15 ms·

So, what is the legality of this? I've not followed much about this at all, but NSO group appears to be an Israeli company. Do they just sell, or operate the h

So, what is the legality of this? I've not followed much about this at all, but NSO group appears to be an Israeli company. Do they just sell, or operate the hacking software for their clients? If they operate it, is it illegal for an Israeli company to hack an American citizen (I assume it is illegal in America, but how about Israel?) Is the sale of hacking software regulated in any way?

PeterisP 5y ago
Since this is an international issue and there's no global "legality", the effect is that locations matter a lot. Presumably, the hacking was done by Saudi authorities from SA, using NSO-developed tools. Citizenship of the target is not very relevant, but it does matter where "the event" happened. If the reporter was in Saudi Arabia when the hack happened, then Saudi laws apply and essentially Saudi government gets to set conditions on whether it was legal or not, and if it was forbidden by their laws, then what consequences (if any!) that should have. If the reporter was in USA at the time, then it would be reasonable to apply US jurisdiction and try and investigate it as a crime in USA. However, Saudi Arabia can refuse to cooperate and even if USA prosecutors identify the culprits and convict them, Saudi Arabia can refuse to extradite them and choose to protect them. In essence, if it's not a random foreign criminal but someone from the actual foreign government that has harmed USA citizens in USA, it's not really a criminal matter as much as a diplomatic one, where all the other aspects of USA-Saudi relationships matter much more than any facts about the actual case; USA can choose to make a big deal out of it or ignore it, but historical precedent shows that it likely will be ignored as the Department of State considers all the other factors of Middle Eastern politics as much more important, SA could likely get away with literal murder (e.g. Khashoggi), not just some hacks. In a similar manner, perhaps you could argue that NSO is an accomplice in that crime (I'm not saying that this would succeed - in general, arms exporters are not considered liable for whoever the purchasing country harms), but that essentially comes down to (a) whether USA prosecutors are willing to pursue this, and (b) whether Israel is willing to cooperate, as in the absence of specific treaties it would be legitimate for Israel to say "NSO did not violate our laws, we won't enforce any foreign judgements about this event"; if so, then any action would be limited to seizing whatever assets NSO has in USA (if any!) and/or trying to capture the involved people (if specific people can be identified) when they are traveling outside of Israel somewhere within the reach of USA. USA could apply diplomatic pressure to get Israel to restrict NSO, however, it doesn't seem likely that USA wants it so much to actually try and change that. For another of your questions, sale of hacking software can be regulated by countries in whatever way each country wishes. In this case, as far as I understand, Israel treats is as essentially an equivalent of "arms export" where NSO has to obtain approval from Israel government for their foreign customers, but in this case it is not contested that NSO did have all the required approvals to sell their tools to Saudi Arabia.
- deleted 5y ago
  [deleted]
- caf 5y ago
  There are allegations that the NSO Group doesn't provide the 0days they're using to their customers, so they are in fact performing the intrusions themselves.
  - sterlind 5y ago
    sounds like they should be treated like mercenaries.
    - PeterisP 5y ago
      What exactly do you mean by "treated like mercenaries", what should be the treatment in your opinion ? In general, countries do hire mercenaries/private military contractors/etc, and it is not considered anything special, and many powerful countries (including e.g. the USA) routinely use mercenaries in their campaigns. the "sending" nation may restrict their people and companies from mercenary actions abroad if they choose to, but if e.g. Israel is okay with their company hiring out as a "mercenary" (the term usually implies directly participating in a conflict while being armed and excludes any other support such as training, logistics, software, etc, but for the sake of argument let's assume it applies here) for Saudi Arabia then there would be nothing unusual about that - for example, Saudi Arabia has used thousands of mercenaries in Yemen. If the specific individuals commit something that's a crime in USA then USA can try to put them on trial, but that works exactly the same no matter if they're Saudi citizens working Saudi government or serving in Saudi military, or foreigners contracted out to Saudi government as "mercenaries"; in both cases it's up to the local government whether they want to hand them over (effectively betraying their own "employees") or refuse.
      - KMag 5y ago
        Presumably the GP means that the NSO employees should be held personally responsible for actions taken by the NSO group, without diplomatic cover or ability to claim that they're law enforcement/military/intelligence. They are civilians, not uniformed government employees.
mensetmanusman 5y ago
It is marketed to law enforcement like most spy-craft. If it gets in to the wrong hands what do you do?
thr0wawayf00 5y ago
Since the US government has historically been one of the largest customers in the zero-day market, my guess would be no.
- krisoft 5y ago
  The US government is also one of the largest customers of ICBM rockets too. And you would find that it is not an unregulated field at all. I don’t know about regulations in the field. All I know is that “US gov buys a lot of X, therefore it X is not regulated” is not a convincing argument.
  - AmericanChopper 5y ago
    The government’s ability to prevent software distribution is limited significantly by the first amendment. Selling “a tool for hacking” is fine, selling “a tool for committing crime” would be illegal, but that distinction just comes down to picking the right marketing copy. The government can however restrict the import and export of software quite broadly. This is not legal advice, obviously.
    - lazide 5y ago
      Well, and the first amendment only matters if someone gets it to court, the court accepts it (not easy to get against the federal gov’t), the evidence or the plaintiff doesn’t ‘disappear’ in the mean time, etc.
      - AmericanChopper 5y ago
