3 ms·

My understanding is they sell it, after the Israeli gov't (Israeli Defense Ministry) vets the sale. It is operated by the client. NSO has claimed they do not ha

by cronix 5y ago

My understanding is they sell it, after the Israeli gov't (Israeli Defense Ministry) vets the sale. It is operated by the client. NSO has claimed they do not have any info on targets by the purchaser, and has no way to find out post-sale. https://www.cbsnews.com/news/interview-with-ceo-of-nso-group-spyware-maker-fighting-terror-khashoggi-murder-and-saudi-arabia-60-minutes-2019-08-18/ https://www.cbsnews.com/news/interview-with-ceo-of-nso-group...

_jal 5y ago
> NSO has claimed they do not have any info on targets by the purchaser, and has no way to find out post-sale. They've also made other claims that only make sense if they do. https://www.techdirt.com/articles/20210723/22444547234/nso-group-attempting-to-distance-itself-damaging-leak-offering-up-contradictory-statements-nothing-to-fear-platitudes.shtml https://www.techdirt.com/articles/20210723/22444547234/nso-g...
ianhawes 5y ago
US DOJ has notably secured convictions against spyware authors that simply sold the software. There is no legal distinction between "dude in his apartment" versus "multinational Israeli defense contractor" in this regard.
sva_ 5y ago
A german article[0] claimed that only a hashvalue of the telephone number is transmitted to NSO Group: > "Das BKA hat nach Angaben der stellvertretenden Behördenleiterin sichergestellt, dass keine sensiblen Daten bei der Firma NSO landen würden. So würden Hashwerte für Telefonnummern vergeben, damit das Unternehmen die Zielpersonen nicht identifizieren könne." They claim that this way the NSO Group would not be able to identify the victims. Obviously that is a fat lie, as a phone number hash could trivially be brute-forced, even on a home pc. From the sounds of it, NSO Group does not give out the zeroday exploits, but rather do the dirty work of exploiting/infecting the victim themselves, and then hand over control. But the writing is pretty vague. Seeing all these democratic countries, including my home country support this kind of stuff by buying their malware, is extremely disheartening to me, when there is clear evidence that it is being misused by authoritarian governments. It also makes me feel powerless. [0] https://www.tagesschau.de/investigativ/ndr-wdr/spaeh-software-pegasus-smartphone-103.html https://www.tagesschau.de/investigativ/ndr-wdr/spaeh-softwar...
- caf 5y ago
  Right. If the US can file charges against Assange and attempt to have him extradited to face them, it should be able to do the same with the NSO Group principals.
- Fnoord 5y ago
  If I hire you to shoot someone I am complicit. So I don't see how a government hiring someone to hack someone else is not complicit. Unless if that government branch had the legal right to execute that hack. Because if they were legally able to, but were unable to themselves, it makes sense to hire someone to do the job for them (if that is legal?) I am quite in awe how for example exploit brokers like Zerodium and Thaddeus Grugq are allowed to sell their services to oppressive regimes, and getting away with it (a clear case of morally bankrupt). They are powerful weapons, and should be treated as such (export controlled etc).

by cronix 5y ago

_jal 5y ago

> NSO has claimed they do not have any info on targets by the purchaser, and has no way to find out post-sale. They've also made other claims that only make sense if they do. https://www.techdirt.com/articles/20210723/22444547234/nso-group-attempting-to-distance-itself-damaging-leak-offering-up-contradictory-statements-nothing-to-fear-platitudes.shtml https://www.techdirt.com/articles/20210723/22444547234/nso-g...

ianhawes 5y ago

US DOJ has notably secured convictions against spyware authors that simply sold the software. There is no legal distinction between "dude in his apartment" versus "multinational Israeli defense contractor" in this regard.

sva_ 5y ago

A german article[0] claimed that only a hashvalue of the telephone number is transmitted to NSO Group: > "Das BKA hat nach Angaben der stellvertretenden Behördenleiterin sichergestellt, dass keine sensiblen Daten bei der Firma NSO landen würden. So würden Hashwerte für Telefonnummern vergeben, damit das Unternehmen die Zielpersonen nicht identifizieren könne." They claim that this way the NSO Group would not be able to identify the victims. Obviously that is a fat lie, as a phone number hash could trivially be brute-forced, even on a home pc. From the sounds of it, NSO Group does not give out the zeroday exploits, but rather do the dirty work of exploiting/infecting the victim themselves, and then hand over control. But the writing is pretty vague. Seeing all these democratic countries, including my home country support this kind of stuff by buying their malware, is extremely disheartening to me, when there is clear evidence that it is being misused by authoritarian governments. It also makes me feel powerless. [0] https://www.tagesschau.de/investigativ/ndr-wdr/spaeh-software-pegasus-smartphone-103.html https://www.tagesschau.de/investigativ/ndr-wdr/spaeh-softwar...

caf 5y ago
Right. If the US can file charges against Assange and attempt to have him extradited to face them, it should be able to do the same with the NSO Group principals.
Fnoord 5y ago
If I hire you to shoot someone I am complicit. So I don't see how a government hiring someone to hack someone else is not complicit. Unless if that government branch had the legal right to execute that hack. Because if they were legally able to, but were unable to themselves, it makes sense to hire someone to do the job for them (if that is legal?) I am quite in awe how for example exploit brokers like Zerodium and Thaddeus Grugq are allowed to sell their services to oppressive regimes, and getting away with it (a clear case of morally bankrupt). They are powerful weapons, and should be treated as such (export controlled etc).