5 ms·

And simultaneusly: - not have any indication their tools were used - canceled the relevant accounts Which "relevant" accounts if NSO's tools weren't used?

azernik 5y ago
This is in Uganda. NSO sells only to governments and law enforcement agencies. Therefore, the relevant client would be the Ugandan government.
Cyph0n 5y ago
I think it's pretty clear by now that they have 100% visibility into the entire exploitation chain for all of their customers. Their "official statements" mean nothing.
- mike_d 5y ago
  Well since they do the exploitation on behalf of customers, yes? NSO is very popular with governments that don't have robust domestic intelligence because all you have to do is type a phone number into a web form and in anywhere from an hour to a week you get a point and click GUI for accessing the contents of the phone.
  - spiderice 5y ago
    > all you have to do is type a phone number into a web form and in anywhere from an hour to a week you get a point and click GUI for accessing the contents of the phone. You have a source for this? I genuinely want to know if they make it that simple
    - mike_d 5y ago
      Publicly? No. Should all come out in the Apple lawsuit though. Edit: Rereading the NSO statement they said they blocked exploitation of numbers starting with +1. Take that to mean whatever you'd like.
    - bicepjai 5y ago
      You should listen to darknet diaries podcast about NSO group activities
  - Cyph0n 5y ago
    I understand that, but they have repeatedly denied that this is the case, which is simply absurd.
  - Thorrez 5y ago
    My thought was that the customer runs the server provided by NSO. I though the web form is running off of a webserver in a building owned by the customer.
    - simonh 5y ago
      I used to work for an ISV in the finance industry. Most of our customers ran our stuff on their own servers in their own data centres, but we had direct logon to the application user account to manage the application config, do software upgrades, investigate issues, etc. A few of our customers preferred to support the software entirely themselves, we had no access and ran training courses for their support teams. I wouldn't be surprised if NSO offer a similar range of options depending on the client's budget and technical capabilities.
  - matheusmoreira 5y ago
    ... Is this real? There's no way to resist this?
seoaeu 5y ago
Presumably the full accusation is "Entity ABC used NSO tools for XYZ". So the reaction was to cancel ABC's account while NSO investigates whether ABC actually did use the tools for XYZ, or whether ABC was only using them for other (approved) purposes.
- BrianOnHN 5y ago
  Regardless, NSO rules over international law.
  - javajosh 5y ago
    No, it means that NSO takes customer complaints seriously, especially a customer as important as the US. They operate under Israeli legal jurisdiction, and probably have an existing relationship with US firms, public and private, and I don't think the Israelis would hesitate to take whatever action the US wanted, because it benefits them to "play nice" and be cooperative. It kinda sucks for them in this case because chances are this is evidence of in-fighting between US agencies, and NSO tools are in the middle. FWIW "international law" is its own thing and doesn't work like normal law; in truth every nation by default "rules over international law". When was the last time you saw an "international law" trial or saw a nation punished?
    - CRConrad 5y ago
      > When was the last time you saw an "international law" trial or saw a nation punished? Mid-to-late 1990s, den Haag, Serbia?
klabb3 5y ago
Shrödinger's moderation. NSO has this magical zero-knowledge technology that: - When questioned about a specific malevolent client misusing their data, they cannot be held accountable because the client is running the ops and NSO has no access. - When asked how they ensure that clients in general don't go rogue and misuse (i.e. human rights & international law abuse) their service, they assure you they monitor them and turn off their access.

azernik 5y ago

This is in Uganda. NSO sells only to governments and law enforcement agencies. Therefore, the relevant client would be the Ugandan government.

Cyph0n 5y ago

I think it's pretty clear by now that they have 100% visibility into the entire exploitation chain for all of their customers. Their "official statements" mean nothing.

mike_d 5y ago
Well since they do the exploitation on behalf of customers, yes? NSO is very popular with governments that don't have robust domestic intelligence because all you have to do is type a phone number into a web form and in anywhere from an hour to a week you get a point and click GUI for accessing the contents of the phone.
- spiderice 5y ago
  > all you have to do is type a phone number into a web form and in anywhere from an hour to a week you get a point and click GUI for accessing the contents of the phone. You have a source for this? I genuinely want to know if they make it that simple
  - mike_d 5y ago
    Publicly? No. Should all come out in the Apple lawsuit though. Edit: Rereading the NSO statement they said they blocked exploitation of numbers starting with +1. Take that to mean whatever you'd like.
  - bicepjai 5y ago
    You should listen to darknet diaries podcast about NSO group activities
- Cyph0n 5y ago
  I understand that, but they have repeatedly denied that this is the case, which is simply absurd.
- Thorrez 5y ago
  My thought was that the customer runs the server provided by NSO. I though the web form is running off of a webserver in a building owned by the customer.
  - simonh 5y ago
    I used to work for an ISV in the finance industry. Most of our customers ran our stuff on their own servers in their own data centres, but we had direct logon to the application user account to manage the application config, do software upgrades, investigate issues, etc. A few of our customers preferred to support the software entirely themselves, we had no access and ran training courses for their support teams. I wouldn't be surprised if NSO offer a similar range of options depending on the client's budget and technical capabilities.
- matheusmoreira 5y ago
  ... Is this real? There's no way to resist this?

seoaeu 5y ago

Presumably the full accusation is "Entity ABC used NSO tools for XYZ". So the reaction was to cancel ABC's account while NSO investigates whether ABC actually did use the tools for XYZ, or whether ABC was only using them for other (approved) purposes.

BrianOnHN 5y ago
Regardless, NSO rules over international law.
- javajosh 5y ago
  No, it means that NSO takes customer complaints seriously, especially a customer as important as the US. They operate under Israeli legal jurisdiction, and probably have an existing relationship with US firms, public and private, and I don't think the Israelis would hesitate to take whatever action the US wanted, because it benefits them to "play nice" and be cooperative. It kinda sucks for them in this case because chances are this is evidence of in-fighting between US agencies, and NSO tools are in the middle. FWIW "international law" is its own thing and doesn't work like normal law; in truth every nation by default "rules over international law". When was the last time you saw an "international law" trial or saw a nation punished?
  - CRConrad 5y ago
    > When was the last time you saw an "international law" trial or saw a nation punished? Mid-to-late 1990s, den Haag, Serbia?

klabb3 5y ago

Shrödinger's moderation. NSO has this magical zero-knowledge technology that: - When questioned about a specific malevolent client misusing their data, they cannot be held accountable because the client is running the ops and NSO has no access. - When asked how they ensure that clients in general don't go rogue and misuse (i.e. human rights & international law abuse) their service, they assure you they monitor them and turn off their access.