7 ms·
Why We’re Suing NSO
- mypastself 4y agoDoes anyone have any good recommendations for getting a decent overview of NSO/Pegasus? A comprehensive Zero Days-type book is likely still years away, but I’m fine with a basic video/audio/read for the time being, as the whole thing kind of passed me by, apart from a few headlines here and there.
- disadvantage 4y agoMandatory reading: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
- EMM_386 4y ago> The bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying. Wow, just ... wow. That is worth a read.
- wisemang 4y agoCould start with some Citizen Lab reports: https://citizenlab.ca/tag/nso-group/ https://citizenlab.ca/tag/nso-group/
- er0k 4y agohttps://darknetdiaries.com/episode/100/ https://darknetdiaries.com/episode/100/
- mypastself 4y agoHa! I’ve actually downloaded the episode months ago, but I’ve completely forgotten about it until now. I’ll give it a listen, Darknet Diaries is always a quality show…
- cyberpunk 4y agoEvery time the presenter says something "is crazy to me" you have to take a drink.
- balls187 4y agoJust gave this ep a listen while setting up the christmas tree. I want to watch the 60-mins interview with NSO now
- hanafudafan 4y ago
- polygamous_bat 4y agoI believe that's why it's important that an American organization is suing them in American courts. Of course, there is a chance you become a target of Mossad, but if they do away with too many American citizen they risk the US voters getting pissed and withdrawing support that's vital for Israel's continued existence.
- Brybry 4y agoIs US support actually vital for Israel's continued existence? US foreign aid isn't even 1% of their GDP[1] And Israel seems to have no issue trading military equipment or creating mutually beneficial deals with Russia and China[2][3] [1] https://www.baltimoresun.com/opinion/op-ed/bs-ed-op-1102-israel-aid-20211102-4yebjwa7grb6zf6ntff7qufule-story.html https://www.baltimoresun.com/opinion/op-ed/bs-ed-op-1102-isr... [2] https://en.wikipedia.org/wiki/China%E2%80%93Israel_relations https://en.wikipedia.org/wiki/China%E2%80%93Israel_relations [3] https://en.wikipedia.org/wiki/Israel%E2%80%93Russia_relations https://en.wikipedia.org/wiki/Israel%E2%80%93Russia_relation...
- woodruffw 4y agoThe US’s support is political as well as financial, and the political support is arguably more important: the US provides a bulwark against international sanctions and UN resolutions, while also exercising influence over Israel’s primary geopolitical adversaries.
- Adverblessly 4y ago> US foreign aid isn't even 1% of their GDP I think a more apples to apples comparison would be the percentage of their governmental budget which was ~133B USD in 2022 (making the 3.8B you cited ~3% of that) and IIUC (3.8B) represents ~15% of Israel's military spending (which given that it is already very high for their budget and GDP, will be difficult to increase otherwise). Though as other posters pointed out, the non financial support is also very important both in things like Anti-BDS (and opposing sanctions on Israel or similar negative ation) and in things like slowing down Iran's nuclear program. > And Israel seems to have no issue trading military equipment or creating mutually beneficial deals with Russia and China[2][3] I think there are two important things to be aware of here. First, Israel sells military equipment primarily to finance its own R&D and manufacture of weapons. In fact, US foreign aid is a partial driver for that here, since the aid money can only be used to purchase US equipment and in that sense Israeli weapons companies have a really tough time selling to Israel itself since they are competing with "free" and so have to supplement with foreign sales. In the other direction, taking away the aid would be to severe of a blow to Israel's military supplies that they can't afford to make deals that the US will disapprove of too much. There's also some unwritten rules between Israel and the US about what sorts of deals Israel can make. I'd go so far as to say that any deal you see Israel make in this space is one that the US at least doesn't really disapprove of (as otherwise the deal would not happen). The second thing is that Israel can't really afford to strain their relationship with Russia. Syria is a major military threat to Israel's existence and prosperity and Russia has tremendous influence over Syria. You may have heard of Israel bombing Iranian military units and bases in Syria and that can only happen "peacefully" thanks to collaboration with Russia. But that doesn't mean that a relationship with Russia could replace one with the US (much like Europian countries depending on Russian gas doesn't mean they'll leave NATO). On the relationship with China I actually don't really know that much, as it is not often discussed in the media (or outside of it really). Israel and the majority of Israeli citizens see Israel as a west-aligned Democracy, so I'd be surprised if the relationship with China became too close or went much beyond the utilitarian. Will be interesting to see where it develops.
- SnowHill9902 4y agoAnybody can sue anybody for any reason.
