5 ms·

why do we even tolerate malware companies

hnbad 5y ago
Because this company was the developer of the "Staatstrojaner" malware government agencies used to hack into computer systems to investigate crimes. I think the original use case was just terrorism but I'm pretty sure it's been used against other crimes as well. As to why the German public tolerate it: because there wasn't sufficient pushback and the government doesn't care about a few protests as most people will eventually forget about it and move on.
- spacemanmatt 5y ago
  Seems to me like the government should internally own their malware rather than tolerate a company that presumably sells to other governments or private entities. Mine was a rhetorical question of course.
  - hutzlibu 5y ago
    That would require the state to attract (and compensate) IT talent. As far as I know, they are trying..
  - hnbad 5y ago
    You mean like a state owned enterprise? That would go against decades of free market ideology. Even if we had somehow ended up with a state owned malware development organization it would probably have been privatized by now.
    - robertlagrant 5y ago
      Are you joking? Many states do this. E.g. in the UK they had a massive hiring binge for cyber a few years ago. They will also buy from third parties. That's not ideology (the free market can't really be deemed an ideology), that's just not succumbing to an (actual) ideology that says the state must own everything.
      - hnbad 5y ago
        > the free market can't really be deemed an ideology The free market isn't an ideology much like money isn't an ideology. Putting the free market in charge of certain aspects of society however is very much an ideological decision, though. Ideology doesn't stop being ideology just because you agree with it (although there are certainly plenty of political candidates throughout history who claim to not adhere to any ideologies). For example anarchists are somewhat open to market economies while state communists usually advocate for central planning and libertarians are strongly in favor of free market maximalism, believing that for a free market to work at its best it needs to be free of all regulations (tho usually still maintaing some rule of law to prevent a real world equivalent of EVE Online's corporate warfare). I'm not saying privatization is good or bad, I'm just saying that the underlying ideology of the past decades in Germany has been that we should privatize as much as possible and where privatization is not possible we should at least reproduce a free market system as closely as possible (e.g. we have multiple competing public healthcare providers despite having strict regulations that mean they all provide very similar levels of care). > Many states do this. We do have people in government agencies "doing cyber". We just don't have a government owned software development department developing malware for government agencies to use, just like we don't have a government owned weapons manufacturing department developing weapons for the police and military. We do have the government owning shares (even majority shares) in private (or rather publicly traded) companies though. But often these are in privatized branches of the government (e.g. Deutsche Bahn) or companies that are naturally monopolistic. Buying out a private software development company would go against the spirit of the free market as it would eliminate competition.
  - kuboble 5y ago
    We have private companies designing and building weapons. There are laws regarding who it can be sold to or where it can be exported. I believe malware is in the same category.
  - saagarjha 5y ago
    At least in the US, there are caps on how much you can pay an internal employee that generally do not pay for a top-tier researcher who’d develop malware like this. Instead you would pay some contractor a much higher rate that they could pass some portion of to their own researchers.
  - mikro2nd 5y ago
    Sometimes (frequently) you want an arms-length/plausibly-deniable relationship so that government can do edgy/illegal stuff but duck the blowback if it all goes pear-shaped or gets exposed to the sanitising light of day. See also extraordinary rendition.
- zeepzeep 5y ago
  > I think the original use case was just terrorism but I'm pretty sure it's been used against other crimes as well. As with every dystopic "anti-terror" measurement, this is correct.
  - robertlagrant 5y ago
    This is somehow such a difficult thing for people to grasp. "Yes the government gained the power to reach into our bank accounts, but it was for a good reason. I'm sure neither this nor any future government will ever abuse that power or mislay information they now have access to."
