Hacker News Reader

How does NSO and/or it's customers steer clear of CFAA violations? Are they given some kind of perpetual amnesty?

Edit: Oh, they ran up against this just a few weeks ago according to their Wikipedia article. How about that.

In addition to the fact that they're not a US company, selling exploits doesn't actually violate CFAA.

Google could potentially sue them under civil CFAA if there was some unauthorized access to Google infrastructure needed to develop the exploits, but that's unlikely to be the case.

Using NSO tools against unwilling targets would violate US law, but that's not what NSO does.

According to recent articles I’ve read this may not be the case. Apparently at least one organization has accused NSO of doing the unlawful accessing.

Standby while I look for a source.

Yes, WhatsApp sued NSO under civil CFAA (among other things) for accessing their infrastructure in the process of building and running their tools.

Reply on news.ycombinator.com