9 ms·

They are just using the EULA as the basis for claiming jurisdiction. They are actually suing not to stop reverse engineering but rather to recover damages incur

They are just using the EULA as the basis for claiming jurisdiction. They are actually suing not to stop reverse engineering but rather to recover damages incurred by unlawful business practices. Basically their argument is that: 0) The defendant's can be sued under California law because they accepted the EULA. 1) California law makes businesses liable for damages incurred by their unlawful business practices. 2) Business practices which violate any California or federal law are unlawful business practices in California. 3) The defendant violated the federal computer fraud and abuse act by hacking into users phones. 4) Apple incurred damages to their reputation and from expenses related to mitigating the hacking of their users. 5) Therefor the defendant is liable for Apple's damages under California law. So the defendant could have been fine if they just done reverse engineering, or even if they developed the hacking tools, but actually using the tools against Apple's users in violation of the CFAA was going too far. https://www.apple.com/newsroom/pdfs/Apple_v_NSO_Complaint_112321.pdf https://www.apple.com/newsroom/pdfs/Apple_v_NSO_Complaint_11...

brutal_chaos_ 5y ago
Nit (maybe moot): > 4) Apple incurred damages […] from expenses related to mitigating the hacking of their users. This sounds like no one should be a security researcher for they risk paying companies to implement the security the company should have implemented anyway. Put another way, that also sounds like the corporate open source push, "We love open source because we don't have to support it, the community will!" "4)" says the community will pay for/support security, just wait for the hack and make 'em clean it up. Mitigation costs shouldn't be a recoverable damage, they should be doubled and paid out to the victims...maybe that'll incentivise better security over dollar dollar bills y'all. This all maybe moot because this was a B2B action and I'm thinking from a non-monied, single user/security researcher perspective. What if the company was a non-profit security research group? Perhaps this is what the 90day grace periods are for when dealing with responsible disclosure? Anyhow, my ignorance must be showing at this point.
- LogonType10 5y ago
  >This sounds like no one should be a security researcher for they risk paying companies to implement the security the company should have implemented anyway. No, read again, this only refers to damages from unlawful activity. "White hat hackers" need not fear.
  - AnthonyMouse 5y ago
    Assuming they're lawyers who know every law and don't get skewered by something like DMCA 1201.
  - jacquesm 5y ago
    I wouldn't be so sure about that. The difference between white hat and black hat is usually only determined once the destination of the results of the activity is known. Plenty of bug bounty programs appear to be one element in the marketplace for valuing an exploit. If the bounty isn't high enough your 'white hat' may well change the color of their hat.
    - LogonType10 5y ago
      So... People who aren't criminals... Might become criminals... After committing a crime... I guess?
- shkkmo 5y ago
  I don't know of any legitimate security research group that hacks user accounts they don't own. NSO hacked devices they didn't own and infected them with spyware. Apple had to pay to repair / replace those devices. I don't see how this sets any sort of precedent with security researchers are liable for the costs of fixing vulnerabilities that they uncover.
  - eganist 5y ago
    > I don't know of any legitimate security research group that hacks user accounts they don't own. nit: "user accounts to which they're not authorized" I work with friends' accounts all the time provided they authorized me to do so and provided I'm permitted to do so as part of the vuln disclosure program terms and rules of engagement, though I usually split the bounty with them in a meaningful way to make it worth their while.
    - jacquesm 5y ago
      I know of several cases of reverse engineering of a bunch of hardware where the hardware is only available to a very limited subset of professionals. To gain access you either need to join that class and break the terms under which the devices are provided, get someone else to break the terms they agreed to or to steal a device (which for obvious reasons is at a somewhat different level than breach of terms and conditions). It is pretty clear that these restrictions exist to avoid reverse engineering of a - trivial - protection that makes making compatible products impossible, and which in turn protects a non-trivial revenue stream. Apple is not really all that different. If they believe that suing to prevent reverse engineering is going to stop the bad guys they are delusional, I suspect that they are fully aware of this and are engaging in a very expensive bit of theater here: the NSO Group is not going to be overly impressed by this, whether they win or lose the case. If they lose they will be open to a damage claim, which in turn will have to be enforced through a court in a different country, if they win Apple will lose far more than just this case, they will lose the battle against everybody that wishes to engage in reverse engineering. Another thing I suspect is that Apple is either very much concerned about the image/reputation damage, their supposedly highly secure platform/environment appears to be less secure than Apple wanted you to believe and a click-through EULA is not going to impress a law breaking entity, they probably should have anticipated that. And Apple may believe that other law breaking entities are going to stop doing their thing if they win this lawsuit, I'm a bit more pessimistic about that. Legal action is not a good way to recover from a technical failure, Apple needs to update their threat model and act accordingly.