- freeflight 5y ago
  > I think the original use case was just terrorism but I'm pretty sure it's been used against other crimes as well. This kind of stuff is always justified with "terrorism, pedophilia and organized crime", but once its in place it's usually overwhelmingly applied to much pettier crimes.
  - hnbad 5y ago
    It's usually CSAM or child sexual abuse in general, not pedophilia, but yes. For example Internet censorship (I believe in the form of IP bans but I'm not sure how they're meant to be implemented exactly) was originally justified with the necessity of blocking CSAM in jurisdictions that are out of reach of Germany and the EU but recently there were moves to ban the pornsite XHamster because it provided an insufficient age check to visitors (although with similar sites it's usually nothing more than a popup to the effect of "Are you old enough to view porn? Y/N"), which while still boiling down to "think of the children" isn't exactly the kind of thing von der Leyen originally described when shooting down criticism of the proposed law.
zeepzeep 5y ago
Malware isn't bad, like guns, it depends on the one using it. There are legit uses, e.g. governments or simulations of real attacks.
- allendoerfer 5y ago
  Instead of writing a malware exploiting a bug to simulate an attack to defend against the exploit, you could have just fixed the damn thing in the first place.
- someotherperson 5y ago
  Do we actually have any cases of governments using malware for good? Guns aren't a great comparison because the use can (and usually is) wholly defensive or acts as a deterrent -- i.e if you are known to be armed then you'd be left alone. Malware on the other hand is almost exclusively offensive and governments around the world almost exclusively use it for nefarious reasons (i.e NSO Group's clientele and published usages).
  - pelasaco 5y ago
    Well looks like it play a role in the defense strategy from the Ukraine https://www.nytimes.com/2022/03/23/us/politics/pegasus-israel-ukraine-russia.html https://www.nytimes.com/2022/03/23/us/politics/pegasus-israe... So maybe until now we didn't see a country with cyber in their strategy being invaded by another?
    - someotherperson 5y ago
      Ukraine hasn't acquired NSO Group's software (based on your article) and ultimately it's a seriously corrupt country -- the most corrupt in Europe -- and globally ranks below El Salvador, Brazil, Turkey and even Cuba. Just because it's currently facing an invasion doesn't mean the malware won't be used for nefarious purposes: i.e Ukrainian elites targeting other Ukrainians or the sitting Ukrainian government targeting opposition political parties. During conflicts we often see governments and elites from those countries trying to siphon as much as they can. Just to drive the point: at the same time that they first requested the software (2014) the country was the biggest arms dealer for the Syrian civil war[0]. A large part of the arms they received after what happened in Crimea ended up making its way to countries like Syria[1] and it's likely a driving reason behind why the country was so ill-equipped with the current conflict. There is little doubt that the physical arms will eventually be sold off after this conflict is over, and with malware that can be copied quite easily it's likely it will be sold the moment it's acquired to any bidder that puts their hand up. [0] https://qz.com/211603/how-ukrainian-arms-dealing-connects-to-syrias-bloody-civil-war/ https://qz.com/211603/how-ukrainian-arms-dealing-connects-to... [1] https://www.reuters.com/article/us-ukraine-crisis-arms-insight-idUSKCN1050ZE https://www.reuters.com/article/us-ukraine-crisis-arms-insig...
pelasaco 5y ago
to avoid to have to ask for support in that area when your country is being invaded by another country maybe? https://www.theguardian.com/world/2022/mar/23/israel-ukraine-pegasus-spyware-russia https://www.theguardian.com/world/2022/mar/23/israel-ukraine...
- Sporktacular 5y ago
  ? Allied states have provided intelligence support and tools to each other for centuries without needing companies to do that for them. The internet didn't change that, greed and regulatory capture did.
- spacemanmatt 5y ago
  seems like we have a whole international alliance for mutual defense assurance
vaylian 5y ago
1) Because most people are blissfully unaware of these companies 2) Because a large portion of people who are not in 1) support it, because they believe it is used to spy on the bad guys™ and never consider that these tools have already been abused in the past and will be abused in the future.
Bayart 5y ago
For the same reason we tolerate any armament company : we need them.
amelius 5y ago
Why do we tolerate personal data brokerage companies?