        Depends on what kind of court you’re talking about. If you’re talking about civil court, then any software (or anything at all really) can be used for committing a tort. If the government tried to ban certain types of software from being made/distributed, they would either make a law that’s never enforced (like the obviously unconstitutional DMCA anti-circumvention law), or a law that’s immediately struck down by the courts.
    - 5y ago
fidesomnes 5y ago
yes. mostly just ITAR as far as I know back in 2016.
cronix 5y ago
My understanding is they sell it, after the Israeli gov't (Israeli Defense Ministry) vets the sale. It is operated by the client. NSO has claimed they do not have any info on targets by the purchaser, and has no way to find out post-sale. https://www.cbsnews.com/news/interview-with-ceo-of-nso-group-spyware-maker-fighting-terror-khashoggi-murder-and-saudi-arabia-60-minutes-2019-08-18/ https://www.cbsnews.com/news/interview-with-ceo-of-nso-group...
- _jal 5y ago
  > NSO has claimed they do not have any info on targets by the purchaser, and has no way to find out post-sale. They've also made other claims that only make sense if they do. https://www.techdirt.com/articles/20210723/22444547234/nso-group-attempting-to-distance-itself-damaging-leak-offering-up-contradictory-statements-nothing-to-fear-platitudes.shtml https://www.techdirt.com/articles/20210723/22444547234/nso-g...
- ianhawes 5y ago
  US DOJ has notably secured convictions against spyware authors that simply sold the software. There is no legal distinction between "dude in his apartment" versus "multinational Israeli defense contractor" in this regard.
- sva_ 5y ago
  A german article[0] claimed that only a hashvalue of the telephone number is transmitted to NSO Group: > "Das BKA hat nach Angaben der stellvertretenden Behördenleiterin sichergestellt, dass keine sensiblen Daten bei der Firma NSO landen würden. So würden Hashwerte für Telefonnummern vergeben, damit das Unternehmen die Zielpersonen nicht identifizieren könne." They claim that this way the NSO Group would not be able to identify the victims. Obviously that is a fat lie, as a phone number hash could trivially be brute-forced, even on a home pc. From the sounds of it, NSO Group does not give out the zeroday exploits, but rather do the dirty work of exploiting/infecting the victim themselves, and then hand over control. But the writing is pretty vague. Seeing all these democratic countries, including my home country support this kind of stuff by buying their malware, is extremely disheartening to me, when there is clear evidence that it is being misused by authoritarian governments. It also makes me feel powerless. [0] https://www.tagesschau.de/investigativ/ndr-wdr/spaeh-software-pegasus-smartphone-103.html https://www.tagesschau.de/investigativ/ndr-wdr/spaeh-softwar...
perihelions 5y ago
I read that it's export-controlled now in the US, https://www.theverge.com/2021/10/22/22740155/commerce-departments-new-rule-hacking-tools-china-russia https://www.theverge.com/2021/10/22/22740155/commerce-depart... ("New US rules on spyware exports try to limit surveillance tech like Pegasus") edit: and HN thread https://news.ycombinator.com/item?id=28933981 https://news.ycombinator.com/item?id=28933981 ("U.S. tightens export controls on items used in surveillance of private citizens")
- driverdan 5y ago
  NSO is in Israel. US export controls do not apply.
cronix 5y ago
> (I assume it is illegal in America, but how about Israel?) This part doesn't matter much in practicality. Like it is illegal for the US gov't to spy on their citizens. It is illegal for the UK to spy on their citizens. So the NSA made a deal with the UK. They spy on us, we spy on them, and exchange the info. There, the US didn't break the law and neither did the UK. They worked around it. We live in a shadowy world. https://www.theguardian.com/world/2013/nov/20/us-uk-secret-deal-surveillance-personal-data https://www.theguardian.com/world/2013/nov/20/us-uk-secret-d...
- White_Wolf 5y ago
  I'm not sure if this counts as spying but in UK they are allowed to monitor people to quite a large extent if I got this right. I think refusing to decrypt your device when requested is also punishable. https://www.theverge.com/2016/11/23/13718768/uk-surveillance-laws-explained-investigatory-powers-bill https://www.theverge.com/2016/11/23/13718768/uk-surveillance...
  - xxpor 5y ago
    Yeah the whole "unwritten constitution" thing is very laughable, if we're honest. At least the US Federal gov has to pretend to care about the 4th and 5th amendments.
    - FridayoLeary 5y ago
      If were honest, the us is held together by a few pieces of paper written by a bunch of men 250 years ago that wasn't meant to last 20 years and has since become the sparring ground of lawyers who have twisted it beyond recognition no doubt.
  - cesaref 5y ago
    Indeed, I don't think the UK government has any problem hacking phones if they believe this is required, but it's likely to involve disclosure to the courts, and hence in some way be accountable. It's therefore easier to get a friendly government to do the hacking and to pass on the discovered info, which side-steps any legal accountability.
bink 5y ago
Hacking is a crime in both Israel and the US. If either government wanted to they could pursue charges. Selling exploits is not illegal in either country AFAIK, and is in fact a booming business.
- kevin_thibedeau 5y ago
  > Hacking is a crime in both Israel and the US. It isn't a crime to exploit your own property.
- lazide 5y ago
  Hacking someone in Israel is the crime right? Same as in the US it’s a crime to hack someone in the US? If the US group hacks someone in Israel and the Israeli group hacks someone in the US, then they’re fine as long as they don’t vacation in the country while someone is looking to serve them with a warrant?
  - megous 5y ago
    Extraditions are a thing. (in general)
    - lazide 5y ago
      But also have to meet a relatively high bar internationally, and require some evidence gathering to meet that bar which is nearly impossible in the situations we are describing. No US law enforcement is going to honor an Israeli subpeona I believe, and vice versa.
deleted 5y ago
[deleted]
eyeball 5y ago
https://darknetdiaries.com/episode/100/ https://darknetdiaries.com/episode/100/ Interesting podcast on NSO group from darknet diaries.
gerash 5y ago
US politics is bizarre. When Ben and Jerry's ice creams decided they wanted to close shop in some disputed territories in Israel many states (mostly Republican run) punished the parent company immediately to make an example of them and sold their holdings of its stock from the pension funds they were controlling. Yet a company like NSO weaponizes and abuses all sorts of vulnerabilities they get their hands on and sell it to thugs around the world who then use it against Americans and the same politicians couldn't care less