- solardev 4y agoWhat good is legal action upon entities that are, by design, extrajudicial to begin with? You can sue NSO out of existence and the people and tradecraft involved will just reappear a few months later under a different name and organization, but keep doing business as before. The whole point of setups like this is to circumvent legal checks and balances to get information they wouldn't normally be able to get. No intelligence apparatus is going to give up that ability, especially not over some silly foreign lawsuit complaining about hacking. This isn't even a slap on the wrist, it's just legal theater.
- tptacek 4y agoA successful judgement against NSO makes it radioactive for US investment firms and potential acquirers.
- solardev 4y agoEven if that company ceased to exist, they'd just reorganize under a different name later on.
- vorpalhex 4y ago1. Forming companies and getting clients isn't zero cost. 2. Judges are human and can apply appropriate principles.
- solardev 4y agoYou're dealing with what is essentially a front for gray-area extrajudicial hacking. The company itself isn't the issue, it's that it gives governments and other entities cover when they want to do shady shit. Same reason we use private military companies. The profitability of any one such company isn't really terribly important (from a privacy standpoint)... when one goes down, another takes its place, and the willing buyers will just buy from a new one instead. Like drug dealers. From the privacy angle, nobody cares about NSO profitability... the point is that even if they go bankrupt, the underlying people, technologies, procedures, and overall shadiness will not only remain but grow stronger and more hidden, learning from this incident. Zero-days will keep getting found and bought and used for surveillance, and that is not something the legal system can solve, because a major customer IS state buyers who are funneling resources to it to purposefully circumvent legal protections. Judges aren't almighty, the law is selectively enforced, and almost always overridden for "national security" purposes.
- guelo 4y agoWhy is NSO able to exist in Israel's legal and social culture? Most western societies wouldn't allow it except within police or military agencies.
- paganel 4y ago> Most western societies wouldn't allow it except within police and military agencies. The answer is partially included in the latter part of your comment. Companies like NSO are "out-sourced" entities of the Israeli intelligence apparatus. If the shit hits the fan, as it happened in this company's case, then the intelligence agencies can say that they had nothing to do with it all.
- tptacek 4y agoNSO was almost acquired by a US defense contractor, and would have been if the Biden administration hadn't stopped it. NSO is not an "outsourced entity of the Israeli intelligence apparatus", at least not in way that Oracle or Cisco aren't also. There are companies like NSO all over the world, many competing in the same legal jurisdiction. Like I said upthread: nobody on HN has a weird theory about how an Auckland CNE/xdev shop is an arm of NZSIS, but everyone thinks they understand the IDF well enough to attribute NSO to it.
- balls187 4y agoProbably because Israel is in the news more frequently than NZ.
- tptacek 4y agoI'm sure that has a lot to do with it, but equally sure that has very little to do with which commercial CNE firms you should pay attention to.
- paganel 4y ago> HN has a weird theory about how an Auckland CNE/xdev shop is an arm of NZSIS Some of us do, i.e. even though we might have never personally heard of those companies we almost automatically equate cybersecurity/surveillance stuff with state entities. In this geopolitical climate it would be foolish not to do it. The thing that is different with Israel is that it has got its mandatory 2-year military conscription and that it has a dedicated cyber unit which is manned by fresh and very bright conscripts. Afaik no other state entity around the world has that.
- IYasha 4y agoIn a perfect world, we should also be suing NSA, Raytheon and many, many others... (
- tptacek 4y agoBreaking into foreign computing assets is literally NSA's chartered job. Other countries could sue NSA for their CNE operations! At a certain point there is a sort of tacit understanding that the intelligence community operates in a sort of Hobbesian state of nature, and not under the laws of any one state. A country wanting to penalize one of NSA's suppliers could single out a commercial CNE supplier and sue them the way US entities are suing NSO. That would jam the target company up, and prevent them from getting investment or doing M&A with companies under that country's jurisdiction. But for obvious reasons, US jurisdiction is a lot more commercially impactful than, say, Indonesian or Russian. Suing NSO is thus probably more impactful than suing a random NSA xdev supplier. The understanding about SIGINT between intelligence agencies is especially strong within NATO (it probably doesn't need saying that the US and major Commonwealth countries have an even closer relationship still). For a long time, it was "common knowledge" that the biggest SIGINT challenge the US had was France, not any actual global military adversary. It's a little unlikely any major western market country is going to go to the mattresses over state-sponsored CNE from one of their own countries. I assume they have better ways of working this stuff out than lawsuits, which is why we never hear about them. (I am out over my skis on at least the last paragraph of this analysis so take it for what it's worth.)
- worik 4y agoWe should be building secure computer systems. We do know how to do it. But security runs counter to convenience so we do not.