Because this company was the developer of the "Staatstrojaner" malware government agencies used to hack into computer systems to investigate crimes. I think the original use case was just terrorism but I'm pretty sure it's been used against other crimes as well. As to why the German public tolerate it: because there wasn't sufficient pushback and the government doesn't care about a few protests as most people will eventually forget about it and move on.

spacemanmatt 5y ago
Seems to me like the government should internally own their malware rather than tolerate a company that presumably sells to other governments or private entities. Mine was a rhetorical question of course.
- hutzlibu 5y ago
  That would require the state to attract (and compensate) IT talent. As far as I know, they are trying..
- hnbad 5y ago
  You mean like a state owned enterprise? That would go against decades of free market ideology. Even if we had somehow ended up with a state owned malware development organization it would probably have been privatized by now.
  - robertlagrant 5y ago
    Are you joking? Many states do this. E.g. in the UK they had a massive hiring binge for cyber a few years ago. They will also buy from third parties. That's not ideology (the free market can't really be deemed an ideology), that's just not succumbing to an (actual) ideology that says the state must own everything.
    - hnbad 5y ago
      > the free market can't really be deemed an ideology The free market isn't an ideology much like money isn't an ideology. Putting the free market in charge of certain aspects of society however is very much an ideological decision, though. Ideology doesn't stop being ideology just because you agree with it (although there are certainly plenty of political candidates throughout history who claim to not adhere to any ideologies). For example anarchists are somewhat open to market economies while state communists usually advocate for central planning and libertarians are strongly in favor of free market maximalism, believing that for a free market to work at its best it needs to be free of all regulations (tho usually still maintaing some rule of law to prevent a real world equivalent of EVE Online's corporate warfare). I'm not saying privatization is good or bad, I'm just saying that the underlying ideology of the past decades in Germany has been that we should privatize as much as possible and where privatization is not possible we should at least reproduce a free market system as closely as possible (e.g. we have multiple competing public healthcare providers despite having strict regulations that mean they all provide very similar levels of care). > Many states do this. We do have people in government agencies "doing cyber". We just don't have a government owned software development department developing malware for government agencies to use, just like we don't have a government owned weapons manufacturing department developing weapons for the police and military. We do have the government owning shares (even majority shares) in private (or rather publicly traded) companies though. But often these are in privatized branches of the government (e.g. Deutsche Bahn) or companies that are naturally monopolistic. Buying out a private software development company would go against the spirit of the free market as it would eliminate competition.
- kuboble 5y ago
  We have private companies designing and building weapons. There are laws regarding who it can be sold to or where it can be exported. I believe malware is in the same category.
- saagarjha 5y ago
  At least in the US, there are caps on how much you can pay an internal employee that generally do not pay for a top-tier researcher who’d develop malware like this. Instead you would pay some contractor a much higher rate that they could pass some portion of to their own researchers.
- mikro2nd 5y ago
  Sometimes (frequently) you want an arms-length/plausibly-deniable relationship so that government can do edgy/illegal stuff but duck the blowback if it all goes pear-shaped or gets exposed to the sanitising light of day. See also extraordinary rendition.
zeepzeep 5y ago
> I think the original use case was just terrorism but I'm pretty sure it's been used against other crimes as well. As with every dystopic "anti-terror" measurement, this is correct.
- robertlagrant 5y ago
  This is somehow such a difficult thing for people to grasp. "Yes the government gained the power to reach into our bank accounts, but it was for a good reason. I'm sure neither this nor any future government will ever abuse that power or mislay information they now have access to."
freeflight 5y ago
> I think the original use case was just terrorism but I'm pretty sure it's been used against other crimes as well. This kind of stuff is always justified with "terrorism, pedophilia and organized crime", but once its in place it's usually overwhelmingly applied to much pettier crimes.
- hnbad 5y ago
  It's usually CSAM or child sexual abuse in general, not pedophilia, but yes. For example Internet censorship (I believe in the form of IP bans but I'm not sure how they're meant to be implemented exactly) was originally justified with the necessity of blocking CSAM in jurisdictions that are out of reach of Germany and the EU but recently there were moves to ban the pornsite XHamster because it provided an insufficient age check to visitors (although with similar sites it's usually nothing more than a popup to the effect of "Are you old enough to view porn? Y/N"), which while still boiling down to "think of the children" isn't exactly the kind of thing von der Leyen originally described when shooting down criticism of the proposed law.

