will their rhetoric sound when they realize they've been pwned by the opposition for the past year using COTS tools?
- rapind 5y ago
  > The use of such military weapons by civilians (or civilian police) against civilians become more obviously ban-able. Not sure it would stop the police part. https://en.wikipedia.org/wiki/Militarization_of_police https://en.wikipedia.org/wiki/Militarization_of_police
tinus_hn 5y ago
As the government that allows itself to use this spyware will always have an advantage over the government that does not, it will never be banned.
- brokenmachine 5y ago
  Like chemical weapons?
  - tsimionescu 5y ago
    Chemical weapons were easily banned because they are almost entirely useless as long as you have access to conventional weapons. They are expensive to store, very inefficient for actually killing the opposition, easy to guard against, have a higher chance of turning back on you, and will slow your advance if you use them in an attack. They are at best a tool for terror or desperation. Think about the Tokyo metro attacks and, not to minimize the tragedy, but how many more lives would have been lost if they had detonated similar quantities of explosives instead of spreading sarin gas - and that is inside a closed tube, with no protection whatsoever and with most victims receiving no medical care until many hours later, as hospitals were entirely unprepared for a gas attack.
    - brokenmachine 5y ago
      Good points. I do wonder about next-gen chemical/genetic weapons that advanced countries could create with the motivation though. Like some crazy airborne virus but only the good guys™ have the antidote/vaccine. >how many more lives would have been lost if they had detonated similar quantities of explosives Wasn't it just a few guys with suitcases, and I think one of them didn't even puncture the container? With conventional weapons there might be more deaths but maybe not.
      - tsimionescu 5y ago
        It's possible, but still unlikely to be as effective or safe as bombing your target to the ground. > Wasn't it just a few guys with suitcases, and I think one of them didn't even puncture the container? With conventional weapons there might be more deaths but maybe not. They had several liters of sarin gas, most of which was splashed on the ground entirely. If they had had some way to spread it as an aerosol the death toll would have been much greater, but still sarin is apparently the most volatile nerve agent, so even in liquid form it evaporates relatively quickly. Even so, if they had started a fire with a few liters of fuel, even without an explosion, they would have probably killed more than 14 people. If they had pulled out guns, or detonated bombs, the death toll would certainly have been worse.
deleted 5y ago
[deleted]
ezoe 5y ago
Prohibiting certain software doesn't solve any problem. Did US prohibiting the export of strong cryptography solve any problem? Instead, we should rather harden the security of our computer. I consider all smartphones are insecure. Anybody who own or relies on smartphones are just trading security for the convenience. I will never want to own or relies on smartphone... or phone at all.
mrkramer 5y ago
Trade ban wouldn't help because instead of having 2 or 3 spyware you would have 20 or 30 domestically produced spyware. Or in another words every nation would try to make their own national spyware. Now they outsource it so you can easily pinpoint who the producer is.
garfieldnate 5y ago
Is the existence of this product not completely offensive to Apple? If I were them, I would be looking for ways to sue NSO, or otherwise to obtain the Pegasus software and patch all of the vulnerabilities it exploits.
FriedrichN 5y ago
This is somewhat of a tangent but I think hoarding zerodays should be illegal for an individual, company, or state. It would be seen as highly irresponsible if someone held back critical information about a vulnerability in a dam, I don't see how a zeroday is any different. What is especially stupid is that the US does this as well, while they're the ones who are the most vulnerable. Just look at the debacle with WannaCry. These attacks come from countries who have a lot less to lose than the US, yet the US insists on throwing stones from their glass house.

340 points by georgecmu 5y ago

I would like to point out that this kind of tech isn't only used by state sponsored operations. https://www.bbc.com/news/technology-50166147 https://www.bbc.com/news/technology-50166147 Lone wolf creepers or quasi legal harassment companies have access to similar tools. https://www.nefariousjobsmain.com/the-works https://www.nefariousjobsmain.com/the-works https://www.vice.com/en/article/ppmpe8/a-revenge-for-hire-business-exists-in-san-francisco https://www.vice.com/en/article/ppmpe8/a-revenge-for-hire-bu... Although of course the state sponsored aspect of this is very real too, and the greatest threat.

