13 ms·
There is an incredibly well produced podcast episode on these ex-NSA engineers working for the UAE that came out a couple of years ago. Check out Darknet Diarie
by badRNG 5y ago
There is an incredibly well produced podcast episode on these ex-NSA engineers working for the UAE that came out a couple of years ago. Check out Darknet Diaries Ep47: Project Raven [1].
Synopsis is that the UAE hires ex-NSA employees as "penetration testers" and when they enter the country for cybersecurity work, some are pulled aside to be briefed to an opportunity called "Project Raven" to assist Emirati intelligence with targeting, allegedly in the interest of counter-terrorism. The thing is, only Emiratis have "hands on keyboard" while the US engineers sit beside them and guide them, which supposedly dodges any legal concerns. Those who Jack interviewed decided to leave Project Raven when it became clear they were targeting dissidents, human rights activists, and later, Americans. As you might imagine, ex-NSA employees who target US citizens for a foreign government are breaking the law. I do wonder if it's these ex-Project Raven engineers that have led prosecutors down the road to where we are now.
[1] https://darknetdiaries.com/episode/47/ https://darknetdiaries.com/episode/47/
- bpodgursky 5y ago> The thing is, only Emiratis have "hands on keyboard" while the US engineers sit beside them and guide them, which supposedly dodges any legal concerns. I find it pretty hard to believe any judge would buy this.
- Enginerrrd 5y agoYou're probably right, but I think it also depends... Is a professor at MIT teaching cyber security exploit development guilty of the same crime? What about a consultant teaching how to use a particular tool or how to look for a particular family of exploits? (Potentially legally dodgy, depending on the client, but probably ok in a lot of grey areas) What about a consultant which performs a passive audit of a target for a 3rd party? (Starting to get pretty dodgy, but probably depends both on the 3rd party and the target and the nature of the audit) It's... probably not so cut-and-dry. Though I agree that it doesn't sound like a get-out-of-jail-free card.
- jareklupinski 5y agoI'm sure the intent of the MIT professor/consultant passing their knowledge on to others is to get ahead of the actual attackers and help prevent further crime(s against humanity), not to actively participate...
- gentle 5y agoYou're just being argumentative. You know the answer.
- Enginerrrd 5y agoOh no, that wasn't my intent at all. I was just saying that things in court can get pretty messy when you try to define things precisely with laws that don't directly address edge cases. That's why you see headlines about rulings that seem so counterintuitive and ridiculous upon first glance.
- deleted 5y ago[deleted]
- hguant 5y agoDoes an instructor who trains someone who goes on to commit murder using the techniques they taught become legally culpable for the murder? If your company offers some service - consulting to set up their infrastructure, or helping them navigate AWS - necessary to the running of the company, and that company goes on to commit a crime are you at fault? They couldn't have done it with out you, after all.
- corv 5y agoStrictly ethically speaking, yes they would be at fault
- mmastrac 5y agoLet's say you are a gun instructor. You take your student out to the street, hand them a sniper rifle and point at their victim. You walk them through the process of pulling the trigger and how to make sure they get their target. The judge isn't going to let that slide. In both cases, you are an accessory.
- sterlind 5y agoTechnically I think both parties would be guilty of murder, but that's specific to murder charges. For instance, getaway drivers have been charged with murder because the robbers they transport shoot someone.
- likpok 5y agoThat is specifically "felony murder", which wouldn't apply here (though conspiracy might?). Felony murder is the idea that you are guilty of murder if someone dies as a result of you committing another felony (sometimes from a specific enumerated list). If you are a direct participant in the murder you might just get charged with it (perhaps as a conspirator which I think often has roughly the same penalties).
- deleted 5y ago[deleted]
- 5y ago
- circular_logic 5y agoAgreed. It's one thing to teach general skills and another to help do the actual hacking If they are being guided through the actual hacking then that's saying that only the driver in pair programming is producing code
- mike_d 5y agoYet this would be very familiar to anyone with previous intelligence experience in the US. The person with hands on keyboard will change depending on if the mission is being conducted under Title 10 or Title 50 authority.
