3 ms·
Shouldn't we be seeing criminal sanctions? If I sold app exploits I would be in jail
by jimnotgym 1y ago
Shouldn't we be seeing criminal sanctions? If I sold app exploits I would be in jail
- saagarjha 1y agoDepends on who you sell them to
- razakel 1y agoYou're not a three-letter agency, though.
- jimnotgym 1y agoNSO is not a three-letter agency, it is a private company
- razakel 1y agoOne of the founders is ex-Mossad.
- bloppe 1y agoWhich is obviously 6 letters
- rabid_turtle 1y agoNSO is very cozy with Israel intelligence. It being private gives it the legal ability to do things that a government agency could not.
- voxic11 1y agoSelling exploits is generally legal. What law would be used to put you in jail? Using exploits can fall under the Computer Fraud and Abuse Act's criminally prohibited conduct but afaik there is no similar law that covers distributing/selling exploits. In fact selling exploits to companies via their bug bounty programs is quite common. All that said NSO didn't just distribute/sell the exploits (that would be giving away their secret sauce). Instead they offered what was essentially a managed service for executing the exploits against user selected targets.
- 4oo4 1y agoWouldn't hosting a service to facilitate others' use of the exploits fall under CFAA? Since there have been numerous arrests for those hosting Ransomware-as-a-service, DDOS-as-a-service, etc. Just curious whether there is a legal nuance that prevents them from being criminally charged instead of just politics/diplomacy.
- advisedwang 1y agoThe Computer Fraud and Abuse Act has a conspiracy provision. If NSO sells an exploit to someone, they can be charged for any downstream hacking that happens.