- ethbr0 5y ago
  From Facts(C), "60. Defendants force Apple to engage in a continual arms race: Even as Apple develops solutions and enhances the security of its devices, Defendants are constantly updating their malware and exploits to overcome Apple’s own security upgrades. 61. These constant recovery and prevention efforts require significant resources and impose huge costs on Apple. Defendants’ unlawful malware activities have caused and continue to cause Apple significant damages in excess of $75,000 and in an amount to be proven at trial." Hopefully the judgement is able to split the hairs between reputational and development harm to a company for security vulnerabilities, and harm to users for organized exploitation of those vulnerabilities. The former feels like it should be free speech -- statement of facts related to the company's product(s). The latter is an obvious wrong.
  - GoblinSlayer 5y ago
    Is it C that imposes huge costs here? Do they have a list what CVEs have what cost?
phkahler 5y ago
>> They are just using the EULA as the basis for claiming jurisdiction. IANAL but it's always seemed to me that if I reject the terms of a EULA then the EULA doesn't apply to me. Pushing the "button" does not mean anything because only the EULA gives it meaning and I reject that. 50 years from now if someone is doing software archaeology and they go to install some software from a long gone company, who does clicking the button form an agreement with? Will it be legal to try that software? Can existing software companies list people they have click-through agreements with? These things seem like a bad joke in practical terms.
- eganist 5y ago
  > 50 years from now if someone is doing software archaeology and they go to install some software from a long gone company, who does clicking the button form an agreement with? Will it be legal to try that software? Can existing software companies list people they have click-through agreements with? These things seem like a bad joke in practical terms. I mean, this seems pretty easily addressed: I can't sign a contract with a dead company, can I? Well, literally I can, but the agreement wouldn't be binding. Same applies here. Unless the entity still exists, in which case congratulations, you're in a binding agreement lol
  - AnthonyMouse 5y ago
    There are some practical problems with this. Suppose that Small Co sells the assets of a business unit to Big Co. Do you now have a contract with Small Co. or Big Co.? Small Co. no longer has the rights to the software. Big Co. may not agree to the terms of the old license. Suppose someone dies and their assets go to their heirs. Do you now have a contract with the heirs? What if there are no heirs, so the assets go to the government? Do you now have a contract with the government? I can think of some fun terms to add to a software license from someone on their deathbed if that's the case.
    - SQueeeeeL 5y ago
      I like how suddenly the intense legal minuate are the most important details of a system as if we're in a contract law class, as opposed to the obvious point that in general these agreements are fairly obvious
FridayoLeary 5y ago
>0) The defendant's can be sued under California law because they accepted the EULA The Court has personal jurisdiction over Defendants because, on information and belief, they created more than one hundred Apple IDs to carry out their attacks and also agreed to Apple’s iCloud Terms and Conditions (“iCloud Terms”), including a mandatory and enforceable forum selection and exclusive jurisdiction clause that constitutes express consent to the jurisdiction of this Court.7 I'm not a legal expert but shouldn't that be stupidly easy to deny? Judge: did you, NSO agree to the Terms and conditions by pressing "I Agree" NSO representative: No, Your honor. Apple Lawyer: Then how did you gain access to my clients services? NSO Rep: A totally unrelated third party gave us 100 unlocked iPhones as a free gift. We never saw the terms and conditions, nor agreed to them. We can fully prove our claims. [edit: (fully proves his claims)] Apple Lawyer: (spluttering) but... but... but... Judge: (bangs gavel) case dismissed! This is assuming NSO were far- sighted enough to actually create such a paper trail. Also, since Apple is disputing more then 100 accounts, maybe such a defence would be ruled as improbable, or some other legal jargon. Maybe someone better informed can chip in.
- TillE 5y ago
  Nerds always want to interpret the law in some strict pedantic fashion, but in practice this is almost never how it works. Law is not applied stupidly or mechanically, you can't fashion yourself some ad hoc workaround unless you're extremely certain about what you're doing, preferably with a mountain of precedent behind you.
  - AnthonyMouse 5y ago
    Nerds always want the law to be consistent. Lawyers are Machiavellian professionals trained in getting it to say "heads I win tails you lose" for their clients, and often succeed. That doesn't mean the nerds are wrong to want what they want.
    - evgen 5y ago
      No, it is just that most nerds are too ignorant to understand how law works and its purpose and mechanisms. They expect it to be some sort of API spec that can be mechanically manipulated. Their own efforts at such intellectual mechanics are nothing but a trail of tears and failure, with bug after bug making a mockery of any claim they have about the benefits of such a system. Law has had millennia to work out the kinks in the system and develop practices that are robust in the face of adversarial attack by actual smart people; coders can't seem to keep basic services operating in ideal conditions and yet you expect anyone to look to this group when it comes to actual life and death decisions? Hard pass.
comex 5y ago
The complaint does also have a straight-up breach of contract claim, in addition to the CFAA claim.