PeterisP 5y ago

Since this is an international issue and there's no global "legality", the effect is that locations matter a lot. Presumably, the hacking was done by Saudi authorities from SA, using NSO-developed tools. Citizenship of the target is not very relevant, but it does matter where "the event" happened. If the reporter was in Saudi Arabia when the hack happened, then Saudi laws apply and essentially Saudi government gets to set conditions on whether it was legal or not, and if it was forbidden by their laws, then what consequences (if any!) that should have. If the reporter was in USA at the time, then it would be reasonable to apply US jurisdiction and try and investigate it as a crime in USA. However, Saudi Arabia can refuse to cooperate and even if USA prosecutors identify the culprits and convict them, Saudi Arabia can refuse to extradite them and choose to protect them. In essence, if it's not a random foreign criminal but someone from the actual foreign government that has harmed USA citizens in USA, it's not really a criminal matter as much as a diplomatic one, where all the other aspects of USA-Saudi relationships matter much more than any facts about the actual case; USA can choose to make a big deal out of it or ignore it, but historical precedent shows that it likely will be ignored as the Department of State considers all the other factors of Middle Eastern politics as much more important, SA could likely get away with literal murder (e.g. Khashoggi), not just some hacks. In a similar manner, perhaps you could argue that NSO is an accomplice in that crime (I'm not saying that this would succeed - in general, arms exporters are not considered liable for whoever the purchasing country harms), but that essentially comes down to (a) whether USA prosecutors are willing to pursue this, and (b) whether Israel is willing to cooperate, as in the absence of specific treaties it would be legitimate for Israel to say "NSO did not violate our laws, we won't enforce any foreign judgements about this event"; if so, then any action would be limited to seizing whatever assets NSO has in USA (if any!) and/or trying to capture the involved people (if specific people can be identified) when they are traveling outside of Israel somewhere within the reach of USA. USA could apply diplomatic pressure to get Israel to restrict NSO, however, it doesn't seem likely that USA wants it so much to actually try and change that. For another of your questions, sale of hacking software can be regulated by countries in whatever way each country wishes. In this case, as far as I understand, Israel treats is as essentially an equivalent of "arms export" where NSO has to obtain approval from Israel government for their foreign customers, but in this case it is not contested that NSO did have all the required approvals to sell their tools to Saudi Arabia.