- wisty 5y agoI don't think the UAE is concerned about this.
- fidesomnes 5y agoThe NSA breaks so many laws for so long they might as we be their own country. To call them out of control is an understatement of unparalleled power.
- walrus01 5y agoIt sounds to me like the UAE made a decision to stop paying vast sums of money to the NSO group and started throwing money at trying to develop their own similar domestic capability. From a purely pragmatic perspective of a UAE royal family member worried about domestic dissent I can see why they would do that, not that I agree with it in the slightest.
- dr-detroit 5y agoThey stopped back in 2017 when Wannacry happened when we found out that Chinese Russians any mid to high level player has full access to the NSA suite of tools for cheaper than the US traitors. (sorry, not traitors. on HN they are "patriots" lol. I just say traitor because they specifically hate me.)
- ThisIsTheWay 5y ago> It sounds to me like the UAE made a decision to stop paying vast sums of money to the NSO group and started throwing money at trying to develop their own similar domestic capability. Porque no los dos?
- pbhjpbhj 5y agoPresumably, the latter is less of a risk; they probably don't want NSO to know their business and there's going to be at least metadata leaking that points to what they're doing. Plus, presumably, there's always a chance NSO could play them off to a higher bidder?
- ThisIsTheWay 5y agoI agree about UAE wanting to keep their cards close to the chest, but I think the choice between NSO/other third party hacking groups and developing in house is an AND statement, not OR. At the end of the day, developing adequate zero day chains that provide access akin to NSO's Pegasus is an extremely time and talent intensive endeavor, and having multiple options to procure those capabilities is the more likely solution.
- 5y ago
- josephd79 5y agoThat podcast is great. I just found it a couple weeks ago, and I've listened to a few already.
- InvOfSmallC 5y agoI came here to say this. Best podcast ever btw.
- WillPostForFood 5y agoAny other episode recommendations?
- stef25 5y ago- The Stuxnet one is pretty good. Went straight out and bought the book. - The one about Pirate Bay if you want to hear what a collosal, confused prick one of the guys behind it is
- hoten 5y agoThe LinkedIn ep + the next few follow the same story. very good!
- dqv 5y agoStart from the beginning! Manfred Part 1 and Part 2 are great.
- throwaway287391 5y ago"Jeremy From Marketing" (Ep. 36) is another one about a pen tester, and it's really engrossing, like an action thriller in your ears.
- mh8h 5y agoI loved the XBox Underground ones.
- easterncalculus 5y agoSome of the best more recent episodes not mentioned yet: 99 - The Spy 95 - Jon and Brian's Big Adventure 90 - Jenny Jack knows how to tell a good physical pentest story, and these are all awesome.
- topicseed 5y ago+1, and that podcast is incredible... jack's story telling skills are amazing....
- Reubachi 5y agomy one gripe, if it can be called a gripe, is that the episodes are more often than not hard to follow due to the complex topic/length. Looking thru the feed, 8/10 of the recent casts I've listened to are only about 1/4 the way thru before I had to go into work, answer a call, etc. Then it's too hard to get back into, and two more eps have been released by the time I get another itch for DD. Of course, real life is complicated and isn't a movie with a plot, and DD's format rewards knowledge and listening. More of a "doing dishes" podcast. Highly recommend!
- dogman144 5y agoShort-form security podcasts are a dime a dozen though, and they usually fail to gain traction because Sec is a nuanced technical/social topic that doesn’t get covered in 20 mins. DD is very popular, IMO, because it handles this well by longer episodes.
- newbamboo 5y agoThe law seems very debatable at present. See for instance the current uproar over milley/esper decision to resist well established presidential powers. The law is whatever the media conglomerates collectively decide.
- darkerside 5y agoYou're right. Nothing is anything.
- decebalus1 5y agoAnd anything is everything. Then we can deduce that everything is nothing.
