3 ms·

They state: "NSO is a technology company. We do not operate the system, nor do we have access to the data of our customers" Yet they also state: "The list is n

They state: "NSO is a technology company. We do not operate the system, nor do we have access to the data of our customers" Yet they also state: "The list is not a list of targets or potential targets of Pegasus." How do they know it is not a list of targets if they don't have access to their customer's lists of targets? None of this is trustworthy and neither are NSO.

mikeyouse 5y ago
In another article - they apparently asked their clients whether they people named in the news stories had been targeted, and then they took their clients' word for it. Just comical. "Hey MBS, did you use our product to target Khashoggi? No? Great, that's a load off."
soheil 5y ago
hmm.. "yet they are obligated to provide us with such information under investigations"
cbsmith 5y ago
You can't trust anyone, but... The Pegasus Project did change their statement from "thousands of numbers that were selected as targets by NSO’s Group clients" to "a list of phone numbers concentrated in countries known to surveil their citizens and also known to have been clients of NSO Group", and they specifically say: "The list does not identify who put the numbers on it, or why, and it is unknown how many of the phones were targeted or surveilled". It sounds like the "list" is from HLR lookups, which get done all the time without NSO being involved. If you think about it, none of NSO's clients would want NSO (or anyone else) to know who they are spying on in the first place, so it stands to reason that there'd not be a centralized list anywhere of targets for their software. I'm sure the list is real and all, but there's a distinct lack of clarity about how that list links to NSO and Pegasus specifically. Now the other bit that the Pegasus Project did was look at phones they suspected of being compromised. I think that's telling in the sense of, "journalists, activists and business people are being targeted". That seems pretty credible, but NSO doesn't seem to be denying that aspect of the story.
- dredmorbius 5y ago
  For those like me unfamiliar. HLR: Home Location Register. A phone-number lookup service / protocol.
rapind 5y ago
Is it relevant even if they are “just a technology company”? “Pipe Bombs Inc.” is just a technology company. They don’t use their products, they just sell them to wackos. Where’s the harm in that?!
smsm42 5y ago
That's a wrong take. Of course they can't claim the list does not include targets or potential (!!) targets at all - if they don't know the potential targets. What they are claiming is that they didn't have such list, and nobody else can plausibly have such list (as they never compiled it, and nobody else had any way to compile it without being able to access data of all clients - which is pretty unlikely), so whatever this list is, it's not what it is claimed to be. It's like I tell you "I hacked your computer and stole the list of all people you know" - and you say "no you didn't, because on my computer there was no such list, so whatever list you have it's not that". Of course it's theoretically possible I watched you for your whole whole life and compiled such list independently - but that's not likely and that's not what I am claiming anyway. Of course, they could be lying and in fact they could have such list (which could then be stolen), but arguing that them claiming they don't have the list contradicts the argument the list is not what it's claimed to be makes no sense. There's no contradiction.

mikeyouse 5y ago

In another article - they apparently asked their clients whether they people named in the news stories had been targeted, and then they took their clients' word for it. Just comical. "Hey MBS, did you use our product to target Khashoggi? No? Great, that's a load off."

soheil 5y ago

hmm.. "yet they are obligated to provide us with such information under investigations"

cbsmith 5y ago

You can't trust anyone, but... The Pegasus Project did change their statement from "thousands of numbers that were selected as targets by NSO’s Group clients" to "a list of phone numbers concentrated in countries known to surveil their citizens and also known to have been clients of NSO Group", and they specifically say: "The list does not identify who put the numbers on it, or why, and it is unknown how many of the phones were targeted or surveilled". It sounds like the "list" is from HLR lookups, which get done all the time without NSO being involved. If you think about it, none of NSO's clients would want NSO (or anyone else) to know who they are spying on in the first place, so it stands to reason that there'd not be a centralized list anywhere of targets for their software. I'm sure the list is real and all, but there's a distinct lack of clarity about how that list links to NSO and Pegasus specifically. Now the other bit that the Pegasus Project did was look at phones they suspected of being compromised. I think that's telling in the sense of, "journalists, activists and business people are being targeted". That seems pretty credible, but NSO doesn't seem to be denying that aspect of the story.

dredmorbius 5y ago
For those like me unfamiliar. HLR: Home Location Register. A phone-number lookup service / protocol.

rapind 5y ago

Is it relevant even if they are “just a technology company”? “Pipe Bombs Inc.” is just a technology company. They don’t use their products, they just sell them to wackos. Where’s the harm in that?!

smsm42 5y ago

That's a wrong take. Of course they can't claim the list does not include targets or potential (!!) targets at all - if they don't know the potential targets. What they are claiming is that they didn't have such list, and nobody else can plausibly have such list (as they never compiled it, and nobody else had any way to compile it without being able to access data of all clients - which is pretty unlikely), so whatever this list is, it's not what it is claimed to be. It's like I tell you "I hacked your computer and stole the list of all people you know" - and you say "no you didn't, because on my computer there was no such list, so whatever list you have it's not that". Of course it's theoretically possible I watched you for your whole whole life and compiled such list independently - but that's not likely and that's not what I am claiming anyway. Of course, they could be lying and in fact they could have such list (which could then be stolen), but arguing that them claiming they don't have the list contradicts the argument the list is not what it's claimed to be makes no sense. There's no contradiction.