deleted 5y ago
[deleted]
caf 5y ago
There are allegations that the NSO Group doesn't provide the 0days they're using to their customers, so they are in fact performing the intrusions themselves.
- sterlind 5y ago
  sounds like they should be treated like mercenaries.
  - PeterisP 5y ago
    What exactly do you mean by "treated like mercenaries", what should be the treatment in your opinion ? In general, countries do hire mercenaries/private military contractors/etc, and it is not considered anything special, and many powerful countries (including e.g. the USA) routinely use mercenaries in their campaigns. the "sending" nation may restrict their people and companies from mercenary actions abroad if they choose to, but if e.g. Israel is okay with their company hiring out as a "mercenary" (the term usually implies directly participating in a conflict while being armed and excludes any other support such as training, logistics, software, etc, but for the sake of argument let's assume it applies here) for Saudi Arabia then there would be nothing unusual about that - for example, Saudi Arabia has used thousands of mercenaries in Yemen. If the specific individuals commit something that's a crime in USA then USA can try to put them on trial, but that works exactly the same no matter if they're Saudi citizens working Saudi government or serving in Saudi military, or foreigners contracted out to Saudi government as "mercenaries"; in both cases it's up to the local government whether they want to hand them over (effectively betraying their own "employees") or refuse.
    - KMag 5y ago
      Presumably the GP means that the NSO employees should be held personally responsible for actions taken by the NSO group, without diplomatic cover or ability to claim that they're law enforcement/military/intelligence. They are civilians, not uniformed government employees.

mensetmanusman 5y ago

It is marketed to law enforcement like most spy-craft. If it gets in to the wrong hands what do you do?

thr0wawayf00 5y ago

Since the US government has historically been one of the largest customers in the zero-day market, my guess would be no.

krisoft 5y ago
The US government is also one of the largest customers of ICBM rockets too. And you would find that it is not an unregulated field at all. I don’t know about regulations in the field. All I know is that “US gov buys a lot of X, therefore it X is not regulated” is not a convincing argument.
- AmericanChopper 5y ago
  The government’s ability to prevent software distribution is limited significantly by the first amendment. Selling “a tool for hacking” is fine, selling “a tool for committing crime” would be illegal, but that distinction just comes down to picking the right marketing copy. The government can however restrict the import and export of software quite broadly. This is not legal advice, obviously.
  - lazide 5y ago
    Well, and the first amendment only matters if someone gets it to court, the court accepts it (not easy to get against the federal gov’t), the evidence or the plaintiff doesn’t ‘disappear’ in the mean time, etc.
    - AmericanChopper 5y ago
      Depends on what kind of court you’re talking about. If you’re talking about civil court, then any software (or anything at all really) can be used for committing a tort. If the government tried to ban certain types of software from being made/distributed, they would either make a law that’s never enforced (like the obviously unconstitutional DMCA anti-circumvention law), or a law that’s immediately struck down by the courts.
  - 5y ago

fidesomnes 5y ago

yes. mostly just ITAR as far as I know back in 2016.

cronix 5y ago

My understanding is they sell it, after the Israeli gov't (Israeli Defense Ministry) vets the sale. It is operated by the client. NSO has claimed they do not have any info on targets by the purchaser, and has no way to find out post-sale. https://www.cbsnews.com/news/interview-with-ceo-of-nso-group-spyware-maker-fighting-terror-khashoggi-murder-and-saudi-arabia-60-minutes-2019-08-18/ https://www.cbsnews.com/news/interview-with-ceo-of-nso-group...

