17 ms·

It is great to see this happen. It's also fascinating that the crux of the Apple's case against NSO hinges on NSO engineers that accepted iCloud's terms and co

It is great to see this happen. It's also fascinating that the crux of the Apple's case against NSO hinges on NSO engineers that accepted iCloud's terms and conditions. From related NYT article: >The sample of Pegasus gave Apple a forensic understanding of how Pegasus worked. The company found that NSO’s engineers had created more than 100 fake Apple IDs to carry out their attacks. In the process of creating those accounts, NSO’s engineers would have had to agree to Apple’s iCloud Terms and Conditions, which expressly require that iCloud users’ engagement with Apple “be governed by the laws of the state of California.” The clause helped Apple bring its lawsuit against NSO in the Northern District of California. https://www.nytimes.com/2021/11/23/technology/apple-nso-group-lawsuit.html https://www.nytimes.com/2021/11/23/technology/apple-nso-grou...

amelius 5y ago
So they used iCloud to spy on NSO? Sounds not right, regardless of what you think of NSO's actions.
- strict9 5y ago
  No. The information on fake accounts was passed to Apple by Citizen Lab, which discovered the zero click vulnerability.
edge17 5y ago
I will just add, the author of the NYT piece has a book out on this subject. The book is decent, has some cringe worthy descriptions of technical things if you are a technical person, but overall I learned a huge amount reading it. A lot of the commentary, accusations, and opinions in the comments here would be addressed or better colored if you're interested enough to read her book (https://www.amazon.com/This-They-Tell-World-Ends/dp/1635576059 https://www.amazon.com/This-They-Tell-World-Ends/dp/16355760...). Also, just to be clear, one of the reasons I like the book is because it's written by a person that doesn't understand all the deep technical aspects of these things.
- josephg 5y ago
  If you want a more technical perspective, The Darknet Diaries did an episode a couple months ago about the NSO group: https://overcast.fm/+PMNc5Hr8c https://overcast.fm/+PMNc5Hr8c I discovered darknet diaries listening to that episode. It’s very accessible and excellent storytelling.
  - edge17 5y ago
    I've listened to a bunch of those episodes. I agree, the host/creator does a fantastic job.
  - martyvis 5y ago
    You actually want to listen to the previous episode to get context first https://darknetdiaries.com/episode/99/ https://darknetdiaries.com/episode/99/
- threeseed 5y ago
  > has some cringe worthy descriptions of technical things Par for the course when trying to explain things to non-technical people. People joke but you can see the thought process in explaining to a politician that the internet is a "series of tubes" for example.
  - sam-2727 5y ago
    Reminds me of when the Oracle v. Google case was argued in front of the Supreme Court on a series of metaphors, among other things comparing Java to football teams: https://www.theverge.com/2020/10/9/21506172/oracle-google-java-supreme-court-hearings-oral-arguments-metaphors-qwerty https://www.theverge.com/2020/10/9/21506172/oracle-google-ja...
    - ls612 5y ago
      The justices clearly boned up on the technical aspects of the case though as their opinion shows a good grasp of what is going on in the underlying dispute over Android.
kingcharles 5y ago
I was the victim of a state-sponsored attack. I took it to court. I tried to subpoena the contents of the government agents' iPhones but Apple came and filed a Joinder in Motion and sent expensive lawyers to lie to the judge about the judge's power to subpoena digital evidence. The lawyer specifically told me all he does is go around the country and lie to judges to get them to cancel subpoenas. We introduced the T+Cs from one major online provider to show how the government violated them. The government stipulated that they had violated the T+Cs and that they had broken the law. Two different courts both stated that government agents are allowed to violate federal and state computer and data access laws to conduct intelligence-gathering operations, and they are certainly allowed to violate T+Cs even when a violation of a T+C is a criminal act (which it is in many jurisdictions). One thing that is lulzy is that I recently received a letter from one government agency stating that the evidence I had requested by subpoena was no longer available because they left it on a server in violation of the T+Cs and never took a copy of it and the provider deleted the account. It hasn't reached the appellate courts yet.
