4 ms·

Companies like NSO and its potential clones do not rely on the money given by US investment firms.

tptacek 4y ago
Another very weird NSO take. There was a whole spate of news stories about NSO shopping themselves to US investors, and ultimately putting the whole company on the block. The sale would have actually occurred had the Biden administration not stopped it. No, I think this is comprehensively false. I think people on HN have a really bad habit of mythologizing CNE shops. You do not in fact need state sponsorship to do exploit R&D and build software implants; dozens of people have started companies that do exactly that, and they get bought routinely. All of them have state actors as their primary client base. I wouldn't be at all surprised to learn that NSO has a tight relationship with the IDF, the same way lots of commercial CNE shops in the US have relationships with NSA. I wouldn't even be surprised to learn the relationship is deeper than that. But there is no evidence at all that NSO is an "arm of Israeli intelligence" in any formal sense, and a lot of countervailing evidence. It's possible the only thing that distinguishes NSO from any of a dozen other shops is that they happen to be Israeli. Somehow, a CNE shop in Auckland just doesn't seem to excite HN the same way. Maybe there's more to the story than I'm suggesting! But, like, you know what they say about extraordinary claims.
- saurik 4y ago
  In case anyone wants some references, I hadn't been paying much attention to NSO in many years, and so got really curious about the "ultimately putting the whole company on the block" comment, so I figured I'd provide some links that I came across: https://www.axios.com/2021/07/22/nso-group-spying-investors https://www.axios.com/2021/07/22/nso-group-spying-investors > The bottom line: NSO isn't some rogue company being operated out of the basements of shadowy founders. Instead, it's been empowered by institutional investors that appear to have turned a blind eye to its deeds in the pursuit of profit. https://www.nytimes.com/2022/01/28/magazine/nso-group-israel-spyware.html https://www.nytimes.com/2022/01/28/magazine/nso-group-israel... > The F.B.I. had bought a version of Pegasus, NSO’s premier spying tool. For nearly a decade, the Israeli firm had been selling its surveillance software on a subscription basis to law-enforcement and intelligence agencies around the world, promising that it could do what no one else — not a private company, not even a state intelligence service — could do: consistently and reliably crack the encrypted communications of any iPhone or Android smartphone. > Since NSO had introduced Pegasus to the global market in 2011, it had helped Mexican authorities capture Joaquín Guzmán Loera, the drug lord known as El Chapo. European investigators have quietly used Pegasus to thwart terrorist plots, fight organized crime and, in one case, take down a global child-abuse ring, identifying dozens of suspects in more than 40 countries. In a broader sense, NSO’s products seemed to solve one of the biggest problems facing law-enforcement and intelligence agencies in the 21st century: that criminals and terrorists had better technology for encrypting their communications than investigators had to decrypt them. The criminal world had gone dark even as it was increasingly going global. https://www.theguardian.com/news/2021/jul/31/nso-group-israeli-spyware-company-berkeley-research-group https://www.theguardian.com/news/2021/jul/31/nso-group-israe... > If the deal proceeds, the California-based company would take over the fund that owns NSO at a difficult time for the Israeli company. The French government has called for an investigation into allegations that NSO clients listed key government officials, including most of Emmanuel Macron’s cabinet, as persons of interest. In the US, a senior Biden administration official involved in national security has also raised concerns about the Pegusus project revelations to an Israeli official.
  - tptacek 4y ago
    I'm glad someone else who pays attention (more than I do, I'm sure) to NSO is on the thread. Just in case other people here have difficulty with the distinction between positive and normative arguments (we all do sometimes), I'll be clear: I think NSO is a force for evil.