_jal 5y ago
> NSO has claimed they do not have any info on targets by the purchaser, and has no way to find out post-sale. They've also made other claims that only make sense if they do. https://www.techdirt.com/articles/20210723/22444547234/nso-group-attempting-to-distance-itself-damaging-leak-offering-up-contradictory-statements-nothing-to-fear-platitudes.shtml https://www.techdirt.com/articles/20210723/22444547234/nso-g...
ianhawes 5y ago
US DOJ has notably secured convictions against spyware authors that simply sold the software. There is no legal distinction between "dude in his apartment" versus "multinational Israeli defense contractor" in this regard.
sva_ 5y ago
A german article[0] claimed that only a hashvalue of the telephone number is transmitted to NSO Group: > "Das BKA hat nach Angaben der stellvertretenden Behördenleiterin sichergestellt, dass keine sensiblen Daten bei der Firma NSO landen würden. So würden Hashwerte für Telefonnummern vergeben, damit das Unternehmen die Zielpersonen nicht identifizieren könne." They claim that this way the NSO Group would not be able to identify the victims. Obviously that is a fat lie, as a phone number hash could trivially be brute-forced, even on a home pc. From the sounds of it, NSO Group does not give out the zeroday exploits, but rather do the dirty work of exploiting/infecting the victim themselves, and then hand over control. But the writing is pretty vague. Seeing all these democratic countries, including my home country support this kind of stuff by buying their malware, is extremely disheartening to me, when there is clear evidence that it is being misused by authoritarian governments. It also makes me feel powerless. [0] https://www.tagesschau.de/investigativ/ndr-wdr/spaeh-software-pegasus-smartphone-103.html https://www.tagesschau.de/investigativ/ndr-wdr/spaeh-softwar...

perihelions 5y ago

I read that it's export-controlled now in the US, https://www.theverge.com/2021/10/22/22740155/commerce-departments-new-rule-hacking-tools-china-russia https://www.theverge.com/2021/10/22/22740155/commerce-depart... ("New US rules on spyware exports try to limit surveillance tech like Pegasus") edit: and HN thread https://news.ycombinator.com/item?id=28933981 https://news.ycombinator.com/item?id=28933981 ("U.S. tightens export controls on items used in surveillance of private citizens")

driverdan 5y ago
NSO is in Israel. US export controls do not apply.

cronix 5y ago

> (I assume it is illegal in America, but how about Israel?) This part doesn't matter much in practicality. Like it is illegal for the US gov't to spy on their citizens. It is illegal for the UK to spy on their citizens. So the NSA made a deal with the UK. They spy on us, we spy on them, and exchange the info. There, the US didn't break the law and neither did the UK. They worked around it. We live in a shadowy world. https://www.theguardian.com/world/2013/nov/20/us-uk-secret-deal-surveillance-personal-data https://www.theguardian.com/world/2013/nov/20/us-uk-secret-d...

White_Wolf 5y ago
I'm not sure if this counts as spying but in UK they are allowed to monitor people to quite a large extent if I got this right. I think refusing to decrypt your device when requested is also punishable. https://www.theverge.com/2016/11/23/13718768/uk-surveillance-laws-explained-investigatory-powers-bill https://www.theverge.com/2016/11/23/13718768/uk-surveillance...
- xxpor 5y ago
  Yeah the whole "unwritten constitution" thing is very laughable, if we're honest. At least the US Federal gov has to pretend to care about the 4th and 5th amendments.
  - FridayoLeary 5y ago
    If were honest, the us is held together by a few pieces of paper written by a bunch of men 250 years ago that wasn't meant to last 20 years and has since become the sparring ground of lawyers who have twisted it beyond recognition no doubt.
- cesaref 5y ago
  Indeed, I don't think the UK government has any problem hacking phones if they believe this is required, but it's likely to involve disclosure to the courts, and hence in some way be accountable. It's therefore easier to get a friendly government to do the hacking and to pass on the discovered info, which side-steps any legal accountability.

bink 5y ago

Hacking is a crime in both Israel and the US. If either government wanted to they could pursue charges. Selling exploits is not illegal in either country AFAIK, and is in fact a booming business.

kevin_thibedeau 5y ago
> Hacking is a crime in both Israel and the US. It isn't a crime to exploit your own property.
lazide 5y ago
Hacking someone in Israel is the crime right? Same as in the US it’s a crime to hack someone in the US? If the US group hacks someone in Israel and the Israeli group hacks someone in the US, then they’re fine as long as they don’t vacation in the country while someone is looking to serve them with a warrant?
- megous 5y ago
  Extraditions are a thing. (in general)
  - lazide 5y ago
    But also have to meet a relatively high bar internationally, and require some evidence gathering to meet that bar which is nearly impossible in the situations we are describing. No US law enforcement is going to honor an Israeli subpeona I believe, and vice versa.

deleted 5y ago

[deleted]

eyeball 5y ago

https://darknetdiaries.com/episode/100/ https://darknetdiaries.com/episode/100/ Interesting podcast on NSO group from darknet diaries.

gerash 5y ago

US politics is bizarre. When Ben and Jerry's ice creams decided they wanted to close shop in some disputed territories in Israel many states (mostly Republican run) punished the parent company immediately to make an example of them and sold their holdings of its stock from the pension funds they were controlling. Yet a company like NSO weaponizes and abuses all sorts of vulnerabilities they get their hands on and sell it to thugs around the world who then use it against Americans and the same politicians couldn't care less