AlexAndScripts 5y ago
That is entirely disgusting. Destroying a life for money. That that's a possibility...
- blooalien 5y ago
  That's what happens when people are trained from birth that money is always more important than anything else.
  - andrei_says_ 5y ago
    And to see being rich as an indicator of merit.
    - blooalien 5y ago
      Sad but true.
squarefoot 5y ago
> Lone wolf creepers or quasi legal harassment companies have access to similar tools. I would take that for granted, as I do with any government, including mine. But thinking that you're more likely to be kept under surveillance by the same government -no matter the color- you fund with your taxes, than some private or foreign entity, makes this even more revolting. Makes one think if nationalism was invented as a tool to throw smoke in the eyes and minds of people so that they can't see their rulers for what they really are.
- cinquemb 5y ago
  The collusion of leaders wrt to their personal business interests can make states seem like protection rackets…
lupire 5y ago
How is parler kicked off its hosting but a site plainly advertising criminal acts for hire is up and has a US domain name?
- ipspam 5y ago
  Hatred of anything not progressive, and especially of conservatives.
- SMAAART 5y ago
  What "criminal acts" are you specifically talking about?
- brokenmachine 5y ago
  Nobody wants to deal with parler, and that's their prerogative. Free market and all that. What criminal acts?
- snypher 5y ago
  I'd guess because it's total cosplay. Edit: "Severe psychological warning, this package is only available for use on clients over 30 years of age." ...because a 26 year old can't handle getting a dildo in the mail?
cinquemb 5y ago
Cheaper than ever for anyone to spy on anyone else, esp with the social media skinner boxes out there with hardware frontends. Getting cheaper by the day…

beebeepka 5y ago

Trade ban... Every single government uses such tools. The ones that don't likely have bigger problems such as sustenance, lack of electricity, etc. What people should be looking at is the crazy amount of Israeli presence in the so called cyber security sector. I can think of a few such companies that literally spy and track hundreds of thousands of people all over the world. The government is using their services and therefore lets them whatever they want. I know a few guys working for such companies. No longer friends with them. Works foriteral evil. No better than military types

newacct583 5y ago
> What people should be looking at is the crazy amount of Israeli presence in the so called cyber security sector. Limiting the ability of nations to export this kind of capability as a product for other entities to use is precisely what "trade ban" would do. You're right that a trade ban won't affect the ability of nations to develop and deploy their own spyware, but most of the targets in the Pegasus dump seem to be of people peripheral to smaller governments that don't have this kind of capability themselves (which is exactly why they buy it!).
- anothernewdude 5y ago
  Nations that want to do this will do it, and trade bans won't stop them. Or even discourage them. It's like banning arms sales to countries like Saudi Arabia. All it does is push them towards China or Russia. Banning this stuff just leads to consolidated power blocs of nasty regimes.
  - newacct583 5y ago
    > Nations that want to do this will do it, and trade bans won't stop them. Again, that's experimentally false. Saudi and Mexico didn't develop their own home-grown spyware. They bought an Israeli product instead. This stuff is harder than you think.
    - throwaway33432 5y ago

runningmike 5y ago

20 years ago I discovered antivirus software did not detect spyware by design. So never ever trust software that is not FOSS. Use Foss with reproducible builds to be a bit more safe against these by design created weaknesses.

