4 ms·

Slightly OT - Isn't it obvious that NSO must be able to control every "copy" of Pegasus it sells? They wouldn't sell it unless they were absolutely sure it wou

by stef25 5y ago

Slightly OT - Isn't it obvious that NSO must be able to control every "copy" of Pegasus it sells? They wouldn't sell it unless they were absolutely sure it wouldn't be used against its own people and they have no problem selling to their arch enemies. NSO's defense has always been "we just sell the tech and can't be held responsible for what our clients do with it" (this was clear from the Darknet Diaries episode). If you consider they must be able to control it, and are therefore perfectly capable of monitoring it, then they become much more complicit in what's being done with it. Same story if somehow 1 license = 1 target. This is something that I don't think was explored enough in DD.

codetrotter 5y ago
> They wouldn't sell it unless they were absolutely sure it wouldn't be used against its own people Why not? NSO Group is willing to sacrifice the lives of others for profit, so who’s to say that NSO Group would shy away from that?
- supercheetah 5y ago
  Does Israel even have laws against spying on its own citizens? If not, or very weak one, it's hard to imagine it wouldn't want to spy on them, especially any political opposition.
- michaelt 5y ago
  Ransomware will often leave computers untouched if they have a Cyrillic keyboard layout, because aggravating authorities in your own country is orders of magnitude more dangerous than aggravating foreign authorities. Theoretically, the NSO group might feel the same way.
- stef25 5y ago
  If I remember correctly every sale of Pegasus requires an export license and is therefore subject to approval by the Israeli govt. They don't seem to care much for human rights activists and journalists but assuming every unpatched smartphone is vulnerable, it's very unlikely they're going to allow sales if it could just be pointed at any member of the Israeli govt or military.
- shmatt 5y ago
  They do care about 1 thing and thats Pegasus source code. A Senior Engineer of theirs got caught and jailed trying to sell it for 50 Million Dollars[1]. I assume they don't want their index of exploits leaked [1]https://www.securityweek.com/ex-nso-employee-accused-stealing-spyware-source-code https://www.securityweek.com/ex-nso-employee-accused-stealin...
DyslexicAtheist 5y ago
> (this was clear from the Darknet Diaries episode) think that episode also mentioned it iirc ... that the plausible deniability goes out the window the minute they host their own infrastructure. also NSO Group goes through great length to obscure who they're selling to using shell and shelf companies. actually indistinguishable from how narco terrorists and organized crime operates: https://forensicnews.net/the-covert-reach-of-nso-group/ https://forensicnews.net/the-covert-reach-of-nso-group/ Unit81, and Unit8200 FTW :(
- vmception 5y ago
  (which is because organized crime is indistinguishable from general business)
- raxxorrax 5y ago
  Not wanting to defend NSO, but I guess that is common business practice for any supplier of surveillance software for state actors. Remember how loud they cried when people leaked about their monitoring? Such dealing are meant to be intransparent and states create the market.
- stef25 5y ago
  Jack was alluding at that but afaik he didn't mention anything about how they ensure it's not used against their own citizens?
  - DyslexicAtheist 5y ago
    I also don't recall it. iirc the topic also came up in a tptazcek episode of "security cryptography whatever" and a handful of other places ... so I might be conflating things on who made claims when. If it were used against their own IL citizens, would it really matter legally? As long as the parent company (NSO) can plausibly claim it had no knowledge of even the existence of a specific SLA between a foreign spinoff (e.g. FloLive, Circle etc) and their clients. If you think yourself into a position where you want to become a global player in an increasingly regulated market (embargoes, sanctions lists etc) the only way to avoid repercussions is by not knowing what other parts of your affiliates are doing. Just because some of these shell companies have been unmasked must be annoying for NSO. But they can still say they had no idea what directors of these "independent" companies were doing. It would be normal military tactic to compartmentalize information not just on paper but also in reality to be on a "need to know basis". So it's double baffling to me that the shell companies listed as the main investors are the same people sitting on the NSO board of directors. sorry lots of conjecture IANAL ...
hutzlibu 5y ago
"They wouldn't sell it unless they were absolutely sure it wouldn't be used against its own people and they have no problem selling to their arch enemies." I do not follow that logic. They do not have to control every instance of their software, to defend against it. I certainly would not try to hack someone with their own tools. I would just assume they spot it easily and exchange the favour.
- giansegato 5y ago
  I believe the OP was referring to the state of Israel, more in the sense that Israel wouldn't grant permission to sell a certain technology without being sure it cannot be wielded against its people. I think it's a sound argument, even if speculative.
  - hutzlibu 5y ago
    You can never be sure with any weapon you made, that it will not be eventually be used against you. But a fine grained hacking tool has a very unique fingerprint and working style, you could defend against much more easier, if it was you who build it all.
macinjosh 5y ago
My assumption is that what they have full control over is the admin/CRUD interface that is on top of the database that their malware is feeding. They tightly control the access to that data which is probably encrypted on the target device. That admin interface probably also is where the targeting is done so they could easily put anything they don't want targeted behind a disallow-list.
q1w2 5y ago
> "we just sell the tech and can't be held responsible for what our clients do with it" This should not be put in quotes - as it is not a quote. Also, they issued a statement saying the opposite - that they review the uses of the tech, and sign agreements with nations buying it that they will act in a certain way. Enforcement those agreements is obviously complicated.
- whimsicalism 5y ago
  I think it is pretty clear from the context that this is not a direct quote. The usage of quotes online has evolved - language is not prescriptive. Have a great day :)
throwaway894345 5y ago
They don’t necessarily need a backdoor or similar to control it, they just need to be able to identify if it is being used against them and to be able to defeat it.