zeepzeep 5y ago

Malware isn't bad, like guns, it depends on the one using it. There are legit uses, e.g. governments or simulations of real attacks.

allendoerfer 5y ago
Instead of writing a malware exploiting a bug to simulate an attack to defend against the exploit, you could have just fixed the damn thing in the first place.
someotherperson 5y ago
Do we actually have any cases of governments using malware for good? Guns aren't a great comparison because the use can (and usually is) wholly defensive or acts as a deterrent -- i.e if you are known to be armed then you'd be left alone. Malware on the other hand is almost exclusively offensive and governments around the world almost exclusively use it for nefarious reasons (i.e NSO Group's clientele and published usages).
- pelasaco 5y ago
  Well looks like it play a role in the defense strategy from the Ukraine https://www.nytimes.com/2022/03/23/us/politics/pegasus-israel-ukraine-russia.html https://www.nytimes.com/2022/03/23/us/politics/pegasus-israe... So maybe until now we didn't see a country with cyber in their strategy being invaded by another?
  - someotherperson 5y ago
    Ukraine hasn't acquired NSO Group's software (based on your article) and ultimately it's a seriously corrupt country -- the most corrupt in Europe -- and globally ranks below El Salvador, Brazil, Turkey and even Cuba. Just because it's currently facing an invasion doesn't mean the malware won't be used for nefarious purposes: i.e Ukrainian elites targeting other Ukrainians or the sitting Ukrainian government targeting opposition political parties. During conflicts we often see governments and elites from those countries trying to siphon as much as they can. Just to drive the point: at the same time that they first requested the software (2014) the country was the biggest arms dealer for the Syrian civil war[0]. A large part of the arms they received after what happened in Crimea ended up making its way to countries like Syria[1] and it's likely a driving reason behind why the country was so ill-equipped with the current conflict. There is little doubt that the physical arms will eventually be sold off after this conflict is over, and with malware that can be copied quite easily it's likely it will be sold the moment it's acquired to any bidder that puts their hand up. [0] https://qz.com/211603/how-ukrainian-arms-dealing-connects-to-syrias-bloody-civil-war/ https://qz.com/211603/how-ukrainian-arms-dealing-connects-to... [1] https://www.reuters.com/article/us-ukraine-crisis-arms-insight-idUSKCN1050ZE https://www.reuters.com/article/us-ukraine-crisis-arms-insig...

pelasaco 5y ago

to avoid to have to ask for support in that area when your country is being invaded by another country maybe? https://www.theguardian.com/world/2022/mar/23/israel-ukraine-pegasus-spyware-russia https://www.theguardian.com/world/2022/mar/23/israel-ukraine...

Sporktacular 5y ago
? Allied states have provided intelligence support and tools to each other for centuries without needing companies to do that for them. The internet didn't change that, greed and regulatory capture did.
spacemanmatt 5y ago
seems like we have a whole international alliance for mutual defense assurance

vaylian 5y ago

1) Because most people are blissfully unaware of these companies 2) Because a large portion of people who are not in 1) support it, because they believe it is used to spy on the bad guys™ and never consider that these tools have already been abused in the past and will be abused in the future.

Bayart 5y ago

For the same reason we tolerate any armament company : we need them.

amelius 5y ago

Why do we tolerate personal data brokerage companies?