blooalien 5y ago
Sadly, most people when hearing this will prefer to argue to the death to support their "choice" of ${favorite giant corporate product} and try to tell you "you're just being paranoid". We live in a world where a great many people will accept the most outlandish conspiracy theories as undeniable fact with little to no supporting evidence, but when you try to warn them about real and verifiable concerns, it doesn't matter how much proof there is… You're automatically wrong in their eyes. What's more terrifying than that? Some of those people hold positions of great power in this world.
- TaylorAlexander 5y ago
  We've got to get to them before microsoft and google do. Teach Linux in schools and about the importance of FLOSS. In my school in California it was all windows in the 1990's and 2000's.
  - blooalien 5y ago
    > In my school in California it was all windows in the 1990's and 2000's. Yeah, it was that way even before that. Microsoft and Apple got into a "donation war" tryin'a get their corporate garbage into schools back when I was a kid. Looks like Microsoft largely won that war. Hard to fight multiple generations deep corporate brainwashing.
    - TaylorAlexander 5y ago
      Ah yes, the efficiency of the free market. Where companies with deep pockets get kids hooked on their product early so they can abuse them for the rest of their lives. In these cases I think administrative oversight of broad and long term benefits to society is important, rather than the more narrow decision of "this choice will benefit next year's budget". Early offers by Microsoft were in a way a trap that kept schools and students paying for decades.

ttctciyf 5y ago

It continues to strike me as a little odd that (AFAIK) there's no mention in The Guardian's reporting of this story of the parallel technology[1] sold by Gamma Group[2] and licensed for export by UK to several suspect regimes[3]. Extensive (40G) information on this was leaked via reddit in August 2014[4], and the leaker noted[5]: > I assumed the hacking would be the hard part and once I got the data it would just kinda go viral on it's own or something. But it turn's out without any media access or idea how that shit works, getting people to notice or care is actually kind of hard. ------ 1: "FinSpy Mobile. Version 4.4, released in of Q4 2012, has the ability to collect data through Skype across iOS, Blackberry, Android, and Windows Mobile platforms . An updated Version 4.5, released in Q1 2013, included the ability to target emails, calendars and keylogging of Windows Phones, and an updated ability to collect data through the camera of a Blackberry or iOS phone." - https://privacyinternational.org/blog/1522/six-things-we-know-latest-finfisher-documents https://privacyinternational.org/blog/1522/six-things-we-kno... (2014) 2: https://en.wikipedia.org/wiki/Gamma_Group https://en.wikipedia.org/wiki/Gamma_Group 3: https://www.independent.co.uk/news/uk/politics/uk-spyware-wiretaps-saudi-arabia-china-bahrain-uae-human-rights-a9613206.html https://www.independent.co.uk/news/uk/politics/uk-spyware-wi... 4: https://privacyinternational.org/blog/1522/six-things-we-know-latest-finfisher-documents https://privacyinternational.org/blog/1522/six-things-we-kno... 5: https://www.reddit.com/r/Anarchism/comments/2cjlop/gamma_international_leaked/ https://www.reddit.com/r/Anarchism/comments/2cjlop/gamma_int...

ozymandias12 5y ago
NSO gets the mic because its the biggest commercial name, there are several other companies that fly under the radar with similar technologies. I like what some other user proposed here: military grade classification. Tada. Now sanctions apply to both sellers and users of this crap.
- ttctciyf 5y ago
  I think there is a licensing procedure in the UK and Germany (Gamma Group) and Israel (NSO), and lip-service to the idea that it's forbidden to sell to repressive regimes, already. The big deal with the NSO story is the 50K target names, I think, and it is a big deal, but you'd expect in a supposedly oppositional paper like the Grauniad, that there'd be some mention of the current UK government's spotty record in this very department, and a sense of the history of the abuse of this technology. I'd have a hard time believing that any of this is news to the journalists reporting the story.

xbar 5y ago

Classifying such technology as military weapons would begin to address a number of international and national concerns with for-sale-malware (aka spyware). The use of such military weapons by civilians (or civilian police) against civilians become more obviously ban-able.