- badRNG 5y agoThis has nothing to do with the post nor the comment you're replying to. There's no need to inject an unrelated political point into the top post's top comment; just make your own post about the subject so it can be discussed there.
- newbamboo 5y agoI take your point but disagree that they are unrelated. They are different news items, so I’ll try and isolate my comments in that way. I just think that people working infosec should care a lot about the sanctity of law and the importance of judicial review. If we let the court of popular opinion reign supreme, hackers will always lose and the powers that be, the elite, will always maintain control. Just my opinion, which I will try and keep more narrowly focused in the future.
- decebalus1 5y agoI think there should be a corollary to Godwin's law to call out any thread that is very much subtle in trying to showcase just how much Donald Trump has been wronged by 'the media'. Sadly there's a surprisingly high amount of these on hn.
- pengaru 5y agoDND has some interesting episodes, but "incredibly well produced" is not how I would describe any. And Jack's sophomoric exaggeration of the otherwise banal often echoes of chicken little. If anything it highlights a need for better podcasts in this domain.
- atmosx 5y agoFeel free to create one :-)
- rhizome 5y agoIn the Chicken Little story everybody except Chicken Little is eaten by the fox, do you mean the boy who cried wolf? Except oops, everybody dies in that one too.
- vxNsr 5y agoIn both of those stories the reason that happens is bec the eponymous character loses all credibility by telling many lies, when they finally tell the truth no one believes them.
- rhizome 5y agoNo, in the Foxy Woxy version everybody believes CL and accompanies them to warn the king. The problem comes when they believe that Foxy Woxy knows a shortcut. Point being: Chicken Little is a crappy analogy to use against doomsayers. BwCW is a little better in the abstract, but still inapt for this.
- pengaru 5y agoNobody listens to chicken little because he's overdramatic and hyperbolic, like most children who haven't had enough life experience to temper their reactions. It's been awhile since I saw the film, but that's what I remember. Regardless, even taking my comment less literally and more like "it feels like a children's show" would still be an accurate take.
- noman-land 5y ago+1 for Darknet Diaries. One of the best podcasts I've ever listened to. So simple, yet so gripping, and well told in a sweet spot between hard nerds and casual enthusiasts. I listened to all 100 episodes since discovering the show in July.
- andrei_says_ 5y agoIf you liked this check out You’re Wrong about. Incredibly well researched and incredibly well presented - information packed and funny at the same time.
- duncan-donuts 5y agoYou’re wrong about is an incredible podcast. Spot on about information density and humor. I love it
- bob_theslob646 5y ago?
- badRNG 5y agoI think they meant: You’re Wrong About is an incredible podcast. Spot on about information density and humor. I love it
- noman-land 5y agoThanks for the recommendation. I've added the RSS feed to my podcast player. I look forward to digging in.
- jeanloolz 5y agoSimilar experience. I discovered this podcast earlier this year and got completely hooked. Had to listen to them all.
- poisonarena 5y agoDarknet Diaries podcast host and Talk to me in Python Podcast host sound like the exact same person(they are not), its wild
- robertwt7 5y agoI’m a regular listener to darknet diaries. Geez that guy is awesome, listening to his podcast is like watching a movie. Love it +1 for anyone who hasn’t listened to him. Defo worth your time
- JamesGi 5y agohttps://mobile.twitter.com/Snowden/status/1438291654239215619?s=19 https://mobile.twitter.com/Snowden/status/143829165423921561... Snowden just denounced ExpressVPN because of their CIO involvement in this
- cycomanic 5y agoIt's weird that the agents suddenly discovered their morals. It's not like they didn't know who'd they be working for before being pulled to the side, apart from the fact that the NSA has been helping all sorts of totalitarian governments with information that could have (and likely was) been used against dissidents etc.. It seems more like they pulled out because it was too blatantly illegal and risky and that was the motivation to leave project raven.
- qwertox 5y agoI just got the chance to listen to this podcast and I want to thank you a lot for mentioning it.