- jp57 5y ago
  > Apple came and filed a Joinder in Motion and sent expensive lawyers to lie to the judge about the judge's power to subpoena digital evidence. If a lawyer makes an argument in court about the law governing a case (as opposed to the facts of the case), and the judge accepts the argument, and the judge's decision survives all its appeals, then the lawyer's argument is, by definition, true. EDIT: I'm objecting here to the characterization of the lawyers' arguments as "lying". The judge's "power" to suboena digital evidence sounds like a question of interpretation of the law. Many (all?) US court cases have at least one question of law in which the parties make opposing arguments. One party prevails, the other does not, or maybe one party prevails on some points and the other prevails on other points. But however those questions are ultimately decided, that's the law, as it pertains to that case. In that context, it seems very strange to characterize either party as "lying" in such arguments. If, on the other hand, "the judge's power to subpoena digital evidence" really means Apple's technical ability to produce such evidence, then I would agree that those are facts about which some statements could be considered truthful or not.
fragmede 5y ago
Is it great? The lawsuit is Apple trying to enforce the iCloud EULA to stop reverse engineering. While NSO Group created hacking tools, and then did some questionable things with them, do we really want those inane licenses no one reads, and everyone scrolls down to hit [agree]; do we really want them to legally binding? Put another way, if it was someone HN liked, would we still say this is actually good? Because compared to the corporation known as Apple, NSO Group and its parent corporation are still "a little guy", and this move really doesn't seem like a good thing. Not for hackers in the HN definition for hackers, ie highly motivated tinkerers. This community features not just fans of reverse engineering, but number of practitioners, eg the popular Nvidia TSEC key extraction that was featured recently[0]. The defendant's actions make them an easy target, but, like the ACLU protecting the civil rights of murderers, because we still live in a nation of laws, I don't see this as great. This is a continuation of Apple's continued use of lawsuits to silence any challenges to their marketing of being the secure computer choice (eg Apple suing Corellium[1]) rather than their products actually being secure. [0] https://news.ycombinator.com/item?id=29315378 https://news.ycombinator.com/item?id=29315378 [1] https://news.ycombinator.com/item?id=28219278 https://news.ycombinator.com/item?id=28219278
- leecb 5y ago
  > those inane licenses no one reads, do we really want them to legally binding? What all would be possible if software EULAs weren't legally binding? One thing that EULAs typically do is reduce liability for the company producing the software. Imagine if Google/Apple were liable for damages from all the miscommunications caused by autocorrect?
  - roblabla 5y ago
    EULAs are also used to protect IP, such as by prohibiting reverse engineering. Preventing reverse engineering would prevent modding games, fixing bugs in software that aren't supported anymore, security analysis, etc... In my view, it'd be a net negative for society.
    - lupire 5y ago
dylan604 5y ago
If this is ruled in Apple's favor, can that be a stepping stone to allow NSO to be charged with aiding in murder?
drdaeman 5y ago