brutal_chaos_ 5y ago

Nit (maybe moot): > 4) Apple incurred damages […] from expenses related to mitigating the hacking of their users. This sounds like no one should be a security researcher for they risk paying companies to implement the security the company should have implemented anyway. Put another way, that also sounds like the corporate open source push, "We love open source because we don't have to support it, the community will!" "4)" says the community will pay for/support security, just wait for the hack and make 'em clean it up. Mitigation costs shouldn't be a recoverable damage, they should be doubled and paid out to the victims...maybe that'll incentivise better security over dollar dollar bills y'all. This all maybe moot because this was a B2B action and I'm thinking from a non-monied, single user/security researcher perspective. What if the company was a non-profit security research group? Perhaps this is what the 90day grace periods are for when dealing with responsible disclosure? Anyhow, my ignorance must be showing at this point.

LogonType10 5y ago
>This sounds like no one should be a security researcher for they risk paying companies to implement the security the company should have implemented anyway. No, read again, this only refers to damages from unlawful activity. "White hat hackers" need not fear.
- AnthonyMouse 5y ago
  Assuming they're lawyers who know every law and don't get skewered by something like DMCA 1201.
- jacquesm 5y ago
  I wouldn't be so sure about that. The difference between white hat and black hat is usually only determined once the destination of the results of the activity is known. Plenty of bug bounty programs appear to be one element in the marketplace for valuing an exploit. If the bounty isn't high enough your 'white hat' may well change the color of their hat.
  - LogonType10 5y ago
    So... People who aren't criminals... Might become criminals... After committing a crime... I guess?
shkkmo 5y ago
I don't know of any legitimate security research group that hacks user accounts they don't own. NSO hacked devices they didn't own and infected them with spyware. Apple had to pay to repair / replace those devices. I don't see how this sets any sort of precedent with security researchers are liable for the costs of fixing vulnerabilities that they uncover.
- eganist 5y ago
  > I don't know of any legitimate security research group that hacks user accounts they don't own. nit: "user accounts to which they're not authorized" I work with friends' accounts all the time provided they authorized me to do so and provided I'm permitted to do so as part of the vuln disclosure program terms and rules of engagement, though I usually split the bounty with them in a meaningful way to make it worth their while.
  - jacquesm 5y ago
    I know of several cases of reverse engineering of a bunch of hardware where the hardware is only available to a very limited subset of professionals. To gain access you either need to join that class and break the terms under which the devices are provided, get someone else to break the terms they agreed to or to steal a device (which for obvious reasons is at a somewhat different level than breach of terms and conditions). It is pretty clear that these restrictions exist to avoid reverse engineering of a - trivial - protection that makes making compatible products impossible, and which in turn protects a non-trivial revenue stream. Apple is not really all that different. If they believe that suing to prevent reverse engineering is going to stop the bad guys they are delusional, I suspect that they are fully aware of this and are engaging in a very expensive bit of theater here: the NSO Group is not going to be overly impressed by this, whether they win or lose the case. If they lose they will be open to a damage claim, which in turn will have to be enforced through a court in a different country, if they win Apple will lose far more than just this case, they will lose the battle against everybody that wishes to engage in reverse engineering. Another thing I suspect is that Apple is either very much concerned about the image/reputation damage, their supposedly highly secure platform/environment appears to be less secure than Apple wanted you to believe and a click-through EULA is not going to impress a law breaking entity, they probably should have anticipated that. And Apple may believe that other law breaking entities are going to stop doing their thing if they win this lawsuit, I'm a bit more pessimistic about that. Legal action is not a good way to recover from a technical failure, Apple needs to update their threat model and act accordingly.
ethbr0 5y ago
From Facts(C), "60. Defendants force Apple to engage in a continual arms race: Even as Apple develops solutions and enhances the security of its devices, Defendants are constantly updating their malware and exploits to overcome Apple’s own security upgrades. 61. These constant recovery and prevention efforts require significant resources and impose huge costs on Apple. Defendants’ unlawful malware activities have caused and continue to cause Apple significant damages in excess of $75,000 and in an amount to be proven at trial." Hopefully the judgement is able to split the hairs between reputational and development harm to a company for security vulnerabilities, and harm to users for organized exploitation of those vulnerabilities. The former feels like it should be free speech -- statement of facts related to the company's product(s). The latter is an obvious wrong.
- GoblinSlayer 5y ago
  Is it C that imposes huge costs here? Do they have a list what CVEs have what cost?