    - saurik 4y ago
      Yeah. And it isn't even always the case that they are magic gods at it... when I first heard about NSO, it was because I learned (as part of Citizen Lab's public analysis of a payload) that they were using some of my software--which I guess they didn't know how to replicate, and, since it wasn't open source, they were awkwardly having to shell out to binaries that I provided in ways that I guess worked well enough--as part of their persistent iPhone spyware. https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ https://citizenlab.ca/2016/08/million-dollar-dissident-iphon... Ahmed Mansoor--the particular UAE dissident who was being targeted in that analysis--is often in the crosshairs, and I think it just goes to further the point of your narrative that there are other companies from countries people ignore (as they don't get to go "oh no! it's Israel! they're scary!") providing software that people are trying to use to hack his devices. One of the other attempts I had paid some attention to was an Italian company named Hacking Team. https://www.vice.com/en/article/mg7pjy/ahmed-mansoor-million-dollar-dissident-government-spyware https://www.vice.com/en/article/mg7pjy/ahmed-mansoor-million... That hack also relied on third-party software, this time written by Collin Mulliner, whom I had known from grad school. He developed software that was somewhat analogous to my work for iOS that ran on Android, and he actually started getting flack as if he had something to do with the hacking, and so ended up publishing a blog post and public statements pointing out his software was both reusable and even sometimes open source, and he had no involvement. https://www.mulliner.org/blog/blosxom.cgi/security/hackingteam.html https://www.mulliner.org/blog/blosxom.cgi/security/hackingte...
  - paganel 4y ago
    > Instead, it's been empowered by institutional investors that appear to have turned a blind eye to its deeds in the pursuit of profit. Maybe I should have worded it better. Yes, companies like NSO most probably do receive institutional money, in the same way that some of the taxes we pay go to purchasing tanks and ammunition (i.e. the military doesn't run from a rogue basement), my point was that if that institutional money were somehow to be gone overnight it will not be the end of the world for companies like NSO, or for the people that they employ. Worst case scenario the company goes bankrupt and another NSO-like company takes its place, with the same stakeholders behind it. But all the institutional and VC money in the world won't help take a NSO-like company off the ground if it doesn't have the right state-approved and and state-sponsored stakeholders.
- saagarjha 4y ago
  > It's possible the only thing that distinguishes NSO from any of a dozen other shops is that they happen to be Israeli. Somehow, a CNE shop in Auckland just doesn't seem to excite HN the same way. I suspect this is because they operate in a way such that Hacker News doesn’t really hear about them.
  - tptacek 4y ago
    I agree. What does that tell you about which firms you should be watching more carefully?

Another very weird NSO take. There was a whole spate of news stories about NSO shopping themselves to US investors, and ultimately putting the whole company on the block. The sale would have actually occurred had the Biden administration not stopped it. No, I think this is comprehensively false. I think people on HN have a really bad habit of mythologizing CNE shops. You do not in fact need state sponsorship to do exploit R&D and build software implants; dozens of people have started companies that do exactly that, and they get bought routinely. All of them have state actors as their primary client base. I wouldn't be at all surprised to learn that NSO has a tight relationship with the IDF, the same way lots of commercial CNE shops in the US have relationships with NSA. I wouldn't even be surprised to learn the relationship is deeper than that. But there is no evidence at all that NSO is an "arm of Israeli intelligence" in any formal sense, and a lot of countervailing evidence. It's possible the only thing that distinguishes NSO from any of a dozen other shops is that they happen to be Israeli. Somehow, a CNE shop in Auckland just doesn't seem to excite HN the same way. Maybe there's more to the story than I'm suggesting! But, like, you know what they say about extraordinary claims.