I guess they haven't done this, but isn't this trivially mitigated by hiring someone to create the accounts, outside of the US entirely, in a jurisdiction where T&C violation doesn't mean anything? Especially if the accounts are needed in bulk, where it makes sense not just to work around the legal arguments but simply economically.
- dodobirdlord 5y ago
  They presumably created the accounts in Israel in any case. It doesn’t matter though, because they’re being sued in the United States. Apple is a US company, and the EULA says that disputes will be resolved according to California law, so according to US law, Apple can sue NSO in California. The jurisdiction where NSO (or their designee) agreed to the EULA isn’t important because contracts have two parties, and Apple is in the US.
miki123211 5y ago
Were those engineers authorized to act on NSO's behalf? If I sign an agreement with Apple on behalf of <faang company>, even as, let's say, an intern at that FAANG company, Apple should probably sue me, not the FAANG.
- ChrisMarshallNY 5y ago
  No, the FAANG is on the hook. I know this, because I did exactly that, and was given a right good talkin’ to, by our General Counsel. If anything lawsuit-worthy had come from it, then I suspect that I would have gotten more than just a lecture.
- dodobirdlord 5y ago
  Probably, there are shades of grey in this sort of thing, but that’s usually for low-level employees agreeing to stuff wildly out of their responsibilities. For engineers agreeing to the EULA for a service that they use as part of their job, the court will probably agree that is sufficient for this lawsuit, even if NSO has policies that notionally should have prevented the engineers from agreeing to the EULA. Also, if they weren’t, then NSO presumably violated the Computer Fraud and Abuse Act by accessing Apple’s services and systems without prior permission. Maybe that nixes Apple’s jurisdiction argument for this lawsuit, but Apple can also sue for criminal damages, and is presumably entitled to do so in their home jurisdiction since that’s where they exist and so that’s where they suffered the damages. And I think Apple notes this also in the lawsuit.
tzs 5y ago
As quoted that sounds like a choice of law clause, not a choice of forum clause, and so wouldn't necessarily help in bringing suit in California. In computer terms a choice of law clause in a contract is essentially a macro that when the contract is interpreted in a court expands to the contract law of the jurisdiction named in the clause. If a court in, say, Kentucky hears a contract dispute and the contract has a choice of law clause specifying California it is essentially as if the parties wrote California contract law into their contract. For things that a contract does not have the power to alter in Kentucky, Kentucky law would apply regardless of what California law said. E.g., the Kentucky court would use Kentucky rules of civil procedure and would use Kentucky rules of evidence. A choice of forum clause requires the parties to use a particular jurisdiction to settle disputes. When you agree to such a contract you are agreeing to give the courts of that jurisdiction personal jurisdiction over you for matters involving that contract. PS: I found the EULA. In addition to a choice of law clause it has a choice of forum clause: > Except to the extent expressly provided in the following paragraph, this Agreement and the relationship between you and Apple shall be governed by the laws of the State of California, excluding its conflicts of law provisions. You and Apple agree to submit to the personal and exclusive jurisdiction of the courts located within the county of Santa Clara, California, to resolve any dispute or claim arising from this Agreement PPS: note that the choice of law clause excludes California's conflict of law provisions. That's to avoid the situation where California's law says that some third jurisdiction's law should apply. In theory you could even end up in a situation where jurisdiction X says to use Y's laws and Y says to use X's, and then you've really got a mess.

