3 ms·

In case anyone wants some references, I hadn't been paying much attention to NSO in many years, and so got really curious about the "ultimately putting the whol

by saurik 4y ago

In case anyone wants some references, I hadn't been paying much attention to NSO in many years, and so got really curious about the "ultimately putting the whole company on the block" comment, so I figured I'd provide some links that I came across: https://www.axios.com/2021/07/22/nso-group-spying-investors https://www.axios.com/2021/07/22/nso-group-spying-investors > The bottom line: NSO isn't some rogue company being operated out of the basements of shadowy founders. Instead, it's been empowered by institutional investors that appear to have turned a blind eye to its deeds in the pursuit of profit. https://www.nytimes.com/2022/01/28/magazine/nso-group-israel-spyware.html https://www.nytimes.com/2022/01/28/magazine/nso-group-israel... > The F.B.I. had bought a version of Pegasus, NSO’s premier spying tool. For nearly a decade, the Israeli firm had been selling its surveillance software on a subscription basis to law-enforcement and intelligence agencies around the world, promising that it could do what no one else — not a private company, not even a state intelligence service — could do: consistently and reliably crack the encrypted communications of any iPhone or Android smartphone. > Since NSO had introduced Pegasus to the global market in 2011, it had helped Mexican authorities capture Joaquín Guzmán Loera, the drug lord known as El Chapo. European investigators have quietly used Pegasus to thwart terrorist plots, fight organized crime and, in one case, take down a global child-abuse ring, identifying dozens of suspects in more than 40 countries. In a broader sense, NSO’s products seemed to solve one of the biggest problems facing law-enforcement and intelligence agencies in the 21st century: that criminals and terrorists had better technology for encrypting their communications than investigators had to decrypt them. The criminal world had gone dark even as it was increasingly going global. https://www.theguardian.com/news/2021/jul/31/nso-group-israeli-spyware-company-berkeley-research-group https://www.theguardian.com/news/2021/jul/31/nso-group-israe... > If the deal proceeds, the California-based company would take over the fund that owns NSO at a difficult time for the Israeli company. The French government has called for an investigation into allegations that NSO clients listed key government officials, including most of Emmanuel Macron’s cabinet, as persons of interest. In the US, a senior Biden administration official involved in national security has also raised concerns about the Pegusus project revelations to an Israeli official.

tptacek 4y ago
I'm glad someone else who pays attention (more than I do, I'm sure) to NSO is on the thread. Just in case other people here have difficulty with the distinction between positive and normative arguments (we all do sometimes), I'll be clear: I think NSO is a force for evil.
- saurik 4y ago
  Yeah. And it isn't even always the case that they are magic gods at it... when I first heard about NSO, it was because I learned (as part of Citizen Lab's public analysis of a payload) that they were using some of my software--which I guess they didn't know how to replicate, and, since it wasn't open source, they were awkwardly having to shell out to binaries that I provided in ways that I guess worked well enough--as part of their persistent iPhone spyware. https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ https://citizenlab.ca/2016/08/million-dollar-dissident-iphon... Ahmed Mansoor--the particular UAE dissident who was being targeted in that analysis--is often in the crosshairs, and I think it just goes to further the point of your narrative that there are other companies from countries people ignore (as they don't get to go "oh no! it's Israel! they're scary!") providing software that people are trying to use to hack his devices. One of the other attempts I had paid some attention to was an Italian company named Hacking Team. https://www.vice.com/en/article/mg7pjy/ahmed-mansoor-million-dollar-dissident-government-spyware https://www.vice.com/en/article/mg7pjy/ahmed-mansoor-million... That hack also relied on third-party software, this time written by Collin Mulliner, whom I had known from grad school. He developed software that was somewhat analogous to my work for iOS that ran on Android, and he actually started getting flack as if he had something to do with the hacking, and so ended up publishing a blog post and public statements pointing out his software was both reusable and even sometimes open source, and he had no involvement. https://www.mulliner.org/blog/blosxom.cgi/security/hackingteam.html https://www.mulliner.org/blog/blosxom.cgi/security/hackingte...
paganel 4y ago
> Instead, it's been empowered by institutional investors that appear to have turned a blind eye to its deeds in the pursuit of profit. Maybe I should have worded it better. Yes, companies like NSO most probably do receive institutional money, in the same way that some of the taxes we pay go to purchasing tanks and ammunition (i.e. the military doesn't run from a rogue basement), my point was that if that institutional money were somehow to be gone overnight it will not be the end of the world for companies like NSO, or for the people that they employ. Worst case scenario the company goes bankrupt and another NSO-like company takes its place, with the same stakeholders behind it. But all the institutional and VC money in the world won't help take a NSO-like company off the ground if it doesn't have the right state-approved and and state-sponsored stakeholders.

by saurik 4y ago

tptacek 4y ago

I'm glad someone else who pays attention (more than I do, I'm sure) to NSO is on the thread. Just in case other people here have difficulty with the distinction between positive and normative arguments (we all do sometimes), I'll be clear: I think NSO is a force for evil.

saurik 4y ago
Yeah. And it isn't even always the case that they are magic gods at it... when I first heard about NSO, it was because I learned (as part of Citizen Lab's public analysis of a payload) that they were using some of my software--which I guess they didn't know how to replicate, and, since it wasn't open source, they were awkwardly having to shell out to binaries that I provided in ways that I guess worked well enough--as part of their persistent iPhone spyware. https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ https://citizenlab.ca/2016/08/million-dollar-dissident-iphon... Ahmed Mansoor--the particular UAE dissident who was being targeted in that analysis--is often in the crosshairs, and I think it just goes to further the point of your narrative that there are other companies from countries people ignore (as they don't get to go "oh no! it's Israel! they're scary!") providing software that people are trying to use to hack his devices. One of the other attempts I had paid some attention to was an Italian company named Hacking Team. https://www.vice.com/en/article/mg7pjy/ahmed-mansoor-million-dollar-dissident-government-spyware https://www.vice.com/en/article/mg7pjy/ahmed-mansoor-million... That hack also relied on third-party software, this time written by Collin Mulliner, whom I had known from grad school. He developed software that was somewhat analogous to my work for iOS that ran on Android, and he actually started getting flack as if he had something to do with the hacking, and so ended up publishing a blog post and public statements pointing out his software was both reusable and even sometimes open source, and he had no involvement. https://www.mulliner.org/blog/blosxom.cgi/security/hackingteam.html https://www.mulliner.org/blog/blosxom.cgi/security/hackingte...

paganel 4y ago

> Instead, it's been empowered by institutional investors that appear to have turned a blind eye to its deeds in the pursuit of profit. Maybe I should have worded it better. Yes, companies like NSO most probably do receive institutional money, in the same way that some of the taxes we pay go to purchasing tanks and ammunition (i.e. the military doesn't run from a rogue basement), my point was that if that institutional money were somehow to be gone overnight it will not be the end of the world for companies like NSO, or for the people that they employ. Worst case scenario the company goes bankrupt and another NSO-like company takes its place, with the same stakeholders behind it. But all the institutional and VC money in the world won't help take a NSO-like company off the ground if it doesn't have the right state-approved and and state-sponsored stakeholders.