Goety 5y ago
Enforcement here would probably be centered on adding additional sentencing time or punishment for misuse. That said we have near zero ability to enforce this at the moment.
milderworkacc 5y ago
While I agree that the trade in these tools is reprehensible, I worry about creating a new class of software that is prohibited to possess or trade in. It wasn't so long ago that strong encryption was labelled a 'dual use technology', and moving it across national borders was non-trivial. How long will it take for pentesting tools and end-to-end encryption to be labelled 'military weapons' under such a scheme?
- xbar 5y ago
  I worry, too. Regulators do hatchet jobs when it comes to software law. But slippery slopes aside, it's pretty clear that selling tools to take over phones en masse is a bad deal for free societies. Here's what we will find next: military and political leaders' phones have also already been compromised by NSO Group tools. I feel confident it has happened at a higher rate than among journalists. Imagine both your favorite and your most hated political firebrands: how will their rhetoric sound when they realize they've been pwned by the opposition for the past year using COTS tools?
rapind 5y ago
> The use of such military weapons by civilians (or civilian police) against civilians become more obviously ban-able. Not sure it would stop the police part. https://en.wikipedia.org/wiki/Militarization_of_police https://en.wikipedia.org/wiki/Militarization_of_police

tinus_hn 5y ago

As the government that allows itself to use this spyware will always have an advantage over the government that does not, it will never be banned.

brokenmachine 5y ago
Like chemical weapons?
- tsimionescu 5y ago
  Chemical weapons were easily banned because they are almost entirely useless as long as you have access to conventional weapons. They are expensive to store, very inefficient for actually killing the opposition, easy to guard against, have a higher chance of turning back on you, and will slow your advance if you use them in an attack. They are at best a tool for terror or desperation. Think about the Tokyo metro attacks and, not to minimize the tragedy, but how many more lives would have been lost if they had detonated similar quantities of explosives instead of spreading sarin gas - and that is inside a closed tube, with no protection whatsoever and with most victims receiving no medical care until many hours later, as hospitals were entirely unprepared for a gas attack.
  - brokenmachine 5y ago
    Good points. I do wonder about next-gen chemical/genetic weapons that advanced countries could create with the motivation though. Like some crazy airborne virus but only the good guys™ have the antidote/vaccine. >how many more lives would have been lost if they had detonated similar quantities of explosives Wasn't it just a few guys with suitcases, and I think one of them didn't even puncture the container? With conventional weapons there might be more deaths but maybe not.
    - tsimionescu 5y ago
      It's possible, but still unlikely to be as effective or safe as bombing your target to the ground. > Wasn't it just a few guys with suitcases, and I think one of them didn't even puncture the container? With conventional weapons there might be more deaths but maybe not. They had several liters of sarin gas, most of which was splashed on the ground entirely. If they had had some way to spread it as an aerosol the death toll would have been much greater, but still sarin is apparently the most volatile nerve agent, so even in liquid form it evaporates relatively quickly. Even so, if they had started a fire with a few liters of fuel, even without an explosion, they would have probably killed more than 14 people. If they had pulled out guns, or detonated bombs, the death toll would certainly have been worse.

deleted 5y ago

[deleted]

ezoe 5y ago

Prohibiting certain software doesn't solve any problem. Did US prohibiting the export of strong cryptography solve any problem? Instead, we should rather harden the security of our computer. I consider all smartphones are insecure. Anybody who own or relies on smartphones are just trading security for the convenience. I will never want to own or relies on smartphone... or phone at all.

mrkramer 5y ago

Trade ban wouldn't help because instead of having 2 or 3 spyware you would have 20 or 30 domestically produced spyware. Or in another words every nation would try to make their own national spyware. Now they outsource it so you can easily pinpoint who the producer is.

garfieldnate 5y ago

Is the existence of this product not completely offensive to Apple? If I were them, I would be looking for ways to sue NSO, or otherwise to obtain the Pegasus software and patch all of the vulnerabilities it exploits.

FriedrichN 5y ago

This is somewhat of a tangent but I think hoarding zerodays should be illegal for an individual, company, or state. It would be seen as highly irresponsible if someone held back critical information about a vulnerability in a dam, I don't see how a zeroday is any different. What is especially stupid is that the US does this as well, while they're the ones who are the most vulnerable. Just look at the debacle with WannaCry. These attacks come from countries who have a lot less to lose than the US, yet the US insists on throwing stones from their glass house.