amelius 5y ago

So they used iCloud to spy on NSO? Sounds not right, regardless of what you think of NSO's actions.

strict9 5y ago
No. The information on fake accounts was passed to Apple by Citizen Lab, which discovered the zero click vulnerability.

edge17 5y ago

I will just add, the author of the NYT piece has a book out on this subject. The book is decent, has some cringe worthy descriptions of technical things if you are a technical person, but overall I learned a huge amount reading it. A lot of the commentary, accusations, and opinions in the comments here would be addressed or better colored if you're interested enough to read her book (https://www.amazon.com/This-They-Tell-World-Ends/dp/1635576059 https://www.amazon.com/This-They-Tell-World-Ends/dp/16355760...). Also, just to be clear, one of the reasons I like the book is because it's written by a person that doesn't understand all the deep technical aspects of these things.

josephg 5y ago
If you want a more technical perspective, The Darknet Diaries did an episode a couple months ago about the NSO group: https://overcast.fm/+PMNc5Hr8c https://overcast.fm/+PMNc5Hr8c I discovered darknet diaries listening to that episode. It’s very accessible and excellent storytelling.
- edge17 5y ago
  I've listened to a bunch of those episodes. I agree, the host/creator does a fantastic job.
- martyvis 5y ago
  You actually want to listen to the previous episode to get context first https://darknetdiaries.com/episode/99/ https://darknetdiaries.com/episode/99/
threeseed 5y ago
> has some cringe worthy descriptions of technical things Par for the course when trying to explain things to non-technical people. People joke but you can see the thought process in explaining to a politician that the internet is a "series of tubes" for example.
- sam-2727 5y ago
  Reminds me of when the Oracle v. Google case was argued in front of the Supreme Court on a series of metaphors, among other things comparing Java to football teams: https://www.theverge.com/2020/10/9/21506172/oracle-google-java-supreme-court-hearings-oral-arguments-metaphors-qwerty https://www.theverge.com/2020/10/9/21506172/oracle-google-ja...
  - ls612 5y ago
    The justices clearly boned up on the technical aspects of the case though as their opinion shows a good grasp of what is going on in the underlying dispute over Android.

kingcharles 5y ago

I was the victim of a state-sponsored attack. I took it to court. I tried to subpoena the contents of the government agents' iPhones but Apple came and filed a Joinder in Motion and sent expensive lawyers to lie to the judge about the judge's power to subpoena digital evidence. The lawyer specifically told me all he does is go around the country and lie to judges to get them to cancel subpoenas. We introduced the T+Cs from one major online provider to show how the government violated them. The government stipulated that they had violated the T+Cs and that they had broken the law. Two different courts both stated that government agents are allowed to violate federal and state computer and data access laws to conduct intelligence-gathering operations, and they are certainly allowed to violate T+Cs even when a violation of a T+C is a criminal act (which it is in many jurisdictions). One thing that is lulzy is that I recently received a letter from one government agency stating that the evidence I had requested by subpoena was no longer available because they left it on a server in violation of the T+Cs and never took a copy of it and the provider deleted the account. It hasn't reached the appellate courts yet.

jp57 5y ago
> Apple came and filed a Joinder in Motion and sent expensive lawyers to lie to the judge about the judge's power to subpoena digital evidence. If a lawyer makes an argument in court about the law governing a case (as opposed to the facts of the case), and the judge accepts the argument, and the judge's decision survives all its appeals, then the lawyer's argument is, by definition, true. EDIT: I'm objecting here to the characterization of the lawyers' arguments as "lying". The judge's "power" to suboena digital evidence sounds like a question of interpretation of the law. Many (all?) US court cases have at least one question of law in which the parties make opposing arguments. One party prevails, the other does not, or maybe one party prevails on some points and the other prevails on other points. But however those questions are ultimately decided, that's the law, as it pertains to that case. In that context, it seems very strange to characterize either party as "lying" in such arguments. If, on the other hand, "the judge's power to subpoena digital evidence" really means Apple's technical ability to produce such evidence, then I would agree that those are facts about which some statements could be considered truthful or not.

fragmede 5y ago

Is it great? The lawsuit is Apple trying to enforce the iCloud EULA to stop reverse engineering. While NSO Group created hacking tools, and then did some questionable things with them, do we really want those inane licenses no one reads, and everyone scrolls down to hit [agree]; do we really want them to legally binding? Put another way, if it was someone HN liked, would we still say this is actually good? Because compared to the corporation known as Apple, NSO Group and its parent corporation are still "a little guy", and this move really doesn't seem like a good thing. Not for hackers in the HN definition for hackers, ie highly motivated tinkerers. This community features not just fans of reverse engineering, but number of practitioners, eg the popular Nvidia TSEC key extraction that was featured recently[0]. The defendant's actions make them an easy target, but, like the ACLU protecting the civil rights of murderers, because we still live in a nation of laws, I don't see this as great. This is a continuation of Apple's continued use of lawsuits to silence any challenges to their marketing of being the secure computer choice (eg Apple suing Corellium[1]) rather than their products actually being secure. [0] https://news.ycombinator.com/item?id=29315378 https://news.ycombinator.com/item?id=29315378 [1] https://news.ycombinator.com/item?id=28219278 https://news.ycombinator.com/item?id=28219278

leecb 5y ago
> those inane licenses no one reads, do we really want them to legally binding? What all would be possible if software EULAs weren't legally binding? One thing that EULAs typically do is reduce liability for the company producing the software. Imagine if Google/Apple were liable for damages from all the miscommunications caused by autocorrect?
- roblabla 5y ago
  EULAs are also used to protect IP, such as by prohibiting reverse engineering. Preventing reverse engineering would prevent modding games, fixing bugs in software that aren't supported anymore, security analysis, etc... In my view, it'd be a net negative for society.
  - lupire 5y ago

dylan604 5y ago

If this is ruled in Apple's favor, can that be a stepping stone to allow NSO to be charged with aiding in murder?