phkahler 5y ago

>> They are just using the EULA as the basis for claiming jurisdiction. IANAL but it's always seemed to me that if I reject the terms of a EULA then the EULA doesn't apply to me. Pushing the "button" does not mean anything because only the EULA gives it meaning and I reject that. 50 years from now if someone is doing software archaeology and they go to install some software from a long gone company, who does clicking the button form an agreement with? Will it be legal to try that software? Can existing software companies list people they have click-through agreements with? These things seem like a bad joke in practical terms.

eganist 5y ago
> 50 years from now if someone is doing software archaeology and they go to install some software from a long gone company, who does clicking the button form an agreement with? Will it be legal to try that software? Can existing software companies list people they have click-through agreements with? These things seem like a bad joke in practical terms. I mean, this seems pretty easily addressed: I can't sign a contract with a dead company, can I? Well, literally I can, but the agreement wouldn't be binding. Same applies here. Unless the entity still exists, in which case congratulations, you're in a binding agreement lol
- AnthonyMouse 5y ago
  There are some practical problems with this. Suppose that Small Co sells the assets of a business unit to Big Co. Do you now have a contract with Small Co. or Big Co.? Small Co. no longer has the rights to the software. Big Co. may not agree to the terms of the old license. Suppose someone dies and their assets go to their heirs. Do you now have a contract with the heirs? What if there are no heirs, so the assets go to the government? Do you now have a contract with the government? I can think of some fun terms to add to a software license from someone on their deathbed if that's the case.
  - SQueeeeeL 5y ago
    I like how suddenly the intense legal minuate are the most important details of a system as if we're in a contract law class, as opposed to the obvious point that in general these agreements are fairly obvious

FridayoLeary 5y ago

>0) The defendant's can be sued under California law because they accepted the EULA The Court has personal jurisdiction over Defendants because, on information and belief, they created more than one hundred Apple IDs to carry out their attacks and also agreed to Apple’s iCloud Terms and Conditions (“iCloud Terms”), including a mandatory and enforceable forum selection and exclusive jurisdiction clause that constitutes express consent to the jurisdiction of this Court.7 I'm not a legal expert but shouldn't that be stupidly easy to deny? Judge: did you, NSO agree to the Terms and conditions by pressing "I Agree" NSO representative: No, Your honor. Apple Lawyer: Then how did you gain access to my clients services? NSO Rep: A totally unrelated third party gave us 100 unlocked iPhones as a free gift. We never saw the terms and conditions, nor agreed to them. We can fully prove our claims. [edit: (fully proves his claims)] Apple Lawyer: (spluttering) but... but... but... Judge: (bangs gavel) case dismissed! This is assuming NSO were far- sighted enough to actually create such a paper trail. Also, since Apple is disputing more then 100 accounts, maybe such a defence would be ruled as improbable, or some other legal jargon. Maybe someone better informed can chip in.

TillE 5y ago
Nerds always want to interpret the law in some strict pedantic fashion, but in practice this is almost never how it works. Law is not applied stupidly or mechanically, you can't fashion yourself some ad hoc workaround unless you're extremely certain about what you're doing, preferably with a mountain of precedent behind you.
- AnthonyMouse 5y ago
  Nerds always want the law to be consistent. Lawyers are Machiavellian professionals trained in getting it to say "heads I win tails you lose" for their clients, and often succeed. That doesn't mean the nerds are wrong to want what they want.
  - evgen 5y ago
    No, it is just that most nerds are too ignorant to understand how law works and its purpose and mechanisms. They expect it to be some sort of API spec that can be mechanically manipulated. Their own efforts at such intellectual mechanics are nothing but a trail of tears and failure, with bug after bug making a mockery of any claim they have about the benefits of such a system. Law has had millennia to work out the kinks in the system and develop practices that are robust in the face of adversarial attack by actual smart people; coders can't seem to keep basic services operating in ideal conditions and yet you expect anyone to look to this group when it comes to actual life and death decisions? Hard pass.

comex 5y ago

The complaint does also have a straight-up breach of contract claim, in addition to the CFAA claim.