- nostrebored 4y ago> The supply of spyware to authoritarian and other rights-abusing governments has become a truly urgent threat to human rights and press freedom—an “existential crisis for journalism around the world,” as the Committee to Protect Journalists put it in a recent statement. David Kaye, the former U.N. special rapporteur for freedom of opinion and expression, has called for a moratorium on the sale of spyware, and in recent months others have joined his call. There is no principled take here. This is a problem with who the software was sold to, not that the software was sold.
- worik 4y ago> There is no principled take here. This is a problem with who the software was sold to, not that the software was sold. Untrue. In any hands tools like these, combined with the vulnerable consumer products, are dreadful. Selling tools like these to anybody is unethical. If they buy these tools they are up to no good.
- balls187 4y agoIt’s not that black and white. If such a tool could have prevented 9/11 (the argument that NSO makes) isn’t that a good? What is problematic is that these tools are used with very little transparency and oversight (not necessarily disclosing vulnerabilities) which allows such tools to be targeted on not just “criminals” but also anyone organizations/nation states deems problematic (journalists, advocates, dissidents, etc)
- jinpa_zangpo 4y agoWhile the article lauds El Faro's "fearless independent reporting", if you follow politics in El Salvador, they are aligned with El Salvador's left wing socialist party, the FMLN, as discussed in this video: https://www.youtube.com/watch?v=flWa7ZMBZ2s https://www.youtube.com/watch?v=flWa7ZMBZ2s
- _8j50 4y agoWhy is there so much hatred against NSO. They are an arms manufacturer. Arms will be acquired with or without them. If you are suing them them there are many other companies, some in the US that do similar things but for law enforcement. How is it fair to blame the weapons maker for selling to legitimate governments. Let's use the same logic and apply it to kinetic weapons: US defense contractors made and sold weapons to saudi arabia who used it to kill a lot of Yemenis, mostly civilians. Should not these defense contractors be sued by any Yemeni-American whose relatives were killed by saudi arabia? Well that can't happen for many reasons but my favorite is the fact that private companies selling to foreign governments are not required to evaluate the intentions of that government, merely its legitimacy and follow the country's laws on foreign arms sales. Did the NSO group violate Israeli law? No. So they traded with the legitimate governments of foreign nations lawfully. Is there a US law that requires evaluating the intent of foreign governments by foreign (or domestic) companies when selling cyber or other weapons? No. The fact is, selling to governments is not the same as selling to individuals. When an individual wants to murder someone, selling them a weapon knowingly makes you complicit in the murder. Governments are special because so long as they are legitimate, they can murder their own people as much as they want. Even commit genocide (unless they signed a treaty in the past to make them accountable to an international court). I keep running into this frustraring sentiment that so many of my fellow americans (and westerners) for some reason refuse to understand and honor a foreign nation's sovreignity. Of course I disagree with what the central american governments are doing to their own journalists. But it is up to those sovreign nations to self-determine, with or without fairness or democracy or the will of the people their own fate. They are sovreign, that means external people or governments don't get to impose their will or ways or hold them accountable without the consent of their government. I can't decide if this arrogant view is a left over from manifest destiny in the US or europe's claim that they colonized forein sovreign nations because their ways were barbaric and wrong. Every native american government the US eradicated or african,latin and asian country whose governments were removed by force to colonize them was neither democratic nor did they trear their own people under the same rules against cruelty and fairness that existed in the west and their invasion was justified as "better for them" in every case. Let those journalists and people fight for the change they desire and fail or succeed under their own terms. It is their own neighbors and citizens that are members of any police or military force keeping their government in power and revolutions happen without the CIA or the west meddling and installing a puppet or undermining sovreignity. A person cannot claim to have learned from the errors of their ancestors if that person refuses to let go of those very same erring ways.
- graymatters 4y agoYou’re suing NSO because it is not a USA based company tied into the US MIIC (military-intelligence-industrial-complex) and supporting legislators. You’re suing NSO because it is highly successful at what it does, putting the unsuccessful competitors who do have said ties to shame. Eliminating opposition via lawsuits is something we see increasingly use in the political system as well. Same players weaponizing the legal system.
- balls187 4y agoFrom what I understand, no one does cyber warfare better than the US. Eliminating the competition doesn’t really make a lot of sense as a justification. If the US Military felt threatened by a private Israeli company, wouldn’t it be more effective to put significant pressure on the Israeli government instead?
- Thorrez 4y agoIs the US MIIC hacking journalists? There are tons of journalists getting hacked by NSO's malware.
- graymatters 4y agoIf you think it doesn’t you must believe in Santa Claus and I got a bridge to sell you.
- Thorrez 4y agoHow come there are tons of reports of journalists being hacked by NSO, but none of journalists being hacked by the US MIIC?