drdaeman 5y ago

I guess they haven't done this, but isn't this trivially mitigated by hiring someone to create the accounts, outside of the US entirely, in a jurisdiction where T&C violation doesn't mean anything? Especially if the accounts are needed in bulk, where it makes sense not just to work around the legal arguments but simply economically.

dodobirdlord 5y ago
They presumably created the accounts in Israel in any case. It doesn’t matter though, because they’re being sued in the United States. Apple is a US company, and the EULA says that disputes will be resolved according to California law, so according to US law, Apple can sue NSO in California. The jurisdiction where NSO (or their designee) agreed to the EULA isn’t important because contracts have two parties, and Apple is in the US.

miki123211 5y ago

Were those engineers authorized to act on NSO's behalf? If I sign an agreement with Apple on behalf of <faang company>, even as, let's say, an intern at that FAANG company, Apple should probably sue me, not the FAANG.

ChrisMarshallNY 5y ago
No, the FAANG is on the hook. I know this, because I did exactly that, and was given a right good talkin’ to, by our General Counsel. If anything lawsuit-worthy had come from it, then I suspect that I would have gotten more than just a lecture.
dodobirdlord 5y ago
Probably, there are shades of grey in this sort of thing, but that’s usually for low-level employees agreeing to stuff wildly out of their responsibilities. For engineers agreeing to the EULA for a service that they use as part of their job, the court will probably agree that is sufficient for this lawsuit, even if NSO has policies that notionally should have prevented the engineers from agreeing to the EULA. Also, if they weren’t, then NSO presumably violated the Computer Fraud and Abuse Act by accessing Apple’s services and systems without prior permission. Maybe that nixes Apple’s jurisdiction argument for this lawsuit, but Apple can also sue for criminal damages, and is presumably entitled to do so in their home jurisdiction since that’s where they exist and so that’s where they suffered the damages. And I think Apple notes this also in the lawsuit.

tzs 5y ago

As quoted that sounds like a choice of law clause, not a choice of forum clause, and so wouldn't necessarily help in bringing suit in California. In computer terms a choice of law clause in a contract is essentially a macro that when the contract is interpreted in a court expands to the contract law of the jurisdiction named in the clause. If a court in, say, Kentucky hears a contract dispute and the contract has a choice of law clause specifying California it is essentially as if the parties wrote California contract law into their contract. For things that a contract does not have the power to alter in Kentucky, Kentucky law would apply regardless of what California law said. E.g., the Kentucky court would use Kentucky rules of civil procedure and would use Kentucky rules of evidence. A choice of forum clause requires the parties to use a particular jurisdiction to settle disputes. When you agree to such a contract you are agreeing to give the courts of that jurisdiction personal jurisdiction over you for matters involving that contract. PS: I found the EULA. In addition to a choice of law clause it has a choice of forum clause: > Except to the extent expressly provided in the following paragraph, this Agreement and the relationship between you and Apple shall be governed by the laws of the State of California, excluding its conflicts of law provisions. You and Apple agree to submit to the personal and exclusive jurisdiction of the courts located within the county of Santa Clara, California, to resolve any dispute or claim arising from this Agreement PPS: note that the choice of law clause excludes California's conflict of law provisions. That's to avoid the situation where California's law says that some third jurisdiction's law should apply. In theory you could even end up in a situation where jurisdiction X says to use Y's laws and Y says to use X's, and then you've really got a mess.