saurik 4y ago
In case anyone wants some references, I hadn't been paying much attention to NSO in many years, and so got really curious about the "ultimately putting the whole company on the block" comment, so I figured I'd provide some links that I came across: https://www.axios.com/2021/07/22/nso-group-spying-investors https://www.axios.com/2021/07/22/nso-group-spying-investors > The bottom line: NSO isn't some rogue company being operated out of the basements of shadowy founders. Instead, it's been empowered by institutional investors that appear to have turned a blind eye to its deeds in the pursuit of profit. https://www.nytimes.com/2022/01/28/magazine/nso-group-israel-spyware.html https://www.nytimes.com/2022/01/28/magazine/nso-group-israel... > The F.B.I. had bought a version of Pegasus, NSO’s premier spying tool. For nearly a decade, the Israeli firm had been selling its surveillance software on a subscription basis to law-enforcement and intelligence agencies around the world, promising that it could do what no one else — not a private company, not even a state intelligence service — could do: consistently and reliably crack the encrypted communications of any iPhone or Android smartphone. > Since NSO had introduced Pegasus to the global market in 2011, it had helped Mexican authorities capture Joaquín Guzmán Loera, the drug lord known as El Chapo. European investigators have quietly used Pegasus to thwart terrorist plots, fight organized crime and, in one case, take down a global child-abuse ring, identifying dozens of suspects in more than 40 countries. In a broader sense, NSO’s products seemed to solve one of the biggest problems facing law-enforcement and intelligence agencies in the 21st century: that criminals and terrorists had better technology for encrypting their communications than investigators had to decrypt them. The criminal world had gone dark even as it was increasingly going global. https://www.theguardian.com/news/2021/jul/31/nso-group-israeli-spyware-company-berkeley-research-group https://www.theguardian.com/news/2021/jul/31/nso-group-israe... > If the deal proceeds, the California-based company would take over the fund that owns NSO at a difficult time for the Israeli company. The French government has called for an investigation into allegations that NSO clients listed key government officials, including most of Emmanuel Macron’s cabinet, as persons of interest. In the US, a senior Biden administration official involved in national security has also raised concerns about the Pegusus project revelations to an Israeli official.
- tptacek 4y ago
  I'm glad someone else who pays attention (more than I do, I'm sure) to NSO is on the thread. Just in case other people here have difficulty with the distinction between positive and normative arguments (we all do sometimes), I'll be clear: I think NSO is a force for evil.
  - saurik 4y ago
    Yeah. And it isn't even always the case that they are magic gods at it... when I first heard about NSO, it was because I learned (as part of Citizen Lab's public analysis of a payload) that they were using some of my software--which I guess they didn't know how to replicate, and, since it wasn't open source, they were awkwardly having to shell out to binaries that I provided in ways that I guess worked well enough--as part of their persistent iPhone spyware. https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ https://citizenlab.ca/2016/08/million-dollar-dissident-iphon... Ahmed Mansoor--the particular UAE dissident who was being targeted in that analysis--is often in the crosshairs, and I think it just goes to further the point of your narrative that there are other companies from countries people ignore (as they don't get to go "oh no! it's Israel! they're scary!") providing software that people are trying to use to hack his devices. One of the other attempts I had paid some attention to was an Italian company named Hacking Team. https://www.vice.com/en/article/mg7pjy/ahmed-mansoor-million-dollar-dissident-government-spyware https://www.vice.com/en/article/mg7pjy/ahmed-mansoor-million... That hack also relied on third-party software, this time written by Collin Mulliner, whom I had known from grad school. He developed software that was somewhat analogous to my work for iOS that ran on Android, and he actually started getting flack as if he had something to do with the hacking, and so ended up publishing a blog post and public statements pointing out his software was both reusable and even sometimes open source, and he had no involvement. https://www.mulliner.org/blog/blosxom.cgi/security/hackingteam.html https://www.mulliner.org/blog/blosxom.cgi/security/hackingte...
- paganel 4y ago
  > Instead, it's been empowered by institutional investors that appear to have turned a blind eye to its deeds in the pursuit of profit. Maybe I should have worded it better. Yes, companies like NSO most probably do receive institutional money, in the same way that some of the taxes we pay go to purchasing tanks and ammunition (i.e. the military doesn't run from a rogue basement), my point was that if that institutional money were somehow to be gone overnight it will not be the end of the world for companies like NSO, or for the people that they employ. Worst case scenario the company goes bankrupt and another NSO-like company takes its place, with the same stakeholders behind it. But all the institutional and VC money in the world won't help take a NSO-like company off the ground if it doesn't have the right state-approved and and state-sponsored stakeholders.
saagarjha 4y ago
> It's possible the only thing that distinguishes NSO from any of a dozen other shops is that they happen to be Israeli. Somehow, a CNE shop in Auckland just doesn't seem to excite HN the same way. I suspect this is because they operate in a way such that Hacker News doesn’t really hear about them.
- tptacek 4y ago
  I agree. What does that tell you about which firms you should be watching more carefully?