by stef25 5y ago

codetrotter 5y ago

> They wouldn't sell it unless they were absolutely sure it wouldn't be used against its own people Why not? NSO Group is willing to sacrifice the lives of others for profit, so who’s to say that NSO Group would shy away from that?

supercheetah 5y ago
Does Israel even have laws against spying on its own citizens? If not, or very weak one, it's hard to imagine it wouldn't want to spy on them, especially any political opposition.
michaelt 5y ago
Ransomware will often leave computers untouched if they have a Cyrillic keyboard layout, because aggravating authorities in your own country is orders of magnitude more dangerous than aggravating foreign authorities. Theoretically, the NSO group might feel the same way.
stef25 5y ago
If I remember correctly every sale of Pegasus requires an export license and is therefore subject to approval by the Israeli govt. They don't seem to care much for human rights activists and journalists but assuming every unpatched smartphone is vulnerable, it's very unlikely they're going to allow sales if it could just be pointed at any member of the Israeli govt or military.
shmatt 5y ago
They do care about 1 thing and thats Pegasus source code. A Senior Engineer of theirs got caught and jailed trying to sell it for 50 Million Dollars[1]. I assume they don't want their index of exploits leaked [1]https://www.securityweek.com/ex-nso-employee-accused-stealing-spyware-source-code https://www.securityweek.com/ex-nso-employee-accused-stealin...

DyslexicAtheist 5y ago

> (this was clear from the Darknet Diaries episode) think that episode also mentioned it iirc ... that the plausible deniability goes out the window the minute they host their own infrastructure. also NSO Group goes through great length to obscure who they're selling to using shell and shelf companies. actually indistinguishable from how narco terrorists and organized crime operates: https://forensicnews.net/the-covert-reach-of-nso-group/ https://forensicnews.net/the-covert-reach-of-nso-group/ Unit81, and Unit8200 FTW :(

vmception 5y ago
(which is because organized crime is indistinguishable from general business)
raxxorrax 5y ago
Not wanting to defend NSO, but I guess that is common business practice for any supplier of surveillance software for state actors. Remember how loud they cried when people leaked about their monitoring? Such dealing are meant to be intransparent and states create the market.
stef25 5y ago
Jack was alluding at that but afaik he didn't mention anything about how they ensure it's not used against their own citizens?
- DyslexicAtheist 5y ago
  I also don't recall it. iirc the topic also came up in a tptazcek episode of "security cryptography whatever" and a handful of other places ... so I might be conflating things on who made claims when. If it were used against their own IL citizens, would it really matter legally? As long as the parent company (NSO) can plausibly claim it had no knowledge of even the existence of a specific SLA between a foreign spinoff (e.g. FloLive, Circle etc) and their clients. If you think yourself into a position where you want to become a global player in an increasingly regulated market (embargoes, sanctions lists etc) the only way to avoid repercussions is by not knowing what other parts of your affiliates are doing. Just because some of these shell companies have been unmasked must be annoying for NSO. But they can still say they had no idea what directors of these "independent" companies were doing. It would be normal military tactic to compartmentalize information not just on paper but also in reality to be on a "need to know basis". So it's double baffling to me that the shell companies listed as the main investors are the same people sitting on the NSO board of directors. sorry lots of conjecture IANAL ...

hutzlibu 5y ago

"They wouldn't sell it unless they were absolutely sure it wouldn't be used against its own people and they have no problem selling to their arch enemies." I do not follow that logic. They do not have to control every instance of their software, to defend against it. I certainly would not try to hack someone with their own tools. I would just assume they spot it easily and exchange the favour.

giansegato 5y ago
I believe the OP was referring to the state of Israel, more in the sense that Israel wouldn't grant permission to sell a certain technology without being sure it cannot be wielded against its people. I think it's a sound argument, even if speculative.
- hutzlibu 5y ago
  You can never be sure with any weapon you made, that it will not be eventually be used against you. But a fine grained hacking tool has a very unique fingerprint and working style, you could defend against much more easier, if it was you who build it all.

macinjosh 5y ago

My assumption is that what they have full control over is the admin/CRUD interface that is on top of the database that their malware is feeding. They tightly control the access to that data which is probably encrypted on the target device. That admin interface probably also is where the targeting is done so they could easily put anything they don't want targeted behind a disallow-list.

q1w2 5y ago

> "we just sell the tech and can't be held responsible for what our clients do with it" This should not be put in quotes - as it is not a quote. Also, they issued a statement saying the opposite - that they review the uses of the tech, and sign agreements with nations buying it that they will act in a certain way. Enforcement those agreements is obviously complicated.

whimsicalism 5y ago
I think it is pretty clear from the context that this is not a direct quote. The usage of quotes online has evolved - language is not prescriptive. Have a great day :)

throwaway894345 5y ago

They don’t necessarily need a backdoor or similar to control it, they just need to be able to identify if it is being used against them and to be able to defeat it.